35388 Commits

Author SHA1 Message Date
Jacopo Mondi
d260c12247 media: uapi: Add PiSP Compressed RAW Bayer formats
Add Raspberry Pi compressed RAW Bayer formats.

The compression algorithm description is provided by Nick Hollinghurst
<nick.hollinghurst@raspberrypi.com> from Raspberry Pi.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Naushir Patuck <naush@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-27 13:06:47 +02:00
Jacopo Mondi
8f6c220222 media: uapi: Add meta pixel format for PiSP BE config
Add format description for the PiSP Back End configuration parameter
buffer.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Naushir Patuck <naush@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-27 13:06:47 +02:00
Jacopo Mondi
d1741141d0 media: uapi: Add a pixel format for BGR48 and RGB48
Add BGR48 and RGB48 16-bit per component image formats.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Naushir Patuck <naush@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-27 13:06:47 +02:00
Hans Verkuil
23558d802a media: vivid: fix CREATE_BUFS support in queue_setup()
While queue_setup was correct for CREATE_BUFS support for
video devices, for VBI, SDR and touch devices it was wrong.

This was found after adding new v4l2-compliance tests.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 17:28:31 +02:00
Hans Verkuil
0fd7c0c2c1 media: vivid: fix wrong sizeimage value for mplane
In several places a division by fmt->vdownsampling[p] was
missing in the sizeimage[p] calculation, causing incorrect
behavior for multiplanar formats were some planes are smaller
than the first plane.

Found by new v4l2-compliance tests.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 17:28:31 +02:00
Laurent Pinchart
7603ac5a8a media: vimc: scaler: Use subdev active state
Store the active formats and crop rectangle in the subdevice active
state. This simplifies implementation of the format and selection
accessors, and allows using the v4l2_subdev_get_fmt() helper to
implement the .get_fmt() operation.

The active configuration that is used in the .process_frame() handler is
still stored in the vimc_scaler_device structure. The driver could
instead access the active state in the .process_frame() handler, but the
required locking could interfere with the real time constraints of the
frame processing. This data would be stored in registers in the
.s_stream() handler for real hardware, storing it in dedicated storage
thus mimics a real driver. To differentiate them from the rest of the
device private data, move the corresponding fields to a sub-structure of
vimc_scaler_device named hw.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 16:39:34 +02:00
Laurent Pinchart
4c46cb2a7f media: vimc: debayer: Use subdev active state
Store the active formats and crop rectangle in the subdevice active
state. This simplifies implementation of the format and selection
accessors, and allows using the v4l2_subdev_get_fmt() helper to
implement the .get_fmt() operation.

The active configuration that is used in the .process_frame() handler is
still stored in the vimc_debayer_device structure. The driver could
instead access the active state in the .process_frame() handler, but the
required locking could interfere with the real time constraints of the
frame processing. This data would be stored in registers in the
.s_stream() handler for real hardware, storing it in dedicated storage
thus mimics a real driver. To differentiate them from the rest of the
device private data, move the corresponding fields to a sub-structure of
vimc_debayer_device named hw.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 16:39:34 +02:00
Laurent Pinchart
cf2552d87a media: vimc: sensor: Use subdev active state
Store the active formats and crop rectangle in the subdevice active
state. This simplifies implementation of the format and selection
accessors, and allows using the v4l2_subdev_get_fmt() helper to
implement the .get_fmt() operation.

The active configuration that is used in the .process_frame() handler is
still stored in the vimc_sensor_device structure. The driver could
instead access the active state in the .process_frame() handler, but the
required locking could interfere with the real time constraints of the
frame processing. This data would be stored in registers in the
.s_stream() handler for real hardware, storing it in dedicated storage
thus mimics a real driver. To differentiate them from the rest of the
device private data, move the corresponding fields to a sub-structure of
vimc_sensor_device named hw.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 16:39:34 +02:00
Laurent Pinchart
b3f73b2188 media: vimc: Initialize subdev active state
Finalize subdev initialization for all subdevs that provide a
.init_state() operation. This creates an active state for all those
subdevs, which subsequent patches will use to simplify the
implementation of individual vimc entities.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 16:39:34 +02:00
Laurent Pinchart
556d821ade media: vimc: Centralize subdev internal_ops initialization
Initialize the subdev internal_ops field in the vimc_ent_sd_register()
function. This handles the internal ops the same way as the subdev ops,
and prepares for moving to the V4L2 subdev active state API.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 16:39:34 +02:00
Laurent Pinchart
0b3b27bb69 media: vimc: scaler: Rename vic_sca_pad enum to vimc_scaler_pad
The vic_sca_pad enum's name has been shortened to the extreme for no
good reason. Rename it to vimc_scaler_pad.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 16:39:34 +02:00
Laurent Pinchart
27d8f61ee9 media: vimc: Constify the ent_config array
The ent_config array contains data that is never modified. Make it
const.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 16:39:34 +02:00
Laurent Pinchart
73a4385c69 media: vimc: Constify vimc_ent_type structures
The vimc_ent_type structure contains static pointers to functions, and
no other information that need to be modified after initialization. Make
them const to avoid the risk of arbitrary code execution following an
overflow that would overwrite the structure's contents.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 16:39:34 +02:00
Laurent Pinchart
2ef9a1e722 media: vimc: Don't iterate over single pad
The .init_state() operations of the debayer and sensor entities iterate
over the entity's pads. In practice, the iteration covers a single pad
only. Access the pad directly and remove the loops.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 16:39:34 +02:00
Hans Verkuil
b6ee5ac184 Miscellaneous fixes for V4L2 core and drivers
-----BEGIN PGP SIGNATURE-----
 
 iJgEABYKAEAWIQTAnvhxs4J7QT+XHKnMPy2AAyfeZAUCZnuxuSIcbGF1cmVudC5w
 aW5jaGFydEBpZGVhc29uYm9hcmQuY29tAAoJEMw/LYADJ95kOsgBALC85dWDNQbF
 RMzcUrhmAOqGwDHUHUZTo/o/TJXPZw1rAQDRQuogVfIyDUHUXFMmI1qQR1UkwNXq
 IPFHdpebU01QBw==
 =ghfD
 -----END PGP SIGNATURE-----

Merge tag 'tags/next-media-20240626' of git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git

- fix typo in v4l2-subdev.h
- imx-pxp bug fix
- media i2c Kconfig: add missing FW_UPLOAD select

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 15:29:04 +02:00
Hans Verkuil
113ac3e239 - Conversion of max9286 and adv748x to V4L2 subdev active state
- Cleanups and fixes for the Renesas R-Car VSP and VIN drivers
 - Miscellaneous cleanups to V4L2 core
 -----BEGIN PGP SIGNATURE-----
 
 iJgEABYKAEAWIQTAnvhxs4J7QT+XHKnMPy2AAyfeZAUCZnNeLCIcbGF1cmVudC5w
 aW5jaGFydEBpZGVhc29uYm9hcmQuY29tAAoJEMw/LYADJ95kxyUBAKdQ86lXbVd1
 97wtbRDP3H3MTtEowjskDGqhfH0QA9kXAP9eTf7rJixORvXFg/DaLcjdWIyfIsjY
 4gz7aHO8MsXGBg==
 =BgVa
 -----END PGP SIGNATURE-----

Merge tag 'tags/next-media-renesas-20240619' of git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git

- Conversion of max9286 and adv748x to V4L2 subdev active state
- Cleanups and fixes for the Renesas R-Car VSP and VIN drivers
- Miscellaneous cleanups to V4L2 core

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-26 14:49:57 +02:00
Kory Maincent
fea074e978 media: i2c: Kconfig: Fix missing firmware upload config select
FW_LOADER config only selects the firmware loader API, but we also need
the sysfs_upload symbols for firmware_upload_unregister() and
firmware_upload_register() to function properly.

Fixes: 7a52ab415b43 ("media: i2c: Add driver for THine THP7312")
Cc: stable@vger.kernel.org
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Link: https://lore.kernel.org/r/20240620102544.1918105-1-kory.maincent@bootlin.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
2024-06-26 09:14:02 +03:00
Harshit Mogalapalli
57e9ce68ae media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
devm_regmap_init_mmio() can fail, add a check and bail out in case of
error.

Fixes: 4e5bd3fdbeb3 ("media: imx-pxp: convert to regmap")
Cc: stable@vger.kernel.org
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/20240514095038.3464191-1-harshit.m.mogalapalli@oracle.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
2024-06-26 09:14:02 +03:00
Zhi Mao
355f509726 media: i2c: Add GC05A2 image sensor driver
Add a V4L2 sub-device driver for Galaxycore GC05A2 image sensor.

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Zhi Mao <zhi.mao@mediatek.com>
[Sakari Ailus: Fold in MAINTAINERS change.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24 16:47:34 +02:00
Zhi Mao
1ad0cd5ed6 media: i2c: Add GC08A3 image sensor driver
Add a V4L2 sub-device driver for Galaxycore GC08A3 image sensor.

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Zhi Mao <zhi.mao@mediatek.com>
[Sakari Ailus: Fold in MAINTAINERS change.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24 16:47:34 +02:00
Hans Verkuil
b178aa6f33 media: b2c2: flexcop-usb: fix flexcop_usb_memory_req
smatch generated this warning:

drivers/media/usb/b2c2/flexcop-usb.c:199 flexcop_usb_memory_req() warn: iterator 'i' not incremented

and indeed the function is not using i or updating buf.

The reason this always worked is that this function is called to write just
6 bytes (a MAC address) to the USB device, and so in practice there is only
a single chunk written. If we ever would need to write more than one chunk,
this function would fail since each chunk would read from or write to the
same buf address.

Rewrite the function to properly handle this.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24 11:05:07 +02:00
Devarsh Thakkar
e1bda64a58 media: verisilicon : Use exported tables from v4l2-jpeg for hantro codec
Use v4l2-jpeg core API to import reference quantization and huffman tables
used for JPEG Encoding.

Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Acked-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24 11:05:07 +02:00
Devarsh Thakkar
ceb9a33bbd media: imagination: Use exported tables from v4l2-jpeg core
Use exported huffman and quantization tables from v4l2-jpeg core library.

Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24 11:05:07 +02:00
Devarsh Thakkar
b5bad839c0 media: v4l2-jpeg: Export reference quantization and huffman tables
Export reference quantization and huffman tables as provided in ITU-T.81 so
that they can be re-used by other JPEG drivers.

These are example tables provided in ITU-T.81 as reference tables and the
JPEG encoders are free to use either these or their own proprietary tables.

Also add necessary prefixes to be used for huffman tables in global header
file.

Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24 11:05:06 +02:00
Devarsh Thakkar
a1e2940458 media: imagination: Add E5010 JPEG Encoder driver
This adds support for stateful V4L2 M2M based driver for Imagination E5010
JPEG Encoder [1] which supports baseline encoding with two different
quantization tables and compression ratio as demanded.

Support for both contiguous and non-contiguous YUV420 and YUV422 semiplanar
formats is added along with alignment restrictions as required by the
hardware.

System and runtime PM hooks are added in the driver along with v4l2 crop
and selection API support.
Minimum resolution supported is 64x64 and
Maximum resolution supported is 8192x8192.

All v4l2-compliance tests are passing [2] :
v4l2-compliance -s -f -a  -d /dev/video0 -e /dev/video1

Total for e5010 device /dev/video0: 79, Succeeded: 79, Failed: 0,
Warnings: 0

NOTE: video1 here is VIVID test pattern generator

Also tests [3] were run manually to verify below driver features:
 - Runtime Power Management
 - Multi-instance JPEG Encoding
 - DMABUF import, export support
 - NV12, NV21, NV16, NV61 video format support
 - Compression quality S_CTRL
 - Cropping support using S_SELECTION

Existing V4L2 M2M based JPEG drivers namely s5p-jpeg, imx-jpeg and rcar_jpu
were referred while making this.

TODO:
Add MMU and memory tiling support

[1]:  AM62A TRM (Section 7.6 is for JPEG Encoder) :
Link: https://www.ti.com/lit/pdf/spruj16

[2]: v4l2-compliance test :
Link: https://gist.github.com/devarsht/1f039c631ca953a57f405cfce1b69e49

[3]: E5010 JPEG Encoder Manual tests :

Performance:
Link: https://gist.github.com/devarsht/c40672944fd71c9a53ab55adbfd9e28b

Functionality:
Link: https://gist.github.com/devarsht/8e88fcaabff016bb2bac83d89c9d23ce

Compression Quality:
Link: https://gist.github.com/devarsht/cbcc7cd97e8c48ba1486caa2b7884655

Multi Instance:
Link: https://gist.github.com/devarsht/22c2fca08cd3441fb40f2c7a4cebc95a

Crop support:
Link: https://gist.github.com/devarsht/de6f5142f678bb1a5338abfd9f814abd

Runtime PM:
Link: https://gist.github.com/devarsht/70cd95d4440ddc678489d93885ddd4dd

Co-developed-by: David Huang <d-huang@ti.com>
Signed-off-by: David Huang <d-huang@ti.com>
Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-24 11:05:06 +02:00
Ivan Bornyakov
6aa0829104 media: chips-media: wave5: support Wave515 decoder
Add initial support for the Wave515 multi-decoder IP. For now it is only
able to decode HEVC Main/Main10 profile videos into YUV420.

This was tested on FPGA prototype, so wave5_dt_ids[] was not expanded.
Users of the real hardware with Wave515 IP will have to
 * provide firmware specific to their SoC
 * add struct wave5_match_data like this:

	static const struct wave5_match_data platform_name_wave515_data = {
		.flags = WAVE5_IS_DEC,
		.fw_name = "cnm/wave515_platform_name_fw.bin",
		.sram_size = (71 * 1024),
	};

 * add item to wave5_dt_ids[] like this:

	{
		.compatible = "vendor,soc-wave515",
		.data = &platform_name_wave515_data,
	},

 * describe new compatible in
   Documentation/devicetree/bindings/media/cnm,wave521c.yaml

Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 10:15:21 +02:00
Ivan Bornyakov
a83d4a689e media: chips-media: wave5: drop "sram-size" DT property
Move the excessive "sram-size" device-tree property to the device match
data. Also change the SRAM memory allocation strategy, instead of
allocating exactly sram_size bytes, allocate all available SRAM memory
up to sram_size. Add the placeholders wave5_vpu_dec_validate_sec_axi()
and wave5_vpu_enc_validate_sec_axi() to validate that the allocated SRAM
memory is sufficient to decode/encode bitstream with a given resolution.

Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 10:15:21 +02:00
Ivan Bornyakov
749476d44d media: chips-media: wave5: separate irq setup routine
Implement a separate setup routine for interrupts to reduce code
duplication. Also enable interrupts based on vpu_attr->support_encoders
and vpu_attr->support_decoders fields to facilitate support for other
Wave5xx IPs, because not all of them are both encoders and decoders.

Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 10:15:20 +02:00
Ivan Bornyakov
2b9188426b media: chips-media: wave5: support reset lines
Add initial support for optional reset lines. For now, simply deassert
resets while probing the driver and assert them back when removing the
driver.

Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 10:15:20 +02:00
Ivan Bornyakov
143e7ab4d9 media: chips-media: wave5: support decoding HEVC Main10 profile
Add support for decoding HEVC Main10 profile by scaling the FBC
buffer stride and size by a factor of (bitdepth / 8).

Signed-off-by: Ivan Bornyakov <brnkv.i1@gmail.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 10:15:20 +02:00
Ming Qian
a8fb5fce7a media: imx-jpeg: Drop initial source change event if capture has been setup
In section 4.5.1.5. Initialization, the step 4 may be skipped and
continue with the Capture Setup sequence, so if the capture has been
setup, there is no need to trigger the initial source change event, just
start decoding, and follow the dynamic resolution change flow if the
configured values do not match those parsed by the decoder.

And it won't fail the gstreamer pipeline.

Fixes: b833b178498d ("media: imx-jpeg: notify source chagne event when the first picture parsed")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 08:57:09 +02:00
Ming Qian
f10edd839e media: imx-jpeg: Remove some redundant error logs
If the picture size parsed by decoder is different from those previously
established, it's a normal flow of dynamic resolution change, not an
error case, the log may mislead that some error occurs in decoding, so
remove the error log in this case.

Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 08:57:09 +02:00
Allen Pais
1021dd010d media: Convert from tasklet to BH workqueue
The only generic interface to execute asynchronously in the BH context is
tasklet; however, it's marked deprecated and has some design flaws. To
replace tasklets, BH workqueue support was recently added. A BH workqueue
behaves similarly to regular workqueues except that the queued work items
are executed in the BH context.

This patch converts drivers/media/* from tasklet to BH workqueue.

Based on the work done by Tejun Heo <tj@kernel.org>

Signed-off-by: Allen Pais <allen.lkml@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 08:57:09 +02:00
Christophe JAILLET
d2ae63c2f6 media: cx231xx: Constify struct vb2_ops
"struct vb2_ops" are not modified in this driver.

Constifying this structure moves some data to a read-only section, so
increase overall security.

On a x86_64, with allmodconfig:
Before:
======
   text	   data	    bss	    dec	    hex	filename
  36607	   1156	      0	  37763	   9383	drivers/media/usb/cx231xx/cx231xx-417.o

After:
=====
   text	   data	    bss	    dec	    hex	filename
  36735	   1016	      0	  37751	   9377	drivers/media/usb/cx231xx/cx231xx-417.o

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 08:57:09 +02:00
Chi Zhiling
68594cec29 media: xc2028: avoid use-after-free in load_firmware_cb()
syzkaller reported use-after-free in load_firmware_cb() [1].
The reason is because the module allocated a struct tuner in tuner_probe(),
and then the module initialization failed, the struct tuner was released.
A worker which created during module initialization accesses this struct
tuner later, it caused use-after-free.

The process is as follows:

task-6504           worker_thread
tuner_probe                             <= alloc dvb_frontend [2]
...
request_firmware_nowait                 <= create a worker
...
tuner_remove                            <= free dvb_frontend
...
                    request_firmware_work_func  <= the firmware is ready
                    load_firmware_cb    <= but now the dvb_frontend has been freed

To fix the issue, check the dvd_frontend in load_firmware_cb(), if it is
null, report a warning and just return.

[1]:
    ==================================================================
     BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0
     Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504

     Call trace:
      load_firmware_cb+0x1310/0x17a0
      request_firmware_work_func+0x128/0x220
      process_one_work+0x770/0x1824
      worker_thread+0x488/0xea0
      kthread+0x300/0x430
      ret_from_fork+0x10/0x20

     Allocated by task 6504:
      kzalloc
      tuner_probe+0xb0/0x1430
      i2c_device_probe+0x92c/0xaf0
      really_probe+0x678/0xcd0
      driver_probe_device+0x280/0x370
      __device_attach_driver+0x220/0x330
      bus_for_each_drv+0x134/0x1c0
      __device_attach+0x1f4/0x410
      device_initial_probe+0x20/0x30
      bus_probe_device+0x184/0x200
      device_add+0x924/0x12c0
      device_register+0x24/0x30
      i2c_new_device+0x4e0/0xc44
      v4l2_i2c_new_subdev_board+0xbc/0x290
      v4l2_i2c_new_subdev+0xc8/0x104
      em28xx_v4l2_init+0x1dd0/0x3770

     Freed by task 6504:
      kfree+0x238/0x4e4
      tuner_remove+0x144/0x1c0
      i2c_device_remove+0xc8/0x290
      __device_release_driver+0x314/0x5fc
      device_release_driver+0x30/0x44
      bus_remove_device+0x244/0x490
      device_del+0x350/0x900
      device_unregister+0x28/0xd0
      i2c_unregister_device+0x174/0x1d0
      v4l2_device_unregister+0x224/0x380
      em28xx_v4l2_init+0x1d90/0x3770

     The buggy address belongs to the object at ffff8000d7ca2000
      which belongs to the cache kmalloc-2k of size 2048
     The buggy address is located 776 bytes inside of
      2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800)
     The buggy address belongs to the page:
     page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0
     flags: 0x7ff800000000100(slab)
     raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000
     raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
     page dumped because: kasan: bad access detected

     Memory state around the buggy address:
      ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     >ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                           ^
      ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     ==================================================================

[2]
    Actually, it is allocated for struct tuner, and dvb_frontend is inside.

Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-21 08:57:09 +02:00
AngeloGioacchino Del Regno
7fc65b78b4 media: platform: mtk-mdp3: Add support for MT8188 MDP3 components
MT8195 and MT8188 share a similar MDP3 macro-block, with minor
differences - as in, the latter supports a subset of the number
of components supported by the former, but are otherwise handled
in the same way.

Add driver data for MT8188, reusing the already present MT8195
data where possible.

Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Fei Shao <fshao@chromium.org>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-20 11:47:48 +02:00
Hans Verkuil
954ee38d40 uvcvideo fixes and improvements
-----BEGIN PGP SIGNATURE-----
 
 iJgEABYKAEAWIQTAnvhxs4J7QT+XHKnMPy2AAyfeZAUCZnCazSIcbGF1cmVudC5w
 aW5jaGFydEBpZGVhc29uYm9hcmQuY29tAAoJEMw/LYADJ95kFxIA/3j8nOqL+Z8g
 DSUH3uOWoVybCVQHJVfA3VKdsFlO9dv7APoCjWldnbb2eL/JaFjes1cNZAiEYjFh
 tySxUHYNLSrlAw==
 =a6zw
 -----END PGP SIGNATURE-----

Merge tag 'tags/media-next-uvc-20240617-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git into media_stage

uvcvideo fixes and improvements:

- add/fix quirks
- improve timestamp handling
- improve Power Line Frequency handling

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-20 10:40:32 +02:00
Jeff Johnson
9ccbcd5383 media: rc: add missing MODULE_DESCRIPTION() macro
With ARCH=x86, make allmodconfig && make W=1 C=1 reports:
WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/rc/rc-core.o

Add the missing invocation of the MODULE_DESCRIPTION() macro.

Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-06-20 09:52:42 +02:00
Laurent Pinchart
1b9fd2f0b5 media: renesas: vsp1: Initialize control handler after subdev
Some VSP modules initialize their control handler after initializing the
subdev, while some initialize it before. This makes the code
inconsistent and more error prone. Standardize on control initialization
after initializing the subdev.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:49 +03:00
Laurent Pinchart
4be710a3f1 media: renesas: vsp1: Pass subdev state to entity operations
To prepare for the removal of the vsp1_entity.state field, pass the
state to all entity operations that needs to access it, instead of
accessing the state from the entity inside the operation handlers. This
lowers the number of accesses to the field.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:48 +03:00
Laurent Pinchart
a2bbb98870 media: renesas: vsp1: Name parameters to entity operations
checkpatch.pl complains when function arguments are not named:

WARNING: function definition argument 'struct vsp1_entity *' should also have an identifier name
+       void (*configure_stream)(struct vsp1_entity *,

In preparation for reworking some of the vsp1_entity_operations
functions, fix the warnings for the existing ones.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:48 +03:00
Laurent Pinchart
4467bd9e44 media: renesas: vsp1: Get configuration from partition instead of state
Entities access various piece of information from the subdev state when
configuring a partition. The same data is available through the
partition structure passed to the .configure_partition() operation. Use
it to avoid accessing the state, which will simplify moving to the V4L2
subdev active state API.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:48 +03:00
Laurent Pinchart
0656babf3c media: renesas: vsp1: Compute partitions for DRM pipelines
The DRM pipelines don't partition frames, as the hardware operates
synchronously with the display. The entity operations access
configuration data from the entity state in that case, instead of
accessing the partition structure. This requires special cases in
entity-specific code, increasing the driver complexity.

To prepare for simplifying the code, initialize a single partition for
the DRM pipelines, similarly to how video pipelines create one partition
spanning the full image when partitioning isn't needed. The partition is
allocated statically in the vsp1_drm_pipeline structure instead of
dynamically as for video pipelines, as DRM pipelines are guaranteed to
operate on a single partition.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:48 +03:00
Laurent Pinchart
51648e9605 media: renesas: vsp1: Keep the DRM pipeline entities sorted
Some of the code that handles pipeline configuration assumes that
entities in a pipeline's entities list are sorted from sink to source.
To prepare for using that code with the DRM pipeline, insert the BRx
just before the WPF, and the RPFs at the head of the list.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
2024-06-20 01:36:48 +03:00
Laurent Pinchart
032000264c media: renesas: vsp1: Add and use function to dump a pipeline to the log
It is useful for debugging purpose to dump a vsp1_pipeline to the kernel
log. Add a new function to do so, and use it when initializing the video
and DRM pipelines.

As __vsp1_pipeline_dump() needs to construct the log message
iteratively, it uses pr_cont(...) (exact equivalent to the more verbose
"printk(KERN_CONT ..."). The function thus can't use dev_dbg() to log
the initial part of the message, for two reasons:

- pr_cont() doesn't seem to work with dev_*(). Even if the format string
  passed to dev_*() doesn't end with a '\n', pr_cont() starts a new line
  in the log. This behaviour doesn't seem to be clearly documented, and
  may or may not be on purpose.

- Messages printed by dev_dbg() may be omitted if dynamic debugging is
  enabled. In that case, the continuation messages will still be
  printed, leading to confusing log messages.

To still benefit from the dynamic debug infrastructure, we declare a
vsp1_pipeline_dump() macro that uses _dynamic_func_call() when dynamic
debugging is enabled. The whole vsp1_pipeline_dump() call can be
selected at runtime. The __vsp1_pipeline_dump() function then uses a
plain "printk(KERN_DEBUG ...)" to print the message header using the
debug log level, and pr_cont() to print the rest of the message on the
same line.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:48 +03:00
Laurent Pinchart
41be7fcc5d media: renesas: vsp1: Replace vsp1_partition_window with v4l2_rect
The vsp1_partition_window structure is used to store the horizontal size
of a partition window. This is all that is currently needed, as all
partitions span the whole image vertically. The horizontal window size
is retrieved in the .configure_partition() handler from the
vsp1_partition_window structure, and the vertical window size from the
subdev state.

Accessing the subdev state in the .configure_partition() handler is
problematic in the context of moving to the V4L2 subdev active state
API, as .configure_partition() is called in non-interruptable context,
and the state lock can't be taken. To avoid this, start by storing the
vertical size in the window, replacing the custom vsp1_partition_window
structure with a v4l2_rect. Retrieving the vertical size from the window
in .configure_partition() will be done in a subsequent change.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:48 +03:00
Laurent Pinchart
2d7e5d80f1 media: renesas: vsp1: Pass partition pointer to .configure_partition()
The entity .configure_partition() function operates on a partition, and
has to retrieve that partition from the pipeline's current partition
field. Pass the partition pointer to the function to make it clearer
what partition it operates on, and remove the vsp1_pipeline.partition
field.

This change clearly shows that the DRM pipeline doesn't use partitions,
which makes entity implementation more complex and error-prone. This
will be addressed in a further cleanup.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:47 +03:00
Laurent Pinchart
a213bc09b1 media: renesas: vsp1: Store RPF partition configuration per RPF instance
The vsp1_partition structure stores the RPF partition configuration in a
single field for all RPF instances, while each RPF can have its own
configuration. Fix it by storing the configuration separately for each
RPF instance.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Fixes: ab45e8585182 ("media: v4l: vsp1: Allow entities to participate in the partition algorithm")
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:47 +03:00
Laurent Pinchart
a143156c85 media: renesas: vsp1: Simplify partition calculation
When calculation a partition in vsp1_pipeline_calculate_partition(),
there is no need to handle the case where the whole image is covered by
a single partition locally. In that case, the index and div_size
parameters are 0 and format->width respectively, which makes the general
code behave exactly as the special case. Drop the special case.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:47 +03:00
Laurent Pinchart
e575095d28 media: renesas: vsp1: Move partition calculation to vsp1_pipe.c
The partition calculation code, located in vsp1_video.c, is not specific
to video pipelines. To prepare for its usage in DRM pipelines, move it
to vsp1_pipe.c.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
2024-06-20 01:36:47 +03:00