| Age | Commit message (Collapse) | Author |
|---|
|
Complete IPU8 ISYS enablement: add the IPU8 NDE control register, TSC
sync variant, TLBID_HASH bits and ISYS MMU hardware table. Add
IS_IPU8() alongside the existing IS_IPU7() check at each site in
ipu6.c, ipu6-buttress.c, ipu6-isys.c, ipu6-isys-csi2.c, ipu6-cpd.c and
ipu6-mmu.c that needs to follow the IPU7-family codepath, keeping the
two checks independent instead of widening IS_IPU7() to also match
IPU8. Without this IPU8 firmware boot fails with
IA_GOFO_FW_BOOT_STATE_CRIT_UNSPECIFIED (0xdead0001), confirmed on real
hardware. PSYS-specific pieces are intentionally left out here.
Signed-off-by: Divyamani Tripathi <divyamani.tripathi@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
IPU8's GPREG stride is 0x2000, not IPU7's hardcoded 0x1000. Add
csi2.gpreg_stride and use it in the two gpreg accessors instead of the
fixed value, wiring it up for both IPU7 and IPU8 in
ipu6_internal_pdata_init().
Signed-off-by: Divyamani Tripathi <divyamani.tripathi@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
Firmware ABI 1.0.14 diverges from IPU7's InSys message layout (uPipe
config, CFA dimension, binning factor, wider output cropping) and
expects boot-message major version 2 instead of IPU7's 1; without the
version fix the IPU8 firmware rejects the boot handshake with
IA_GOFO_FW_BOOT_STATE_CRIT_MSG_VERSION (0xdead0301), confirmed on real
hardware.
Add the IPU8 layout as additional '_ipu8' structs and convert to it at
send time when running on IPU8, keeping the existing IPU7 layout as
the shared driver-internal representation used by the common isys
queue/video code.
Signed-off-by: Divyamani Tripathi <divyamani.tripathi@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
Add IPU_VERSION_8 and an IS_IPU8() accessor mirroring
IS_IPU7()/IS_IPU7P5(), plus the IPU8 firmware/model name defines, as
the baseline for the rest of this series.
Signed-off-by: Divyamani Tripathi <divyamani.tripathi@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
Drop the retired IPU_INSYS_RESP_TYPE_PWM_IRQ response type and add the
mipi_fn field the firmware now reports in its place, matching staging
ipu7's ABI bump. The boot-ABI and psys message changes from that
commit don't apply here: this driver has no equivalents to touch.
Signed-off-by: Divyamani Tripathi <divyamani.tripathi@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
A PIN_DATA_READY response for an unconfigured pin dereferences a NULL
output_pins_queue entry in interrupt context. Check the queue like the
ipu6 path does.
Fixes: f268203d74ff ("media: ipu6: Add ipu7 isr handler")
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
ipu6_isys_fwcom_cfg_init() runs on every first stream start and allocates
the firmware config and queue configs with devm, so each STREAMON/STREAMOFF
cycle leaks them. They are only needed until ipu6_fw_com_prepare() has
copied them, so free them right after. Also check the return value, an
allocation failure would otherwise make ipu6_fw_com_prepare() dereference
a NULL queue config.
Fixes: f625e8d7ffc1 ("media: intel/ipu6: input system ABI between firmware and driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
ipu7_fw_isys_init() runs on every first stream start, but allocates the
firmware context and queue configs with devm and never frees them, so
each STREAMON/STREAMOFF cycle leaks them. Use kzalloc and free them in
ipu7_fw_isys_cleanup().
Fixes: 9ab793dbc176 ("media: ipu6: Add ipu7 fw isys ops")
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
The ISYS needs a reset when the active buffer list isn't empty. Warn about
this.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Antti Laakso <antti.laakso@linux.intel.com>
|
|
The need_reset field in struct ipu6_isys tells whether the device needs a
power-on reset. Resetting the field was removed unintentionally in commit
70e3fac3ec78 ("media: ipu6: Move firmware init/cleanup to RPM callbacks").
Add it back.
Fixes: 70e3fac3ec78 ("media: ipu6: Move firmware init/cleanup to RPM callbacks")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Antti Laakso <antti.laakso@linux.intel.com>
|
|
dm-writecache doesn't work in pmem mode - mkfs.ext4 and the following
fsck.ext4 fail with data corruption reported.
The commit 7dd76d1feec7 ("dm: improve bio splitting and associated IO
accounting") introduced a latent bug in dm_accept_partial_bio - it set
tio->io->sectors = n_sectors;. This is incorrect, according to the
diagram in the source code at dm_accept_partial_bio, it should be the
size of regions 1+2, not the region 2 alone.
The latent bug become real bug with the commit 8b211aaccb91 ("dm: add two
stage requeue mechanism").
dm-writecache in pmem mode is the only target that actually advances bio
with bio_advance and then calls dm_accept_partial_bio (so, the region 1
is non-empty). All the other targets call dm_accept_partial_bio with
region 1 empty, so bug went unnoticed for so long.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Fixes: 8b211aaccb91 ("dm: add two stage requeue mechanism")
|
|
The Microsoft Surface Pro 11 for Business (Intel) mounts this sensor
upside down, as commit b238116ccd4b ("media: ipu-bridge: Add upside-down
quirk for Surface Pro 11") records, and the driver has no flip controls
to compensate.
Add V4L2_CID_HFLIP and V4L2_CID_VFLIP on bits 3 and 4 of register 0x3820.
The mirror bit is active low, as in Intel's out-of-tree ov13858 driver.
The Bayer order does not change with either flip, so the controls do not
set V4L2_CTRL_FLAG_MODIFY_LAYOUT. They are clustered, and grabbed while
streaming.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Sergey Lebedev <lsa.uz@pm.me>
Tested-by: German Pablo Lindo <germanpapulindez@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
Currently there is no way for applications to query the available frame
sizes, so implement `VIDIOC_ENUM_FRMSIZES` based on what is allowed in
`rvin_format_align()`.
Signed-off-by: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
`risp_io_{input,capture}_enum_framesizes()` sets the horizonal and vertical
step size to 2. However, `risp_io_{input,capture}_try_format()` passes 2
to `v4l_bound_align_image()`, which corresponds to a step size of 2^2 = 4.
So move these constants into macros to avoid the repetition, and with that,
use 4 as the step size everywhere.
Fixes: 2151350f60d1 ("media: rcar-isp: Add support for ISPCORE")
Signed-off-by: Barnabás Pőcze <barnabas.pocze+renesas@ideasonboard.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
Originally a chip id check in the driver's probe function is done for
any OmniVision "ov02" sensors, but is too wide, since there are at least
"ov02a", "ov02b", "ov02c", "ov02e", "ov02g", "ov02k" and likely even
more families of sensors with similar names, thus the check for id shall
be more specific and match "ov02c" exclusively and expectedly.
Signed-off-by: Vladimir Zapolskiy <vz@kernel.org>
Reviewed-by: Tarang Raval <tarang.raval@siliconsignals.io>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
The OmniVision OG0VA1B is a monochrome image sensor closely related to
the OG0VE1B. It shares the SCCB control interface, power supplies and
the single-lane MIPI D-PHY description, and differs in its chip id, the
test pattern register, the register programming and the output format
(10-bit RAW instead of 8-bit).
Add an og0ve1b_sensor_data entry describing the OG0VA1B together with
its 640x480 60fps register sequence.
The control registers (mode select, software reset, exposure, analogue
gain, vertical timing and the test pattern enable bit) are identical on
both parts, so give them a common OG0V_ prefix. Registers that differ
between the two sensors keep their part-specific prefix.
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Tested-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org> # og0ve1b
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
Refactor the driver to separate sensor-specific data from the common
driver code. Introduce a sensor_data structure, populated through
i2c_get_match_data(), to hold the chip ID, MCLK frequency, link
frequencies and supported modes.
Test pattern programming is described by a per-sensor callback, and each
mode stores its media bus format code (rather than a bits-per-pixel
value) so that sensors with a different output format can be supported.
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Tested-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
Add a driver for the Omnivision ov05c10 camera sensor. This driver
implements a single mode only.
Signed-off-by: Hao Yao <hao.yao@intel.com>
Co-developed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Tested-by: Antti Laakso <antti.laakso@linux.intel.com>
Reviewed-by: Antti Laakso <antti.laakso@linux.intel.com>
|
|
Add a V4L2 sub-device driver for the Samsung S5KJN5, a 50 MP 10-bit
RAW MIPI CSI-2 image sensor. The driver supports the 4096x3072 mode and
exposes the standard controls (exposure, gain, vblank/hblank, test
pattern).
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
|
|
Commit de626073dfcb ("media: em28xx: drop 'users' field") replaced the
vb2_fop_release() call in em28xx_v4l2_close() with
_vb2_fop_release(filp, NULL) under dev->lock. vb2_fop_release() took
the vb2 queue lock, but the new call takes no lock at all.
The video and VBI queues have their own locks (vb_queue_lock and
vb_vbi_queue_lock), and v4l2_ioctl_get_lock() serializes the queue
ioctls with those rather than dev->lock. The queue can therefore be
released on close while another file handle is in the middle of
VIDIOC_REQBUFS. __vb2_queue_alloc() adds each buffer to the queue before
allocating its planes, so the release can find an MMAP buffer whose
mem_priv is still NULL and hand it to vb2_vmalloc_put():
BUG: kernel NULL pointer dereference, address: 0000000000000020
RIP: 0010:vb2_vmalloc_put+0xe/0x50 [videobuf2_vmalloc]
Call Trace:
__vb2_queue_free+0x14e/0x350 [videobuf2_common]
vb2_core_queue_release+0x3b/0x80 [videobuf2_common]
_vb2_fop_release+0x44/0x70 [videobuf2_v4l2]
em28xx_v4l2_close+0x60/0x140 [em28xx_v4l]
v4l2_release+0x9d/0xf0 [videodev]
__fput+0xfd/0x280
This was hit with OBS on a MyGica iGrabber (card=105).
Pass the queue lock to _vb2_fop_release(). Taking it while holding
dev->lock matches the existing order in em28xx_v4l2_fini(), where
vb2_video_unregister_device() takes the queue lock under dev->lock.
Fixes: de626073dfcb ("media: em28xx: drop 'users' field")
Assisted-by: LLM
Signed-off-by: Christopher Snowhill <chris@kode54.net>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
Commit 8e53399c63c3 ("media: em28xx: Add support for Empia em2828X
bridge") changed the condition for setting V4L2_CAP_TUNER on the VBI
device from "dev->tuner_type != TUNER_ABSENT" to a check of the video
device's capabilities, but inverted it: the VBI node now advertises a
tuner only when the video node does not have one.
On boards without a tuner (e.g. the MyGica iGrabber, card=105) the VBI
device's device_caps therefore contain V4L2_CAP_TUNER, while the shared
vidioc_querycap() correctly omits it from cap->capabilities. This trips
the sanity check in v4l_querycap() whenever the VBI node is queried,
for example by udev's v4l_id on every hotplug:
WARNING: drivers/media/v4l2-core/v4l2-ioctl.c:1119 at v4l_querycap+0xff/0x110 [videodev]
(cap->capabilities & (vfd->device_caps | V4L2_CAP_DEVICE_CAPS)) != (vfd->device_caps | V4L2_CAP_DEVICE_CAPS)
It also leaves the tuner ioctls enabled on the VBI node of tuner-less
boards and disables them on boards that do have a tuner.
Restore the intended logic so the VBI device has V4L2_CAP_TUNER exactly
when the video device does.
Fixes: 8e53399c63c3 ("media: em28xx: Add support for Empia em2828X bridge")
Assisted-by: LLM
Signed-off-by: Christopher Snowhill <chris@kode54.net>
Cc: stable@vger.kernel.org
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
When allocation of usb_bufs->buf[i] fails, em28xx_alloc_urbs()
explicitly frees all items within usb_bufs->buf before calling
em28xx_uninit_usb_xfer(), which also frees these items, causing them to be
freed twice.
BUG: KASAN: double-free in usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96)
Free of addr ffff88802fd37c00 by task kworker/1:2/1182
Workqueue: events request_module_async
Call Trace:
kasan_report_invalid_free (mm/kasan/report.c:557)
check_slab_allocation (mm/kasan/common.c:235)
kfree (./include/linux/kasan.h:199 (discriminator 1) mm/slub.c:2693 (discriminator 1) mm/slub.c:6508 (discriminator 1) mm/slub.c:6801 (discriminator 1))
usb_free_urb.part.0 (drivers/usb/core/urb.c:25 ./include/linux/kref.h:65 drivers/usb/core/urb.c:96)
usb_free_urb (drivers/usb/core/urb.c:95)
em28xx_uninit_usb_xfer (drivers/media/usb/em28xx/em28xx-core.c:964)
em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1076)
em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Allocated by task 1182:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
__kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5414 mm/slub.c:5439)
em28xx_alloc_urbs (./include/linux/slab.h:995 ./include/linux/slab.h:1312 drivers/media/usb/em28xx/em28xx-core.c:1081)
em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Freed by task 1182:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
kasan_save_free_info (mm/kasan/generic.c:584)
__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
kfree (./include/linux/kasan.h:235 mm/slub.c:2748 mm/slub.c:6508 mm/slub.c:6801)
em28xx_alloc_urbs (drivers/media/usb/em28xx/em28xx-core.c:1084)
em28xx_dvb_init (drivers/media/usb/em28xx/em28xx-dvb.c:1734 drivers/media/usb/em28xx/em28xx-dvb.c:1698)
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
request_module_async (drivers/media/usb/em28xx/em28xx-cards.c:3685)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Remove the explicit cleanup loop and let em28xx_uninit_usb_xfer()
handle the cleanup.
Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
Cc: stable@vger.kernel.org
Reported-by: co+6a04efcebe0fc0ce@bugs.sh
Assisted-by: LLM
Signed-off-by: Kaho Jiang <kj2864@nyu.edu>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
fimc_lite_subdev_s_stream(on = 0) sets ST_FLITE_OFF outside of the
fimc->slock protected region, and only then stops the capture in the
hardware. flite_irq_handler() runs under fimc->slock and clears
ST_FLITE_OFF, so an interrupt can be handled in between: the handler finds
ST_FLITE_OFF already set, clears it and wakes up fimc->irq_queue before the
capture has actually been stopped. The wait_event_timeout() right after it
then returns immediately and the driver continues as if the capture had
stopped.
Set ST_FLITE_OFF in the same critical section that stops the capture, as
fimc_lite_stop_capture() already does.
Fixes: 6319d6a002be ("[media] fimc-lite: Add ISP FIFO output support")
Cc: stable@vger.kernel.org
Signed-off-by: Ginger Li <ginger.jzllee@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
cx231xx_dump_SC_reg() is compiled out with #if 0 and has no callers.
Remove the dead code.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Zain Aboobacker <zainaboobacker33@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
dump_registers() is compiled out with #if 0 and has no callers.
Remove the dead code.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Zain Aboobacker <zainaboobacker33@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
Get rid of bitmap_weight(), and use find_nth_bit() in the function,
instead of the for-loop.
Signed-off-by: Yury Norov <ynorov@nvidia.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
rtl2832u_tuner_attach() registers an rtl2832_sdr platform device, but
does not unregister it if no driver is bound. It also does not take a
reference on the bound driver module.
Unregister the platform device when no driver is bound or the module
reference cannot be acquired. Drop the module reference in
rtl28xxu_tuner_detach() before unregistering the device.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fixes: a2f7f220df5e ("[media] rtl28xxu: switch SDR module to platform driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
Non-interlaced 60 Hz sources, such as the 240p output of classic game
consoles, produce 262 lines per field with no half-line offset, so every
field has the same parity. The TVP5150 tracks such a signal without
trouble (locked, 60 Hz, vertical line count 524 instead of 525) but
reports the same field ID for every field, and the em2860 forwards that
in its field-start header. On an EM2860/TVP5150 reference design
(eb1a:5051) fed by a NES, 112 of 113 consecutive headers in a 6 s stream
carry field ID 1 (bottom); the lone top-field header is the first one.
finish_field_prepare_next() only completes a buffer and starts the next
one when a top field arrives, so with such a source no frame is ever
delivered: streaming starts, the first buffer never finishes, and the
application sits in select() until it times out. Disturbing the cable
briefly loses sync, yields a stray top-field header and lets a single
frame through -- the "one frame, then it freezes" symptom.
Track the previous field ID. When a header repeats the ID of the field
before it, give the new field the opposite parity instead of taking the
ID literally, so consecutive fields are woven into a frame the same way
a genuine top/bottom pair is. Interlaced streams alternate IDs and are
unaffected. A dropped field in one now lands two bottom fields in the
same buffer, which the copy path already tolerates, and the following
top field starts a new frame as before.
With this the NES streams at 29.9 fps with a stable, correctly woven
picture. Each frame holds two consecutive progressive source frames, so
an application that wants the source's 60 fps back can bob-deinterlace.
Signed-off-by: David Wood <d01.devel@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
The StarTech.com SVID2USB23 is an EM2860 + TVP5150AM1 + EMP202 capture
dongle that ships with the generic eb1a:5051 USB ID, so it is picked up
as the EM2860/TVP5150 reference design. Video works, but analog audio
capture is silent: the ALSA device yields a flat noise floor of about
-85 dBFS whether or not anything is connected.
Audio on this board is not on the em28xx vendor path. Chip config
register 0x00 reads 0x50, so the board exposes a USB Audio Class
interface, claimed by snd-usb-audio, that is fed by the EMP202 ADC.
The ADC record source is selected by AC97_REC_SEL, which
em28xx_audio_analog_set() only programs when EM28XX_AOUT_PCM_IN is set
in the input's .aout. With .amux alone only the mixer volume registers
are written, and the record source stays at its reset value (Mic, not
wired on this board), so the ADC captures nothing.
Add a board entry for the SVID2USB23 with .aout selecting the PCM
record path from Line In, and identify the board by its EEPROM hash,
leaving the reference design entry untouched. Boards with this USB ID
that do not match a hash keep the reference design as before, without
any extra log output. card=114 also selects the entry by hand.
Verified on the SVID2USB23: the board is identified as card=114 and the
driver programs AC97_REC_SEL to 0x0404 on its own at probe. Toggling
that register alone with everything else held constant is what
separates working (-22 dBFS, line level) from silent (-85 dBFS)
capture. AC97_POWERDOWN reads 0x420d (ADC, analog and reference all
ready) throughout, so this is not a power or GPIO problem.
The V4L2 mute control still defaults to 1 and gates the bridge audio
path, so clearing it remains necessary to hear anything; that is a
separate issue.
Signed-off-by: David Wood <d01.devel@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
class_dev_create() stores a reference to the USB device obtained with
get_device() in class_dev->parent, which class_dev_destroy() releases.
When device_register() fails the function only drops class_dev, so the
reference to the USB parent device is never released.
Drop the parent reference on the failure path as well.
Fixes: 28c4a5e6d324 ("V4L/DVB: pvrusb2: Fix USB parent device reference count")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
tw686x_video_init() registers the V4L2 device, which initializes its
reference count. Successfully registered video devices take additional
references to the V4L2 device as well.
The probe failure paths currently tear down the PCI resources and then
free the channel arrays and the tw686x device directly. This bypasses
the V4L2 device reference count and the tw686x_dev_release() callback.
If a video device still holds a reference, its eventual release will
drop a reference to the already freed V4L2 device. Even when no extra
references remain, directly freeing the device bypasses the lifetime
management established by v4l2_device_register().
After cleaning up the PCI resources, check whether the V4L2 device was
registered. If so, mark the hardware unavailable and drop the driver's
V4L2 device reference, letting tw686x_dev_release() free the backing
objects when the final reference is released. Keep the existing direct
free path for failures that occur before V4L2 device registration.
This issue was found by manual code inspection.
Fixes: 704a84ccdbf1 ("[media] media: Support Intersil/Techwell TW686x-based video capture cards")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
em28xx_audio_urb_init() divides by the audio endpoint's wMaxPacketSize
without checking it, so a USB device that declares a zero-sized audio
endpoint divides by zero at probe time.
Reject a zero-sized audio endpoint like a missing one; the caller already
unwinds on a negative return.
Oops: divide error: 0000 [#1] SMP NOPTI
Workqueue: usb_hub_wq hub_event
RIP: 0010:em28xx_audio_init (drivers/media/usb/em28xx/em28xx-audio.c:718)
Call Trace:
em28xx_init_extension (drivers/media/usb/em28xx/em28xx-core.c:1248)
em28xx_init_dev.isra.0 (drivers/media/usb/em28xx/em28xx-cards.c:3887)
em28xx_usb_probe (drivers/media/usb/em28xx/em28xx-cards.c:4258)
usb_probe_interface (drivers/usb/core/driver.c:396)
...
usb_set_configuration (drivers/usb/core/message.c:2268)
usb_generic_driver_probe (drivers/usb/core/generic.c:250)
usb_probe_device (drivers/usb/core/driver.c:291)
...
usb_new_device (drivers/usb/core/hub.c:2703)
hub_event (drivers/usb/core/hub.c:5961)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Kernel panic - not syncing: Fatal exception
Fixes: 1b3fd2d34266 ("[media] em28xx-audio: don't hardcode audio URB calculus")
Cc: stable@vger.kernel.org
Reported-by: co+9782320f78c23f40@bugs.sh
Closes: https://lore.kernel.org/all/51lCz4R7QyTUKbh4mhXNaNzX0evpk0siOzbh%40bugs.sh/
Assisted-by: Claude:claude-opus-5
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
Adjust em28xx_v4l2_init() to setup video and VBI capture queues
before calling video_register_device(), thus making error cleanup
work as expected.
Reported-by: syzbot+dd0f06181ab66b93dc00@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dd0f06181ab66b93dc00
Suggested-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
V4L2_TUNER_ADC is the deprecated alias of V4L2_TUNER_SDR.
Use V4L2_TUNER_SDR directly throughout the driver.
no change of function.
Signed-off-by: Syed Ali <syedalia1000@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
tegra20_channel_host1x_syncpt_init() requests two host1x syncpoints. It
stored the first one (mw ack) into chan->mw_ack_sp[0] and only then
requested the second one (frame start). If the second request failed the
function returned without releasing the first syncpoint, leaking it: the
caller tegra_channel_init() bails out with a bare "return ret" on a
syncpt init failure and does not run its free_syncpts error path (that
path only covers failures after syncpoint init has fully succeeded), and
the channel is subsequently torn down via the kfree()-only path, so
nothing ever releases the orphaned syncpoint.
Release the already-acquired syncpoint on the error path, and only
publish the syncpoints into the channel once both have been successfully
requested, so chan->mw_ack_sp[0] never holds a released handle. This
matches the handling in tegra210_channel_host1x_syncpt_init().
Fixes: 0e2c4117c351 ("staging: media: tegra-video: add CSI support for Tegra20 and Tegra30")
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Reviewed-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
|
|
Add support for the RZ/G3L LVDS encoder driver. It operates in single-link
mode with 4 lanes (Data) + 1 lane (Clock) and supports pixel clock rates
from 25 to 87 MHz. The LVDS module cannot be used at the same time as
MIPI-DSI. However, LVDS and the DSI interface share a peripheral clock and
the MIPI_DSI_PRESET_N reset signal. Also, the MIPI_DSI_CMN_RSTB and
MIPI_DSI_ARESET_N reset signals must be asserted before using the LVDS
module.
Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20261001094041.135697-8-biju.das.jz@bp.renesas.com
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
|
|
Add Display Unit support for the Renesas RZ/G3L SoC (R9A08G046). It is
similar to the one found on RZ/G2L, but has LVDS support.
Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20261001094041.135697-7-biju.das.jz@bp.renesas.com
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
|
|
Add support for the MIPI DSI controller found on the Renesas RZ/G3L
(R9A08G046) SoC. The D-PHY global timing table of RZ/G3L SoC different
compared to the other SoCs. Introduce a dedicated D-PHY global timing
table rzg3l_mipi_dsi_global_timings and wire it up via a new
rzg3l_mipi_dsi_info hw_info variant for RZ/G3L SoC.
Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20261001094041.135697-6-biju.das.jz@bp.renesas.com
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
|
|
The register for controlling power to the DSI region is in the SYSC
(System Controller) block. Add support for controlling the DSI PWRRDY
signal so the driver can efficiently manage power to the DSI region.
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://patch.msgid.link/20261001094041.135697-5-biju.das.jz@bp.renesas.com
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
|
|
Move rzg2l_mipi_dsi_global_timings and its array size out of the hardcoded
ARRAY_SIZE reference in rzg2l_mipi_dsi_dphy_init() and into the struct
rzg2l_mipi_dsi_hw_info. This allows future hardware variants to supply
their own timing tables rather than sharing a single global array, making
the driver more extensible without code duplication.
Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20261001094041.135697-4-biju.das.jz@bp.renesas.com
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
|
|
Move the post-reset activation delay into the hw_info structure as
activation_dly, allowing SoC-specific values to be defined per
compatible. This prepares the driver for supporting SoCs that require a
different delay after reset deassertion.
Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20261001094041.135697-3-biju.das.jz@bp.renesas.com
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
|
|
Move the DSIDPHYCTRL0 initialization value into the hw_info structure as
dphyctrl0_init_val, allowing SoC-specific D-PHY control register
initialization to be defined per compatible. This prepares the driver for
supporting SoCs that require a different initial DSIDPHYCTRL0 value.
Reviewed-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20261001094041.135697-2-biju.das.jz@bp.renesas.com
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
|
|
Add trivial SYSCFG driver for ST STM32MP25xx, which binds drivers
to its subnodes. This is currently used to bind USB PHY drivers to
subnodes described in the SYSCFG DT node.
Signed-off-by: Marek Vasut <marex@nabladev.com>
Tested-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Acked-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Link: https://lore.kernel.org/r/20260902124018.606544-2-marex@nabladev.com
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
|
|
ifname_mon is assigned when the monitor interface is created and cleared
when it is deleted, but the value is never read.
Remove the unused field and its dead stores.
Signed-off-by: AmirHossein HajiMohammadi <info@hajimohammadi.net>
Link: https://patch.msgid.link/71228854-6533-486D-B930-BBFD2B51D2B1@hajimohammadi.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Rename function PHY_ConvertTxPowerLimitToPowerIndex() to
phy_tx_power_limit_to_index().
Signed-off-by: Leonardo Martins Martins <dev.lmmrtns@gmail.com>
Link: https://patch.msgid.link/20260926-rtl8723bs-tx-pwr-limit-v1-1-989dcbc113fd@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
xmitframe_swencrypt() always returns _SUCCESS, and none of its callers
use the return value.
Change the function to return void.
No functional change.
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Link: https://patch.msgid.link/20260926102736.2773-1-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Removed redundant outer parentheses around prframe->u.hdr.list in a call
to list_del_init()
Signed-off-by: Rishik Yechuri <rishik.yechuri.code@gmail.com>
Link: https://patch.msgid.link/20260925175627.227374-1-rishik.yechuri.code@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Make the I915_GTT_VIEW_* enumerators less i915 specific, and rename them
INTEL_GTT_VIEW_*.
$ sed -i 's/I915_GTT_VIEW_/INTEL_GTT_VIEW_/g' -- $(git grep -l I915_GTT_VIEW_)
Reviewed-by: Maarten Lankhorst <dev@lankhorst.se>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/6e66fd6b61e361ffde316e5399baf9432383ced5.1790780340.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
|
|
Prefer using the intel_gtt_view_is_*() helpers instead of comparing the
view type directly.
Reviewed-by: Maarten Lankhorst <dev@lankhorst.se>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/6d9279ce0522f6768f55fb6c760862fdb92ffc03.1790780340.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
|
|
Prefer using the intel_gtt_view_is_*() helpers instead of comparing the
view type directly.
v3: Use view, not vma->gtt_view even more (Ville)
v2: Use view, not vma->gtt_view at the end (Sashiko)
Reviewed-by: Maarten Lankhorst <dev@lankhorst.se>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/350f0be2c56ae4ac7b7bb97186f4d501faa7bb4e.1790780340.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
|
