Commit Graph

2255 Commits

Author SHA1 Message Date
Bradford Love
08b34f01a9 media: cx23885: Module option to disable analog video
Initialized and left to themselves some boards with analog inputs,
on some modern platforms can throw critical errors which prevents
even digital from working thereafter. If analog is never used this
module parameter allows analog to be disabled on a card by card
basis.

It is already possible to disable analog audio.

For example, to disable for Hauppauge QuadHD with analog functionality:

options cx23885 disable_analog_video=56,57

can be placed insode of /etc/modprobe.d/cx23885.conf

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25 18:27:25 +01:00
Sean Young
dccc0c3ddf media: rc: fix race between unregister and urb/irq callbacks
Some rc device drivers have a race condition between rc_unregister_device()
and irq or urb callbacks. This is because rc_unregister_device() does two
things, it marks the device as unregistered so no new commands can be
issued and then it calls rc_free_device(). This means the driver has no
chance to cancel any pending urb callbacks or interrupts after the device
has been marked as unregistered. Those callbacks may access struct rc_dev
or its members (e.g. struct ir_raw_event_ctrl), which have been freed by
rc_free_device().

This change removes the implicit call to rc_free_device() from
rc_unregister_device(). This means that device drivers can call
rc_unregister_device() in their remove or disconnect function, then cancel
all the urbs and interrupts before explicitly calling rc_free_device().

Note this is an alternative fix for an issue found by Haotian Zhang, see
the Closes: tags.

Reported-by: Haotian Zhang <vulab@iscas.ac.cn>
Closes: https://lore.kernel.org/linux-media/20251114101432.2566-1-vulab@iscas.ac.cn/
Closes: https://lore.kernel.org/linux-media/20251114101418.2548-1-vulab@iscas.ac.cn/
Closes: https://lore.kernel.org/linux-media/20251114101346.2530-1-vulab@iscas.ac.cn/
Closes: https://lore.kernel.org/linux-media/20251114090605.2413-1-vulab@iscas.ac.cn/
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 14:43:56 +01:00
Bradford Love
ca3e8eaaa4 media: saa7164: Fix REV2 firmware filename
The wrong firmware file is listed, leading to non functional devices
on REV2 models.

Signed-off-by: Bradford Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 10:50:19 +01:00
Wang Jun
d51c60a498 media: saa7164: add ioremap return checks and cleanups
Add checks for ioremap return values in saa7164_dev_setup(). If
ioremap for BAR0 or BAR2 fails, release the already allocated PCI
memory regions, remove the device from the global list, decrement
the device count, and return -ENODEV.

This prevents potential null pointer dereferences and ensures proper
cleanup on memory mapping failures.

Fixes: 443c1228d5 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon")
Cc: stable@vger.kernel.org
Signed-off-by: Wang Jun <1742789905@qq.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-16 19:07:58 +01:00
Abdun Nihaal
8ea21435fe media: pci: zoran: fix potential memory leak in zoran_probe()
The memory allocated for codec in videocodec_attach() is not freed in
one of the error paths, due to an incorrect goto label. Fix the label
to free it on error.

Fixes: 8f7cc5c0b0 ("media: staging: media: zoran: introduce zoran_i2c_init")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-16 16:30:21 +01:00
Bartosz Golaszewski
c42c596a85 media: saa7134: rename i2c_dbg() to saa7134_i2c_dbg()
Ahead of introducing I2C-adapter-specific printk() helpers, preemptively
avoid a conflict with the upcoming i2c_dbg() and rename the local macro
in the saa7134 driver to saa7134_i2c_dbg().

Suggested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-16 16:30:20 +01:00
Atharv Dubey
f48753aa3a media: cx25821-alsa: replace BUG_ON() with WARN_ON()
media: cx25821-alsa: replace BUG_ON() with WARN_ON()

Avoid crashing the kernel for a recoverable condition
by replacing BUG_ON() with WARN_ON().

Signed-off-by: Atharv Dubey <atharvd440@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-16 11:51:55 +01:00
Martin Tůma
b4318729a0 media:pci:mgb4: Add zDML color mapping support
Add zDML (a special signal mapping as used in Audi Digital Matrix Lights)
color mapping support. In addition to extending the already existing color
mapping property of the inputs, the same property is added for the outputs
that must be configured in the same way as the inputs.

Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-16 11:51:55 +01:00
Martin Tůma
0924f7ed0c media:pci:mgb4: Fixed negative hwmon temperatures processing
The "magic" temperature formula must be computed using a signed integer for
negative temperatures to work properly.

Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-16 11:51:55 +01:00
Leif Skunberg
d6576b85d3 media: ipu-bridge: Add OV5675 sensor config
Add the Omnivision OV5675 (ACPI HID OVTI5675) to the
ipu_supported_sensors[] table with a link frequency of 450 MHz.

This sensor is found in the Lenovo ThinkPad X1 Fold 16 Gen 1 behind
an Intel Vision Sensing Controller (IVSC). Without this entry the IPU
bridge does not create the software-node fwnode graph for the sensor,
preventing the camera from being enumerated.

Signed-off-by: Leif Skunberg <diamondback@cohunt.app>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-03-11 01:05:37 +01:00
Hans de Goede
2c10400e4a media: ipu-bridge: Add upside-down sensor DMI quirk for Dell XPS 13 9340 and XPS 14 9440
The Dell XPS 13 9340 and XPS 14 9440 have an upside-down mounted OV02C10
sensor, just like the XPS 13 9350 and XPS 16 9640 models.

Extend the existing DMI matches for handling these laptops with DMI
matches for these 2 models

Reported-by: Heimir Thor Sverrisson <heimir.sverrisson@gmail.com> # XPS 14 9440
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2440581 # XPS 13 9340
Fixes: d5ebe3f7d1 ("media: ov02c10: Fix default vertical flip")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-03-11 01:05:35 +01:00
Ethan Tidmore
8dd088b8b1 media: intel/ipu6: fix error pointer dereference
In a error path isp->psys is confirmed to be an error pointer not NULL so
this condition is true and the error pointer is dereferenced. So isp-psys
should be set to NULL before going to out_ipu6_bus_del_devices.

Detected by Smatch:
drivers/media/pci/intel/ipu6/ipu6.c:690 ipu6_pci_probe() error:
'isp->psys' dereferencing possible ERR_PTR()

Fixes: 25fedc0219 ("media: intel/ipu6: add Intel IPU6 PCI device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
[Sakari Ailus: Fix commit message.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2026-03-11 01:05:35 +01:00
Kees Cook
189f164e57 Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
Conversion performed via this Coccinelle script:

  // SPDX-License-Identifier: GPL-2.0-only
  // Options: --include-headers-for-types --all-includes --include-headers --keep-comments
  virtual patch

  @gfp depends on patch && !(file in "tools") && !(file in "samples")@
  identifier ALLOC = {kmalloc_obj,kmalloc_objs,kmalloc_flex,
 		    kzalloc_obj,kzalloc_objs,kzalloc_flex,
		    kvmalloc_obj,kvmalloc_objs,kvmalloc_flex,
		    kvzalloc_obj,kvzalloc_objs,kvzalloc_flex};
  @@

  	ALLOC(...
  -		, GFP_KERNEL
  	)

  $ make coccicheck MODE=patch COCCI=gfp.cocci

Build and boot tested x86_64 with Fedora 42's GCC and Clang:

Linux version 6.19.0+ (user@host) (gcc (GCC) 15.2.1 20260123 (Red Hat 15.2.1-7), GNU ld version 2.44-12.fc42) #1 SMP PREEMPT_DYNAMIC 1970-01-01
Linux version 6.19.0+ (user@host) (clang version 20.1.8 (Fedora 20.1.8-4.fc42), LLD 20.1.8) #1 SMP PREEMPT_DYNAMIC 1970-01-01

Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-22 08:26:33 -08:00
Linus Torvalds
bf4afc53b7 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21 17:09:51 -08:00
Kees Cook
69050f8d6d treewide: Replace kmalloc with kmalloc_obj for non-scalar types
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-21 01:02:28 -08:00
Linus Torvalds
b7ef56a076 [GIT PULL for v7.0] media updates
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmmMWOIACgkQCF8+vY7k
 4RXPxw/9F1tYWWaFMJS39mKK99sK5rXk+/ZfYr89k9S44iYQ1cDGp41Hx4SY1oki
 sZid8WKMzv5+YJL/IGUs8bESL+Dn5AYiOL04P2ITJjer7T2U9ZgTfj+OFfiEhIA5
 hvebZoHtxo4HrlS7v++OB2t5ozgIsPDuM5YuqOKfxXETvbeeddPYoKqrCQ+JEqoE
 jTUd+wHM3PsY1GFl1RO2GhIz3hSfxE0a58fP8a6VDjN7qo9UFDtPcvDNb+BAP5or
 87fesM52VuEw4pXR0/y0hXbyFWsFxIWNXO9uOTIyvSEHXQth58SJmFY7UyCYAO/t
 XVXcoSKH0WjLn6e1/QHy34dU4sKxK4zM+nDtfBx0IeMSkGj7tiPskQsFjlq/1uSS
 UP59vgQHOQk2bVER6sRTE4WVsp9XI2gOwS6vIwvUBfhIT6Of0iBAkYRhAp62Pu0a
 3urAUj7/sRnghwF+QgBCrmuIYnfgF/gMmJR2TnhOo5bc6QGPN5vWL1sX521uXbWz
 F0iewntKx+iTeX3FQhcjuLSX7X3fqFo3+63bADOoZ08KD5r8ia/EWr1Yfrzs4Hno
 fyOP6U2Oobdg5hN+waqV1ZIJI0zGwl39P7Iuo7Qw6EgW3NDJV4VKK/Y+9HYamyvC
 NMXkREg4U4QXk7z+DJAdXzuupqolMiidabONWhqrW9QLzhA8Ak8=
 =oFw9
 -----END PGP SIGNATURE-----

Merge tag 'media/v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:

 - Add support for GMSL1 and GMSL‑coax modules (PCI mgb4)

 - Add driver for TI VIP

 - AV1 – first kernel support (pixel‑format, decoder, transcoder)

 - Three new camera‑sensor drivers (os05b10, s5k3m5, s5kjn1)

 - Synopsys CSI‑2 receiver driver

 - Verisilicon & rkvdec – major fixes and enhancements

 - IPU6 (and 7) fixes and preparation for metadata

 - omap3isp: v4l2-compliance updates

 - Fix DVB streaming, drop wait_prepare/finish (dvb/vb2)

* tag 'media/v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (307 commits)
  media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer
  media: uvcvideo: Fix allocation for small frame sizes
  media: uvcvideo: Return queued buffers on start_streaming() failure
  media: uvcvideo: Create an ID namespace for streaming output terminals
  media: rkvdec: Add HEVC support for the VDPU383 variant
  media: rkvdec: Add HEVC support for the VDPU381 variant
  media: rkvdec: Add H264 support for the VDPU383 variant
  media: rkvdec: Add H264 support for the VDPU381 variant
  media: rkvdec: Disable multicore support
  media: rkvdec: Enable all clocks without naming them
  media: rkvdec: Support per-variant interrupt handler
  media: rkvdec: Add RCB and SRAM support
  media: rkvdec: Add variant specific coded formats list
  media: rkvdec: Move hevc functions to common file
  media: rkvdec: Move h264 functions to common file
  media: rkvdec: Use structs to represent the HW RPS
  media: rkvdec: Move cabac tables to their own source file
  media: rkvdec: Switch to using structs instead of writel
  media: visl: Add HEVC short and long term RPS sets
  media: v4l2-ctrls: Add hevc_ext_sps_[ls]t_rps controls
  ...
2026-02-11 12:20:25 -08:00
Sebastian Andrzej Siewior
ef92b98f5f media: pci: mg4b: Use IRQF_NO_THREAD
The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke other
interrupt handlers and this supposed to happen from hard interrupt context.

Use IRQF_NO_THREAD to forbid forced-threading.

Fixes: 0ab13674a9 ("media: pci: mgb4: Added Digiteq Automotive MGB4 driver")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260128095540.863589-21-bigeasy@linutronix.de
2026-02-03 09:20:55 +01:00
Martin Tůma
f67adf545f media: pci: mgb4: Add support for GMSL3 coaxial modules
Add support for GMSL3 modules with a coaxial interface, a variant of the
already existing module with the id #4. The FW is the same as for all other
GMSL3 modules.

Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-17 09:08:02 +01:00
Martin Tůma
a20cf188ab media: pci: mgb4: Add support for GMSL1 modules
Add support for GMSL1 modules. GMSL1 modules have 2 inputs, 2 outputs and
require a separate FW (id #3).

Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-17 09:08:02 +01:00
Sakari Ailus
2eeefb22f9 media: ipu6: Update e-mail addresses
Remove Hongju's e-mail address that no longer works.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-16 14:08:52 +01:00
Sakari Ailus
dc6c52205b media: ipu6: Always call video_device_pipeline_alloc_start()
Even if a video device is part of a pipeline already,
video_device_pipeline_alloc_start() handles that case gracefully. Don't
explicitly differentiate between video_device_pipeline_start() and
video_device_pipeline_alloc_start() based on the existence of a pipeline.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
58410f62e2 media: ipu6: Drop custom functions to obtain sd state information
Drop the custom functions that are used to obtain information from the
sub-device state.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
e660207a1d media: ipu6: Remove source_entity from struct ipu6_isys_stream
Remove source_entity from struct ipu6_isys_stream and instead pass it on
in function arguments.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
7c30585091 media: ipu6: Obtain unique source pad from remote sub-device
Obtain unique source pad from a remote sub-device, instead of the first
one. This means that only one link may be active at stream start. There's
no functional change in practice, unless multiple CSI-2 transmitters are
directly connected to the receiver.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
b613b2fedb media: ipu6: Obtain remote pad using media_pad_remote_pad_unique()
There's no reason to use media_entity_remote_source_pad_unique() as we
know our pads. Use media_pad_remote_pad_unique() instead.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
6d9f46bc30 media: ipu6: Drop error argument from ipu6_isys_stream_start()
error argument for ipu6_isys_stream_start() is always false, remove the
argument. The IPU6_ISYS_BUFFER_LIST_FL_SET_STATE buffer flag also becomes
redundant as a result, remove it as well.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
2b08b7007e media: ipu6: Always close firmware stream
Close the firmware stream even when disabling a stream on an upstream
sub-device fails. This allows the firmware to release resources related to
a stream that is stopped in any case.

Suggested-by: Bingbu Cao <bingbu.cao@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
5925a92cc7 media: ipu6: Close firmware streams on streaming enable failure
When enabling streaming fails, the stream is stopped in firmware but not
closed. Do this to release resources on firmware side.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
04d59cc06a media: ipu6: Don't check pipeline in stream_start
A pipeline exists when start_streaming has returned so the check for
start_streaming_called is equivalent to having media_pipeline. Use
vb2_start_streaming_called() to perform the check.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
b008748368 media: ipu6: Remove redundant streaming start via buffer queueing
The videobuf2 framework will ensure buffers are queued before streaming is
started. Remove support for starting streaming via the buf_queue()
callback.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
e5af254e44 media: ipu6: Make symbols static
Make isys_setup_hw and isys_isr static as they're only used in a single
file.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
312c74e6d3 media: ipu6: Remove redundant driver data checks
Both runtime PM resume and suspend callbacks check whether the driver's
data is set for the device. This is done in probe(); drop the redundant
checks.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
5b18b3816f media: ipu6: Drop MMU hardware initialisation in probe()
The MMU hardware is initialised and cleaned up in the runtime PM resume
callbacks. Do not do this in probe().

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Sakari Ailus
779bdaad2a media: ipu6: Ensure stream_mutex is acquired when dealing with node list
The ipu6 isys driver maintains the list of video buffer queues related to
a stream (in ipu6 context streams on the same CSI-2 virtual channel) and
this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs.
Ensure the common mutex is acquired when accessing the linked list, i.e.
the isys device context's stream_mutex.

Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard()
while at it as the error handling becomes more simple this way.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:56 +01:00
Bingbu Cao
6099f78e4c media: ipu6: Fix RPM reference leak in probe error paths
Several error paths in ipu6_pci_probe() were jumping directly to
out_ipu6_bus_del_devices without releasing the runtime PM reference.
Add pm_runtime_put_sync() before cleaning up other resources.

Cc: Stable@vger.kernel.org
Fixes: 25fedc0219 ("media: intel/ipu6: add Intel IPU6 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:55 +01:00
Bingbu Cao
3e0fcc9127 media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
Fix two coding errors in ipu6-mmu.c:

1. Fix syntax error in page_table_dump() where the closing parenthesis
   and semicolon were swapped in the TBL_PHYS_ADDR macro call.

2. Fix incorrect loop bound in alloc_l2_pt(). When initializing L2 page
   table entries, the loop was incorrectly using ISP_L1PT_PTES instead
   of ISP_L2PT_PTES.

Fixes: 9163d83573 ("media: intel/ipu6: add IPU6 DMA mapping API and MMU table")
Cc: stable@vger.kernel.org
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 12:47:55 +01:00
Haoxiang Li
68cd8ac994 media: cx25821: Fix a resource leak in cx25821_dev_setup()
Add release_mem_region() if ioremap() fails to release the memory
region obtained by cx25821_get_resources().

Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 13:21:04 +01:00
Kees Cook
0fdf6323c3 media: solo6x10: Check for out of bounds chip_id
Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
(literal "1" is an "int") could end up being shifted beyond 32 bits,
so instrumentation was added (and due to the double is_tw286x() call
seen via inlining), Clang decides the second one must now be undefined
behavior and elides the rest of the function[1]. This is a known problem
with Clang (that is still being worked on), but we can avoid the entire
problem by actually checking the existing max chip ID, and now there is
no runtime instrumentation added at all since everything is known to be
within bounds.

Additionally use an unsigned value for the shift to remove the
instrumentation even without the explicit bounds checking.

Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
Suggested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: fix checkpatch warning for is_tw286x]
2026-01-13 13:21:03 +01:00
Haoxiang Li
863f50d583 media: cx25821: Add missing unmap in snd_cx25821_hw_params()
In error path, add cx25821_alsa_dma_unmap() to release the
resource acquired by cx25821_alsa_dma_map()

Fixes: 8d8e6d6005 ("[media] cx28521: drop videobuf abuse in cx25821-alsa")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 13:21:03 +01:00
Haoxiang Li
141c81849f media: cx23885: Add missing unmap in snd_cx23885_hw_params()
In error path, add cx23885_alsa_dma_unmap() to release the
resource acquired by cx23885_alsa_dma_map().

Fixes: 9529a4b0cf ("[media] cx23885: drop videobuf abuse in cx23885-alsa")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 13:21:03 +01:00
Haoxiang Li
dbc527d980 media: cx88: Add missing unmap in snd_cx88_hw_params()
In error path, add cx88_alsa_dma_unmap() to release
resource acquired by cx88_alsa_dma_map().

Fixes: b2c75abde0 ("[media] cx88: drop videobuf abuse in cx88-alsa")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13 13:21:03 +01:00
Hans de Goede
b75710155a media: ipu-bridge: Add DMI quirk for Dell XPS laptops with upside down sensors
The Dell XPS 13 9350 and XPS 16 9640 both have an upside-down mounted
OV02C10 sensor. This rotation of 180° is reported in neither the SSDB nor
the _PLD for the sensor (both report a rotation of 0°).

Add a DMI quirk mechanism for upside-down sensors and add 2 initial entries
to the DMI quirk list for these 2 laptops.

Note the OV02C10 driver was originally developed on a XPS 16 9640 which
resulted in inverted vflip + hflip settings making it look like the sensor
was upright on the XPS 16 9640 and upside down elsewhere this has been
fixed in commit d5ebe3f7d1 ("media: ov02c10: Fix default vertical flip").
This makes this commit a regression fix since now the video is upside down
on these Dell XPS models where it was not before.

Fixes: d5ebe3f7d1 ("media: ov02c10: Fix default vertical flip")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bod@kernel.org>
Reviewed-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-06 09:33:33 +01:00
Hans de Goede
4985b66fbd media: ipu6: isys: Add support for monochrome media bus formats
Add support for monochrome media bus formats, for use with monochrome/IR
camera sensors.

This has been tested on a Dell XPS 13 9320 with OV1A1B IR sensor.

Signed-off-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-11-13 10:57:52 +01:00
Hao Yao
abe3f43438 media: ipu-bridge: Add OV05C10 to the list of supported sensors
Add the OV05C10 sensor to the list of supported sensors.

Signed-off-by: Hao Yao <hao.yao@intel.com>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-11-13 10:57:51 +01:00
Jimmy Su
84c56e1cb3 media: ipu-bridge: Add IMX471 to the list of supported sensors
Add the IMX471 sensor, which is used with a SONY471A ACPI HID on
the Lenovo ThinkPad X9 15 laptop to the list of supported sensors.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=2362064
Signed-off-by: Jimmy Su <jimmy.su@intel.com>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-11-13 10:57:51 +01:00
Mauro Carvalho Chehab
29ae148fa8 Linux 6.18-rc5
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmkRH1seHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGUCgH/j+fMbEg618ajVS2
 SWdAXZKEDVtCqN6bq9VT3g3rwk/zNgvppjMdCBqyXFpjvkGGIxlZnNgiTVuTLzvR
 cjl0c5C1a38lJ+DzmLjTF1TJ3t0CcA/8l2iWKu3Dm1ch2yuxm5ZcM2b9ujBholf7
 pYd7jZ7JhVm5eXD7U5X03AkZPUWAIx/Nip37cO7RLGzlkRSGLB7OXq3TB2u4e2ti
 gDpP4O+cgOqSuS71Hz0/8T6KIVQ9IZ/qzANWAYeHZD2DQwI3OZXI1WRnc1iw401o
 QaMaV21NirKwAANKetvbj7FgtmpdfQs/7FA+yR7YW2ARTpkc1EXrxgMZ6NuphGKE
 kYQo55g=
 =QaZ2
 -----END PGP SIGNATURE-----

Merge tag 'v6.18-rc5' into media-next

Linux 6.18-rc5

* tag 'v6.18-rc5': (1016 commits)
  Linux 6.18-rc5
  kbuild: Let kernel-doc.py use PYTHON3 override
  rtc: rx8025: fix incorrect register reference
  Revert "drm/nouveau: set DMA mask before creating the flush page"
  io_uring: fix regbuf vector size truncation
  compiler_types: Move unused static inline functions warning to W=2
  smb: client: validate change notify buffer before copy
  tracing/tools: Fix incorrcet short option in usage text for --threads
  drm/xe: Enforce correct user fence signaling order using
  x86/microcode/AMD: Add more known models to entry sign checking
  drm/xe: Do clean shutdown also when using flr
  drm/xe: Move declarations under conditional branch
  drm/xe/guc: Synchronize Dead CT worker with unbind
  tracing: Fix memory leaks in create_field_var()
  ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up
  tracing: tprobe-events: Fix to put tracepoint_user when disable the tprobe
  tracing: tprobe-events: Fix to register tracepoint correctly
  gpio: tb10x: Drop unused tb10x_set_bits() function
  drm/amd/display: Enable mst when it's detected but yet to be initialized
  drm/amdgpu: Fix wait after reset sequence in S3
  ...
2025-11-11 12:44:28 +01:00
Martin Tůma
2d71d7b5e9 media: pci: mgb4: Fix DV capabilities
Use the same value (4096) for the maximum height as used for width.
The HW limits are a 4K video, but the orientation does not matter. Fixes
issues with some portrait oriented Audi displays that exceed the old
height value (2160).

Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-11-03 15:58:42 +01:00
Ma Ke
765abb76f5 media: ivsc: Release csi_dev reference early in mei_ace_setup_dev_link()
Put the reference to csi_dev acquired during driver probe in
mei_ace_setup_dev_link() inside the same function, instead of during driver
unbind in mei_ace_remove(). This can be done as device_link_add() already
takes a reference to csi_dev.

Signed-off-by: Ma Ke <make24@iscas.ac.cn>
[Sakari Ailus: Rework commit message.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-29 13:47:16 +01:00
Ricardo Ribalda
ee738d5c91 media: ipu6: isys: Use %pe format specifier
The %pe format specifier is designed to print error pointers. It prints
a symbolic error name (eg. -EINVAL) and it makes the code simpler by
omitting PTR_ERR().

This patch fixes this cocci report:
./pci/intel/ipu6/ipu6-isys-csi2.c:91:22-29: WARNING: Consider using %pe to print PTR_ERR()

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-17 11:31:16 +02:00
Ricardo Ribalda
96097ec153 media: ipu3-cio2: Use %pe format specifier
The %pe format specifier is designed to print error pointers. It prints
a symbolic error name (eg. -EINVAL) and it makes the code simpler by
omitting PTR_ERR().

This patch fixes this cocci report:
./pci/intel/ipu3/ipu3-cio2.c:318:19-26: WARNING: Consider using %pe to print PTR_ERR()

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-17 11:31:16 +02:00