Pull media updates from Mauro Carvalho Chehab:

 - v4l2-core: added ISP statistics support and per-block validation

 - v4l2-core: Allow unknown HDR10 white point and luminance

 - New camera sensors: Sony IMX678 and IMX471m, Himax HM1092 IR sensor

 - New codec: Milos: VPU v2.0 codec support

 - isp driver: gained support for Dreamchip RPPX1 ISP framework

 - vsp1 driver: gained support for RZ/T2H and RZ/N2H

 - Novalake driver: gained CVS support for new NVL hardware

 - dvb-core: fix feed leak on failed DMX_ADD_PID

 - several driver fixes, cleanups and minor improvements

* tag 'media/v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (308 commits)
  media: ipu-bridge: check all DMI entries when overriding sensor rotation
  media: v4l2-async: avoid deleting unlinked ASC entry on link error
  media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement
  media: intel/ipu6: fix async notifier cleanup leak on parse error
  media: staging/ipu7: fix async notifier UAF on probe error path
  media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path
  media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()
  media: rcar-isp: Fix VSPX reference leaks
  media: rcar-isp: Release ISPCORE resources
  media: i2c: imx415: Release runtime PM reference on VBLANK error
  media: i2c: imx415: Return test pattern write errors
  media: renesas: vsp1: Declare index variables in for loop statement
  media: renesas: vsp1: Make reset control optional to support platforms without a reset line
  media: dt-bindings: media: renesas,vsp1: Document RZ/T2H and RZ/N2H SoCs
  media: dt-bindings: media: renesas,fcp: Document RZ/T2H and RZ/N2H SoCs
  media: nxp: imx8-isi: Add additional 32-bit RGB format support
  media: nxp: imx8-isi: Add 16-bit raw Bayer format support
  media: nxp: imx8-isi: Implement per-stream reference counting for multiplexed streams
  media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
  media: nxp: imx8-isi: Correct color map between V4L2 and ISI
  ...

Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>

When loading a rc keymap, rc_map_get() attempts to load the kernel module
using the keymap name.

The rc_map RC_MAP_VIDEOMATE_K100 is defined to "rc-videomate-k100"
but the module is called rc-videomate-m1f.ko, so therefore automagic
loading of the keymap will fail.

Rename the module to match.

Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Instead of using magic constants define an enum that that makes it
easier to keep .driver_data and the array of different types in sync.

While touching the pnp_device_id array simplify the list terminator and
use named initializers which better show which struct members are
actually assigned to.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Sean Young <sean@mess.org>

Explicitly assigning .driver_data in drivers that don't use this member
is silly and a bit irritating. Drop it. Also simplify the list
terminator entry to be just empty to match what most other device_id
tables do.

While touching these arrays convert them to use named initializers,
empty list terminators and no comma after the terminator.

There is no changed semantic, not even a change in the compiled result.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Sean Young <sean@mess.org>

After rc_register_device() succeeds, later probe failures must undo the
registration with rc_unregister_device(). The current error path jumps to
the allocation cleanup label and only calls rc_free_device(), leaving the
rc device registration and resources created by rc_register_device()
behind.

Add a registered-device unwind label for the IRQ lookup, IRQ request, and
hardware initialization failure paths. Keep rc_free_device() for failures
before rc_register_device() succeeds.

Fixes: b4e3e59fb59c ("[media] rc: add sunxi-ir driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>

Pull media updates from Mauro Carvalho Chehab:

 - v4l2:
     - core: fix subdev sensor ownership
     - subdev: Allow accessing routes with STREAMS client capability
     - ctrls: Add validation for HEVC active reference counts and
       background detection control
     - common: Add YUV24 format info and has_alpha helper

 - vb2: Change vb2_read() and vb2_write() return types to ssize_t

 - i2c: cvs: Add driver of Intel Computer Vision Sensing Controller(CVS)

 - atmel-isc: remove deprecated driver

 - cec: Add CEC Latency Indication Protocol (LIP) support

 - imon: Add iMON VFD HID OEM v1.2 key mappings

 - AVMatrix: new HWS capture driver

 - isp4: new AMD capture driver

 - qcom:
     - iris: Add hierarchical coding, B-frame, and Long-Term Reference
       support for encoder
     - camss: Add SM6350 platform support
     - venus: Add SM6115 platform support

 - chips-media: wave5: Add support for Packed YUV422, CBP profile, and
   background detection

 - csi2rx: Add multistream support and 32 dma chans

 - Several cleanups and fixes

* tag 'media/v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (394 commits)
  media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()
  media: qcom: iris: vdec: allow GEN2 decoding into 10bit format
  media: qcom: iris: vdec: update find_format to handle 8bit and 10bit formats
  media: qcom: iris: vdec: update size and stride calculations for 10bit formats
  media: qcom: iris: gen2: add support for 10bit decoding
  media: qcom: iris: add QC10C & P010 buffer size calculations
  media: qcom: iris: add helpers for 8bit and 10bit formats
  media: qcom: iris: Fix FPS calculation and VPP FW overhead
  media: qcom: camss: vfe-340: Support for PIX client
  media: qcom: camss: vfe-340: Proper client handling
  media: qcom: camss: csid-340: Enable PIX interface routing
  media: qcom: camss: csid-340: Add port-to-interface mapping
  media: qcom: camss: csid-340: Switch to generic CSID_CFG/CTRL registers
  media: iris: Initialize HFI ops after firmware load in core init
  media: iris: drop struct iris_fmt
  media: iris: Add platform data for X1P42100
  media: iris: Add hardware power on/off ops for X1P42100
  media: iris: optimize COMV buffer allocation for VPU3x and VPU4x
  media: iris: add FPS calculation and VPP FW overhead in frequency formula
  media: qcom: iris: Simplify COMV size calculation
  ...

Commit eac69475b01f ("media: rc: igorplugusb: heed coherency
rules") changed the control request storage from an embedded struct to
an allocated pointer so it can obey DMA coherency rules.

However, the driver still passes &ir->request to usb_fill_control_urb().
That points the URB setup packet at the pointer field itself rather than
at the allocated struct usb_ctrlrequest.

USB core then interprets pointer bytes as the setup packet. This can
produce an invalid bRequestType and trigger the control direction warning
reported by syzbot:

  usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0

Pass ir->request itself as the setup packet.

Fixes: eac69475b01f ("media: rc: igorplugusb: heed coherency rules")
Reported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=11f0e4f957c7c3bf3d51
Tested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5.5
Signed-off-by: Henri A <contact@henrialfonso.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Add Vol+/Vol-/Mute panel button mappings for iMON VFD HID OEM v1.2.
This version differs in the codes that generate the
KEY_VOLUMEUP, KEY_VOLUMEDOWN and KEY_MUTE events.

Signed-off-by: Alessandro Baldi <baldovic@virgilio.it>
Signed-off-by: Sean Young <sean@mess.org>

Use the common USB helpers for looking up bulk and interrupt endpoints
(and determining max packet size) instead of open coding.

Note that the device has two bulk endpoints so there is no functional
change here.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sean Young <sean@mess.org>