Move kernel-doc comment for strength field in
ia_css_aa_config from inline to structure-level comment
for better readability and tooling compatibility.
Signed-off-by: LiangCheng Wang <zaq14760@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Fix checkpatch.pl warning on useless return on the end of the void
function.
Signed-off-by: Adrian Barnaś <abarnas@google.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Clean up coding style whitespace issues
in drivers/staging/media/atomisp/pci/hive_isp_css_common/host/gdc.c.
Fixes include:
- removal of unnecessary line breaks
- correcting spacing around operators
- correcting spaces between types and names
Signed-off-by: Adrian Barnaś <abarnas@google.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Use string_choices.h helpers instead of hard-coded strings.
Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Replace open-coded width * height * sizeof() multiplications with
array3_size() to prevent integer overflow in buffer allocations.
The atomisp driver computes DVS, morphing table, shading table and
statistics buffer sizes using unchecked arithmetic. When dimensions
are attacker-controlled or simply large, the product can silently wrap,
causing kvmalloc() to allocate an undersized buffer.
array3_size() saturates to SIZE_MAX on overflow, so kvmalloc() returns
NULL instead of succeeding with too few bytes.
Signed-off-by: Feng Ning <feng@innora.ai>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Replace hardcoded function name string with __func__ macro in
dev_dbg call as recommended by kernel coding style.
Signed-off-by: Oskar Ray-Frayssinet <rayfraytech@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Remove unnecessary else clause after return statement as the else
branch is not needed when the if branch always returns.
Signed-off-by: Oskar Ray-Frayssinet <rayfraytech@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Replace the open-coded multiplication in kmalloc() with kmalloc_array()
to provide overflow protection and improve code readability.
Signed-off-by: Lin YuChen <starpt.official@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Drop unnecessary casts when accessing vma->vm_private_data.
No functional change.
Signed-off-by: Zile Xiong <xiongzile99@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
This driver includes the legacy header <linux/gpio.h> but does
not use any symbols from it. Drop the inclusion.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The load_primary_binaries() function is overly complex and has som large
variables on the stack, which can cause warnings depending on CONFIG_FRAME_WARN
setting:
drivers/staging/media/atomisp/pci/sh_css.c: In function 'load_primary_binaries':
drivers/staging/media/atomisp/pci/sh_css.c:5260:1: error: the frame size of 1560 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
Half of the stack usage is for the prim_descr[] array, but only one
member of the array is used at any given time.
Reduce the stack usage by turning the array into a single structure.
Fixes: a49d25364d ("staging/atomisp: Add support for the Intel IPU v2")
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Remove the 'assert(entry)' call. In the atomisp driver, assert() is a
wrapper around BUG(), which intentionally crashes the entire kernel.
This is dangerous and inappropriate for a simple null pointer check
during stream teardown. Replace it with a safe 'if (!entry) continue;'
check.
Change the early 'return' to a 'continue'. In a destruction
path, it is better to proceed with cleaning up as many resources as
possible rather than aborting early, which would result in memory leaks
for the remaining pipes.
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
To reduce indentation and improve the readability of
ia_css_stream_destroy(), extract the ISP2401-specific cleanup block into
a new static helper function, ia_css_stream_destroy_isp2401().
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The nested loop inside the IS_ISP2401 block incorrectly uses the same
variable 'i' as the outer loop. This shadows the outer loop variable
and causes premature termination or skipped array elements.
Change the inner loop to use a new variable 'j' to prevent this.
Fixes: 113401c673 ("media: atomisp: sh_css: Removed #ifdef ISP2401 to make code generic")
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Replace open-coded ternary min expressions with umin() in
strscpy() calls, as suggested by Dan Carpenter.
Signed-off-by: Michael Ugrin <mugrinphoto@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
gmin_cfg_get_dsm() iterates over ACPI _DSM package elements as
key/value pairs using obj->package.count - 1 as the loop bound.
If package.count is 0, the subtraction underflows and may lead
to out-of-bounds access.
Use i + 1 < obj->package.count instead.
Signed-off-by: Mohamad El Harake <mohamedharake2006@gmail.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The function configure_isp_from_args() contained a duplicate call to
ia_css_output0_configure() using the same output frame index. Remove the
redundant call to simplify the configuration path.
The ia_css_output0_configure() function acts as a configuration setter.
It populates a struct ia_css_output0_configuration from the frame info
and caches it in the binary parameters. Calling it twice with the same
out_frame[0] pointer merely overwrites the exact same state with
identical values. It has no cumulative state, neither does its order
matter relative to ia_css_copy_output_configure().
ia_css_configure_output0() writes into binary->mem_params.params[], a
software-side DMEM parameter buffer in kernel memory. The ISP firmware
receives these parameters later as a batch, not at the time of the call.
Calling a pure memory write twice with the same pointer and same value
simply overwrites the same location with identical data, there is no
hardware interaction that could require repetition.
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The FIXME comment noted that delay_frames can be NULL for certain
pipeline configurations, without knowing why. The reason is that when a
binary does not enable ref_frame, delay frame allocation is
intentionally skipped to save memory, leaving the pointers NULL by
design.
The ISP feature flags in binary->info->sp.enable accurately reflect
which features are active for a given binary. Using enable.ref_frame and
enable.tnr as the predicate for their respective configuration steps
ensures the configuration path stays in sync with what was actually
built into the pipeline
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Merge declaration of const GP_TIMER_BASE split across 2 lines to improve
readability.
Signed-off-by: Anushka Badhe <anushkabadhe@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Replace usage of uint32_t with u32 to comply with kernel coding
style guidelines.
Reported by checkpatch.pl.
CHECK: Prefer kernel type 'u32' over 'uint32_t'
Signed-off-by: Abinash Singh <abinashsinghlalotra@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
gc2235_probe() handles its error paths incorrectly.
If media_entity_pads_init() fails, gc2235_remove() is called, which
tears down the subdev and frees dev, but then still falls through to
atomisp_register_i2c_module(). This results in use-after-free.
If atomisp_register_i2c_module() fails, the media entity and control
handler are left initialized and dev is leaked.
gc2235_remove() unconditionally calls media_entity_cleanup() and
v4l2_ctrl_handler_free(), but these are not initialized at every
error path in gc2235_probe().
Replace gc2235_remove() calls in the probe error paths with explicit
unwind labels that free only the resources initialized at each point
of failure, in reverse order of initialization.
Fixes: a49d25364d ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The struct ia_css_region definition is redundant as struct v4l2_rect
provides the same functionality (left, top, width, height) and is the
standard V4L2 type.
Replace usage of ia_css_region with v4l2_rect in ia_css_dz_config
and remove the definition of ia_css_region from ia_css_types.h.
Also remove historical comments referencing the addition of zoom_region
and include <linux/videodev2.h> to support the v4l2_rect type.
Signed-off-by: Karthikey Kadati <karthikey3608@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Fix checkpatch.pl warnings in sh_css_param_shading.c regarding block
comment formatting.
The warning was:
- Block comments use a trailing */ on a separate line
This change also moves text from the first line of block comments to
subsequent lines to adhere to the standard Linux kernel coding style.
Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Existing comments in mmu_public.h used Doxygen syntax and had
inconsistent formatting.
Convert the function documentation to the standard kernel-doc format to
adhere to the Linux kernel coding style.
Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The function mmu_get_page_table_base_index() accepts only one argument
mmu_ID_t, the block comment for it shows an erroneous additional
argument base_index[in]. Similarly, mmu_reg_load() only accepts two
arguments, however the block comment explaining it shows an erroneous
argument 'value[in]'.
Remove incorrect documentation lines.
Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Fix checkpatch.pl warnings regarding block comments.
Add missing asterisks to block comments to adhere to the kernel coding
style.
Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Fix checkpatch.pl warnings regarding lines ending with "(" and improper
spacing for indentation.
This change fixes the function signatures for both function prototypes
and static inline function definations in mmu_public.h.
The kernel coding style prefers arguments to start immediately after
the open parenthesis.
Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The function mmu_reg_store() returns void. The final return
statement is redundant as it is followed by the closing brace.
Remove the redundant return statement to simplify code and adhere to
kernel coding style.
Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Systems with the atomisp ISP do not have a lot of memory for modern
standards, so these are often under memory pressure and alloc_pages_bulk()
does not try very hard to free pages before returning an amount of pages
which is less then requested. This leads to streaming from the camera
often failing with a "alloc_pages_bulk() failed" error.
vmalloc() also uses alloc_pages_bulk(), but falls back to allocating one
page at a time when that fails.
Do the same in alloc_private_pages() to avoid these errors.
While at it also drop the weird custom GFP flags and just use GFP_KERNEL
and drop the dev_err() as alloc_pages() already complaints loudly if
it fails itself.
Closes: https://github.com/jfwells/linux-asus-t100ta/issues/4
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
atomisp_v4l2_framebuffer_to_css_frame() allocates memory for
temporary variable raw_black_frame, which must be released via
ia_css_frame_free() before the function returns. However, if
sh_css_set_black_frame() fails, the function returns immediately without
performing this cleanup, leading to a memory leak.
Fix this by assigning the return value of sh_css_set_black_frame() to
ret. This ensures that the error code is propagated while allowing the
execution to fall through to the ia_css_frame_free() cleanup call.
The bug was originally detected on v6.13-rc1 using an experimental
static analysis tool we are developing, and we have verified that the
issue persists in the latest mainline kernel. The tool is based on the
LLVM framework and is specifically designed to detect memory management
issues. It is currently under active development and not yet publicly
available.
We performed build testing on x86_64 with allyesconfig. Since triggering
this error path in atomisp requires specific Intel Atom ISP hardware and
firmware, we were unable to perform runtime testing and instead verified
the fix according to the code logic.
Fixes: 85b606e02a ("media: atomisp: get rid of a bunch of other wrappers")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Remove redundant 'return;' at the end of void function
ia_css_dvs_statistics_get(). Void functions do not need an explicit
return statement at the end. No other occurrences in this file.
Found with checkpatch.pl --strict.
Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The OP_std_modadd() adds no value, kill it and update the users to
perform the necessary operations themselves. No intended functional
changes.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Update block and inline comments to follow kernel
commenting conventions, fix typos and wording, remove
redundant comments and reformat long comments for clarity
and line length consistency.
Although some comments used the /** ... */ style, they are not
kernel-doc comments and are converted to normal comment style.
No functional changes are intended.
Signed-off-by: Hamdan Khan <hamdankhan212@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Fix checkpatch.pl errors:
ERROR: that open brace { should be on the previous line
Signed-off-by: Matt Wardle <matt@mattwardle.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Fix parameter indentation for functions and move opening braces onto new
line. Fix checkpatch.pl errors:
ERROR: open brace '{' following function definitions go on the next line
Signed-off-by: Matt Wardle <matt@mattwardle.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Fix checkpatch.pl warnings:
WARNING: braces {} are not necessary for single statement blocks
WARNING: braces {} are not necessary for any arm of this statement
Signed-off-by: Matt Wardle <matt@mattwardle.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Auditing calls to sprintf(). This code is fine because we are
copying 9 characters into a 52 character buffer. But it would
be cleaner to use strscpy() instead. Additionally, the 2-argument
version of strscpy() checks at compile time that dst is an array,
not just a pointer.
This is the only sprintf() call in the whole driver.
Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.
The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.
While touching all these arrays, unify usage of whitespace and commas.
This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
atmel-isc has been in staging pending removal since 2022.
Hence remove now.
Signed-off-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
si476x_radio_probe() registers radio->v4l2dev before allocating the V4L2
controls and before registering the video device. If any of those later
steps fails, probe returns through the exit label after freeing only the
control handler.
A failed probe does not call si476x_radio_remove(), so the
v4l2_device_unregister() there is not reached. This leaves the parent
device reference taken by v4l2_device_register() behind on the error path.
Unregister the V4L2 device in the probe error path after freeing the
controls.
Fixes: b879a9c2a7 ("[media] v4l2: Add a V4L2 driver for SI476X MFD")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
pwc_isoc_init() submits its isochronous URBs with
usb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is
submitted, its completion handler pwc_isoc_handler() can run on another
CPU before the loop finishes:
start_streaming()
pwc_isoc_init()
usb_submit_urb(urbs[0], GFP_KERNEL)
pwc_isoc_handler(urbs[0])
pdev->fill_buf =
pwc_get_next_fill_buf(pdev)
usb_submit_urb(urbs[i>0], ..) -> fails
pwc_isoc_cleanup(pdev) /* kills URBs */
return ret;
pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED)
pwc_get_next_fill_buf() detaches a buffer from pdev->queued_bufs and
stores it in pdev->fill_buf. The error path in start_streaming() only
drains pdev->queued_bufs, so the buffer parked in pdev->fill_buf is
leaked. vb2_start_streaming() then triggers
WARN_ON(owned_by_drv_count).
stop_streaming() already handles this since commit 80b0963e16
("[media] pwc: fix WARN_ON"), which added the fill_buf drain in the
teardown path but not in the start_streaming() error path. Mirror that
handling on failure so start_streaming() returns with no buffer owned
by the driver.
Issue identified by automated review of the INV-003 series at
https://sashiko.dev/
Fixes: 885fe18f55 ("[media] pwc: Replace private buffer management code with videobuf2")
Cc: stable@vger.kernel.org
Signed-off-by: Valery Borovsky <vebohr@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
With DRM_AMDGPU=m and DRM_AMD_ISP=y, it is possible to configura
VIDEO_AMD_ISP4_CAPTURE as built-in, but that fails to link:
aarch64-linux-ld: drivers/media/platform/amd/isp4/isp4_interface.o: in function `isp4if_gpu_mem_alloc.isra.0':
isp4_interface.c:(.text+0x1d0): undefined reference to `isp_kernel_buffer_alloc'
aarch64-linux-ld: drivers/media/platform/amd/isp4/isp4_interface.o: in function `isp4if_dealloc_fw_gpumem':
isp4_interface.c:(.text+0x26c): undefined reference to `isp_kernel_buffer_free'
Add a dependency on the tristate DRM_AMDGPU symbol in addition to
the boolean DRM_AMD_ISP=y, so this can only be built-in if
the ISP driver is also linked into the kernel itself.
Fixes: 9a54c28563 ("media: platform: amd: Introduce amd isp4 capture driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Bin Du <Bin.Du@amd.com>
Tested-by: Bin Du <Bin.Du@amd.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Newer Smatch snapshots no longer report the false positive around
isp4if_send_fw_cmd(), so the extra list reinitialization before kfree()
is no longer needed.
Drop the stale list reinit and keep the cleanup path simpler.
Signed-off-by: Bin Du <Bin.Du@amd.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The OV13B10 sensor driver currently handles a single regulator called
avdd, however the sensor can be supplied by up to three regulators.
Update the driver to handle all of them together using the regulator
bulk API.
Signed-off-by: Arun T <arun.t@intel.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
The Intel NVL platform uses IPU8 powered by a TPS68470 PMIC,
requiring board data to configure the GPIOs and regulators for
proper camera sensor operation.
Signed-off-by: Arun T <arun.t@intel.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Rename the MSI-specific daisy-chain GPIO properties and software node
to generic names so they can be reused by other platforms that also
require daisy-chain GPIO configuration for TPS68470.
Signed-off-by: Arun T <arun.t@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Drop comments about CEC 2.0 from cec-funcs.h.
In cec.h clearly comment messages that are CEC 2.0 specific
as such. Also rename references to HDMI 2.0 to CEC 2.0.
The <Request/Report Current Latency> messages were marked
as CEC 2.0 only. That is wrong, these messages are explicitly
allowed for any CEC version.
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Link: https://patch.msgid.link/098789ee233f777d5ad87a72f09a997373c98d25.1779115235.git.hverkuil+cisco@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-ID: <098789ee233f777d5ad87a72f09a997373c98d25.1779115235.git.hverkuil+cisco@kernel.org>
