Commit Graph

1461859 Commits

Author SHA1 Message Date
Sakari Ailus
42f83a3225 dt-bindings: media: i2c: Add Sony IMX678
Really add Sony IMX678 bindings this time. Those were accidentally missed
from commit 447ea0c26e ("dt-bindings: media: i2c: Add Sony IMX678") even
though the original patch included them.

Fixes: 447ea0c26e ("dt-bindings: media: i2c: Add Sony IMX678")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Acked-by: Jai Luthra <jai.luthra@ideasonboard.com>
2026-07-15 23:16:20 +03:00
Ricardo Ribalda
bb03a00d68 media: atomisp: Demote all broken kernel-doc comments
The atomisp code has been very heavily annotated in doxygen format.

Unfortunately, both doxygen and kernel-doc use the same mark for signify
the beginning of a comment (/**).

As a result of this, kernel-doc gets confused when it parses atomisp and
throws tons of warnings, which made us completely disable atomisp
kernel-doc checks in Media-CI.

Demote all the broken comments so we can have 100% coverage.

Future patches can convert the doxygen annotations to kernel-doc if this
is deemed useful.

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Chen Changcheng
bf2909f85c media: go7007: fix memory leaks on probe error paths
In go7007_register_encoder(), if any step after
v4l2_device_register() fails (go7007_init_encoder,
go7007_v4l2_ctrl_init, go7007_i2c_init, go7007_v4l2_init), the
function returns directly without cleanup, leaking the registered
V4L2 device and the control handler (if already initialized).

Add cascade error labels that properly release resources according
to how far initialization has progressed:
- err_free_controls: frees the control handler
- err_unregister_v4l2_dev: unregisters the V4L2 device (reached
  from any failure after v4l2_device_register)

Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Lei Huang
330f2936ab media: s2255: check firmware size before reading trailing marker
s2255_probe() reads a 4-byte marker and version from the last 8 bytes
of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the
firmware file is shorter than 8 bytes, fw_size - 8 underflows and the
access reads out of bounds. Validate the firmware size before indexing.

Fixes: 14d962602c ("V4L/DVB (8752): s2255drv: firmware improvement patch")
Cc: stable@vger.kernel.org
Signed-off-by: Lei Huang <huanglei@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Tharit Tangkijwanichakul
cd05b6174e media: videobuf2: move vb2_querybuf() kernel-doc to header
Move the function documentation for vb2_querybuf() from videobuf2-v4l2.c
to videobuf2-v4l2.h to match other functions.

Leaving the comment in the source file prevents the kernel-doc parser
from extracting it - thus become missing from the generated HTML.

Additionally, format the comment block to be the same style as other
functions in the header.

Signed-off-by: Tharit Tangkijwanichakul <tharitt97@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Oliver Neukum
3839365cf0 media: stk1160: handle ESHUTDOWN gracefully
Give it its own error message.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Oliver Neukum
083362373e media: stk1160: cleanup error handling in probe
Do not replicate cleanup code.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Ruoyu Wang
3a7d6b9c4c media: cobalt: Avoid freeing ALSA private data twice
snd_cobalt_card_create() stores cobsc in sc->private_data and installs
snd_cobalt_card_private_free() as sc->private_free. From that point,
snd_card_free(sc) releases cobsc through the ALSA card cleanup path.

If cobalt_alsa_init() fails after snd_cobalt_card_create(), the
err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That
second free releases the same object again.

Remove the explicit kfree(cobsc) and leave ownership with the ALSA card.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 85756a069c ("[media] cobalt: add new driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Hao-Qun Huang
ae15adeed9 staging: media: tegra-video: vi: fix probe failure on skipped last port
tegra_vi_channels_alloc() iterates over port nodes and skips those
whose reg property cannot be read or whose remote endpoint fails
v4l2_fwnode_endpoint_parse(), leaving the negative result of the
failed call in ret. If that happens on the last port node, the loop
ends with ret still negative and tegra_vi_init() fails the whole VI
probe.

The same defective port earlier in the ports node is skipped silently,
so probing succeeds or fails depending on the order of the port nodes.
The CSI equivalent, tegra_csi_channels_alloc(), returns 0
unconditionally after its loop and does not have this problem.

Use a separate variable for the per-port checks so that only fatal
errors end up in ret.

Fixes: 1ebaeb0983 ("media: tegra-video: Add support for external sensor capture")
Fixes: 2ac4035a78 ("media: tegra-video: Add support for x8 captures with gang ports")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Hao-Qun Huang
7393372f79 staging: media: tegra-video: fix of_node_put() on VIP parse errors
tegra_vip_channel_of_parse() initializes np from dev->of_node without
taking a reference, but its error paths drop one through the
err_node_put label. This underflows the refcount of the VIP device's
OF node when endpoint parsing fails on a malformed device tree.

The only reference the function takes on np is the success-path
of_node_get() stored in vip->chan.of_node, and that one is already
released by the tegra_vip_init() error path and by tegra_vip_exit().

Return errors directly instead of jumping to the bogus cleanup label.

Fixes: e740d199cf ("staging: media: tegra-video: add support for Tegra20 parallel input")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Shuangpeng Bai
1bd456afeb media: go7007: defer the ALSA v4l2 put until card release
go7007_snd_init() already takes a v4l2_device reference for the ALSA
side, but go7007_snd_remove() drops it immediately after calling
snd_card_free_when_closed().

That is too early when a userspace process still has the capture PCM open.
The ALSA card and its PCM callbacks remain alive until the last file is
closed, so the release path can still reach struct go7007 through
pcm->private_data and call go7007_snd_hw_free() after the V4L2 release path
has freed the object.

Move the matching v4l2_device_put() to the ALSA card private_free callback
so the existing ALSA reference covers the whole deferred card lifetime.

Closes: https://lore.kernel.org/r/178144969601.60470.6005237146425573205@gmail.com
Fixes: d5d3a7cc12 ("[media] go7007: fix unregister/disconnect handling")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Shuangpeng Bai
fc530fe168 media: usbtv: keep device alive while ALSA card exists
The ALSA PCM callbacks store the driver state in pcm->private_data. An
open PCM file can outlive USB disconnect because usbtv_audio_free() uses
snd_card_free_when_closed(). The disconnect path can then drop the V4L2
device reference and free struct usbtv before ALSA releases the substream,
so a later close dereferences freed memory in snd_usbtv_pcm_close().

Take a V4L2 device reference for the ALSA card and drop it from the card
private_free callback. This keeps struct usbtv valid until ALSA has closed
the remaining files and freed the card.

Closes: https://lore.kernel.org/r/178144969601.60470.4852887710381872458@gmail.com
Fixes: 63ddf68de5 ("[media] usbtv: add audio support")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Uday Khare
76e379754b media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
kthread_run() returns an ERR_PTR on failure, not NULL.
When start_streaming() fails, data->kthread_vid_cap is left holding
this error pointer instead of being cleared.

This causes two subsequent bugs:
1. A future call to start_streaming() sees a non-NULL kthread_vid_cap
   and returns 0 (success) immediately, without actually starting the
   capture thread.
2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which
   is false for an error pointer, and proceeds to call kthread_stop()
   on the error pointer, leading to a kernel crash.

Fix this by resetting kthread_vid_cap to NULL on failure before
jumping to the error path.

Fixes: 5cebaac609 ("media: video-i2c: add video-i2c driver")
Cc: stable@vger.kernel.org
Signed-off-by: Uday Khare <udaykhare77@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Joseph Breihan
4e1d07cfc1 media: au0828: add support for Monoprice 106456 USB ATSC/QAM tuner
The Monoprice 106456 (board rev TV22AD-A, also sold as the AnyTV
AUTV002) is a USB ATSC/QAM tuner that enumerates as 05e1:0400 and
reports itself as a "Syntek Semiconductor USB 2.0 Video Capture
Controller". The hardware is an Auvitek AU0828A bridge with an AU8522
demodulator and an NXP TDA18271HDC2 tuner at I2C address 0x60 -- the
same demod/tuner combination as the existing Hauppauge Woodbury board.

Adds board profile and the USB ID so the device binds. The digital
frontend is electrically identical to the Woodbury, so share that
board's au8522/tda18271 configuration and attach path rather than
duplicating it. Tested with over-the-air 8VSB ATSC: it locks and
streams a live 720p transport stream.

Some 05e1:0400 units reportedly ship a Microtune MT2131 tuner with an
AU8502 demodulator instead. This patch does not handle that variant,
but it can't regress it either: 05e1:0400 matches no driver today, and
on the MT2131 units tda18271_attach() just fails, so no frontend is
registered.

Signed-off-by: Joseph Breihan <linux@josephbreihan.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Pengpeng Hou
0a617f11c8 media: stm32: dcmipp: Propagate runtime resume errors
dcmipp_runtime_resume() can fail while preparing the device clocks, but
dcmipp_resume() currently ignores the result of
pm_runtime_force_resume() and always returns success.

Return the pm_runtime_force_resume() result so system resume does not
hide a failed runtime resume.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Pengpeng Hou
da929031d6 media: stm32: dcmi: Propagate runtime resume errors
dcmi_runtime_resume() returns clock enable failures, but dcmi_resume()
currently ignores the result of pm_runtime_force_resume() and always
returns success.

Return the pm_runtime_force_resume() result so system resume does not
hide a failed runtime resume.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Jiangong.Han
826915b6b6 media: em28xx: fix use-after-free of dev_next->devlist on disconnect
When a device with has_dual_ts=1 is probed and the is_audio_only path
is taken, both dev and dev->dev_next are added to the global
em28xx_devlist via em28xx_init_extension(). However, during disconnect,
em28xx_close_extension(dev) only calls list_del(&dev->devlist), leaving
dev->dev_next->devlist still linked in the global list. When dev_next is
subsequently freed via kref_put(), its devlist entry becomes a dangling
pointer in em28xx_devlist. The next device probe that calls
em28xx_init_extension() triggers a list corruption BUG when list_add_tail
detects the freed node.

This bug was exposed by commit a368ecde8a ("USB: core: Fix duplicate
endpoint bug by clearing reserved bits in the descriptor") which clears
reserved bits in bEndpointAddress during endpoint parsing. This causes
fuzzed endpoint addresses like 0xf3 to be normalized to 0x83, which
em28xx interprets as a vendor audio endpoint, enabling the
is_audio_only + has_dual_ts code path that was previously unreachable
with such descriptors.

Fix this by removing dev->dev_next->devlist from the global list in
em28xx_close_extension() before the device is freed.

Fixes: f410b4093f ("media: em28xx: split up em28xx_dvb_init to reduce stack size")
Cc: stable@vger.kernel.org
Reported-by: syzbot+99d6c66dbbc484f50e1c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=99d6c66dbbc484f50e1c
Signed-off-by: Jiangong.Han <jiangong.han@windriver.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Yousef Alhouseen
41f82777e5 media: go7007: avoid undefined shifts in MPEG-4 headers
The byte-alignment paths can call CODE_ADD() with a zero bit
length.  The macro then shifts an int by name.b, which can be 32
after the preceding bit was flushed.

vti_bitlen() can likewise shift a signed int into its sign bit while
searching for the bit length, and the package mask construction can
shift by the full type width.

Make zero-length additions a no-op, derive the bit length with fls(),
and build the mask with GENMASK().

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Pengpeng Hou
f373cf17fb media: ivtv: stop VBI start-code scan before short tail
compress_sliced_buf() scans one byte at a time while testing a four-byte
VBI start code.  The final iterations can read beyond the remaining
buffer tail.

Stop the scan once fewer than four bytes remain.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Pengpeng Hou
bf533acaaa media: cx18: stop VBI start-code scan before short tail
compress_sliced_buf() scans one byte at a time while testing a four-byte
VBI start code.  The final iterations can read beyond the remaining
buffer tail.

Stop the scan once fewer than four bytes remain.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:55 +02:00
Uwe Kleine-König (The Capable Hub)
007b61981a media: pci: Use PCI_DEVICE macros and drop zeros from pci_device_id arrays
Some pci_device_id arrays already used the PCI_DEVICE macros, others
used named initializers or list initializers. Unify all to use the
PCI_DEVICE macros and (if applicable) a named initializer for
.driver_data. Also drop all zeros that the compiler can care for and
unify indention and spacing.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:54 +02:00
Svyatoslav Ryhel
dd5f981d02 staging: media: tegra-video: vi: Improve media graph building logic
The existing tegra_vi_graph_build function relies heavily on a one-to-one
match between Device Tree nodes and media pad links. While this works for
simpler configurations, it causes issues when Device Tree nodes do not
match media pad link logic (e.g., mt9m114). Switch to the
media_entity_get_fwnode_pad helper to verify and retrieve the correct pad
linked to an endpoint, rather than assuming the endpoint ID matches the
pad ID.

Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # tegra20, parallel camera
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:54 +02:00
Uwe Kleine-König (The Capable Hub)
e1880f52cb media: ti: vpe: #include <linux/platform_device.h> explicitly
The driver uses several symbols and structs defined in that header. The
header is currently included transitively via

	"vip.h" ->
	<media/v4l2-ctrls.h> ->
	<media/media-request.h> ->
	<media/media-device.h> ->
	<linux/platform_device.h>

which seems to be on the lower end of the scale between random and
reliable.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:54 +02:00
André Moreira
635590417a staging: media: av7110: refactor av7110_start_feed to reduce indentation
The av7110_start_feed function contains heavily nested if-statements,
causing excessive indentation and violating code style guidelines.

Refactor the logic inside the DMX_MEMORY_FE case by inverting the
conditional check to break early. Additionally, remove the inner
'if (feed->ts_type & TS_DECODER)' check, as it is redundant since
the outer block already validates this condition.

This reduces the indentation level and cleans up redundant checks
without altering the underlying driver behavior.

Signed-off-by: André Moreira <andrem.33333@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 17:12:54 +02:00
Dave Stevenson
b7f17b9fe0 media: imx355: Remove storing cur_mode in the state
All the information for the mode is now stored within
the subdev state, so configure the sensor based on that.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:33 +03:00
Dave Stevenson
9f36cdacfd media: imx355: Switch to using the subdev state
The subdev state is now preferred rather than handling crop
and format within the driver state, so switch the driver to
using it.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:32 +03:00
Dave Stevenson
7c3aad6fba media: imx355: Support 2 lane readout
The sensor supports 2 or 4 lane readout, but the driver only allowed
for 4 lanes. Add 2 lane support.

The clock tree only supports single PLL mode to feed both IOP (MIPI)
and IVT (Pixel array).
2 lane mode supports a MIPI link frequency of up to 445MHz (890Mbit/s)
cf 360MHz (720Mbit/s) for 4lane. Update clock setup and pixel rates to
match.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:32 +03:00
Dave Stevenson
b8d87e9bdb media: imx355: Compute link frequency from PLL setup
In preparation for additional options in the PLL setup, compute
the link frequency rather than using a hardcoded value.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:32 +03:00
Dave Stevenson
2ae189fc1c media: imx355: Use NULL ctrl_ops for HBLANK as it is a read-only control
This avoids the set_ctrl handler being called under any
circumstances, as it will return an error for the unhandled
ctrl.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:32 +03:00
Dave Stevenson
f31cb77bb1 media: imx355: Define the exposure offset, and use that define
The difference between frame length and max exposure time in
lines is 10. That had been used as a bare value in calculations.

Move it to a define, and use that define.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:31 +03:00
Dave Stevenson
ba533bb043 media: imx355: Set the colorspace in the format
The colorspace fields were left set to 0 when they should be
set appropriately for a raw image sensor. Add those values.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:31 +03:00
Dave Stevenson
314a674393 media: imx355: Convert to new CCI register access helpers
Use the new comon CCI register access helpers to replace the private
register access helpers in the imx355 driver.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:31 +03:00
Dave Stevenson
a21872acb7 media: imx355: Use pm_runtime autosuspend_delay
Avoid powering the sensor up and down unnecessarily by using
pm_runtime's autosuspend_delay feature.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:31 +03:00
Dave Stevenson
8a52937cae media: imx355: Add support for get_selection
Provide all the cropping information via get_selection.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:30 +03:00
Dave Stevenson
ac2d97c65d media: imx355: Remove redundant fll_min, and implement fixed offset
fll_min (Frame Length Lines) is set to the same value as fll_def
for all modes, which makes it redundant.

The actual value is also erroneous as the sensor works in all
the defined modes with FLL set at the mode height + 20 lines,
so set the vblank control minimum to 20 rather than varying it.
This also improves the maximum frame rate achievable.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:30 +03:00
Dave Stevenson
2ed5e717a4 media: imx355: pixel_rate never changes, so don't recompute
The pixel rate is always the same, so there is no need to try and
recompute it in imx355_set_pad_format, and then no need to have the
pointer to it stored.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:30 +03:00
Dave Stevenson
d8c0dd60e9 media: imx355: Remove link_freq_index from each mode as ununsed
The link_freq_index value in imx355_mode is unused, so remove it.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:30 +03:00
Dave Stevenson
70a99e08c4 media: imx355: Set binning mode registers programmatically
Compute the binning registers based on the difference between
the mode width/height vs the crop width/height.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:29 +03:00
Dave Stevenson
8722701663 media: imx355: Set register LINE_LENGTH_PCK programmatically
The driver already has the LLP value stored in the mode structure,
but also had the same value set via register writes in the mode's
register list. Remove this duplication.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:29 +03:00
Dave Stevenson
f8ec1f0c06 media: imx355: Programmatically set the crop parameters for each mode
Currently the cropping is set via register entries in the per mode
register lists. Add the crop information to the mode structure as
a v4l2_rect, and set the registers programmatically.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:29 +03:00
Dave Stevenson
c8703ce868 media: imx355: Remove setting FRM_LENGTH_LINES in the mode regs
Registers 0x0340 and 0x0341 (FRM_LENGTH_LINES) are already written
from the set_ctrl(V4L2_CID_VBLANK) handler, so don't write them
from the mode register list.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:29 +03:00
Dave Stevenson
5ac4c9b680 media: imx355: Remove duplicated registers from the mode tables
A large number of registers are identical within all the modes.
Move those to imx355_global_regs.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:28 +03:00
Dave Stevenson
1b3f2170a0 dt-bindings: media: imx355: Allow 2 CSI2 data lane output
The sensor supports output over either 2 or 4 CSI2 data
lanes. The binding only permitted the 4 lane configuration.

Add the 2 lane configuration as an option.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:28 +03:00
David Heidelberg
64faa6aa51 media: imx355: Add support for 24 MHz external clock
The IMX355 sensor supports multiple external clock frequencies,
including 19.2 MHz and 24 MHz. The driver currently supports only
fixed 19.2 MHz input clock.

Refactor the clock handling to make the PLL configuration dependent
on the external clock frequency and add support for 24 MHz. Introduce
a table of clock parameter sets and program the corresponding EXTCLK
frequency and PLL multipliers to maintain consistent internal VCO
frequencies across supported inputs.

The PLL settings are adjusted so that OP VCO remains at 720 MHz

This preserves existing timing characteristics while allowing systems
using a 24 MHz clock to operate correctly.

No functional change for existing 19.2 MHz users.

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: David Heidelberg <david@ixit.cz>
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:24 +03:00
Dave Stevenson
ee737bc3cc media: imx355: Avoid calling imx355_power_off twice in error path
If v4l2_async_register_subdev_sensor failed, then the sensor had
already been powered down by pm_runtime_idle, but the error path
then also explicitly called imx355_power_off as well. That left
an imbalance in the regulator and clock calls.

Call pm_runtime_idle only after v4l2_async_register_subdev_sensor
succeeds to avoid this.

Fixes: efa5fe19c0 ("media: imx355: Enable runtime PM before registering async sub-device")
Cc: stable@vger.kernel.org
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 17:04:15 +03:00
Benjamin Mugnier
7a1e5239ae media: i2c: vd55g1: Add support for vd55g4
vd55g4 is the same device as vd65g4 but outputs in monochrome instead of
RGB. Adapt the driver structure according to this new variant, and add
its support.

Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 11:13:58 +03:00
Benjamin Mugnier
eaa329aff7 media: dt-bindings: vd55g1: Add vd55g4 compatible
Define it as a new monochrome variant of vd65g4.

Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 11:13:58 +03:00
Benjamin Mugnier
113a84d6ba media: i2c: vd55g1: Fix manual digital gain on color variant
Apply digital gain to all channels, each channel representing a color.

Cc: stable@vger.kernel.org
Fixes: e138e7f000 ("media: i2c: vd55g1: Add support for vd65g4 RGB variant")
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 11:13:57 +03:00
Benjamin Mugnier
3e275097e2 media: i2c: vd55g1: Remove spurious pad format update on init_state()
vd55g1_update_pad_fmt() is called in vd55g1_init_state(). But
vd55g1_set_pad_fmt(), called at the end of vd55g1_init_state(), also
calls vd55g1_update_pad_fmt() itself.

Enhance readability and clear confusion by only preparing the format in
vd55g1_init_state() and let vd55g1_set_pad_fmt() update it instead,
effectively calling it only 1 time instead of 2.

Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 11:13:57 +03:00
Benjamin Mugnier
e4a4f2e3b9 media: i2c: vd55g1: Fix media bus code initialization
In the driver initialization, the index of the default media bus code
from the supported media bus code array is passed directly to the
vd55g1_get_fmt_code() function instead of the proper media bus code.

This works correctly as a proper media bus code is set after
initialization but could not have been the case. This also resulted in
mutliple "Unsupported mbus format" error messages.

Retrieve the media bus code from the media bus code array, and pass this
media bus code to vd55g1_get_fmt_code() instead of the code index.

Rename VD55G1_MBUS_CODE_DEF to VD55G1_MBUS_CODE_IDX_DEF and
VD55G1_MODE_DEF to VD55G1_MODE_IDX_DEF while at it to avoid future
confusions. Display the guilty error code in warning message.

Cc: stable@vger.kernel.org
Fixes: e138e7f000 ("media: i2c: vd55g1: Add support for vd65g4 RGB variant")
Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-15 11:13:57 +03:00