summaryrefslogtreecommitdiff
path: root/drivers/media
AgeCommit message (Collapse)Author
2026-04-27media: qcom: camss: avoid format string warningArnd Bergmann
clang-22 warns about csiphy_match_clock_name() taking a variable format string that is not checked against the 'int index' argument: drivers/media/platform/qcom/camss/camss-csiphy.c:566:44: error: diagnostic behavior may be improved by adding the 'format(printf, 2, 3)' attribute to the declaration of 'csiphy_match_clock_name' [-Werror,-Wmissing-format-attribute] 561 | static bool csiphy_match_clock_name(const char *clock_name, const char *format, | __attribute__((format(printf, 2, 3))) 562 | int index) 563 | { 564 | char name[16]; /* csiphyXXX_timer\0 */ 565 | 566 | snprintf(name, sizeof(name), format, index); | ^ drivers/media/platform/qcom/camss/camss-csiphy.c:561:13: note: 'csiphy_match_clock_name' declared here 561 | static bool csiphy_match_clock_name(const char *clock_name, const char *format, | ^ Change the function to use a snprintf() style format string that allows this to be checked at the call site. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: qcom: camss: Add missing clocks for VFE lite on sa8775pWenmeng Liu
Add missing required clocks (cpas_ahb and camnoc_axi) for VFE lite instances on sa8775p platform. These clocks are necessary for proper VFE lite operation: Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com> Fixes: e7b59e1d06fb ("media: qcom: camss: Add support for VFE 690") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: qcom: camss: Fix csid clock configuration for sa8775pWenmeng Liu
Fix the mismatch between clock list and clock rate table for CSID lite instances. The current implementation has 5 clocks defined but only 2 are actually needed (vfe_lite_csid and vfe_lite_cphy_rx), while the clock rate table doesn't match this configuration. Update both clock list and rate table to maintain consistency: - Remove unused clocks: cpas_vfe_lite, vfe_lite_ahb, vfe_lite - Update clock rate table to match the remaining two clocks Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: qcom: camss: Fix csid IRQ offset for sa8775pWenmeng Liu
Fix BUF_DONE_IRQ_STATUS_RDI_OFFSET calculation for csid lite on sa8775p platform. The offset should be 0 for csid lite on sa8775p, Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280Dmitry Baryshkov
Follow the commit bfe1326573ff ("venus: Fix for H265 decoding failure.") and increase H265D_MAX_SLICE following firmware requirements on that platform. Otherwise decoding of the H.265 streams fails with the "insufficient scratch_1 buffer size" from the firmware. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> [bod: Fixed commit log withthe => with the] Fixes: e1f5d32608ec ("media: iris: Add internal buffer calculation for HEVC and VP9 decoders") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: iris: fix use-after-free of fmt_src during MBPF checkVishnu Reddy
During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internals of a single instance, while the Macro Blocks Per Frame (MBPF) checker walks the core list under core->lock and reads fields like fmt_src->width and fmt_src->height. At the same time, iris_close() may free fmt_src and fmt_dst under inst->lock while the instance is still present in the core list. This allows a situation where the MBPF checker, still iterating through the core list, reaches an instance whose fmt_src was already freed by another thread and ends up dereferencing a dangling pointer, resulting in a use-after-free. This happens because the MBPF checker assumes that any instance in the core list is fully valid, but the freeing of fmt_src and fmt_dst without removing the instance from the core list is not correct. The correct ordering is to defer freeing fmt_src and fmt_dst until after the instance has been removed from the core list and all teardown under the core lock has completed, ensuring that no dangling pointers are ever exposed during MBPF checks. Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Fixes: 5ad964ad5656 ("media: iris: Initialize and deinitialize encoder instance structure") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: iris: switch to hardware mode after firmware bootVikash Garodia
Currently the driver switches the vcodec GDSC to hardware (HW) mode before firmware load and boot sequence. GDSC can be powered off, keeping in hw mode, thereby the vcodec registers programmed in TrustZone (TZ) carry default (reset) values. Move the transition to HW mode after firmware load and boot sequence. The bug was exposed with driver configuring different stream ids to different devices via iommu-map. With registers carrying reset values, VPU would not generate desired stream-id, thereby leading to SMMU fault. For vpu4, when GDSC is switched to HW mode, there is a need to perform the reset operation. Without reset, there are occasional issues of register corruption observed. Hence the vpu GDSC switch also involves the reset. Co-developed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com> Signed-off-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> [bod: occassional => occasional] Fixes: dde659d37036 ("media: iris: Introduce vpu ops for vpu4 with necessary hooks") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()Thomas Fourier
The core->iface_q_table_vaddr buffer is alloc'd with size queue_size but freed with sizeof(*q_tbl_hdr) which is different. Change the dma_free_attrs() size. Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: iris: Fix use-after-free in iris_release_internal_buffers()Dikshita Agarwal
The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session_release_buf() may free the buffer. The caller, iris_release_internal_buffers(), continued to access `buffer` after the call, leading to a potential use-after-free. Fix this by setting BUF_ATTR_PENDING_RELEASE before calling session_release_buf(), and reverting the flag if the call fails. This ensures no dereference occurs after potential freeing. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com> Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: iris: fix QCOM_MDT_LOADER dependencyArnd Bergmann
When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_IRIS=y, the kernel fails to link: x86_64-linux-ld: drivers/media/platform/qcom/iris/iris_firmware.o: in function `iris_fw_load': iris_firmware.c:(.text+0xb0): undefined reference to `qcom_mdt_get_size' iris_firmware.c:(.text+0xfd): undefined reference to `qcom_mdt_load' The problem is the conditional 'select' statement. Change this to make the driver built-in here regardless of CONFIG_ARCH_QCOM. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-27media: venus: fix QCOM_MDT_LOADER dependencyArnd Bergmann
When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_VENUS=y, the kernel fails to link: x86_64-linux-ld: drivers/media/platform/qcom/venus/firmware.o: in function `venus_boot': firmware.c:(.text+0x1e3): undefined reference to `qcom_mdt_get_size' firmware.c:(.text+0x25a): undefined reference to `qcom_mdt_load' firmware.c:(.text+0x272): undefined reference to `qcom_mdt_load_no_init' The problem is the conditional 'select' statement. Change this to make the driver built-in here regardless of CONFIG_ARCH_QCOM, same as for the similar IRIS driver. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Fixes: 0399b696f7f4 ("media: venus: fix compile-test build on non-qcom ARM platform") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-04-17Merge tag 'rpmsg-v7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: "Mark 'data' argument in rpmsg_send() const, and perculate to related drivers. Replace deprecated class_destroy() with class_unregister()" * tag 'rpmsg-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: media: platform: mtk-mdp3: Constify buffer passed to mdp_vpu_sendmsg() ASoC: qcom: Constify GPR packet being send over GPR interface rpmsg: Constify buffer passed to send API remoteproc: mtk_scp: Constify buffer passed to scp_send_ipi() remoteproc: mtk_scp_ipi: Constify buffer passed to scp_ipi_send() drivers: rpmsg: class_destroy() is deprecated
2026-04-15Merge tag 'media/v7.1-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - new CSI tegra support, covering Tegra20 and Tegra30 - new camera sensor drivers: T4ka3 and ov2732 - m88ds3103: add 3103c chip support - uvcvideo: add support for Intel RealSense D436/D555 and P010 pixel format - synopsys csi2rx: add i.MX93 support - imx8-isi: add i.MX95 support - imx8mq-mipi-csi2: add i.MX8ULP support - dw100: add V4L2 requests support - support for DTV devices from Hauppauge got some improvements - media staging: dropped starfive-camss driver - media docs: document multi-committers model and improve maint profile - media core: - add v4l2_subdev_get_frame_desc_passthrough() helper - improve error handling in fwnode parsing - lots of driver fixes, cleanups and improvements * tag 'media/v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (251 commits) Revert "media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935" media: synopsys: csi2rx: add i.MX93 support media: dt-bindings: add NXP i.MX93 compatible string media: synopsys: csi2rx: Use enum and u32 array for register offsets media: synopsys: csi2rx: implement .get_frame_desc() callback media: synopsys: csi2rx: only check errors from devm_clk_bulk_get_all() media: synopsys: csi2rx: use devm_reset_control_get_optional_exclusive() media: i2c: imx283: add support for non-continuous MIPI clock mode media: i2c: ov08d10: add support for 24 MHz input clock media: i2c: ov08d10: add support for reset and power management media: i2c: ov08d10: add support for binding via device tree dt-bindings: media: i2c: document Omnivision OV08D10 CMOS image sensor media: i2c: ov08d10: add missing newline to prints media: i2c: ov08d10: fix some typos in comments media: i2c: ov08d10: remove duplicate register write media: i2c: ov08d10: fix image vertical start setting media: i2c: ov08d10: fix runtime PM handling in probe staging: media: ipu7: Update TODO media: Add t4ka3 camera sensor driver media: i2c: Add ov2732 image sensor driver ...
2026-04-06media: platform: mtk-mdp3: Constify buffer passed to mdp_vpu_sendmsg()Krzysztof Kozlowski
mdp_vpu_sendmsg() passes the buffer to scp_ipi_send(), which takes now pointer to const, so adjust this interface as well for increased code safety and code readability. Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260317-rpmsg-send-const-v3-5-4d7fd27f037f@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-03-26Revert "media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935"Bradford Love
This reverts commit bb2a3912549d3b5cef5ed27200402fe8f6fb0694. The USB ID 2040:8360 was reported as a new revision of Hauppauge HVR-935 and requested to be added to the cx231xx driver. The issue is current generation of Hauppauge 9x5 devices including 935, 955, and 975 have moved to em2828x usb bridge. Support for the em2828x usb bridge and USB ID's for the new devices has been submitted. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: synopsys: csi2rx: add i.MX93 supportFrank Li
The i.MX93 uses a newer version of the DW CSI-2 controller with a changed register layout and an integrated Image Pixel Interface (IPI), which converts the received CSI-2 packets from byte to pixel format and produces a pixel data bus containing vertical and horizontal synchronization information. The reset flow also differs, so add the .assert_reset(), .deassert_reset(), and .idi_enable() callbacks to support it. Reviewed-by: Michael Riesch <michael.riesch@collabora.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> [Sakari Ailus: include missing linux/bitfield.h.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: synopsys: csi2rx: Use enum and u32 array for register offsetsFrank Li
Use enum dw_mipi_csi2rx_regs_index together with a u32 array to describe register offsets. This allows supporting new IP versions with different register layouts in a structured way. Add rk3568_regs matching the previous macro definitions and pass it as driver data during probe. No functional change intended. Reviewed-by: Michael Riesch <michael.riesch@collabora.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: synopsys: csi2rx: implement .get_frame_desc() callbackFrank Li
Implement the .get_frame_desc() callback to fetch information from the remote endpoint. Signed-off-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Michael Riesch <michael.riesch@collabora.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: synopsys: csi2rx: only check errors from devm_clk_bulk_get_all()Frank Li
devm_clk_bulk_get_all() returns all clocks described in the DT, which are already validated by the binding. Do not need enforce an expected clock count. Only check for error returns (< 0) to support more SoCs. Reviewed-by: Michael Riesch <michael.riesch@collabora.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: synopsys: csi2rx: use devm_reset_control_get_optional_exclusive()Frank Li
The DW MIPI CSI-2 RX is used on different SoCs, not all of which provide a reset controller. Switch to devm_reset_control_get_optional_exclusive() to support such platforms. Reset presence and numbering are validated by the DT binding. Reviewed-by: Michael Riesch <michael.riesch@collabora.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: imx283: add support for non-continuous MIPI clock modeMatthias Fend
Add support for selecting between continuous and non-continuous MIPI clock mode. Previously, the CSI-2 non-continuous clock endpoint flag was ignored and the sensor was always configured for non-continuous clock mode. For existing device tree nodes that do not have this property enabled, this update will therefore change the actual clock mode. Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com> Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: ov08d10: add support for 24 MHz input clockMatthias Fend
The sensor supports an input clock in the range of 6 to 27 MHz. Currently, the driver only supports a 19.2 MHz clock. Extend the driver so that at least 24 MHz, which is a typical frequency for this sensor, can also be used. Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: ov08d10: add support for reset and power managementMatthias Fend
Add support for the required power supplies as well as the control of an optional sensor reset. Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: ov08d10: add support for binding via device treeMatthias Fend
The OV08D10 can be used also on embedded designs using device tree so allow the sensor to bind to a device tree node. Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: ov08d10: add missing newline to printsMatthias Fend
Add trailing \n to dev_* prints where missing. Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: ov08d10: fix some typos in commentsMatthias Fend
Fix some spelling errors in comments. Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: ov08d10: remove duplicate register writeMatthias Fend
Register P1:0x33 is written twice with the same value in the 'lane_2_mode_1632x1224' sequence. Remove one unnecessary write access. Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: ov08d10: fix image vertical start settingMatthias Fend
The current settings for the "image vertical start" register appear to be incorrect. While this only results in an incorrect start line for native modes, this faulty setting causes actual problems in binning mode. At least on an i.MX8MP test system, only corrupted frames could be received. To correct this, the recommended settings from the reference register sets are used for all modes. Since this shifts the start by one line, the Bayer pattern also changes, which has also been corrected. Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: ov08d10: fix runtime PM handling in probeMatthias Fend
Set the device's runtime PM status and enable runtime PM before registering the async sub-device. This is needed to avoid the case where the device is runtime PM resumed while runtime PM has not been enabled yet. Remove the related, non-driver-specific comment while at it. Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver") Cc: stable@vger.kernel.org Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Matthias Fend <matthias.fend@emfend.at> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: ccs: Avoid deadlock in ccs_init_state()Sakari Ailus
The sub-device state lock has been already acquired when ccs_init_state() is called. Do not try to acquire it again. Reported-by: David Heidelberg <david@ixit.cz> Fixes: a88883d1209c ("media: ccs: Rely on sub-device state locking") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: uvcvideo: Fix bug in error path of uvc_alloc_urb_buffersRicardo Ribalda
Recent cleanup introduced a bug in the error path of uvc_alloc_urb_buffers(). If there is not enough memory for the allocation the following error will be triggered: [ 739.196672] UBSAN: shift-out-of-bounds in mm/page_alloc.c:1403:22 [ 739.196710] shift exponent 52 is too large for 32-bit type 'int' Resulting in: [ 740.464422] BUG: unable to handle page fault for address: fffffac1c0800000 The reason for the bug is that usb_free_noncoherent is called with an invalid size (0) instead of the actual size of the urb. This patch takes care of that. Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Closes: https://lore.kernel.org/linux-media/abycbXzYupZpGkvR@hyeyoo/T/#t Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Fixes: c824345288d1 ("media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer") Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: https://patch.msgid.link/20260320-uvc-urb-free-error-v1-1-b12cc3762a19@chromium.org Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: Add t4ka3 camera sensor driverKate Hsuan
Add the t4ka3 driver from: https://github.com/kitakar5525/surface3-atomisp-cameras.git With many cleanups / changes (almost a full rewrite) to make it suitable for upstream: * Remove the VCM and VCM-OTP support, the mainline kernel models VCMs and calibration data eeproms as separate v4l2-subdev-s. * Remove the integration-factor t4ka3_get_intg_factor() support and IOCTL, this provided info to userspace through an atomisp private IOCTL. * Turn atomisp specific exposure/gain IOCTL into standard v4l2 controls. * Use normal ACPI power-management in combination with runtime-pm support instead of atomisp specific GMIN power-management code. * Turn into a standard V4L2 sensor driver using v4l2_async_register_subdev_sensor(). * Add vblank, hblank, and link-freq controls; drop get_frame_interval(). * Use CCI register helpers. * Calculate values for modes instead of using fixed register-value lists, allowing arbritrary modes. * Add get_selection() and set_selection() support * Add a CSI2 bus configuration check This was tested on a Xiaomi Mipad2 tablet which has a T4KA3 sensor with DW9761 VCM as back sensor. Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Co-developed-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Kate Hsuan <hpa@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-26media: i2c: Add ov2732 image sensor driverWalter Werner Schneider
Add a V4L2 subdevice driver for the Omnivision OV2732 sensor. The OV2732 is a 1/4" color CMOS 1080p (1920x1080) HD image sensor with programmable controls like: gain, exposure, frame rate, image and windowing size, horizontal mirror, vertical flip, cropping. Signed-off-by: Walter Werner Schneider <contact@schnwalter.eu> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> [Sakari Ailus: Squashed Walter's fixup.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: i2c: ov5675: Wait for endpointAntti Laakso
Defer probe if endpoint is not yet available. And do it before acquiring clock, gpio and regulators. Signed-off-by: Antti Laakso <antti.laakso@linux.intel.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: cx23885: Module option to disable analog videoBradford Love
Initialized and left to themselves some boards with analog inputs, on some modern platforms can throw critical errors which prevents even digital from working thereafter. If analog is never used this module parameter allows analog to be disabled on a card by card basis. It is already possible to disable analog audio. For example, to disable for Hauppauge QuadHD with analog functionality: options cx23885 disable_analog_video=56,57 can be placed insode of /etc/modprobe.d/cx23885.conf Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: vidtv: Use crc32_be() instead of open codingEric Biggers
dvb_crc32() does exactly the same computation as the crc32_be() library function. Just call crc32_be() instead. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Acked-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: em28xx: Add Hauppauge 461e v3Bradford Love
Same as 461v2, but uses Montage ds3103c instead of ds3103b Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: m88ds3103: Implement 3103c chip supportBradford Love
Hauppauge 416e products have moved to using the 3103C satellite demod. This demod behaves mostly like a 3103b, but has different initialization, clocking, and lock operations. This Linux code was reverse egineered entirely using a Windows reference driver. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> [hverkuil: fix a few minor checkpatch issues] [hverkuil: fixed two minor sparse issues]
2026-03-25media: em28xx: Add Hauppauge em2828X based 9x5 revisionsBradford Love
The Hauppauge HVR-935, HVR-955, and HVR-975 have moved from cx231xx bridge to em2828x bridge. The following USB device id's are new: 2040:0360 - HVR-935 ISOC transport 2040:8360 - HVR-935 Bulk transport 2040:0366 - HVR-955 ISOC transport 2040:8366 - HVR-955 Bulk transport 2040:036a - HVR-975 ISOC transport 2040:836a - HVR-975 Bulk transport The devices all now utilize si2177 tuner. Capabilities are: - Digital TV - Composite video input - S-Video input - Analog stereo input HVR-935 has DVB-C/T/T2 demod (si2168). HVR-955 has ATSC/QAM demod (lgdt3306a). HVR-975 has both ATSC/QAM and DVB-C/T/T2 demods. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> [hverkuil: a few minor checkpatch fixes]
2026-03-25media: si2157: Include support for si2177 chipBradford Love
The si2177 is very closely related to si2157, with slight differences when doing analog operations. Digital is left as is, but analog needs to be configured specially because the signal is internally demodulated and CVBS video is output directly from the tuner. Verified locked and working with all supported standards. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: em28xx: driver supports two frontends, but not i2c clientsBradford Love
Fix em28xx driver to accommodate a device with two i2c client demods. The em28xx driver already had a multi frontend aware device struct, with two fe, just not two i2c client demods. Since Hauppauge HVR975 has transitioned from cx231xx to em2828X, this is required for full functionality of the devices. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: au0828: Fix green screen in analogBradford Love
When the driver was converted to VB2 the original function to fix green frame detection was removed and a default vb2 dqbuf function was used instead. This vb2 dqbuf function leads to green frames not being detected and correupting stream captures. The vidioc_dqbuf function checks the greenscreen flag, and, if set resets the stream to discard the green frame and decode a real frame. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: em28xx: Add Hauppauge USB Live2Bradford Love
New revision of Hauppauge USB Live2 switches from cx231xx usb bridge to Empia em2828X bridge. Inputs for the USB Live2 remain the same: - Composite video - S-Video - Analog stereo audio Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: em28xx: Add support for Empia em2828X bridgeBradford Love
The empia em2828X usb bridge contains previous functionality, but also contains an embedded video decoder. The implemented capabilities include composite and s-video inputs, as well as analog TV. Analog TV is expected in CVBS format, it must be demodulated already. Media controller decoder entity is included so pipeline verification passes and graph is properly constructed. Analog TV bits based off cx231xx driver. Signed-off-by: Bradford Love <brad@nextdimension.cc> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> [hverkuil: fix a few minor checkpatch issues]
2026-03-25media: renesas: vsp1: Initialize format on all padsLaurent Pinchart
The state initialization function vsp1_entity_init_state() incorrectly leaves the last entity pad out when initializing formats due to an off by one error. Fix it. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-14-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: Implement control eventsLaurent Pinchart
The V4L2 API requires drivers that expose controls to implement control notification events. This is enforced by v4l2-compliance. Add event handling to the VSP1 entities that create controls to fix the compliance failures. Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com> Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-13-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: histo: Fix format settingLaurent Pinchart
The histogram .set_fmt() handler suffers from two problems: - When operating on the source pad, it returns correct information to userspace, but does not store the format in the subdev state. Subsequent calls to .get_fmt(), handled by the vsp1_subdev_get_pad_format() helper, will not return the correct information. - When operating on the sink pad, it uses the vsp1_subdev_set_pad_format(), which propagates the sink format to the source, incorrectly overwriting the fixed source format. The first issue could be fixed by implementing the set format operation with vsp1_subdev_get_pad_format() on the source pad, if it wasn't that .set_fmt() is also used to initialize the subdev state in vsp1_entity_init_state(). The histogram would need a custom .init_state() handler. As the second issue would anyway overwrite the format, and therefore requires a custom .set_fmt() implementation, fix both issues without using the helpers. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-12-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: histo: Fix size enumerationLaurent Pinchart
The histogram supports size enumeration on the sink pad only, as the source pad outputs a metadata format. The correct error code when enumeration is not supported is -ENOTTY, not -EINVAL. Fix it. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-11-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: histo: Fix code enumerationLaurent Pinchart
The histogram media bus code enumeration does not check the index when operating on the source pad, resulting in an infinite loop if userspace keeps enumerating code without any loop boundary. Fix it by returning an error for indices larger than 0 as the pad supports a single format. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-10-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-25media: renesas: vsp1: hsit: Fix size enumerationLaurent Pinchart
The HSIT entity performs format conversion, which leads to incorrect results with the vsp1_subdev_enum_frame_size() helper. Implement a custom .enum_frame_size() handler that correctly validates the media bus code. Size validation is identical to the helper. Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> # HiHope RZ/G2M Link: https://patch.msgid.link/20260318235907.831556-9-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>