summaryrefslogtreecommitdiff
path: root/drivers/media
AgeCommit message (Collapse)Author
2024-06-27media: stm32: dcmipp: correct error handling in dcmipp_create_subdevsAlain Volmat
Correct error handling within the dcmipp_create_subdevs by properly decrementing the i counter when releasing the subdeves. Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver") Cc: stable@vger.kernel.org Signed-off-by: Alain Volmat <alain.volmat@foss.st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-27media: raspberrypi: Add support for PiSP BENaushir Patuck
Add support for the Raspberry Pi PiSP Back End. The driver has been upported from the Raspberry Pi kernel at revision f74893f8a0c2 ("drivers: media: pisp_be: Update seqeuence numbers of the buffers"). The ISP documentation is available at: https://datasheets.raspberrypi.com/camera/raspberry-pi-image-signal-processor-specification.pdf Signed-off-by: David Plowman <david.plowman@raspberrypi.com> Signed-off-by: Naushir Patuck <naush@raspberrypi.com> Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.org> Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil: drop dev_err after platform_get_irq to fix a coccinelle check]
2024-06-27media: uapi: Add PiSP Compressed RAW Bayer formatsJacopo Mondi
Add Raspberry Pi compressed RAW Bayer formats. The compression algorithm description is provided by Nick Hollinghurst <nick.hollinghurst@raspberrypi.com> from Raspberry Pi. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Reviewed-by: Naushir Patuck <naush@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-27media: uapi: Add meta pixel format for PiSP BE configJacopo Mondi
Add format description for the PiSP Back End configuration parameter buffer. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Reviewed-by: Naushir Patuck <naush@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-27media: uapi: Add a pixel format for BGR48 and RGB48Jacopo Mondi
Add BGR48 and RGB48 16-bit per component image formats. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com> Reviewed-by: Naushir Patuck <naush@raspberrypi.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vivid: fix CREATE_BUFS support in queue_setup()Hans Verkuil
While queue_setup was correct for CREATE_BUFS support for video devices, for VBI, SDR and touch devices it was wrong. This was found after adding new v4l2-compliance tests. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vivid: fix wrong sizeimage value for mplaneHans Verkuil
In several places a division by fmt->vdownsampling[p] was missing in the sizeimage[p] calculation, causing incorrect behavior for multiplanar formats were some planes are smaller than the first plane. Found by new v4l2-compliance tests. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vimc: scaler: Use subdev active stateLaurent Pinchart
Store the active formats and crop rectangle in the subdevice active state. This simplifies implementation of the format and selection accessors, and allows using the v4l2_subdev_get_fmt() helper to implement the .get_fmt() operation. The active configuration that is used in the .process_frame() handler is still stored in the vimc_scaler_device structure. The driver could instead access the active state in the .process_frame() handler, but the required locking could interfere with the real time constraints of the frame processing. This data would be stored in registers in the .s_stream() handler for real hardware, storing it in dedicated storage thus mimics a real driver. To differentiate them from the rest of the device private data, move the corresponding fields to a sub-structure of vimc_scaler_device named hw. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vimc: debayer: Use subdev active stateLaurent Pinchart
Store the active formats and crop rectangle in the subdevice active state. This simplifies implementation of the format and selection accessors, and allows using the v4l2_subdev_get_fmt() helper to implement the .get_fmt() operation. The active configuration that is used in the .process_frame() handler is still stored in the vimc_debayer_device structure. The driver could instead access the active state in the .process_frame() handler, but the required locking could interfere with the real time constraints of the frame processing. This data would be stored in registers in the .s_stream() handler for real hardware, storing it in dedicated storage thus mimics a real driver. To differentiate them from the rest of the device private data, move the corresponding fields to a sub-structure of vimc_debayer_device named hw. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vimc: sensor: Use subdev active stateLaurent Pinchart
Store the active formats and crop rectangle in the subdevice active state. This simplifies implementation of the format and selection accessors, and allows using the v4l2_subdev_get_fmt() helper to implement the .get_fmt() operation. The active configuration that is used in the .process_frame() handler is still stored in the vimc_sensor_device structure. The driver could instead access the active state in the .process_frame() handler, but the required locking could interfere with the real time constraints of the frame processing. This data would be stored in registers in the .s_stream() handler for real hardware, storing it in dedicated storage thus mimics a real driver. To differentiate them from the rest of the device private data, move the corresponding fields to a sub-structure of vimc_sensor_device named hw. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vimc: Initialize subdev active stateLaurent Pinchart
Finalize subdev initialization for all subdevs that provide a .init_state() operation. This creates an active state for all those subdevs, which subsequent patches will use to simplify the implementation of individual vimc entities. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vimc: Centralize subdev internal_ops initializationLaurent Pinchart
Initialize the subdev internal_ops field in the vimc_ent_sd_register() function. This handles the internal ops the same way as the subdev ops, and prepares for moving to the V4L2 subdev active state API. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vimc: scaler: Rename vic_sca_pad enum to vimc_scaler_padLaurent Pinchart
The vic_sca_pad enum's name has been shortened to the extreme for no good reason. Rename it to vimc_scaler_pad. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vimc: Constify the ent_config arrayLaurent Pinchart
The ent_config array contains data that is never modified. Make it const. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vimc: Constify vimc_ent_type structuresLaurent Pinchart
The vimc_ent_type structure contains static pointers to functions, and no other information that need to be modified after initialization. Make them const to avoid the risk of arbitrary code execution following an overflow that would overwrite the structure's contents. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: vimc: Don't iterate over single padLaurent Pinchart
The .init_state() operations of the debayer and sensor entities iterate over the entity's pads. In practice, the iteration covers a single pad only. Access the pad directly and remove the loops. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26Merge tag 'tags/next-media-20240626' of ↵Hans Verkuil
git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git - fix typo in v4l2-subdev.h - imx-pxp bug fix - media i2c Kconfig: add missing FW_UPLOAD select Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26Merge tag 'tags/next-media-renesas-20240619' of ↵Hans Verkuil
git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git - Conversion of max9286 and adv748x to V4L2 subdev active state - Cleanups and fixes for the Renesas R-Car VSP and VIN drivers - Miscellaneous cleanups to V4L2 core Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26media: i2c: Kconfig: Fix missing firmware upload config selectKory Maincent
FW_LOADER config only selects the firmware loader API, but we also need the sysfs_upload symbols for firmware_upload_unregister() and firmware_upload_register() to function properly. Fixes: 7a52ab415b43 ("media: i2c: Add driver for THine THP7312") Cc: stable@vger.kernel.org Signed-off-by: Kory Maincent <kory.maincent@bootlin.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Link: https://lore.kernel.org/r/20240620102544.1918105-1-kory.maincent@bootlin.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
2024-06-26media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()Harshit Mogalapalli
devm_regmap_init_mmio() can fail, add a check and bail out in case of error. Fixes: 4e5bd3fdbeb3 ("media: imx-pxp: convert to regmap") Cc: stable@vger.kernel.org Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://lore.kernel.org/r/20240514095038.3464191-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
2024-06-24media: i2c: Add GC05A2 image sensor driverZhi Mao
Add a V4L2 sub-device driver for Galaxycore GC05A2 image sensor. Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Zhi Mao <zhi.mao@mediatek.com> [Sakari Ailus: Fold in MAINTAINERS change.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24media: i2c: Add GC08A3 image sensor driverZhi Mao
Add a V4L2 sub-device driver for Galaxycore GC08A3 image sensor. Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Zhi Mao <zhi.mao@mediatek.com> [Sakari Ailus: Fold in MAINTAINERS change.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24media: b2c2: flexcop-usb: fix flexcop_usb_memory_reqHans Verkuil
smatch generated this warning: drivers/media/usb/b2c2/flexcop-usb.c:199 flexcop_usb_memory_req() warn: iterator 'i' not incremented and indeed the function is not using i or updating buf. The reason this always worked is that this function is called to write just 6 bytes (a MAC address) to the USB device, and so in practice there is only a single chunk written. If we ever would need to write more than one chunk, this function would fail since each chunk would read from or write to the same buf address. Rewrite the function to properly handle this. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24media: verisilicon : Use exported tables from v4l2-jpeg for hantro codecDevarsh Thakkar
Use v4l2-jpeg core API to import reference quantization and huffman tables used for JPEG Encoding. Signed-off-by: Devarsh Thakkar <devarsht@ti.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Acked-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24media: imagination: Use exported tables from v4l2-jpeg coreDevarsh Thakkar
Use exported huffman and quantization tables from v4l2-jpeg core library. Signed-off-by: Devarsh Thakkar <devarsht@ti.com> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24media: v4l2-jpeg: Export reference quantization and huffman tablesDevarsh Thakkar
Export reference quantization and huffman tables as provided in ITU-T.81 so that they can be re-used by other JPEG drivers. These are example tables provided in ITU-T.81 as reference tables and the JPEG encoders are free to use either these or their own proprietary tables. Also add necessary prefixes to be used for huffman tables in global header file. Signed-off-by: Devarsh Thakkar <devarsht@ti.com> Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24media: imagination: Add E5010 JPEG Encoder driverDevarsh Thakkar
This adds support for stateful V4L2 M2M based driver for Imagination E5010 JPEG Encoder [1] which supports baseline encoding with two different quantization tables and compression ratio as demanded. Support for both contiguous and non-contiguous YUV420 and YUV422 semiplanar formats is added along with alignment restrictions as required by the hardware. System and runtime PM hooks are added in the driver along with v4l2 crop and selection API support. Minimum resolution supported is 64x64 and Maximum resolution supported is 8192x8192. All v4l2-compliance tests are passing [2] : v4l2-compliance -s -f -a -d /dev/video0 -e /dev/video1 Total for e5010 device /dev/video0: 79, Succeeded: 79, Failed: 0, Warnings: 0 NOTE: video1 here is VIVID test pattern generator Also tests [3] were run manually to verify below driver features: - Runtime Power Management - Multi-instance JPEG Encoding - DMABUF import, export support - NV12, NV21, NV16, NV61 video format support - Compression quality S_CTRL - Cropping support using S_SELECTION Existing V4L2 M2M based JPEG drivers namely s5p-jpeg, imx-jpeg and rcar_jpu were referred while making this. TODO: Add MMU and memory tiling support [1]: AM62A TRM (Section 7.6 is for JPEG Encoder) : Link: https://www.ti.com/lit/pdf/spruj16 [2]: v4l2-compliance test : Link: https://gist.github.com/devarsht/1f039c631ca953a57f405cfce1b69e49 [3]: E5010 JPEG Encoder Manual tests : Performance: Link: https://gist.github.com/devarsht/c40672944fd71c9a53ab55adbfd9e28b Functionality: Link: https://gist.github.com/devarsht/8e88fcaabff016bb2bac83d89c9d23ce Compression Quality: Link: https://gist.github.com/devarsht/cbcc7cd97e8c48ba1486caa2b7884655 Multi Instance: Link: https://gist.github.com/devarsht/22c2fca08cd3441fb40f2c7a4cebc95a Crop support: Link: https://gist.github.com/devarsht/de6f5142f678bb1a5338abfd9f814abd Runtime PM: Link: https://gist.github.com/devarsht/70cd95d4440ddc678489d93885ddd4dd Co-developed-by: David Huang <d-huang@ti.com> Signed-off-by: David Huang <d-huang@ti.com> Signed-off-by: Devarsh Thakkar <devarsht@ti.com> Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: chips-media: wave5: support Wave515 decoderIvan Bornyakov
Add initial support for the Wave515 multi-decoder IP. For now it is only able to decode HEVC Main/Main10 profile videos into YUV420. This was tested on FPGA prototype, so wave5_dt_ids[] was not expanded. Users of the real hardware with Wave515 IP will have to * provide firmware specific to their SoC * add struct wave5_match_data like this: static const struct wave5_match_data platform_name_wave515_data = { .flags = WAVE5_IS_DEC, .fw_name = "cnm/wave515_platform_name_fw.bin", .sram_size = (71 * 1024), }; * add item to wave5_dt_ids[] like this: { .compatible = "vendor,soc-wave515", .data = &platform_name_wave515_data, }, * describe new compatible in Documentation/devicetree/bindings/media/cnm,wave521c.yaml Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: chips-media: wave5: drop "sram-size" DT propertyIvan Bornyakov
Move the excessive "sram-size" device-tree property to the device match data. Also change the SRAM memory allocation strategy, instead of allocating exactly sram_size bytes, allocate all available SRAM memory up to sram_size. Add the placeholders wave5_vpu_dec_validate_sec_axi() and wave5_vpu_enc_validate_sec_axi() to validate that the allocated SRAM memory is sufficient to decode/encode bitstream with a given resolution. Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: chips-media: wave5: separate irq setup routineIvan Bornyakov
Implement a separate setup routine for interrupts to reduce code duplication. Also enable interrupts based on vpu_attr->support_encoders and vpu_attr->support_decoders fields to facilitate support for other Wave5xx IPs, because not all of them are both encoders and decoders. Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: chips-media: wave5: support reset linesIvan Bornyakov
Add initial support for optional reset lines. For now, simply deassert resets while probing the driver and assert them back when removing the driver. Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: chips-media: wave5: support decoding HEVC Main10 profileIvan Bornyakov
Add support for decoding HEVC Main10 profile by scaling the FBC buffer stride and size by a factor of (bitdepth / 8). Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: imx-jpeg: Drop initial source change event if capture has been setupMing Qian
In section 4.5.1.5. Initialization, the step 4 may be skipped and continue with the Capture Setup sequence, so if the capture has been setup, there is no need to trigger the initial source change event, just start decoding, and follow the dynamic resolution change flow if the configured values do not match those parsed by the decoder. And it won't fail the gstreamer pipeline. Fixes: b833b178498d ("media: imx-jpeg: notify source chagne event when the first picture parsed") Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: imx-jpeg: Remove some redundant error logsMing Qian
If the picture size parsed by decoder is different from those previously established, it's a normal flow of dynamic resolution change, not an error case, the log may mislead that some error occurs in decoding, so remove the error log in this case. Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: Convert from tasklet to BH workqueueAllen Pais
The only generic interface to execute asynchronously in the BH context is tasklet; however, it's marked deprecated and has some design flaws. To replace tasklets, BH workqueue support was recently added. A BH workqueue behaves similarly to regular workqueues except that the queued work items are executed in the BH context. This patch converts drivers/media/* from tasklet to BH workqueue. Based on the work done by Tejun Heo <tj@kernel.org> Signed-off-by: Allen Pais <allen.lkml@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: cx231xx: Constify struct vb2_opsChristophe JAILLET
"struct vb2_ops" are not modified in this driver. Constifying this structure moves some data to a read-only section, so increase overall security. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 36607 1156 0 37763 9383 drivers/media/usb/cx231xx/cx231xx-417.o After: ===== text data bss dec hex filename 36735 1016 0 37751 9377 drivers/media/usb/cx231xx/cx231xx-417.o Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21media: xc2028: avoid use-after-free in load_firmware_cb()Chi Zhiling
syzkaller reported use-after-free in load_firmware_cb() [1]. The reason is because the module allocated a struct tuner in tuner_probe(), and then the module initialization failed, the struct tuner was released. A worker which created during module initialization accesses this struct tuner later, it caused use-after-free. The process is as follows: task-6504 worker_thread tuner_probe <= alloc dvb_frontend [2] ... request_firmware_nowait <= create a worker ... tuner_remove <= free dvb_frontend ... request_firmware_work_func <= the firmware is ready load_firmware_cb <= but now the dvb_frontend has been freed To fix the issue, check the dvd_frontend in load_firmware_cb(), if it is null, report a warning and just return. [1]: ================================================================== BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0 Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504 Call trace: load_firmware_cb+0x1310/0x17a0 request_firmware_work_func+0x128/0x220 process_one_work+0x770/0x1824 worker_thread+0x488/0xea0 kthread+0x300/0x430 ret_from_fork+0x10/0x20 Allocated by task 6504: kzalloc tuner_probe+0xb0/0x1430 i2c_device_probe+0x92c/0xaf0 really_probe+0x678/0xcd0 driver_probe_device+0x280/0x370 __device_attach_driver+0x220/0x330 bus_for_each_drv+0x134/0x1c0 __device_attach+0x1f4/0x410 device_initial_probe+0x20/0x30 bus_probe_device+0x184/0x200 device_add+0x924/0x12c0 device_register+0x24/0x30 i2c_new_device+0x4e0/0xc44 v4l2_i2c_new_subdev_board+0xbc/0x290 v4l2_i2c_new_subdev+0xc8/0x104 em28xx_v4l2_init+0x1dd0/0x3770 Freed by task 6504: kfree+0x238/0x4e4 tuner_remove+0x144/0x1c0 i2c_device_remove+0xc8/0x290 __device_release_driver+0x314/0x5fc device_release_driver+0x30/0x44 bus_remove_device+0x244/0x490 device_del+0x350/0x900 device_unregister+0x28/0xd0 i2c_unregister_device+0x174/0x1d0 v4l2_device_unregister+0x224/0x380 em28xx_v4l2_init+0x1d90/0x3770 The buggy address belongs to the object at ffff8000d7ca2000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 776 bytes inside of 2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800) The buggy address belongs to the page: page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0 flags: 0x7ff800000000100(slab) raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [2] Actually, it is allocated for struct tuner, and dvb_frontend is inside. Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-20media: platform: mtk-mdp3: Add support for MT8188 MDP3 componentsAngeloGioacchino Del Regno
MT8195 and MT8188 share a similar MDP3 macro-block, with minor differences - as in, the latter supports a subset of the number of components supported by the former, but are otherwise handled in the same way. Add driver data for MT8188, reusing the already present MT8195 data where possible. Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Fei Shao <fshao@chromium.org> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-20Merge tag 'tags/media-next-uvc-20240617-2' of ↵Hans Verkuil
git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git into media_stage uvcvideo fixes and improvements: - add/fix quirks - improve timestamp handling - improve Power Line Frequency handling Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-20media: rc: add missing MODULE_DESCRIPTION() macroJeff Johnson
With ARCH=x86, make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/rc/rc-core.o Add the missing invocation of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-20media: renesas: vsp1: Initialize control handler after subdevLaurent Pinchart
Some VSP modules initialize their control handler after initializing the subdev, while some initialize it before. This makes the code inconsistent and more error prone. Standardize on control initialization after initializing the subdev. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20media: renesas: vsp1: Pass subdev state to entity operationsLaurent Pinchart
To prepare for the removal of the vsp1_entity.state field, pass the state to all entity operations that needs to access it, instead of accessing the state from the entity inside the operation handlers. This lowers the number of accesses to the field. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20media: renesas: vsp1: Name parameters to entity operationsLaurent Pinchart
checkpatch.pl complains when function arguments are not named: WARNING: function definition argument 'struct vsp1_entity *' should also have an identifier name + void (*configure_stream)(struct vsp1_entity *, In preparation for reworking some of the vsp1_entity_operations functions, fix the warnings for the existing ones. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20media: renesas: vsp1: Get configuration from partition instead of stateLaurent Pinchart
Entities access various piece of information from the subdev state when configuring a partition. The same data is available through the partition structure passed to the .configure_partition() operation. Use it to avoid accessing the state, which will simplify moving to the V4L2 subdev active state API. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20media: renesas: vsp1: Compute partitions for DRM pipelinesLaurent Pinchart
The DRM pipelines don't partition frames, as the hardware operates synchronously with the display. The entity operations access configuration data from the entity state in that case, instead of accessing the partition structure. This requires special cases in entity-specific code, increasing the driver complexity. To prepare for simplifying the code, initialize a single partition for the DRM pipelines, similarly to how video pipelines create one partition spanning the full image when partitioning isn't needed. The partition is allocated statically in the vsp1_drm_pipeline structure instead of dynamically as for video pipelines, as DRM pipelines are guaranteed to operate on a single partition. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20media: renesas: vsp1: Keep the DRM pipeline entities sortedLaurent Pinchart
Some of the code that handles pipeline configuration assumes that entities in a pipeline's entities list are sorted from sink to source. To prepare for using that code with the DRM pipeline, insert the BRx just before the WPF, and the RPFs at the head of the list. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
2024-06-20media: renesas: vsp1: Add and use function to dump a pipeline to the logLaurent Pinchart
It is useful for debugging purpose to dump a vsp1_pipeline to the kernel log. Add a new function to do so, and use it when initializing the video and DRM pipelines. As __vsp1_pipeline_dump() needs to construct the log message iteratively, it uses pr_cont(...) (exact equivalent to the more verbose "printk(KERN_CONT ..."). The function thus can't use dev_dbg() to log the initial part of the message, for two reasons: - pr_cont() doesn't seem to work with dev_*(). Even if the format string passed to dev_*() doesn't end with a '\n', pr_cont() starts a new line in the log. This behaviour doesn't seem to be clearly documented, and may or may not be on purpose. - Messages printed by dev_dbg() may be omitted if dynamic debugging is enabled. In that case, the continuation messages will still be printed, leading to confusing log messages. To still benefit from the dynamic debug infrastructure, we declare a vsp1_pipeline_dump() macro that uses _dynamic_func_call() when dynamic debugging is enabled. The whole vsp1_pipeline_dump() call can be selected at runtime. The __vsp1_pipeline_dump() function then uses a plain "printk(KERN_DEBUG ...)" to print the message header using the debug log level, and pr_cont() to print the rest of the message on the same line. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20media: renesas: vsp1: Replace vsp1_partition_window with v4l2_rectLaurent Pinchart
The vsp1_partition_window structure is used to store the horizontal size of a partition window. This is all that is currently needed, as all partitions span the whole image vertically. The horizontal window size is retrieved in the .configure_partition() handler from the vsp1_partition_window structure, and the vertical window size from the subdev state. Accessing the subdev state in the .configure_partition() handler is problematic in the context of moving to the V4L2 subdev active state API, as .configure_partition() is called in non-interruptable context, and the state lock can't be taken. To avoid this, start by storing the vertical size in the window, replacing the custom vsp1_partition_window structure with a v4l2_rect. Retrieving the vertical size from the window in .configure_partition() will be done in a subsequent change. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20media: renesas: vsp1: Pass partition pointer to .configure_partition()Laurent Pinchart
The entity .configure_partition() function operates on a partition, and has to retrieve that partition from the pipeline's current partition field. Pass the partition pointer to the function to make it clearer what partition it operates on, and remove the vsp1_pipeline.partition field. This change clearly shows that the DRM pipeline doesn't use partitions, which makes entity implementation more complex and error-prone. This will be addressed in a further cleanup. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20media: renesas: vsp1: Store RPF partition configuration per RPF instanceLaurent Pinchart
The vsp1_partition structure stores the RPF partition configuration in a single field for all RPF instances, while each RPF can have its own configuration. Fix it by storing the configuration separately for each RPF instance. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Fixes: ab45e8585182 ("media: v4l: vsp1: Allow entities to participate in the partition algorithm") Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>