Tomasz has reported that his device, Generalplus Technology Inc. 808 Camera,
with ID 1b3f:2002, stopped being detected:
$ ls -l /dev/video*
zsh: no matches found: /dev/video*
[ 7.230599] usb 3-2: Found multiple Units with ID 5
This particular device is non-compliant, having both the Output Terminal
and Processing Unit with ID 5. uvc_scan_fallback, though, is able to build
a chain. However, when media elements are added and uvc_mc_create_links
call uvc_entity_by_id, it will get the incorrect entity,
media_create_pad_link will WARN, and it will fail to register the entities.
In order to reinstate support for such devices in a timely fashion,
reverting the fix for these warnings is appropriate. A proper fix that
considers the existence of such non-compliant devices will be submitted in
a later development cycle.
Reported-by: Tomasz Sikora <sikora.tomus@gmail.com> Fixes: 3dd075fe8ebb ("media: uvcvideo: Require entities to have a non-zero unique ID") Cc: stable@vger.kernel.org Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://lore.kernel.org/r/20250114200045.1401644-1-cascardo@igalia.com Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Zhen Lei [Tue, 15 Oct 2024 01:40:53 +0000 (09:40 +0800)]
media: nuvoton: Fix an error check in npcm_video_ece_init()
When function of_find_device_by_node() fails, it returns NULL instead of
an error code. So the corresponding error check logic should be modified
to check whether the return value is NULL and set the error code to be
returned as -ENODEV.
Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine") Cc: stable@vger.kernel.org Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Link: https://lore.kernel.org/r/20241015014053.669-1-thunder.leizhen@huawei.com Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
media: dvb-usb-v2: af9035: fix ISO C90 compilation error on af9035_i2c_master_xfer
This fixes a 'ISO C90 forbids mixed declarations and code' compilation
error on af9035_i2c_master_xfer, which is caused by the sanity check added
on user controlled msg[i], before declaring the demodulator register.
jieqing.wang [Thu, 1 Dec 2022 05:27:05 +0000 (13:27 +0800)]
media: fix secfeed undefined when filter alloc fail
In dvb_dmxdev_filter_start, when secfeed allocate secfilter fail.
the secfeed of current dmxfilter, need set to NULL;
Instead of call start_filtering, which already handled in
dvb_dmxdev_feed_restart
Krzysztof Kozlowski [Wed, 11 Dec 2024 09:25:09 +0000 (10:25 +0100)]
media: dt-bindings: trivial white-space and example cleanup
Minor cleanups without funcitonal impact:
- There should not be an empty blank line after SPDX tag,
- Convention is to indent DTS examples in coding style with 2- or
4-space indentation (4 is preferred),
- Drop unused labels in DTS examples.
Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Acked-by: Chen-Yu Tsai <wens@csie.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Lukas Bulwahn [Fri, 13 Dec 2024 06:00:11 +0000 (07:00 +0100)]
MAINTAINERS: repair file entry in MEDIA DRIVERS FOR STM32 - CSI
Commit dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
adds a new driver at drivers/media/platform/st/stm32/stm32-csi.c, but
creates a new MAINTAINERS section MEDIA DRIVERS FOR STM32 - CSI with a file
entry pointing to drivers/media/platform/stm32/stm32-csi.c. Note that the
file entry is missing the ‘st’ directory in its path.
Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a
broken reference. Repair this file entry in MEDIA DRIVERS FOR STM32 - CSI.
Joe Hattori [Tue, 24 Dec 2024 03:54:11 +0000 (12:54 +0900)]
staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
imx_media_add_of_subdevs() calls of_parse_phandle() and passes the
obtained node to imx_media_of_add_csi(). The passed node is used in
v4l2_async_nf_add_fwnode(), which increments the refcount of the node.
Therefore, while the current implementation only releases the node when
imx_media_of_add_csi() fails, but should always release it. Call
of_node_put() right after imx_media_of_add_csi().
Fixes: dee747f88167 ("media: imx: Don't register IPU subdevs/links if CSI port missing") Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Edward Adam Davis [Sun, 29 Dec 2024 10:50:39 +0000 (18:50 +0800)]
media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
syzbot report a null-ptr-deref in vidtv_mux_stop_thread. [1]
If dvb->mux is not initialized successfully by vidtv_mux_init() in the
vidtv_start_streaming(), it will trigger null pointer dereference about mux
in vidtv_mux_stop_thread().
Adjust the timing of streaming initialization and check it before
stopping it.
Reported-by: syzbot+5e248227c80a3be8e96a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5e248227c80a3be8e96a Signed-off-by: Edward Adam Davis <eadavis@qq.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Lubomir Rintel [Tue, 31 Dec 2024 19:04:34 +0000 (20:04 +0100)]
media: mmp: Bring back registration of the device
In commit 4af65141e38e ("media: marvell: cafe: Register V4L2 device
earlier"), a call to v4l2_device_register() was moved away from
mccic_register() into its caller, marvell/cafe's cafe_pci_probe().
This is not the only caller though -- there's also marvell/mmp.
Add v4l2_device_register() into mmpcam_probe() to unbreak the MMP camera
driver, in a fashion analogous to what's been done to the Cafe driver.
Same for the teardown path.
Jani Nikula [Tue, 17 Dec 2024 10:00:24 +0000 (12:00 +0200)]
media: cec: include linux/debugfs.h and linux/seq_file.h where needed
Having cec.h include linux/debugfs.h leads to all users of all cec
headers include and depend on debugfs.h and its dependencies for no
reason. Drop the include from cec.h, and include debugfs.h and
seq_file.h where needed.
Sort all the modified include lists while at it.
Signed-off-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
This commit has a basic flaw in that it relies on camss->res->csid_num as a
control to index the array camss->vfe[i].
Testing on a platform where csid_num > vfe_num showed this bug up.
camss->vfe should only be indexed by camss->res->vfe_num. Since this commit
is meant to make the code be more readable reverting will simply restore
the previous correct bounds checking.
We can make another pass at making camss_link_entities look prettier but,
for now we should zap the bug introduced.
Fixes: cc1ecabe67d9 ("media: qcom: camss: Restructure camss_link_entities") Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Dr. David Alan Gilbert [Mon, 16 Dec 2024 22:06:28 +0000 (22:06 +0000)]
media: venus: Remove unused hfi_core_ping()
hfi_core_ping() was added by 2017's
commit 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware
Interface (HFI)")
but has remained unused.
Remove it.
It was the only caller of the ->core_ping member of hfi_ops,
so remove it, and the venus_core_ping that it pointed to.
Note I've left pky_sys_ping which seems to be the lowest level
definition of the command.
Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Bryan O'Donoghue [Mon, 30 Dec 2024 17:00:35 +0000 (17:00 +0000)]
media: dt-bindings: qcom-venus: Deprecate video-decoder and video-encoder where applicable
For the list of yaml files here the video-decoder and video-encoder nodes
provide nothing more than configuration input for the driver. These entries
do not in fact impart hardware specific data and should be deprecated.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Bryan O'Donoghue [Mon, 30 Dec 2024 17:00:34 +0000 (17:00 +0000)]
media: venus: Populate video encoder/decoder nodename entries
Populate encoder and decoder node-name entries for the upstream parts. Once
done the compat="video-encoder" and compat="video-decoder" in the dtsi can
be dropped though the venus driver will continue to favour DT declared
video-encoder/video-decoder declarations over static declarations for
compatibility.
Tested-by: Renjiang Han <quic_renjiang@quicinc.com> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Bryan O'Donoghue [Mon, 30 Dec 2024 17:00:33 +0000 (17:00 +0000)]
media: venus: Add support for static video encoder/decoder declarations
Add resource structure data and probe() logic to support static
declarations of encoder and decoder.
Right now we rely on video encoder/decoder selection happening in the dtb
but, this goes against the remit of device tree which is supposed to
describe hardware, not select functional logic in Linux drivers.
Provide two strings in the venus resource structure enc_nodename and
dec_nodename.
When set the venus driver will create an OF entry in-memory consistent
with:
dec_nodename {
compat = "video-decoder";
};
and/or
enc_nodename {
compat = "video-encoder";
};
This will allow us to reuse the existing driver scheme of relying on compat
names maintaining compatibility with old dtb files.
dec_nodename can be "video-decoder" or "video0"
enc_nodename can be "video-encoder" or "video1"
This change relies on of_changeset() API as a result select OF_DYNAMIC will
be added to venus/Kconfig
Tested-by: Renjiang Han <quic_renjiang@quicinc.com> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Sergey Senozhatsky [Tue, 24 Dec 2024 07:24:05 +0000 (16:24 +0900)]
media: venus: destroy hfi session after m2m_ctx release
This partially reverts commit that made hfi_session_destroy()
the first step of vdec/venc close(). The reason being is a
regression report when, supposedly, encode/decoder is closed
with still active streaming (no ->stop_streaming() call before
close()) and pending pkts, so isr_thread cannot find instance
and fails to process those pending pkts. This was the idea
behind the original patch - make it impossible to use instance
under destruction, because this is racy, but apparently there
are uses cases that depend on that unsafe pattern. Return to
the old (unsafe) behaviour for the time being (until a better
fix is found).
Fixes: 45b1a1b348ec ("media: venus: sync with threaded IRQ during inst destruction") Cc: stable@vger.kernel.org Reported-by: Nathan Hebert <nhebert@google.com> Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Apparently, the driver does not properly set the field member of
vb2_v4l2_buffer struct, returning the default V4L2_FIELD_ANY value which
is against the guidelines.
Isaac Scott [Tue, 17 Dec 2024 11:13:51 +0000 (11:13 +0000)]
media: uvcvideo: Add Kurokesu C1 PRO camera
Add support for the Kurokesu C1 PRO camera. This camera experiences the
same issues faced by the Sonix Technology Co. 292A IPC AR0330. As such,
enable the UVC_QUIRK_MJPEG_NO_EOF quirk for this device to prevent
frames from being erroneously dropped.
Signed-off-by: Isaac Scott <isaac.scott@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Isaac Scott [Thu, 28 Nov 2024 14:51:44 +0000 (14:51 +0000)]
media: uvcvideo: Add new quirk definition for the Sonix Technology Co. 292a camera
The Sonix Technology Co. 292A camera (which uses an AR0330 sensor), can
produce MJPEG and H.264 streams concurrently. When doing so, it drops
the last packets of MJPEG frames every time the H.264 stream generates a
key frame. Set the UVC_QUIRK_MJPEG_NO_EOF quirk to work around the
issue.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Isaac Scott <isaac.scott@ideasonboard.com> Link: https://lore.kernel.org/r/20241128145144.61475-3-isaac.scott@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Isaac Scott [Thu, 28 Nov 2024 14:51:43 +0000 (14:51 +0000)]
media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
Some cameras, such as the Sonix Technology Co. 292A, exhibit issues when
running two parallel streams, causing USB packets to be dropped when an
H.264 stream posts a keyframe while an MJPEG stream is running
simultaneously. This occasionally causes the driver to erroneously
output two consecutive JPEG images as a single frame.
To fix this, we inspect the buffer, and trigger a new frame when we
find an SOI.
Signed-off-by: Isaac Scott <isaac.scott@ideasonboard.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://lore.kernel.org/r/20241128145144.61475-2-isaac.scott@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Ricardo Ribalda [Wed, 18 Dec 2024 21:39:10 +0000 (21:39 +0000)]
media: uvcvideo: Allow changing noparam on the fly
Right now the parameter value is read during video_registration and
cannot be changed afterwards, despite its permissions 0644, that makes
the user believe that the value can be written.
The parameter only affects the behaviour of uvc_queue_buffer_complete(),
with only one check per buffer.
We can read the value directly from uvc_queue_buffer_complete() and
therefore allowing changing it with sysfs on the fly.
Ricardo Ribalda [Wed, 18 Dec 2024 21:39:09 +0000 (21:39 +0000)]
media: uvcvideo: Invert default value for nodrop module param
The module param `nodrop` defines what to do with frames that contain an
error: drop them or sending them to userspace.
The default in the rest of the media subsystem is to return buffers with
an error to userspace with V4L2_BUF_FLAG_ERROR set in v4l2_buffer.flags.
In UVC we drop buffers with errors by default.
Change the default behaviour of uvcvideo to match the rest of the
drivers and maybe get rid of the module parameter in the future.
Ricardo Ribalda [Wed, 18 Dec 2024 21:39:08 +0000 (21:39 +0000)]
media: uvcvideo: Propagate buf->error to userspace
Now we return VB2_BUF_STATE_DONE for valid and invalid frames. Propagate
the correct value, so the user can know if the frame is valid or not via
struct v4l2_buffer->flags.
Reported-by: Hans de Goede <hdegoede@redhat.com> Closes: https://lore.kernel.org/linux-media/84b0f212-cd88-46bb-8e6f-b94ec3eccba6@redhat.com Fixes: 6998b6fb4b1c ("[media] uvcvideo: Use videobuf2-vmalloc") Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20241218-uvc-deprecate-v2-1-ab814139e983@chromium.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Ricardo Ribalda [Tue, 3 Dec 2024 21:20:10 +0000 (21:20 +0000)]
media: uvcvideo: Remove dangling pointers
When an async control is written, we copy a pointer to the file handle
that started the operation. That pointer will be used when the device is
done. Which could be anytime in the future.
If the user closes that file descriptor, its structure will be freed,
and there will be one dangling pointer per pending async control, that
the driver will try to use.
Clean all the dangling pointers during release().
To avoid adding a performance penalty in the most common case (no async
operation), a counter has been introduced with some logic to make sure
that it is properly handled.
Cc: stable@vger.kernel.org Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-3-26c867231118@chromium.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Ricardo Ribalda [Tue, 3 Dec 2024 21:20:09 +0000 (21:20 +0000)]
media: uvcvideo: Remove redundant NULL assignment
ctrl->handle will only be different than NULL for controls that have
mappings. This is because that assignment is only done inside
uvc_ctrl_set() for mapped controls.
Cc: stable@vger.kernel.org Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-2-26c867231118@chromium.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Ricardo Ribalda [Tue, 3 Dec 2024 21:20:08 +0000 (21:20 +0000)]
media: uvcvideo: Only save async fh if success
Now we keep a reference to the active fh for any call to uvc_ctrl_set,
regardless if it is an actual set or if it is a just a try or if the
device refused the operation.
We should only keep the file handle if the device actually accepted
applying the operation.
Cc: stable@vger.kernel.org Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Suggested-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-1-26c867231118@chromium.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Benoit Sevens [Thu, 7 Nov 2024 14:22:03 +0000 (14:22 +0000)]
media: uvcvideo: Refactor frame parsing code into a uvc_parse_frame function
The ftype value does not change in the while loop so we can check it
before entering the while loop. Refactoring the frame parsing code into
a dedicated uvc_parse_frame function makes this more readable.
Ricardo Ribalda [Thu, 28 Nov 2024 20:53:41 +0000 (20:53 +0000)]
media: uvcvideo: Support partial control reads
Some cameras, like the ELMO MX-P3, do not return all the bytes
requested from a control if it can fit in less bytes.
Eg: Returning 0xab instead of 0x00ab.
usb 3-9: Failed to query (GET_DEF) UVC control 3 on unit 2: 1 (exp. 2).
Extend the returned value from the camera and return it.
Cc: stable@vger.kernel.org Fixes: a763b9fb58be ("media: uvcvideo: Do not return positive errors in uvc_query_ctrl()") Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://lore.kernel.org/r/20241128-uvc-readless-v5-1-cf16ed282af8@chromium.org Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Laurent Pinchart [Thu, 7 Nov 2024 23:51:30 +0000 (01:51 +0200)]
media: uvcvideo: Fix double free in error path
If the uvc_status_init() function fails to allocate the int_urb, it will
free the dev->status pointer but doesn't reset the pointer to NULL. This
results in the kfree() call in uvc_status_cleanup() trying to
double-free the memory. Fix it by resetting the dev->status pointer to
NULL after freeing it.
Fixes: a31a4055473b ("V4L/DVB:usbvideo:don't use part of buffer for USB transfer #4") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20241107235130.31372-1-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Ricardo Ribalda [Wed, 6 Nov 2024 20:36:07 +0000 (20:36 +0000)]
media: uvcvideo: Fix crash during unbind if gpio unit is in use
We used the wrong device for the device managed functions. We used the
usb device, when we should be using the interface device.
If we unbind the driver from the usb interface, the cleanup functions
are never called. In our case, the IRQ is never disabled.
If an IRQ is triggered, it will try to access memory sections that are
already free, causing an OOPS.
We cannot use the function devm_request_threaded_irq here. The devm_*
clean functions may be called after the main structure is released by
uvc_delete.
Luckily this bug has small impact, as it is only affected by devices
with gpio units and the user has to unbind the device, a disconnect will
not trigger this error.
This happens because in v4l2_i2c_subdev_init(), the i2c_set_cliendata()
is called again and the data is overwritten to point to sd, instead of
priv. So, in remove(), the wrong pointer is passed to
v4l2_async_unregister_subdev(), leading to a crash.
Naushir Patuck [Wed, 27 Nov 2024 11:15:15 +0000 (11:15 +0000)]
media: bcm2835-unicam: Fix for possible dummy buffer overrun
The Unicam hardware has been observed to cause a buffer overrun when
using the dummy buffer as a circular buffer. The conditions that cause
the overrun are not fully known, but it seems to occur when the memory
bus is heavily loaded.
To avoid the overrun, program the hardware with a buffer size of 0 when
using the dummy buffer. This will cause overrun into the allocated dummy
buffer, but avoid out of bounds writes.
The imx219/imx708 sensors frequently generate a single corrupt frame
(image or embedded data) when the sensor first starts. This can either
be a missing line, or invalid samples within the line. This only occurrs
using the upstream Unicam kernel driver.
Disabling trigger mode elimiates this corruption. Since trigger mode is
a legacy feature copied from the firmware driver and not expected to be
needed, remove it. Tested on the Raspberry Pi cameras and shows no ill
effects.
Naushir Patuck [Wed, 27 Nov 2024 11:15:13 +0000 (11:15 +0000)]
media: bcm2835-unicam: Allow setting of unpacked formats
When matching formats via try_fmt/set_fmt ioctls, test for the unpacked
formats as well as packed formats. This allows userland clients setup
unpacking to 16-bits from the 10/12/14-packed CSI2 formats.
Ensure that the frame sequence counter is incremented only if a previous
frame start interrupt has occurred, or a frame start + frame end has
occurred simultaneously.
This corresponds the sequence number with the actual number of frames
produced by the sensor, not the number of frame buffers dequeued back
to userland.
Hans de Goede [Thu, 28 Nov 2024 15:23:38 +0000 (16:23 +0100)]
media: ov2740: Add regulator support
On some designs the regulators for the AVDD / DOVDD / DVDD power rails
are controlled by Linux.
Add support to the driver for getting regulators for these 3 rails and
for enabling these regulators when necessary.
The datasheet specifies a delay of 0ns between enabling the regulators,
IOW they can all 3 be enabled at the same time. This allows using the bulk
regulator API.
The regulator core will provide dummy regulators for the 3 power-rails
when necessary.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Ricardo Ribalda <ribalda@chromium.org> Tested-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Hans de Goede [Thu, 28 Nov 2024 15:23:37 +0000 (16:23 +0100)]
media: ov2740: Add powerdown GPIO support
The ov2740 sensor has both reset and power_down inputs according to
the datasheet one or the other should always be tied to DOVDD but on
some designs both are attached to GPIOs.
Add support for controlling both a reset and a powerdown GPIO.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Tested-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> Acked-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Hans de Goede [Thu, 28 Nov 2024 15:23:35 +0000 (16:23 +0100)]
media: ov2740: Debug log chip ID
Calling the identify function may get delayed till the first stream-on,
add a dev_dbg() to it so that we know when it has run. This is useful
to debug bring-up problems related to regulators / clks / GPIOs.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Tested-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tomi Valkeinen [Fri, 6 Dec 2024 08:26:47 +0000 (10:26 +0200)]
media: i2c: ds90ub960: Reduce sleep in ub960_rxport_wait_locks()
We currently sleep for 50 ms at the end of each iteration in
ub960_rxport_wait_locks(). This feels a bit excessive, especially as we
always do at least two loops, so there's always at least one sleep, even
if we already have a stable lock.
Change the sleep to 10 ms.
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tomi Valkeinen [Fri, 6 Dec 2024 08:26:46 +0000 (10:26 +0200)]
media: i2c: ds90ub960: Drop unused indirect block define
Drop the unused UB960_IND_TARGET_CSI_CSIPLL_REG_1 define. It does not
even match to any block in the more recent documents, so it's possible
it is not only unused but also wrong.
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tomi Valkeinen [Fri, 6 Dec 2024 08:26:43 +0000 (10:26 +0200)]
media: i2c: ds90ub960: Add support for I2C_RX_ID
Normally the driver accesses both the RX and the TX port registers via a
paging mechanism: one register is used to select the page (i.e. the
port), which dictates the port used when accessing the port specific
registers.
The downside to this is that while debugging it's almost impossible to
access the port specific registers from the userspace, as the driver can
change the page at any moment.
The hardware supports another access mechanism: using the I2C_RX_ID
registers (one for each RX port), i2c addresses can be chosen which,
when accessed, will always use the specific port's registers, skipping
the paging mechanism.
The support is only for the RX port, but it has proven very handy while
debugging and testing. So let's add the code for this, but hide it
behind a disabled define.
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tomi Valkeinen [Fri, 6 Dec 2024 08:26:41 +0000 (10:26 +0200)]
media: i2c: ds90ub960: Fix UB9702 VC map
The driver uses a static CSI-2 virtual channel mapping where all virtual
channels from an RX port are mapped to a virtual channel number matching
the RX port number.
The UB960 and UB9702 have different registers for the purpose, and the
UB9702 version is not correct. Each of the VC_ID_MAP registers do not
contain a single mapping, as the driver currently thinks, but two.
This can cause received VCs other than 0 to be mapped in a wrong way.
Fix this by writing both mappings to each register.
Cc: stable@vger.kernel.org Fixes: afe267f2d368 ("media: i2c: add DS90UB960 driver") Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tomi Valkeinen [Fri, 6 Dec 2024 08:26:40 +0000 (10:26 +0200)]
media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
UB9702 does not have SP and EQ registers, but the driver uses them in
log_status(). Fix this by separating the SP and EQ related log_status()
work into a separate function (for clarity) and calling that function
only for UB960.
Cc: stable@vger.kernel.org Fixes: afe267f2d368 ("media: i2c: add DS90UB960 driver") Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tomi Valkeinen [Fri, 6 Dec 2024 08:26:39 +0000 (10:26 +0200)]
media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
UB9702 doesn't have the registers for SP and EQ. Adjust the code in
ub960_rxport_wait_locks() to not use those registers for UB9702. As
these values are only used for a debug print here, there's no functional
change.
Cc: stable@vger.kernel.org Fixes: afe267f2d368 ("media: i2c: add DS90UB960 driver") Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tomi Valkeinen [Fri, 6 Dec 2024 08:26:37 +0000 (10:26 +0200)]
media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as
part of their remove process, and if the driver is removed multiple
times, eventually leads to put "overflow", possibly causing memory
corruption or crash.
The fwnode_handle_put() is a leftover from commit 905f88ccebb1 ("media:
i2c: ds90ub9x3: Fix sub-device matching"), which changed the code
related to the sd.fwnode, but missed removing these fwnode_handle_put()
calls.
Cc: stable@vger.kernel.org Fixes: 905f88ccebb1 ("media: i2c: ds90ub9x3: Fix sub-device matching") Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Niklas Söderlund [Tue, 10 Dec 2024 15:54:00 +0000 (16:54 +0100)]
media: rcar-csi2: Update D-PHY startup on V4M
The latest datasheet (Rev.0.70) updates the D-PHY start-up sequence for
D-PHY operation. Unfortunately the datasheet do not add any additional
documentation on the magic values.
This have been tested together with the MAX96724 available on the single
board test platform and it works as expected.
Dave Stevenson [Mon, 9 Dec 2024 14:55:45 +0000 (14:55 +0000)]
media: i2c: ov9282: Correct the exposure offset
The datasheet lists that "Maximum exposure time is frame
length -25 row periods, where frame length is set by
registers {0x380E, 0x380F}".
However this driver had OV9282_EXPOSURE_OFFSET set to 12
which allowed that restriction to be violated, and would
result in very under-exposed images.
Correct the offset.
Fixes: 14ea315bbeb7 ("media: i2c: Add ov9282 camera sensor driver") Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Mehdi Djait [Wed, 11 Dec 2024 13:30:45 +0000 (14:30 +0100)]
media: ccs: Fix cleanup order in ccs_probe()
ccs_limits is allocated in ccs_read_all_limits() after the allocation of
mdata.backing. Ensure that resources are freed in the reverse order of
their allocation by moving out_free_ccs_limits up.
Fixes: a11d3d6891f0 ("media: ccs: Read CCS static data from firmware binaries") Cc: stable@vger.kernel.org Signed-off-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Niklas Söderlund [Thu, 21 Nov 2024 13:41:08 +0000 (14:41 +0100)]
media: rcar-csi2: Allow specifying C-PHY line order
Later versions of the V4H datasheet adds documentation for the line
order register needed to support all possible configurations. Extend the
driver to take the line order for each data line into account when
configuring the device.
Unfortunately not all registers initially thought to be involved in line
order configuration where directly related. One magic value is still in
the driver and left as-is, but it is not related to line order as that
procedure have now been documented.
Niklas Söderlund [Thu, 21 Nov 2024 13:41:06 +0000 (14:41 +0100)]
media: v4l: fwnode: Parse MiPI DisCo for C-PHY line-orders
Extend the fwnode parsing to validate and fill in the CSI-2 C-PHY
line-orders order properties as defined in MIPI Discovery and
Configuration (DisCo) Specification for Imaging.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[Sakari Ailus: Use ARRAY_SIZE() instead of an integer.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Niklas Söderlund [Thu, 21 Nov 2024 13:41:05 +0000 (14:41 +0100)]
media: dt-bindings: Add property to describe CSI-2 C-PHY line orders
Each data lane on a CSI-2 C-PHY bus uses three phase encoding and is
constructed from three physical wires. The wires are referred to as A, B
and C and their default order is ABC. However to ease hardware design
the specification allows for the wires to be switched in any order.
Add a vendor neutral property to describe the line order used. The
property name 'line-orders', the possible values it can be assigned and
there names are taken from the MIPI Discovery and Configuration (DisCo)
Specification for Imaging.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Naushir Patuck [Fri, 15 Nov 2024 18:07:17 +0000 (20:07 +0200)]
media: imx296: Add standby delay during probe
Add a 2-5ms delay when coming out of standby and before reading the
sensor info register durning probe, as instructed by the datasheet. This
standby delay is already present when the sensor starts streaming.
During a cold-boot, reading the IMX296_SENSOR_INFO register would often
return a value of 0x0000, if this delay is not present before.
Dave Stevenson [Wed, 20 Nov 2024 19:17:04 +0000 (19:17 +0000)]
media: i2c: imx290: Register 0x3011 varies between imx327 and imx290
Reviewing the datasheets, register 0x3011 is meant to be 0x02 on imx327
and 0x00 on imx290.
Move it out of the common registers, and set it appropriately in the
sensor specific sections. (Included for imx290 to be explicit, rather
than relying on the default value).
Fixes: 2d41947ec2c0 ("media: i2c: imx290: Add support for imx327 variant") Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Sakari Ailus [Tue, 3 Dec 2024 10:23:01 +0000 (12:23 +0200)]
media: ccs: Clean up parsed CCS static data on parse failure
ccs_data_parse() releases the allocated in-memory data structure when the
parser fails, but it does not clean up parsed metadata that is there to
help access the actual data. Do that, in order to return the data
structure in a sane state.
Fixes: a6b396f410b1 ("media: ccs: Add CCS static data parser library") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Sakari Ailus [Tue, 3 Dec 2024 08:10:23 +0000 (10:10 +0200)]
media: ccs: Fix CCS static data parsing for large block sizes
The length field of the CCS static data blocks was mishandled, leading to
wrong interpretation of the length header for blocks that are 16 kiB in
size. Such large blocks are very, very rare and so this wasn't found
earlier.
As the length is used as part of input validation, the issue has no
security implications.
Jiasheng Jiang [Tue, 3 Dec 2024 21:29:02 +0000 (21:29 +0000)]
media: marvell: Add check for clk_enable()
Add check for the return value of clk_enable() to guarantee the success.
Fixes: 81a409bfd551 ("media: marvell-ccic: provide a clock for the sensor") Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
[Sakari Ailus: Fix spelling in commit message.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Andy Yan [Mon, 16 Dec 2024 10:04:43 +0000 (18:04 +0800)]
media: rockchip: rga: Fix Copyright description
The company name has update to Rockchip Electronics Co., Ltd.
since 2021.
And change Co.Ltd to Co., Ltd. to fix mail server warning:
DBL_SPAM(6.50)[co.ltd:url];
Signed-off-by: Andy Yan <andy.yan@rock-chips.com> Reviewed-by: Kever Yang <kever.yang@rock-chips.com> Acked-by: Heiko Stuebner <heiko@sntech.de> Link: https://lore.kernel.org/r/20241216100444.3726048-1-andyshrk@163.com Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Nicolas Dufresne [Tue, 10 Dec 2024 21:25:16 +0000 (16:25 -0500)]
media: hantro: Replace maintainers
As per a long time request from Ezequiel, who left the project around
2020, replace the top maintainers with Benjamin and myself, and also
keeping Philipp, who is still active in the subsystem.
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
projects / users / dwmw2 / linux.git / log