Commit Graph

1444247 Commits

Author SHA1 Message Date
Jose A. Perez de Azpillaga
e4e6bc933a media: atomisp: gate ref and tnr frame config behind ISP enable flags
The FIXME comment noted that delay_frames can be NULL for certain
pipeline configurations, without knowing why. The reason is that when a
binary does not enable ref_frame, delay frame allocation is
intentionally skipped to save memory, leaving the pointers NULL by
design.

The ISP feature flags in binary->info->sp.enable accurately reflect
which features are active for a given binary. Using enable.ref_frame and
enable.tnr as the predicate for their respective configuration steps
ensures the configuration path stays in sync with what was actually
built into the pipeline

Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:31 +03:00
Anushka Badhe
c06b73f1e1 staging: media: atomisp: pci: fix split GP_TIMER_BASE declaration
Merge declaration of const GP_TIMER_BASE split across 2 lines to improve
readability.

Signed-off-by: Anushka Badhe <anushkabadhe@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:30 +03:00
Abinash Singh
ddc87e50b9 staging: media: atomisp: replace uint32_t with u32
Replace usage of uint32_t with u32 to comply with kernel coding
style guidelines.

Reported by checkpatch.pl.
CHECK: Prefer kernel type 'u32' over 'uint32_t'

Signed-off-by: Abinash Singh <abinashsinghlalotra@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:30 +03:00
Yuho Choi
628f763aee media: atomisp: gc2235: fix UAF and memory leak
gc2235_probe() handles its error paths incorrectly.

If media_entity_pads_init() fails, gc2235_remove() is called, which
tears down the subdev and frees dev, but then still falls through to
atomisp_register_i2c_module(). This results in use-after-free.

If atomisp_register_i2c_module() fails, the media entity and control
handler are left initialized and dev is leaked.

gc2235_remove() unconditionally calls media_entity_cleanup() and
v4l2_ctrl_handler_free(), but these are not initialized at every
error path in gc2235_probe().

Replace gc2235_remove() calls in the probe error paths with explicit
unwind labels that free only the resources initialized at each point
of failure, in reverse order of initialization.

Fixes: a49d25364d ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:30 +03:00
Karthikey Kadati
2ebf05cc41 media: atomisp: replace ia_css_region with v4l2_rect
The struct ia_css_region definition is redundant as struct v4l2_rect
provides the same functionality (left, top, width, height) and is the
standard V4L2 type.

Replace usage of ia_css_region with v4l2_rect in ia_css_dz_config
and remove the definition of ia_css_region from ia_css_types.h.

Also remove historical comments referencing the addition of zoom_region
and include <linux/videodev2.h> to support the v4l2_rect type.

Signed-off-by: Karthikey Kadati <karthikey3608@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:30 +03:00
Mahad Ibrahim
2e6b2d4330 media: atomisp: Fix block comment coding style in sh_css_param_shading.c
Fix checkpatch.pl warnings in sh_css_param_shading.c regarding block
comment formatting.

The warning was:
- Block comments use a trailing */ on a separate line

This change also moves text from the first line of block comments to
subsequent lines to adhere to the standard Linux kernel coding style.

Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:30 +03:00
Mahad Ibrahim
33fea3423f media: atomisp: Convert comments to kernel-doc
Existing comments in mmu_public.h used Doxygen syntax and had
inconsistent formatting.

Convert the function documentation to the standard kernel-doc format to
adhere to the Linux kernel coding style.

Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:30 +03:00
Mahad Ibrahim
ffb694d752 media: atomisp: Fix erroneous parameter descriptions
The function mmu_get_page_table_base_index() accepts only one argument
mmu_ID_t, the block comment for it shows an erroneous additional
argument base_index[in]. Similarly, mmu_reg_load() only accepts two
arguments, however the block comment explaining it shows an erroneous
argument 'value[in]'.

Remove incorrect documentation lines.

Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:30 +03:00
Mahad Ibrahim
2842e567b4 media: atomisp: Fix block comment coding style
Fix checkpatch.pl warnings regarding block comments.

Add missing asterisks to block comments to adhere to the kernel coding
style.

Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:29 +03:00
Mahad Ibrahim
fff06b0538 media: atomisp: Fix function signature alignment
Fix checkpatch.pl warnings regarding lines ending with "(" and improper
spacing for indentation.

This change fixes the function signatures for both function prototypes
and static inline function definations in mmu_public.h.

The kernel coding style prefers arguments to start immediately after
the open parenthesis.

Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:29 +03:00
Mahad Ibrahim
5ed76a163b media: atomisp: Remove redundant return statement
The function mmu_reg_store() returns void. The final return
statement is redundant as it is followed by the closing brace.

Remove the redundant return statement to simplify code and adhere to
kernel coding style.

Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:29 +03:00
Hans de Goede
0a41dd4aab media: atomisp: Fix alloc_pages_bulk() failed errors
Systems with the atomisp ISP do not have a lot of memory for modern
standards, so these are often under memory pressure and alloc_pages_bulk()
does not try very hard to free pages before returning an amount of pages
which is less then requested. This leads to streaming from the camera
often failing with a "alloc_pages_bulk() failed" error.

vmalloc() also uses alloc_pages_bulk(), but falls back to allocating one
page at a time when that fails.

Do the same in alloc_private_pages() to avoid these errors.

While at it also drop the weird custom GFP flags and just use GFP_KERNEL
and drop the dev_err() as alloc_pages() already complaints loudly if
it fails itself.

Closes: https://github.com/jfwells/linux-asus-t100ta/issues/4
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:29 +03:00
Zilin Guan
4e8156bd95 media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
atomisp_v4l2_framebuffer_to_css_frame() allocates memory for
temporary variable raw_black_frame, which must be released via
ia_css_frame_free() before the function returns. However, if
sh_css_set_black_frame() fails, the function returns immediately without
performing this cleanup, leading to a memory leak.

Fix this by assigning the return value of sh_css_set_black_frame() to
ret. This ensures that the error code is propagated while allowing the
execution to fall through to the ia_css_frame_free() cleanup call.

The bug was originally detected on v6.13-rc1 using an experimental
static analysis tool we are developing, and we have verified that the
issue persists in the latest mainline kernel. The tool is based on the
LLVM framework and is specifically designed to detect memory management
issues. It is currently under active development and not yet publicly
available.

We performed build testing on x86_64 with allyesconfig. Since triggering
this error path in atomisp requires specific Intel Atom ISP hardware and
firmware, we were unable to perform runtime testing and instead verified
the fix according to the code logic.

Fixes: 85b606e02a ("media: atomisp: get rid of a bunch of other wrappers")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:29 +03:00
Ethan Lam
f69992d08a staging: media: atomisp: fix block comment style in atomisp_cmd.c
Fix block comment style warnings reported by checkpatch.pl in atomisp_cmd.c.

Signed-off-by: Ethan Lam <ethanlxkernel@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:29 +03:00
Tomasz Unger
835da7cf2d media: staging: atomisp: Remove unnecessary return statement in void function
Remove redundant 'return;' at the end of void function
ia_css_dvs_statistics_get(). Void functions do not need an explicit
return statement at the end. No other occurrences in this file.

Found with checkpatch.pl --strict.

Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:28 +03:00
Andy Shevchenko
4d1e8d9ca1 staging: media: atomisp: Kill OP_std_modadd() macro
The OP_std_modadd() adds no value, kill it and update the users to
perform the necessary operations themselves. No intended functional
changes.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Ethan Tidmore <ethantidmore06@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:28 +03:00
Hamdan Khan
5cb289b539 staging: media: atomisp: Fix typos and formatting in headers
Update block and inline comments to follow kernel
commenting conventions, fix typos and wording, remove
redundant comments and reformat long comments for clarity
and line length consistency.

Although some comments used the /** ... */ style, they are not
kernel-doc comments and are converted to normal comment style.

No functional changes are intended.

Signed-off-by: Hamdan Khan <hamdankhan212@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:28 +03:00
Matt Wardle
a380fa65d5 staging: media: atomisp: Fix braces on incorrect lines
Fix checkpatch.pl errors:

ERROR: that open brace { should be on the previous line

Signed-off-by: Matt Wardle <matt@mattwardle.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:28 +03:00
Matt Wardle
2785424faf staging: media: atomisp: Fix function indentation and braces
Fix parameter indentation for functions and move opening braces onto new
line. Fix checkpatch.pl errors:

ERROR: open brace '{' following function definitions go on the next line

Signed-off-by: Matt Wardle <matt@mattwardle.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:28 +03:00
Matt Wardle
f3c450f5f1 staging: media: atomisp: Remove braces for single statement blocks
Fix checkpatch.pl warnings:

WARNING: braces {} are not necessary for single statement blocks
WARNING: braces {} are not necessary for any arm of this statement

Signed-off-by: Matt Wardle <matt@mattwardle.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:28 +03:00
Tomasz Unger
c565afd284 staging: media: atomisp: replace sprintf() with strscpy()
Auditing calls to sprintf(). This code is fine because we are
copying 9 characters into a 52 character buffer. But it would
be cleaner to use strscpy() instead. Additionally, the 2-argument
version of strscpy() checks at compile time that dst is an array,
not just a pointer.

This is the only sprintf() call in the whole driver.

Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:27 +03:00
Tomasz Unger
0812f34bf5 staging: media: atomisp: Fix spelling mistakes in comments
Fix various spelling mistakes found by codespell:
 - aviod => avoid
 - corrent => correct
 - stablization => stabilization
 - addtional => additional
 - facor => factor
 - steams => streams

Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-20 11:29:27 +03:00
Uwe Kleine-König (The Capable Hub)
2958d579ff media: Use named initializers for arrays of i2c_device_data
While being less compact, using named initializers allows to more easily
see which members of the structs are assigned which value without having
to lookup the declaration of the struct. And it's also more robust
against changes to the struct definition.

The mentioned robustness is relevant for a planned change to struct
i2c_device_id that replaces .driver_data by an anonymous union.

While touching all these arrays, unify usage of whitespace and commas.

This patch doesn't modify the compiled arrays, only their representation
in source form benefits. The former was confirmed with x86 and arm64
builds.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-20 09:03:40 +02:00
Thorsten Blum
5d579ece43 media: ivtv: use clamp in ivtv_try_fmt_vid_{out,cap}
Replace multiple min(), max() calls with clamp().

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-20 09:01:58 +02:00
Eugen Hristev
ffdb7c4eca media: staging: atmel-isc: Remove driver
atmel-isc has been in staging pending removal since 2022.
Hence remove now.

Signed-off-by: Eugen Hristev <ehristev@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-20 08:58:05 +02:00
Myeonghun Pak
436a693af0 media: radio-si476x: Unregister v4l2_device on probe failure
si476x_radio_probe() registers radio->v4l2dev before allocating the V4L2
controls and before registering the video device. If any of those later
steps fails, probe returns through the exit label after freeing only the
control handler.

A failed probe does not call si476x_radio_remove(), so the
v4l2_device_unregister() there is not reached. This leaves the parent
device reference taken by v4l2_device_register() behind on the error path.

Unregister the V4L2 device in the probe error path after freeing the
controls.

Fixes: b879a9c2a7 ("[media] v4l2: Add a V4L2 driver for SI476X MFD")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-20 08:58:05 +02:00
Valery Borovsky
906e410dcf media: pwc: Drain fill_buf on start_streaming() failure
pwc_isoc_init() submits its isochronous URBs with
usb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is
submitted, its completion handler pwc_isoc_handler() can run on another
CPU before the loop finishes:

  start_streaming()
    pwc_isoc_init()
      usb_submit_urb(urbs[0], GFP_KERNEL)
                                  pwc_isoc_handler(urbs[0])
                                    pdev->fill_buf =
                                      pwc_get_next_fill_buf(pdev)
      usb_submit_urb(urbs[i>0], ..)  -> fails
      pwc_isoc_cleanup(pdev)           /* kills URBs */
      return ret;
    pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED)

pwc_get_next_fill_buf() detaches a buffer from pdev->queued_bufs and
stores it in pdev->fill_buf. The error path in start_streaming() only
drains pdev->queued_bufs, so the buffer parked in pdev->fill_buf is
leaked. vb2_start_streaming() then triggers
WARN_ON(owned_by_drv_count).

stop_streaming() already handles this since commit 80b0963e16
("[media] pwc: fix WARN_ON"), which added the fill_buf drain in the
teardown path but not in the start_streaming() error path. Mirror that
handling on failure so start_streaming() returns with no buffer owned
by the driver.

Issue identified by automated review of the INV-003 series at
https://sashiko.dev/

Fixes: 885fe18f55 ("[media] pwc: Replace private buffer management code with videobuf2")
Cc: stable@vger.kernel.org
Signed-off-by: Valery Borovsky <vebohr@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-20 08:58:05 +02:00
Arnd Bergmann
e62bb5abdc media: platform: amd: add DRM_AMDGPU dependency
With DRM_AMDGPU=m and DRM_AMD_ISP=y, it is possible to configura
VIDEO_AMD_ISP4_CAPTURE as built-in, but that fails to link:

aarch64-linux-ld: drivers/media/platform/amd/isp4/isp4_interface.o: in function `isp4if_gpu_mem_alloc.isra.0':
isp4_interface.c:(.text+0x1d0): undefined reference to `isp_kernel_buffer_alloc'
aarch64-linux-ld: drivers/media/platform/amd/isp4/isp4_interface.o: in function `isp4if_dealloc_fw_gpumem':
isp4_interface.c:(.text+0x26c): undefined reference to `isp_kernel_buffer_free'

Add a dependency on the tristate DRM_AMDGPU symbol in addition to
the boolean DRM_AMD_ISP=y, so this can only be built-in if
the ISP driver is also linked into the kernel itself.

Fixes: 9a54c28563 ("media: platform: amd: Introduce amd isp4 capture driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Bin Du <Bin.Du@amd.com>
Tested-by: Bin Du <Bin.Du@amd.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-19 14:49:25 +03:00
Bin Du
5d8004bd27 media: platform: amd: isp4: drop stale list reinit before free
Newer Smatch snapshots no longer report the false positive around
isp4if_send_fw_cmd(), so the extra list reinitialization before kfree()
is no longer needed.

Drop the stale list reinit and keep the cleanup path simpler.

Signed-off-by: Bin Du <Bin.Du@amd.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-19 14:49:25 +03:00
Arun T
03529c85f4 media: ov13b10: Support multiple regulators
The OV13B10 sensor driver currently handles a single regulator called
avdd, however the sensor can be supplied by up to three regulators.
Update the driver to handle all of them together using the regulator
bulk API.

Signed-off-by: Arun T <arun.t@intel.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-19 23:55:59 +03:00
Arun T
cbc6cd55ae platform/x86: int3472: Add TPS68470 board data for intel nvl
The Intel NVL platform uses IPU8 powered by a TPS68470 PMIC,
requiring board data to configure the GPIOs and regulators for
proper camera sensor operation.

Signed-off-by: Arun T <arun.t@intel.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-19 23:55:58 +03:00
Arun T
d5a047e957 platform/x86: int3472: Rename daisy-chain GPIO props to generic
Rename the MSI-specific daisy-chain GPIO properties and software node
to generic names so they can be reused by other platforms that also
require daisy-chain GPIO configuration for TPS68470.

Signed-off-by: Arun T <arun.t@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-05-19 23:55:58 +03:00
Hans Verkuil
79500c929d media: include/uapi/linux/cec*: clarify which msgs are CEC 2.0
Drop comments about CEC 2.0 from cec-funcs.h.

In cec.h clearly comment messages that are CEC 2.0 specific
as such. Also rename references to HDMI 2.0 to CEC 2.0.

The <Request/Report Current Latency> messages were marked
as CEC 2.0 only. That is wrong, these messages are explicitly
allowed for any CEC version.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Link: https://patch.msgid.link/098789ee233f777d5ad87a72f09a997373c98d25.1779115235.git.hverkuil+cisco@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-ID: <098789ee233f777d5ad87a72f09a997373c98d25.1779115235.git.hverkuil+cisco@kernel.org>
2026-05-19 17:53:05 +02:00
Hans Verkuil
b300f96cb8 media: cec: core: add LIP support
Add support for the new CEC LIP opcodes.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Link: https://patch.msgid.link/9fb27f4a2133cf46b8e0fc126c2d1ef8b1bc30e1.1779115235.git.hverkuil+cisco@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-ID: <9fb27f4a2133cf46b8e0fc126c2d1ef8b1bc30e1.1779115235.git.hverkuil+cisco@kernel.org>
2026-05-19 17:53:05 +02:00
Hans Verkuil
300b8963c2 Documentation: media: add CEC opcodes
Add the new opcodes to cec.h.rst.exceptions to avoid
documentation build failures.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Link: https://patch.msgid.link/afe5d8f6cdf2dc030011eaf9acd8f68847d1b8cf.1779115235.git.hverkuil+cisco@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-ID: <afe5d8f6cdf2dc030011eaf9acd8f68847d1b8cf.1779115235.git.hverkuil+cisco@kernel.org>
2026-05-19 17:53:04 +02:00
Hans Verkuil
65efd1314d media: include/uapi/linux/cec*.h: add CEC LIP support
Add support for the new Latency Indication Protocol feature.

This adds the opcodes and the wrapper functions.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Link: https://patch.msgid.link/8dac7c99b7eab4fcc11d76d50dd08fb4448672f4.1779115235.git.hverkuil+cisco@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-ID: <8dac7c99b7eab4fcc11d76d50dd08fb4448672f4.1779115235.git.hverkuil+cisco@kernel.org>
2026-05-19 17:53:04 +02:00
David Carlier
a1db83cc6f media: mali-c55: Disable pm_runtime on probe error
When mali_c55_media_frameworks_init() fails, the goto target jumps to
err_free_context_registers, skipping pm_runtime_disable() despite
pm_runtime having already been enabled earlier in the function.

Fix this by adding an err_pm_runtime_disable label and redirecting the
frameworks init failure to it, so pm_runtime is properly unwound on
that error path. The runtime PM status is also set back to suspended
before disabling, to undo the pm_runtime_set_active() from probe.

Cc: stable@vger.kernel.org
Fixes: d5f281f3dd ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:50 +02:00
David Carlier
2c9b9bcc25 media: mali-c55: Power-off the peripheral in remove()
The Mali C55 driver doesn't depend on PM. For this reason, if pm_runtime
is not compiled in it is required to manually power-off the peripheral
during the driver's remove() handler.

Also pm_runtime_enable() is called during probe but mali_c55_remove()
never calls pm_runtime_disable(), leaving the device's runtime PM state
enabled after the driver is unbound.

Manually power-off the peripheral in remove() if the peripheral has not
been suspended using runtime_pm and disable runtime pm.

Cc: stable@vger.kernel.org
Fixes: d5f281f3dd ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
David Carlier
38e3509dd9 media: mali-c55: Add missing of_reserved_mem_device_release()
mali_c55_probe() calls of_reserved_mem_device_init() to associate
reserved memory regions with the device. This function allocates a
struct rmem_assigned_device and adds it to a global linked list, which
must be explicitly released via of_reserved_mem_device_release() — there
is no devm variant of this API.

However, neither the probe error paths nor mali_c55_remove() called
of_reserved_mem_device_release(). Any probe failure after the
of_reserved_mem_device_init() call, as well as every normal device
removal, leaked the reserved memory association on the global list.

Fix this by adding an err_release_mem label at the end of the probe
error chain and calling of_reserved_mem_device_release() in
mali_c55_remove(). The remove teardown order is also corrected to call
mali_c55_media_frameworks_deinit() before kfree(), mirroring the probe
init order in reverse.

Cc: stable@vger.kernel.org
Fixes: d5f281f3dd ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Alper Ak
94c6402e42 media: mali-c55: Fix possible ERR_PTR in enable_streams
The media_pad_remote_pad_unique() function returns either a valid
pointer or an ERR_PTR() on failure (-ENOTUNIQ if multiple links are
enabled, -ENOLINK if no connected pad is found). The return value
was assigned directly to isp->remote_src and dereferenced in the
next line without checking for errors, which could lead to an
ERR_PTR dereference.

Add proper error checking with IS_ERR() before dereferencing the
pointer. Also set isp->remote_src to NULL on error to maintain
consistency with other error paths in the function.

Cc: stable@vger.kernel.org
Fixes: d5f281f3dd ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Chen Ni
ff57ee8585 media: mali-c55: core: Remove redundant dev_err()
The platform_get_irq_byname() function already prints an error message
internally upon failure using dev_err_probe(). Therefore, the explicit
dev_err() is redundant and results in duplicate error logs.

Remove the redundant dev_err() call to clean up the error path.

Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
jempty.liang
5a11410b3d media: mali-c55: Initialise dev for tpg/rsz/isp subdevs
The subdevices registered by the Mali-C55 driver do not have their
'struct device *dev' member initialized. This is visibile when looking
at debug message, as in example:

"(NULL device *): collect_streams: sub-device 'mali-c55 tpg' does not
 support streams"

Fix this by initializing the *dev field for each subdevice registered
by the Mali-C55 driver.

Signed-off-by: jempty.liang <imntjempty@163.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Chen Ni
e398a06907 media: mali-c55: Remove unneeded semicolon
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the
semantic patch at scripts/coccinelle/misc/semicolon.cocci.

Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Jacopo Mondi
b4e6ddce16 media: rzv2h-ivc: Wait for frame end in stop_streaming
The rzv2h-ivc driver fails to handle back-2-back streaming sessions that
do not go through a peripheral reset. As the driver uses an autosuspend
delay of 2 seconds, it is quite possible that two consecutive streaming
sessions won't go through a suspend/resume sequence.

If the peripheral is not reset the second streaming session hangs and no
frames are delivered to the ISP.

This is because the stop_streaming() procedure implemented in the driver
doesn't match what's prescribed by the chip datasheet:

1) The chip manual suggests to poll the RZV2H_IVC_FM_INT_STAT_STPEND bit
   of RZV2H_IVC_REG_FM_INT_STA instead of polling on RZV2H_IVC_REG_FM_STOP
   and prescribes to clear the bit after polling has completed

2) More importantly: the RZV2H_IVC_REG_FM_STOP_FSTOP bit has to be set
   on RZV2H_IVC_REG_FM_STOP -only- if a frame transfer to the ISP is in
   progress. Setting the RZV2H_IVC_REG_FM_STOP_FSTOP bit when no frame is
   being transferred causes the polling routine to timeout and the next
   streaming session fails to start

As a frame transfer of an image in 1920x1080@10bi takes 5 milliseconds
at most, it is quite possible that the frame transfer completion interrupt
races with the stop procedure.

Instead of forcing a frame transfer abort, simply wait for the
in-progress transfer to complete by polling the ivc->vvalid_ifp status
variable in an hand-rolled loop that allows to inspect the variable
while holding the spinlock, to allow the irq handler to complete the
current buffer.

With this change, streaming back-2-back without suspending the
peripheral works successfully.

Cc: stable@vger.kernel.org
Fixes: f0b3984d82 ("media: platform: Add Renesas Input Video Control block driver")
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Jacopo Mondi
8cb2d88fa5 media: rzg2l-cru: Simplify irq return value handling
The rzg2l_cru_irq() irq handler uses a local variable to store the
handler return value.

Simplify it by using IRQ_NONE and IRQ_HANDLED.

Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Jacopo Mondi
acb6a00aa3 media: rzg2l-cru: Remove debug printouts from irq
Using dev_dbg() in irq handlers to debug per-frame events is marginally
useful and possibly not the best idea, as using printk-based helpers
introduce latencies that impact the drivers operations.

If any tracing/debugging has to be performed around frame events
in interrupt handlers, the tracing subsystem offers better alternatives.

Drop dev_dgb() calls from the CRU interrupt handlers.

Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Jacopo Mondi
85d8820d48 media: rzg2l-cru: Remove the 'state' variable
The cru driver uses a 'state' variable for debugging purpose in the
interrupt handler. The state is used to detect invalid usage conditions
that are not meant to happen unless the driver has a bug in handling the
stop and start conditions.

Remove the state variable which seems to be a debugging leftover.

Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Daniel Scally
145b8d16cc media: rzg2l-cru: Rework rzg2l_cru_fill_hw_slot()
The current implementation of rzg2l_cru_fill_hw_slot() results in the
artificial loss of frames. At present whenever a frame-complete IRQ
is received the driver fills the hardware slot that was just written
to with the address of the next buffer in the driver's queue. If the
queue is empty, that hardware slot's address is set to the address of
the scratch buffer to enable the capture loop to keep running. There
is a minimum of a two-frame delay before that slot will be written to
however, and in the intervening period userspace may queue more
buffers which could be used.

To resolve the issue rework rzg2l_cru_fill_hw_slot() so that it
iteratively fills all slots from the queue which currently do not
have a buffer assigned, until the queue is empty. The scratch
buffer is only resorted to in the event that the queue is empty and
the next slot that will be written to does not already have a buffer
assigned.

Signed-off-by: Daniel Scally <dan.scally+renesas@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Jacopo Mondi
1b0e65a1bd media: rz2gl-cru: Return pending buffers in order
Buffers are programmed into slots in queueing order.

When returning pending buffers we can't simply start from the first slot
but we should actually iterate slots starting from the one is use. The
rzg3e_cru_irq() handler already uses 'active_slot', make rzg2l_cru_irq()
use it as well to know where to start iterating from.

As the pattern of iterating over slots in order will be used for slots
programming in the next patches, provide an helper macro to do that.

While at it, rename return_unused_buffers() to rzg2l_cru_return_buffers().

Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00
Jacopo Mondi
f067b1c9c2 media: rzg2l-cru: Manually track active slot number
The CRU cycles over the hardware slots where the destination address for
the next frame has to be programmed.

The RZ/G2L version of the IP has a register that tells which is the
last used slot by the hardware but, unfortunately, such register is not
available on RZ/G3E and RZ/V2H(P).

The driver currently compares the value of the AMnMADRSL/H register
which report "the memory address which the current video data was
written to" and compares it with the address programmed in the slots.

This heuristic requires a bit of book keeping and proper locking. As the
driver handles the FrameEnd interrupt, it's way easier to keep track
of the slot that has been used by ourselves with a driver variable.

Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-19 09:01:49 +02:00