]> git.hungrycats.org Git - linux/log
linux
10 months agomedia: venus: fix use after free bug in venus_remove due to race condition
Zheng Wang [Tue, 18 Jun 2024 09:25:59 +0000 (14:55 +0530)]
media: venus: fix use after free bug in venus_remove due to race condition

in venus_probe, core->work is bound with venus_sys_error_handler, which is
used to handle error. The code use core->sys_err_done to make sync work.
The core->work is started in venus_event_notify.

If we call venus_remove, there might be an unfished work. The possible
sequence is as follows:

CPU0                  CPU1

                     |venus_sys_error_handler
venus_remove         |
hfi_destroy    |
venus_hfi_destroy  |
kfree(hdev);      |
                     |hfi_reinit
 |venus_hfi_queues_reinit
                     |//use hdev

Fix it by canceling the work in venus_remove.

Cc: stable@vger.kernel.org
Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: verisilicon: Move Rockchip AV1 hardware drivers to the corresponding option
Alexander Stein [Fri, 21 Jun 2024 10:50:23 +0000 (12:50 +0200)]
media: verisilicon: Move Rockchip AV1 hardware drivers to the corresponding option

There is no need to compile the Rockchip specific AV1 drivers if
CONFIG_VIDEO_HANTRO_ROCKCHIP is not set.
All the driver functions are only referenced by rockchip_vpu_hw.c which
is already under this option.

Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder")
Fixes: d8ebe59e7b36 ("media: verisilicon: Add film grain feature to AV1 driver")
Fixes: c0d0e579db4e ("media: verisilicon: Add AV1 entropy helpers")
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: verisilicon: Move Rockchip hardware drivers to the corresponding option
Alexander Stein [Fri, 21 Jun 2024 10:50:22 +0000 (12:50 +0200)]
media: verisilicon: Move Rockchip hardware drivers to the corresponding option

There is no need to compile the Rockchip specific drivers if
CONFIG_VIDEO_HANTRO_ROCKCHIP is not set.
All the driver functions are only referenced by rockchip_vpu_hw.c which
is already under this option.

Fixes: c9caebd57b3a ("media: hantro: merge Rockchip platform drivers")
Fixes: c07665f99386 ("media: hantro: Add H.264 support for Rockchip VDPU2")
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: verisilicon: AV1: Correct some sizes/positions on register fields
Benjamin Gaignard [Tue, 21 May 2024 15:26:03 +0000 (17:26 +0200)]
media: verisilicon: AV1: Correct some sizes/positions on register fields

Some fields aren't well positioned or with an incorrect size inside the
hardware registers. Fix them.

This doesn't impact the Fluster score.

Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder")
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: verisilicon: Fix auxiliary buffer allocation size
Benjamin Gaignard [Thu, 28 Mar 2024 09:34:39 +0000 (10:34 +0100)]
media: verisilicon: Fix auxiliary buffer allocation size

Use v4l2_av1_tile_info->tile_cols to get the number of columns
in the frame and make auxiliary buffer memory size computation
more accurate.

Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder")
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: verisilicon: AV1: Be more flexible with postproc capabilities
Benjamin Gaignard [Thu, 28 Mar 2024 09:34:38 +0000 (10:34 +0100)]
media: verisilicon: AV1: Be more flexible with postproc capabilities

The RK3588 post-processor block is able to convert 10-bit pixel-formats
into 8-bit pixel-formats.

Fixes: 003afda97c65 ("media: verisilicon: Enable AV1 decoder on rk3588")
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: coda: cast an operand of multiplication to a larger type
Anastasia Belova [Mon, 5 Feb 2024 15:23:50 +0000 (18:23 +0300)]
media: coda: cast an operand of multiplication to a larger type

If the width and height are 0xffff (or close), the result of a
multiplication will overflow.
Cast to a larger type to avoid undefined behavior.

Such values are possible in CODA7, but unlikely.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 918c66fd4126 ("[media] coda: add CODA7541 decoding support")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: vicodec: allow en/decoder cmd w/o CAPTURE
Deborah Brouwer [Thu, 9 Nov 2023 18:48:38 +0000 (10:48 -0800)]
media: vicodec: allow en/decoder cmd w/o CAPTURE

Vicodec will ignore en/decoder commands if the CAPTURE queue is not
streaming. But this prevents CMD_STOP from being used during a dynamic
resolution change to mark the last source buffer. Since CMD_STOP is
ignored, but doesn’t fail, there is no warning that the command needs to
be resent, and CAPTURE will continue to attempt to dequeue buffers
waiting, futilely, for one with V4L2_BUF_FLAG_LAST.

Fix this problem by carrying out en/decoder commands even if CAPTURE is
not streaming.

Fixes: d17589afa9706 vicodec: improve handling of ENC_CMD_STOP/START
Reported by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agoMerge tag 'next-media-rkisp1-20240814' of git://git.kernel.org/pub/scm/linux/kernel...
Hans Verkuil [Wed, 14 Aug 2024 15:18:47 +0000 (17:18 +0200)]
Merge tag 'next-media-rkisp1-20240814' of git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git

Extensible parameters support for the rkisp1 driver.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: rkisp1: Add support for the companding block
Paul Elder [Thu, 8 Aug 2024 20:41:05 +0000 (22:41 +0200)]
media: rkisp1: Add support for the companding block

Add support to the rkisp1 driver for the companding block that exists on
the i.MX8MP version of the ISP. This requires usage of the new
extensible parameters format, and showcases how the format allows for
extensions without breaking backward compatibility.

Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: rkisp1: Add feature flags for BLS and compand
Paul Elder [Thu, 8 Aug 2024 20:41:04 +0000 (22:41 +0200)]
media: rkisp1: Add feature flags for BLS and compand

Add feature flags for the dedicated black level subtraction hardware
block and for the compand hardware block. The companding feature flag is
added on its own (as opposed to "the absence of BLS") because we will
need it later for when we add support for the companding block.

Skip BLS configuration when the BLS feature flag is unset, as devices
without the dedicated BLS block cannot configure a hardware block that
doesn't exist.

Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: rkisp1: Add register definitions for the companding block
Paul Elder [Thu, 8 Aug 2024 20:41:03 +0000 (22:41 +0200)]
media: rkisp1: Add register definitions for the companding block

To prepare for adding support for the companding block to the rkisp1
driver for the version of the ISP on the i.MX8MP, add the register
definitions for it, including relevant register field values.

Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: rkisp1: Add features mask to extensible block handlers
Laurent Pinchart [Thu, 8 Aug 2024 20:41:02 +0000 (22:41 +0200)]
media: rkisp1: Add features mask to extensible block handlers

Future ISP parameter blocks for i.MX8MP-specific features will not
support on Rockchip platforms as they lack the corresponding hardware.
Introduce a features mask in the extensible block handlers to indicate
which device features a block require, and ignore blocks that require
unavailable features.

Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: rkisp1: Add helper function to swap colour channels
Laurent Pinchart [Thu, 8 Aug 2024 20:41:01 +0000 (22:41 +0200)]
media: rkisp1: Add helper function to swap colour channels

The BLS parameters passed by userspace are specified for named colour
channels (R, Gr, Gb and B), while the hardware registers reference
positions in the 2x2 CFA pattern (A, B, C and D).

The BLS values are swapped based on the CFA pattern when writing to or
reading from registers, using hand-roled switch statements. The logic is
duplicated already, and new code will require similar processing. Move
the swap logic to a shared function, using static data to control the
channels order.

Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: rkisp1: Implement s_fmt/try_fmt
Jacopo Mondi [Thu, 8 Aug 2024 20:41:00 +0000 (22:41 +0200)]
media: rkisp1: Implement s_fmt/try_fmt

Implement in the rkisp1 driver support for the s_fmt and try_fmt
operation to allow userspace to select between the extensible
and the fixed parameters formats.

Implement enum_mbus_code to enumerate the fixed and the extensible
formats and disallow changing the data format while the queue is busy.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: rkisp1: Implement extensible params support
Jacopo Mondi [Thu, 8 Aug 2024 20:40:59 +0000 (22:40 +0200)]
media: rkisp1: Implement extensible params support

Implement support in rkisp1-params for the extensible configuration
parameters format.

Create a list of handlers for each ISP block that wraps the existing
configuration functions and handles the ISP block enablement.

Parse the configuration parameters buffer in rkisp1_ext_params_config
and filter the enable blocks by group, to allow setting the 'other'
groups separately from the 'lsc' group to support the pre/post-configure
operations.

Implement parameter buffer validation for the extensible format at
.buf_prepare() time.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: videobuf2-core: attach once if multiple planes share the same dbuf
Yunke Cao [Wed, 14 Aug 2024 02:06:43 +0000 (11:06 +0900)]
media: videobuf2-core: attach once if multiple planes share the same dbuf

When multiple planes use the same dma buf, each plane will have its own dma
buf attachment and mapping. It is a waste of IOVA space.

This patch adds a dbuf_duplicated boolean in vb2_plane. If a plane's dbuf
is the same as an existing plane, do not create another attachment and
mapping.

Signed-off-by: Yunke Cao <yunkec@chromium.org>
Acked-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: videobuf2-core: reverse the iteration order in __vb2_buf_dmabuf_put
Yunke Cao [Wed, 14 Aug 2024 02:06:42 +0000 (11:06 +0900)]
media: videobuf2-core: reverse the iteration order in __vb2_buf_dmabuf_put

This patch prepares for allowing multiple planes to share the same DMA
buffer attachment.

Release the planes from num_planes - 1 to 0 so that we don't leave invalid
mem_priv pointers behind.

Signed-off-by: Yunke Cao <yunkec@chromium.org>
Acked-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: videobuf2-core: release all planes first in __prepare_dmabuf()
Yunke Cao [Wed, 14 Aug 2024 02:06:41 +0000 (11:06 +0900)]
media: videobuf2-core: release all planes first in __prepare_dmabuf()

In the existing implementation, validating planes, checking if the planes
changed, releasing previous planes and reaquiring new planes all happens in
the same for loop.

Split the for loop into 3 parts
1. In the first for loop, validate planes and check if planes changed.
2. Call __vb2_buf_dmabuf_put() to release all planes.
3. In the second for loop, reaquire new planes.

Signed-off-by: Yunke Cao <yunkec@chromium.org>
Acked-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
Yunke Cao [Wed, 14 Aug 2024 02:06:40 +0000 (11:06 +0900)]
media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()

Clear vb2_plane's memory related fields in __vb2_plane_dmabuf_put(),
including bytesused, length, fd and data_offset.

Remove the duplicated code in __prepare_dmabuf().

Signed-off-by: Yunke Cao <yunkec@chromium.org>
Acked-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agodocs: uapi: media: Document Mediatek 10bit tiled formats
Nicolas Dufresne [Thu, 14 Sep 2023 15:06:51 +0000 (11:06 -0400)]
docs: uapi: media: Document Mediatek 10bit tiled formats

Document V4L2_PIX_FMT_MT2110T and V4L2_PIX_FMT_MT2110R. These two
formats are nearly identical, reusing MM21 format and expending it
by inserting chunk of 16 bytes of lower 2 bit pixel data after each
chunk of 64 bytes higher 8 bit of data.

Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agodocs: uapi: media: Add a layout diagram for MT2110T
Nicolas Dufresne [Thu, 14 Sep 2023 15:06:50 +0000 (11:06 -0400)]
docs: uapi: media: Add a layout diagram for MT2110T

This diagram details the partitioning done in each tiles.

Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agodocs: uapi: media: Move NV12_10BE_8L128 to NV15 section
Nicolas Dufresne [Thu, 14 Sep 2023 15:06:48 +0000 (11:06 -0400)]
docs: uapi: media: Move NV12_10BE_8L128 to NV15 section

This is a 15 bits per pixel (or packed 10 bit format), so move it
into the relevant section.

Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agodocs: uapi: media: Properly locate NV12MT diagram
Nicolas Dufresne [Thu, 14 Sep 2023 15:06:47 +0000 (11:06 -0400)]
docs: uapi: media: Properly locate NV12MT diagram

The diagram have been pushed back at the end of a list of unrelated
pixels formats. Move it back next its related pixel format.

Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: admin-guide: mgb4: Outputs DV timings documentation update
Martin Tůma [Mon, 5 Aug 2024 15:40:54 +0000 (17:40 +0200)]
media: admin-guide: mgb4: Outputs DV timings documentation update

Properly document the function of the mgb4 output "frame_rate" sysfs
parameter and update the default DV timings values according to the latest
code changes.

Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: mgb4: Fixed signal frame rate limit handling
Martin Tůma [Mon, 5 Aug 2024 15:40:53 +0000 (17:40 +0200)]
media: mgb4: Fixed signal frame rate limit handling

Change the default DV timings for the outputs to produce a better signal
less "crippled" by the frame rate limiting. While the individual values
are now different, the resulting signal still matches the same default
display as before.

Additionally fix the corner case when the frame rate limit is set to zero
causing a "divide by zero" kernel panic.

Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: mgb4: Add support for V4L2_CAP_TIMEPERFRAME
Martin Tůma [Mon, 5 Aug 2024 15:40:52 +0000 (17:40 +0200)]
media: mgb4: Add support for V4L2_CAP_TIMEPERFRAME

Recent mgb4 firmwares have support for setting a variable framerate
independent of the signal framerate. Add/fix (the mgb4 driver already did
promote V4L2_CAP_TIMEPERFRAME, but it didn't work) support for
V4L2_CAP_TIMEPERFRAME to the driver to enable this feature.

Additionally add support for the DV timings API (VIDIOC_G_DV_TIMINGS,
VIDIOC_ENUM_DV_TIMINGS, ...) for the outputs that was missing. The timings
info is required/used for implementing the V4L2_CAP_TIMEPERFRAME
functionality.

Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: mgb4: Add support for YUV image formats
Martin Tůma [Mon, 5 Aug 2024 15:40:51 +0000 (17:40 +0200)]
media: mgb4: Add support for YUV image formats

Recent mgb4 firmwares support YUV in addition to the RGB image format.
Enable YUV in the driver when the FW supports it.

Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: staging: media: starfive: camss: Drop obsolete return value documentation
Uwe Kleine-König [Wed, 24 Apr 2024 14:02:48 +0000 (16:02 +0200)]
media: staging: media: starfive: camss: Drop obsolete return value documentation

Recently the function stfcamss_remove() was changed to not return a
value. Drop the documentation of the return value in the kernel doc.

Fixes: b1f3677aebe5 ("media: staging: media: starfive: camss: Convert to platform remove callback returning void")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: rkisp1: Cache the currently active format
Jacopo Mondi [Thu, 8 Aug 2024 20:40:58 +0000 (22:40 +0200)]
media: rkisp1: Cache the currently active format

The rkisp1-params driver assumes the data buffer format is the only
currently supported "fixed" one. The usage of the "fixed" format is
assumed when allocating memory for the scratch buffers and when
initializing the vb2 queue.

In order to prepare to support the "extensible" format beside the
existing "fixed" one, add support in the driver for both formats by
caching a pointer to the active one in the driver structure and use it
in the vb2 queue operations and subdev pad operations implementations.

Do not yet allow userspace to select between the two formats as the
support for the "extensible" format parsing will be introduced in a later
patch in the series.

While at it, document the un-documented ycbcr_encoding field of
struct rkisp1_params_ops.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: rkisp1: Copy the parameters buffer
Jacopo Mondi [Thu, 8 Aug 2024 20:40:57 +0000 (22:40 +0200)]
media: rkisp1: Copy the parameters buffer

The ISP parameters buffers are queued by userspace to the params video
device and appended by the driver to the list of available buffers for
later consumption.

As the parameters buffer is mapped in the userspace process memory,
applications have access to the buffer content after the buffer has
been queued.

To prevent userspace from modifying the contents of the parameters buffer
after it has been queued to the video device, add to 'struct
rkisp1_params_buffer' a scratch buffer where to copy the parameters.

Allocate the scratch buffer in the vb2 buf_init() operation and copy the
buffer content in the buf_prepare() operation. Free the scratch
buffer in the newly introduced buf_cleanup() operation handler.

Modify the ISP configuration function to access the ISP configuration
from the cached copy of the parameters buffer instead of using the
userspace-mapped one.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: rkisp1: Add struct rkisp1_params_buffer
Jacopo Mondi [Thu, 8 Aug 2024 20:40:56 +0000 (22:40 +0200)]
media: rkisp1: Add struct rkisp1_params_buffer

Create the 'struct rkisp1_params_buffer' type that wraps a
vb2_v4l2_buffer to prepare to hold a copy of the parameters buffer that
will be used to cache the user-provided configuration buffer in the
following patches.

Replace usage of 'struct rkisp1_buffer' with 'struct
rkisp1_params_buffer' in rkisp1-params.c to prepare for that.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: uapi: videodev2: Add V4L2_META_FMT_RK_ISP1_EXT_PARAMS
Jacopo Mondi [Thu, 8 Aug 2024 20:40:55 +0000 (22:40 +0200)]
media: uapi: videodev2: Add V4L2_META_FMT_RK_ISP1_EXT_PARAMS

The rkisp1 driver stores ISP configuration parameters in the fixed
rkisp1_params_cfg structure. As the members of the structure are part of
the userspace API, the structure layout is immutable and cannot be
extended further. Introducing new parameters or modifying the existing
ones would change the buffer layout and cause breakages in existing
applications.

The allow for future extensions to the ISP parameters, introduce a new
extensible parameters format, with a new format 4CC. Document usage of
the new format in the rkisp1 admin guide.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: uapi: rkisp1-config: Add extensible params format
Jacopo Mondi [Thu, 8 Aug 2024 20:40:54 +0000 (22:40 +0200)]
media: uapi: rkisp1-config: Add extensible params format

Add to the rkisp1-config.h header data types and documentation of
the extensible parameters format.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: rkisp1: Adapt to different SoCs having different size limits
Ondrej Jirman [Fri, 15 Mar 2024 23:02:41 +0000 (00:02 +0100)]
media: rkisp1: Adapt to different SoCs having different size limits

- RK3399 has input/output limit of main path 4416 x 3312
- PX30 has input/output limit of main path 3264 x 2448
- i.MX8MP has input/output limit of main path 4096 x 3072

Use rkisp1_info struct to encode the limits.

Signed-off-by: Ondrej Jirman <megi@xff.cz>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
10 months agomedia: ti: cal: use 'time_left' variable with wait_event_timeout()
Wolfram Sang [Mon, 5 Aug 2024 21:51:21 +0000 (23:51 +0200)]
media: ti: cal: use 'time_left' variable with wait_event_timeout()

There is a confusing pattern in the kernel to use a variable named
'timeout' to store the result of wait_event_timeout() causing
patterns like:

        timeout = wait_event_timeout(...)
        if (!timeout) return -ETIMEDOUT;

with all kinds of permutations. Use 'time_left' as a variable to make the
code self explaining.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: tegra-vde: use 'time_left' variable with wait_for_completion_interruptible_tim...
Wolfram Sang [Mon, 5 Aug 2024 21:51:20 +0000 (23:51 +0200)]
media: tegra-vde: use 'time_left' variable with wait_for_completion_interruptible_timeout()

There is a confusing pattern in the kernel to use a variable named
'timeout' to store the result of
wait_for_completion_interruptible_timeout() causing patterns like:

        timeout = wait_for_completion_interruptible_timeout(...)
        if (!timeout) return -ETIMEDOUT;

with all kinds of permutations. Use 'time_left' as a variable to make the
code self explaining.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: solo6x10: use 'time_left' variable with wait_for_completion_timeout()
Wolfram Sang [Mon, 5 Aug 2024 21:51:19 +0000 (23:51 +0200)]
media: solo6x10: use 'time_left' variable with wait_for_completion_timeout()

There is a confusing pattern in the kernel to use a variable named
'timeout' to store the result of wait_for_completion_timeout() causing
patterns like:

        timeout = wait_for_completion_timeout(...)
        if (!timeout) return -ETIMEDOUT;

with all kinds of permutations. Use 'time_left' as a variable to make the
code self explaining.

Fix to the proper variable type 'unsigned long' while here.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Ismael Luceno <ismael@iodev.co.uk>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: platform: exynos-gsc: use 'time_left' variable with wait_event_timeout()
Wolfram Sang [Mon, 5 Aug 2024 21:51:18 +0000 (23:51 +0200)]
media: platform: exynos-gsc: use 'time_left' variable with wait_event_timeout()

There is a confusing pattern in the kernel to use a variable named
'timeout' to store the result of wait_event_timeout() causing
patterns like:

        timeout = wait_event_timeout(...)
        if (!timeout) return -ETIMEDOUT;

with all kinds of permutations. Use 'time_left' as a variable to make the
code self explaining.

Fix to the proper variable type 'long' while here.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: fimc-is: use 'time_left' variable with wait_event_timeout()
Wolfram Sang [Mon, 5 Aug 2024 21:51:17 +0000 (23:51 +0200)]
media: fimc-is: use 'time_left' variable with wait_event_timeout()

There is a confusing pattern in the kernel to use a variable named
'timeout' to store the result of wait_event_timeout() causing
patterns like:

        timeout = wait_event_timeout(...)
        if (!timeout) return -ETIMEDOUT;

with all kinds of permutations. Use 'time_left' as a variable to make the
code self explaining.

Fix to the proper variable type 'long' while here.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: bdisp: use 'time_left' variable with wait_event_timeout()
Wolfram Sang [Mon, 5 Aug 2024 21:51:16 +0000 (23:51 +0200)]
media: bdisp: use 'time_left' variable with wait_event_timeout()

There is a confusing pattern in the kernel to use a variable named
'timeout' to store the result of wait_event_timeout() causing
patterns like:

        timeout = wait_event_timeout(...)
        if (!timeout) return -ETIMEDOUT;

with all kinds of permutations. Use 'time_left' as a variable to make the
code self explaining.

Fix to the proper variable type 'long' while here.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: atmel-isi: use 'time_left' variable with wait_for_completion_timeout()
Wolfram Sang [Mon, 5 Aug 2024 21:51:15 +0000 (23:51 +0200)]
media: atmel-isi: use 'time_left' variable with wait_for_completion_timeout()

There is a confusing pattern in the kernel to use a variable named
'timeout' to store the result of wait_for_completion_timeout() causing
patterns like:

        timeout = wait_for_completion_timeout(...)
        if (!timeout) return -ETIMEDOUT;

with all kinds of permutations. Use 'time_left' as a variable to make the
code self explaining.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: allegro: use 'time_left' variable with wait_for_completion_timeout()
Wolfram Sang [Mon, 5 Aug 2024 21:51:14 +0000 (23:51 +0200)]
media: allegro: use 'time_left' variable with wait_for_completion_timeout()

There is a confusing pattern in the kernel to use a variable named
'timeout' to store the result of wait_for_completion_timeout() causing
patterns like:

        timeout = wait_for_completion_timeout(...)
        if (!timeout) return -ETIMEDOUT;

with all kinds of permutations. Use 'time_left' as a variable to make the
code self explaining, also for the code path using 'tmo' as a variable.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: dt-bindings: media: renesas,fcp: Document RZ/G2UL FCPVD bindings
Biju Das [Mon, 5 Aug 2024 10:35:44 +0000 (11:35 +0100)]
media: dt-bindings: media: renesas,fcp: Document RZ/G2UL FCPVD bindings

Document FCPVD found in RZ/G2UL SoC. FCPVD block is similar to FCP for
VSP found on RZ/{G2L,G2LC,V2L} SoCs.

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: dt-bindings: media: renesas,vsp1: Document RZ/G2UL VSPD bindings
Biju Das [Mon, 5 Aug 2024 10:35:43 +0000 (11:35 +0100)]
media: dt-bindings: media: renesas,vsp1: Document RZ/G2UL VSPD bindings

Document VSPD found in RZ/G2UL SoC. The VSPD block is identical to RZ/G2L
SoC and therefore use RZ/G2L fallback to avoid any driver changes.

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agostaging: media: atmel: use for_each_endpoint_of_node()
Kuninori Morimoto [Tue, 30 Jul 2024 00:35:21 +0000 (00:35 +0000)]
staging: media: atmel: use for_each_endpoint_of_node()

We already have for_each_endpoint_of_node(), don't use
of_graph_get_next_endpoint() directly. Replace it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: platform: xilinx: use for_each_endpoint_of_node()
Kuninori Morimoto [Tue, 30 Jul 2024 00:35:10 +0000 (00:35 +0000)]
media: platform: xilinx: use for_each_endpoint_of_node()

We already have for_each_endpoint_of_node(), don't use
of_graph_get_next_endpoint() directly. Replace it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: platform: ti: use for_each_endpoint_of_node()
Kuninori Morimoto [Tue, 30 Jul 2024 00:35:00 +0000 (00:35 +0000)]
media: platform: ti: use for_each_endpoint_of_node()

We already have for_each_endpoint_of_node(), don't use
of_graph_get_next_endpoint() directly. Replace it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: platform: microchip: use for_each_endpoint_of_node()
Kuninori Morimoto [Tue, 30 Jul 2024 00:34:51 +0000 (00:34 +0000)]
media: platform: microchip: use for_each_endpoint_of_node()

We already have for_each_endpoint_of_node(), don't use
of_graph_get_next_endpoint() directly. Replace it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: docs: Fix newline typos in capture.c
Javier Carrasco [Mon, 29 Jul 2024 19:37:13 +0000 (21:37 +0200)]
media: docs: Fix newline typos in capture.c

Commit d7894721f73b ("media: docs: Fix newline typo") aimed to fix the
newline typos in capture.c, but some of the typos were not fixed. Fix
the remaining newline typos.

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: qcom: camss: Fix ordering of pm_runtime_enable
Bryan O'Donoghue [Mon, 29 Jul 2024 12:42:03 +0000 (13:42 +0100)]
media: qcom: camss: Fix ordering of pm_runtime_enable

pm_runtime_enable() should happen prior to vfe_get() since vfe_get() calls
pm_runtime_resume_and_get().

This is a basic race condition that doesn't show up for most users so is
not widely reported. If you blacklist qcom-camss in modules.d and then
subsequently modprobe the module post-boot it is possible to reliably show
this error up.

The kernel log for this error looks like this:

qcom-camss ac5a000.camss: Failed to power up pipeline: -13

Fixes: 02afa816dbbf ("media: camss: Add basic runtime PM support")
Reported-by: Johan Hovold <johan+linaro@kernel.org>
Closes: https://lore.kernel.org/lkml/ZoVNHOTI0PKMNt4_@hovoldconsulting.com/
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Konrad Dybcio <konradybcio@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: qcom: camss: Remove use_count guard in stop_streaming
Bryan O'Donoghue [Mon, 29 Jul 2024 12:42:02 +0000 (13:42 +0100)]
media: qcom: camss: Remove use_count guard in stop_streaming

The use_count check was introduced so that multiple concurrent Raw Data
Interfaces RDIs could be driven by different virtual channels VCs on the
CSIPHY input driving the video pipeline.

This is an invalid use of use_count though as use_count pertains to the
number of times a video entity has been opened by user-space not the number
of active streams.

If use_count and stream-on count don't agree then stop_streaming() will
break as is currently the case and has become apparent when using CAMSS
with libcamera's released softisp 0.3.

The use of use_count like this is a bit hacky and right now breaks regular
usage of CAMSS for a single stream case. Stopping qcam results in the splat
below, and then it cannot be started again and any attempts to do so fails
with -EBUSY.

[ 1265.509831] WARNING: CPU: 5 PID: 919 at drivers/media/common/videobuf2/videobuf2-core.c:2183 __vb2_queue_cancel+0x230/0x2c8 [videobuf2_common]
...
[ 1265.510630] Call trace:
[ 1265.510636]  __vb2_queue_cancel+0x230/0x2c8 [videobuf2_common]
[ 1265.510648]  vb2_core_streamoff+0x24/0xcc [videobuf2_common]
[ 1265.510660]  vb2_ioctl_streamoff+0x5c/0xa8 [videobuf2_v4l2]
[ 1265.510673]  v4l_streamoff+0x24/0x30 [videodev]
[ 1265.510707]  __video_do_ioctl+0x190/0x3f4 [videodev]
[ 1265.510732]  video_usercopy+0x304/0x8c4 [videodev]
[ 1265.510757]  video_ioctl2+0x18/0x34 [videodev]
[ 1265.510782]  v4l2_ioctl+0x40/0x60 [videodev]
...
[ 1265.510944] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 0 in active state
[ 1265.511175] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 1 in active state
[ 1265.511398] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 2 in active st

One CAMSS specific way to handle multiple VCs on the same RDI might be:

- Reference count each pipeline enable for CSIPHY, CSID, VFE and RDIx.
- The video buffers are already associated with msm_vfeN_rdiX so
  release video buffers when told to do so by stop_streaming.
- Only release the power-domains for the CSIPHY, CSID and VFE when
  their internal refcounts drop.

Either way refusing to release video buffers based on use_count is
erroneous and should be reverted. The silicon enabling code for selecting
VCs is perfectly fine. Its a "known missing feature" that concurrent VCs
won't work with CAMSS right now.

Initial testing with this code didn't show an error but, SoftISP and "real"
usage with Google Hangouts breaks the upstream code pretty quickly, we need
to do a partial revert and take another pass at VCs.

This commit partially reverts commit 89013969e232 ("media: camss: sm8250:
Pipeline starting and stopping for multiple virtual channels")

Fixes: 89013969e232 ("media: camss: sm8250: Pipeline starting and stopping for multiple virtual channels")
Reported-by: Johan Hovold <johan+linaro@kernel.org>
Closes: https://lore.kernel.org/lkml/ZoVNHOTI0PKMNt4_@hovoldconsulting.com/
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: i2c: tda1997x: constify snd_soc_component_driver struct
Javier Carrasco [Mon, 29 Jul 2024 09:37:37 +0000 (11:37 +0200)]
media: i2c: tda1997x: constify snd_soc_component_driver struct

`tda1997x_codec_driver` is not modified after its declaration, and it
is only passed to `devm_snd_soc_register_component()`, which expects
a constant `snd_soc_component_driver`.

Move `tda1997x_codec_driver` to a read-only section by declaring it
const.

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: raspberrypi: VIDEO_RASPBERRYPI_PISP_BE should depend on ARCH_BCM2835
Geert Uytterhoeven [Mon, 22 Jul 2024 15:28:28 +0000 (17:28 +0200)]
media: raspberrypi: VIDEO_RASPBERRYPI_PISP_BE should depend on ARCH_BCM2835

Currently, the Raspberry Pi PiSP Backend (BE) ISP is only present on the
Broadcom BCM2712-based Raspberry Pi 5.  Hence add a dependency on
ARCH_BCM2835, to prevent asking the user about this driver when
configuring a kernel without Broadcom BCM2835 family support.  The
dependency can be relaxed if/when the encoder appears on other SoC
families.

Fixes: 12187bd5d4f8 ("media: raspberrypi: Add support for PiSP BE")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: FLorian Fainelli <florian.fainelli@broadcom.com>
Acked-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agoDocumentation: media: move Memory Consistency Flags
Hans Verkuil [Sat, 20 Jul 2024 10:46:51 +0000 (12:46 +0200)]
Documentation: media: move Memory Consistency Flags

The documentation of the Memory Consistency Flags was part of the struct
v4l2_buffer documentation, but that struct doesn't use those flags. Instead
it is used by VIDIOC_CREATE_BUFS and VIDIOC_REQBUFS. Move the documentation
from buffer.rst to vidioc-reqbufs.rst which is where it belongs.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: v4l2-core: v4l2-ioctl: missing ', ' in create_bufs logging
Hans Verkuil [Wed, 17 Jul 2024 09:58:45 +0000 (11:58 +0200)]
media: v4l2-core: v4l2-ioctl: missing ', ' in create_bufs logging

The v4l_print_create_buffers() function was missing a ', ' in
the pr_cont call, leading to logs like this:

[93293.533425] video0: VIDIOC_CREATE_BUFS: index=0, count=0, memory=dmabuf, capabilities=0x00000297, max num buffers=32type=vid-cap, width=0, height=0, pixelformat=.... little-endian (0x00000000),
field=any, bytesperline=0, sizeimage=0, colorspace=0, flags=0x0, ycbcr_enc=0, quantization=0, xfer_func=0

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Sebastian Fricke <sebastian.fricke@collabora.com>
10 months agoDocumentation: media: add missing V4L2_BUF_CAP_ flags
Hans Verkuil [Tue, 16 Jul 2024 12:28:17 +0000 (14:28 +0200)]
Documentation: media: add missing V4L2_BUF_CAP_ flags

The documentation for V4L2_BUF_CAP_SUPPORTS_MAX_NUM_BUFFERS and
V4L2_BUF_CAP_SUPPORTS_REMOVE_BUFS was missing. Add this.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
10 months agoRevert "media: tuners: fix error return code of hybrid_tuner_request_state()"
Roman Smirnov [Tue, 16 Jul 2024 09:10:40 +0000 (12:10 +0300)]
Revert "media: tuners: fix error return code of hybrid_tuner_request_state()"

This reverts commit b9302fa7ed979e84b454e4ca92192cf485a4ed41.

As Fedor Pchelkin pointed out, this commit violates the
convention of using the macro return value, which causes errors.
For example, in functions tda18271_attach(), xc5000_attach(),
simple_tuner_attach().

Link: https://lore.kernel.org/linux-media/20240424202031.syigrtrtipbq5f2l@fpc/
Suggested-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Roman Smirnov <r.smirnov@omp.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: i2c: GC08A3: Fix spelling mistake "STRAEMING_REG" -> "STREAMING_REG"
Colin Ian King [Tue, 9 Jul 2024 10:50:03 +0000 (11:50 +0100)]
media: i2c: GC08A3: Fix spelling mistake "STRAEMING_REG" -> "STREAMING_REG"

There is a spelling mistake in a dev_err message. Fix it.

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: i2c: GC05A2: Fix spelling mistake "Horizental" -> "Horizontal"
Colin Ian King [Tue, 9 Jul 2024 10:48:07 +0000 (11:48 +0100)]
media: i2c: GC05A2: Fix spelling mistake "Horizental" -> "Horizontal"

There is a spelling mistake in a string in the gc05a2_test_pattern_menu
array. Fix it.

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agodrivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
Junlin Li [Tue, 2 Jul 2024 17:50:23 +0000 (01:50 +0800)]
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error

Ensure index in rtl2830_pid_filter does not exceed 31 to prevent
out-of-bounds access.

dev->filters is a 32-bit value, so set_bit and clear_bit functions should
only operate on indices from 0 to 31. If index is 32, it will attempt to
access a non-existent 33rd bit, leading to out-of-bounds access.
Change the boundary check from index > 32 to index >= 32 to resolve this
issue.

Fixes: df70ddad81b4 ("[media] rtl2830: implement PID filter")
Signed-off-by: Junlin Li <make24@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agodrivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
Junlin Li [Tue, 2 Jul 2024 13:24:13 +0000 (21:24 +0800)]
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error

Ensure index in rtl2832_pid_filter does not exceed 31 to prevent
out-of-bounds access.

dev->filters is a 32-bit value, so set_bit and clear_bit functions should
only operate on indices from 0 to 31. If index is 32, it will attempt to
access a non-existent 33rd bit, leading to out-of-bounds access.
Change the boundary check from index > 32 to index >= 32 to resolve this
issue.

Signed-off-by: Junlin Li <make24@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 4b01e01a81b6 ("[media] rtl2832: implement PID filter")
[hverkuil: added fixes tag, rtl2830_pid_filter -> rtl2832_pid_filter in logmsg]

10 months agoDocumentation: media: vivid.rst: update TODO list
Hans Verkuil [Tue, 2 Jul 2024 06:51:39 +0000 (08:51 +0200)]
Documentation: media: vivid.rst: update TODO list

The vivid driver supports media controller support for quite a long
time now, so drop that from the list.

Since commit 4c4dacb052d4 ("media: vivid: loopback based on
'Connected To' controls") making EDID changes causes correct signaling
to happen, but what is still missing is the 100 ms delay required before
signaling that there is an HPD. Modify this TODO item accordingly.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: i2c: thp7312: Convert comma to semicolon
Chen Ni [Tue, 2 Jul 2024 02:57:11 +0000 (10:57 +0800)]
media: i2c: thp7312: Convert comma to semicolon

Replace a comma between expression statements by a semicolon.

Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: imx-pxp: Rewrite coeff expression
Ricardo Ribalda [Fri, 28 Jun 2024 15:11:15 +0000 (15:11 +0000)]
media: imx-pxp: Rewrite coeff expression

GCC5 cannot figure out that the expressions are constant, and that
triggers a build failure. Rewrite the expressions.

The following gcc5 error is workaround:

 #define BM_PXP_CSC1_COEF0_YCBCR_MODE 0x80000000
                                      ^
    BM_PXP_CSC1_COEF0_YCBCR_MODE |
    ^
 #define BM_PXP_CSC1_COEF0_YCBCR_MODE 0x80000000
                                      ^

drivers/media/platform/nxp/imx-pxp.c: In function 'pxp_setup_csc':
drivers/media/platform/nxp/imx-pxp.h:582:38: error: initializer element is not constant
drivers/media/platform/nxp/imx-pxp.c:374:4: note: in expansion of macro 'BM_PXP_CSC1_COEF0_YCBCR_MODE'
drivers/media/platform/nxp/imx-pxp.h:582:38: note: (near initialization for 'csc1_coef_bt601_lim[0]')

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: ti: cal: Constify struct media_entity_operations
Christophe JAILLET [Mon, 24 Jun 2024 04:40:38 +0000 (06:40 +0200)]
media: ti: cal: Constify struct media_entity_operations

'struct media_entity_operations' is not modified in this driver.

Constifying this structure moves some data to a read-only section, so
increase overall security.

On a x86_64, with allmodconfig, as an example:
Before:
======
   text    data     bss     dec     hex filename
  20694    1394      32   22120    5668 drivers/media/platform/ti/cal/cal-camerarx.o

After:
=====
   text    data     bss     dec     hex filename
  20726    1362      32   22120    5668 drivers/media/platform/ti/cal/cal-camerarx.o

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: meson: vdec: add GXLX SoC platform
Christian Hewitt [Tue, 4 Jun 2024 05:15:33 +0000 (05:15 +0000)]
media: meson: vdec: add GXLX SoC platform

Add the GXLX SoC platform which is based on GXL but omits the VP9 codec.

Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agodt-bindings: media: amlogic,gx-vdec: add the GXLX SoC family and update GXL
Christian Hewitt [Tue, 4 Jun 2024 05:15:32 +0000 (05:15 +0000)]
dt-bindings: media: amlogic,gx-vdec: add the GXLX SoC family and update GXL

The GXLX SoC is a GXL variant that omits VP9 codec support. Also add S905W
and S905Y as GXL chips and sort the GXL comment.

Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agoDocumentation: media: Fix v4l2_av1_segmentation table formatting
Fritz Koenig [Thu, 30 May 2024 18:51:57 +0000 (11:51 -0700)]
Documentation: media: Fix v4l2_av1_segmentation table formatting

Fix incorrect formatting.

Signed-off-by: Fritz Koenig <frkoenig@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: added missing commit message]

10 months agomedia: verisilicon: Use fourcc format string
Michael Tretter [Tue, 28 May 2024 13:03:14 +0000 (15:03 +0200)]
media: verisilicon: Use fourcc format string

There is a fourcc format string for printing formats. Use it instead of
open coding the conversion.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: Drop explicit initialization of struct i2c_device_id::driver_data to 0
Uwe Kleine-König [Wed, 8 May 2024 13:20:42 +0000 (15:20 +0200)]
media: Drop explicit initialization of struct i2c_device_id::driver_data to 0

These drivers don't use the driver_data member of struct i2c_device_id,
so don't explicitly initialize this member.

This prepares putting driver_data in an anonymous union which requires
either no initialization or named designators. But it's also a nice
cleanup on its own.

While add it, also remove commas after the sentinel entries.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: platform: allegro-dvt: Constify struct regmap_config
Christophe JAILLET [Sun, 5 May 2024 07:28:25 +0000 (09:28 +0200)]
media: platform: allegro-dvt: Constify struct regmap_config

'allegro_regmap_config' and 'allegro_sram_config' are not modified in this
diver and are only used as a const struct regmap_config.

Constifying these structures moves some data to a read-only section, so
increase overall security.

On a x86_64, with allmodconfig:
Before:
   text    data     bss     dec     hex filename
  79587    3706     116   83409   145d1 drivers/media/platform/allegro-dvt/allegro-core.o

After:
   text    data     bss     dec     hex filename
  80219    3066     116   83401   145c9 drivers/media/platform/allegro-dvt/allegro-core.o

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: i2c: tvp5150: Constify some structures
Christophe JAILLET [Sun, 5 May 2024 07:24:02 +0000 (09:24 +0200)]
media: i2c: tvp5150: Constify some structures

'vbi_ram_default' and 'tvp5150_config' are not modified in this diver
and are only used as a const struct.

Constifying these structures moves some data to a read-only section, so
increase overall security.

On a x86_64, with allmodconfig:
Before:
   text    data     bss     dec     hex filename
  57197    2936      36   60169    eb09 drivers/media/i2c/tvp5150.o

After:
   text    data     bss     dec     hex filename
  57517    2608      36   60161    eb01 drivers/media/i2c/tvp5150.o

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: Documentation: Fix spelling of "blanking"
Sakari Ailus [Mon, 29 Apr 2024 19:10:09 +0000 (22:10 +0300)]
media: Documentation: Fix spelling of "blanking"

"Blanking" should be spelled as such, not "balanking". Fix it.

Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
10 months agomedia: cec: cec-adap.c: improve CEC_MSG_FL_REPLY_VENDOR_ID check
Hans Verkuil [Thu, 8 Aug 2024 09:09:18 +0000 (11:09 +0200)]
media: cec: cec-adap.c: improve CEC_MSG_FL_REPLY_VENDOR_ID check

The new CEC_MSG_FL_REPLY_VENDOR_ID flag only makes sense in combination
with CEC_MSG_VENDOR_COMMAND_WITH_ID. So rather than reporting an error
if that flag is set with another command, just clear the flag instead.

Only keep the message length check, since otherwise the flag would not
make sense.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
10 months agomedia: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
Hans Verkuil [Wed, 7 Aug 2024 07:22:10 +0000 (09:22 +0200)]
media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags

The cec_msg_set_reply_to() helper function never zeroed the
struct cec_msg flags field, this can cause unexpected behavior
if flags was uninitialized to begin with.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 0dbacebede1e ("[media] cec: move the CEC framework out of staging and to media")
Cc: <stable@vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
11 months agomedia: siano: Simplify smscore_load_firmware_from_file
Ricardo Ribalda [Mon, 5 Aug 2024 07:59:43 +0000 (07:59 +0000)]
media: siano: Simplify smscore_load_firmware_from_file

The function is never called with a loadfirmware_handler, so we can
remove some dead code.

We can also use this as a excuse to remove some unused type definitions.

This fixes the following smatch warning:
drivers/media/common/siano/smscoreapi.c:1172 smscore_load_firmware_from_file() error: we previously assumed 'loadfirmware_handler' could be null (see line 1150)

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Closes: https://lore.kernel.org/linux-media/99bd75a0-a6f3-4c47-bc89-70ffd87da756@xs4all.nl/T/#t
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
11 months agomedia: vivid: add <Vendor Command With ID> support
Hans Verkuil [Thu, 25 Jul 2024 08:06:39 +0000 (10:06 +0200)]
media: vivid: add <Vendor Command With ID> support

This makes it possible to test the new CEC_MSG_FL_REPLY_VENDOR_ID flag.

The vivid driver will Feature Abort any messages that do not have
exactly 1 payload byte. It ignores messages where the payload byte is
even, and where it is odd it will reply with the payload byte incremented
by 1. Basically a simple ping-pong command.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
11 months agomedia: cec: core: add new CEC_MSG_FL_REPLY_VENDOR_ID flag
Hans Verkuil [Thu, 4 Jul 2024 09:01:51 +0000 (11:01 +0200)]
media: cec: core: add new CEC_MSG_FL_REPLY_VENDOR_ID flag

If this flag is set, then the reply is expected to consist of
the CEC_MSG_VENDOR_COMMAND_WITH_ID opcode followed by the Vendor ID (as
used in bytes 1-4 of the message), followed by the struct cec_msg reply
field.

Note that this assumes that the byte after the Vendor ID is a
vendor-specific opcode.

This flag makes it easier to wait for replies to vendor commands,
using the same CEC framework support for waiting for regular replies.

Support for this flag is indicated by setting the new
CEC_CAP_REPLY_VENDOR_ID capability.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
11 months agoMerge tag 'v6.11-rc2' into media_stage
Mauro Carvalho Chehab [Mon, 5 Aug 2024 06:25:09 +0000 (08:25 +0200)]
Merge tag 'v6.11-rc2' into media_stage

Linux 6.11-rc2

* tag 'v6.11-rc2': (283 commits)
  Linux 6.11-rc2
  profiling: remove profile=sleep support
  arm: dts: arm: versatile-ab: Fix duplicate clock node name
  runtime constants: deal with old decrepit linkers
  clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
  cifs: update internal version number
  smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
  smb3: add dynamic tracepoints for shutdown ioctl
  cifs: Remove cifs_aio_ctx
  smb: client: handle lack of FSCTL_GET_REPARSE_POINT support
  arm64: jump_label: Ensure patched jump_labels are visible to all CPUs
  syscalls: fix syscall macros for newfstat/newfstatat
  uretprobe: change syscall number, again
  thermal: core: Update thermal zone registration documentation
  Revert "nouveau: rip out busy fence waits"
  protect the fetch of ->fd[fd] in do_dup2() from mispredictions
  x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit
  riscv: Fix linear mapping checks for non-contiguous memory regions
  KVM: x86/mmu: fix determination of max NPT mapping level for private pages
  PCI: pciehp: Retain Power Indicator bits for userspace indicators
  ...

11 months agoLinux 6.11-rc2
Linus Torvalds [Sun, 4 Aug 2024 20:50:53 +0000 (13:50 -0700)]
Linux 6.11-rc2

11 months agoprofiling: remove profile=sleep support
Tetsuo Handa [Sun, 4 Aug 2024 09:48:10 +0000 (18:48 +0900)]
profiling: remove profile=sleep support

The kernel sleep profile is no longer working due to a recursive locking
bug introduced by commit 42a20f86dc19 ("sched: Add wrapper for get_wchan()
to keep task blocked")

Booting with the 'profile=sleep' kernel command line option added or
executing

  # echo -n sleep > /sys/kernel/profiling

after boot causes the system to lock up.

Lockdep reports

  kthreadd/3 is trying to acquire lock:
  ffff93ac82e08d58 (&p->pi_lock){....}-{2:2}, at: get_wchan+0x32/0x70

  but task is already holding lock:
  ffff93ac82e08d58 (&p->pi_lock){....}-{2:2}, at: try_to_wake_up+0x53/0x370

with the call trace being

   lock_acquire+0xc8/0x2f0
   get_wchan+0x32/0x70
   __update_stats_enqueue_sleeper+0x151/0x430
   enqueue_entity+0x4b0/0x520
   enqueue_task_fair+0x92/0x6b0
   ttwu_do_activate+0x73/0x140
   try_to_wake_up+0x213/0x370
   swake_up_locked+0x20/0x50
   complete+0x2f/0x40
   kthread+0xfb/0x180

However, since nobody noticed this regression for more than two years,
let's remove 'profile=sleep' support based on the assumption that nobody
needs this functionality.

Fixes: 42a20f86dc19 ("sched: Add wrapper for get_wchan() to keep task blocked")
Cc: stable@vger.kernel.org # v5.16+
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
11 months agoMerge tag 'x86-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git...
Linus Torvalds [Sun, 4 Aug 2024 15:57:08 +0000 (08:57 -0700)]
Merge tag 'x86-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Thomas Gleixner:

 - Prevent a deadlock on cpu_hotplug_lock in the aperf/mperf driver.

   A recent change in the ACPI code which consolidated code pathes moved
   the invocation of init_freq_invariance_cppc() to be moved to a CPU
   hotplug handler. The first invocation on AMD CPUs ends up enabling a
   static branch which dead locks because the static branch enable tries
   to acquire cpu_hotplug_lock but that lock is already held write by
   the hotplug machinery.

   Use static_branch_enable_cpuslocked() instead and take the hotplug
   lock read for the Intel code path which is invoked from the
   architecture code outside of the CPU hotplug operations.

 - Fix the number of reserved bits in the sev_config structure bit field
   so that the bitfield does not exceed 64 bit.

 - Add missing Zen5 model numbers

 - Fix the alignment assumptions of pti_clone_pgtable() and
   clone_entry_text() on 32-bit:

   The code assumes PMD aligned code sections, but on 32-bit the kernel
   entry text is not PMD aligned. So depending on the code size and
   location, which is configuration and compiler dependent, entry text
   can cross a PMD boundary. As the start is not PMD aligned adding PMD
   size to the start address is larger than the end address which
   results in partially mapped entry code for user space. That causes
   endless recursion on the first entry from userspace (usually #PF).

   Cure this by aligning the start address in the addition so it ends up
   at the next PMD start address.

   clone_entry_text() enforces PMD mapping, but on 32-bit the tail might
   eventually be PTE mapped, which causes a map fail because the PMD for
   the tail is not a large page mapping. Use PTI_LEVEL_KERNEL_IMAGE for
   the clone() invocation which resolves to PTE on 32-bit and PMD on
   64-bit.

 - Zero the 8-byte case for get_user() on range check failure on 32-bit

   The recend consolidation of the 8-byte get_user() case broke the
   zeroing in the failure case again. Establish it by clearing ECX
   before the range check and not afterwards as that obvioulsy can't be
   reached when the range check fails

* tag 'x86-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit
  x86/mm: Fix pti_clone_entry_text() for i386
  x86/mm: Fix pti_clone_pgtable() alignment assumption
  x86/setup: Parse the builtin command line before merging
  x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
  x86/sev: Fix __reserved field in sev_config
  x86/aperfmperf: Fix deadlock on cpu_hotplug_lock

11 months agoMerge tag 'timers-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel...
Linus Torvalds [Sun, 4 Aug 2024 15:50:16 +0000 (08:50 -0700)]
Merge tag 'timers-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fixes from Thomas Gleixner:
 "Two fixes for the timer/clocksource code:

   - The recent fix to make the take over of the broadcast timer more
     reliable retrieves a per CPU pointer in preemptible context.

     This went unnoticed in testing as some compilers hoist the access
     into the non-preemotible section where the pointer is actually
     used, but obviously compilers can rightfully invoke it where the
     code put it.

     Move it into the non-preemptible section right to the actual usage
     side to cure it.

   - The clocksource watchdog is supposed to emit a warning when the
     retry count is greater than one and the number of retries reaches
     the limit.

     The condition is backwards and warns always when the count is
     greater than one. Fixup the condition to prevent spamming dmesg"

* tag 'timers-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
  tick/broadcast: Move per CPU pointer access into the atomic section

11 months agoMerge tag 'sched-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel...
Linus Torvalds [Sun, 4 Aug 2024 15:46:14 +0000 (08:46 -0700)]
Merge tag 'sched-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler fixes from Thomas Gleixner:

 - When stime is larger than rtime due to accounting imprecision, then
   utime = rtime - stime becomes negative. As this is unsigned math, the
   result becomes a huge positive number.

   Cure it by resetting stime to rtime in that case, so utime becomes 0.

 - Restore consistent state when sched_cpu_deactivate() fails.

   When offlining a CPU fails in sched_cpu_deactivate() after the SMT
   present counter has been decremented, then the function aborts but
   fails to increment the SMT present counter and leaves it imbalanced.
   Consecutive operations cause it to underflow. Add the missing fixup
   for the error path.

   For SMT accounting the runqueue needs to marked online again in the
   error exit path to restore consistent state.

* tag 'sched-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/core: Fix unbalance set_rq_online/offline() in sched_cpu_deactivate()
  sched/core: Introduce sched_set_rq_on/offline() helper
  sched/smt: Fix unbalance sched_smt_present dec/inc
  sched/smt: Introduce sched_smt_present_inc/dec() helper
  sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime

11 months agoMerge tag 'perf-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git...
Linus Torvalds [Sun, 4 Aug 2024 15:42:18 +0000 (08:42 -0700)]
Merge tag 'perf-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 perf fixes from Thomas Gleixner:

 - Move the smp_processor_id() invocation back into the non-preemtible
   region, so that the result is valid to use

 - Add the missing package C2 residency counters for Sierra Forest CPUs
   to make the newly added support actually useful

* tag 'perf-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86: Fix smp_processor_id()-in-preemptible warnings
  perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra Forest

11 months agoMerge tag 'irq-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git...
Linus Torvalds [Sun, 4 Aug 2024 15:36:57 +0000 (08:36 -0700)]
Merge tag 'irq-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq fixes from Thomas Gleixner:
 "A couple of fixes for interrupt chip drivers:

   - Make sure to skip the clear register space in the MBIGEN driver
     when calculating the node register index. Otherwise the clear
     register is clobbered and the wrong node registers are accessed.

   - Fix a signed/unsigned confusion in the loongarch CPU driver which
     converts an error code to a huge "valid" interrupt number.

   - Convert the mesion GPIO interrupt controller lock to a raw spinlock
     so it works on RT.

   - Add a missing static to a internal function in the pic32 EVIC
     driver"

* tag 'irq-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/mbigen: Fix mbigen node address layout
  irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t'
  irqchip/irq-pic32-evic: Add missing 'static' to internal function
  irqchip/loongarch-cpu: Fix return value of lpic_gsi_to_irq()

11 months agoMerge tag 'locking-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel...
Linus Torvalds [Sun, 4 Aug 2024 15:32:31 +0000 (08:32 -0700)]
Merge tag 'locking-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fixes from Thomas Gleixner:
 "Two fixes for locking and jump labels:

   - Ensure that the atomic_cmpxchg() conditions are correct and
     evaluating to true on any non-zero value except 1. The missing
     check of the return value leads to inconsisted state of the jump
     label counter.

   - Add a missing type conversion in the paravirt spinlock code which
     makes loongson build again"

* tag 'locking-urgent-2024-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  jump_label: Fix the fix, brown paper bags galore
  locking/pvqspinlock: Correct the type of "old" variable in pv_kick_node()

11 months agoarm: dts: arm: versatile-ab: Fix duplicate clock node name
Rob Herring (Arm) [Tue, 30 Jul 2024 21:00:30 +0000 (15:00 -0600)]
arm: dts: arm: versatile-ab: Fix duplicate clock node name

Commit 04f08ef291d4 ("arm/arm64: dts: arm: Use generic clock and
regulator nodenames") renamed nodes and created 2 "clock-24000000" nodes
(at different paths).

The kernel can't handle these duplicate names even though they are at
different paths.  Fix this by renaming one of the nodes to "clock-pclk".

This name is aligned with other Arm boards (those didn't have a known
frequency to use in the node name).

Fixes: 04f08ef291d4 ("arm/arm64: dts: arm: Use generic clock and regulator nodenames")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Tested-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
11 months agoMerge tag '6.11-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Linus Torvalds [Sun, 4 Aug 2024 15:18:40 +0000 (08:18 -0700)]
Merge tag '6.11-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - two reparse point fixes

 - minor cleanup

 - additional trace point (to help debug a recent problem)

* tag '6.11-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: update internal version number
  smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
  smb3: add dynamic tracepoints for shutdown ioctl
  cifs: Remove cifs_aio_ctx
  smb: client: handle lack of FSCTL_GET_REPARSE_POINT support

11 months agoMerge tag 'media/v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab...
Linus Torvalds [Sun, 4 Aug 2024 15:12:33 +0000 (08:12 -0700)]
Merge tag 'media/v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media fixes from Mauro Carvalho Chehab:

 - two Kconfig fixes

 - one fix for the UVC driver addressing probing time detection of a UVC
   custom controls

 - one fix related to PDF generation

* tag 'media/v6.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: v4l: Fix missing tabular column hint for Y14P format
  media: intel/ipu6: select AUXILIARY_BUS in Kconfig
  media: ipu-bridge: fix ipu6 Kconfig dependencies
  media: uvcvideo: Fix custom control mapping probing

11 months agoMerge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Linus Torvalds [Sat, 3 Aug 2024 22:12:56 +0000 (15:12 -0700)]
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "One core change that reverts the double message print patch in sd.c
  (it was causing regressions on embedded systems).

  The rest are driver fixes in ufs, mpt3sas and mpi3mr"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: exynos: Don't resume FMP when crypto support is disabled
  scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
  scsi: mpi3mr: Avoid IOMMU page faults on REPORT ZONES
  scsi: ufs: core: Do not set link to OFF state while waking up from hibernation
  scsi: Revert "scsi: sd: Do not repeat the starting disk message"
  scsi: ufs: core: Fix deadlock during RTC update
  scsi: ufs: core: Bypass quick recovery if force reset is needed
  scsi: ufs: core: Check LSDBS cap when !mcq

11 months agoMerge tag 'xfs-6.11-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Linus Torvalds [Sat, 3 Aug 2024 16:09:25 +0000 (09:09 -0700)]
Merge tag 'xfs-6.11-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Chandan Babu:

 - Fix memory leak when corruption is detected during scrubbing parent
   pointers

 - Allow SECURE namespace xattrs to use reserved block pool to in order
   to prevent ENOSPC

 - Save stack space by passing tracepoint's char array to file_path()
   instead of another stack variable

 - Remove unused parameter in macro XFS_DQUOT_LOGRES

 - Replace comma with semicolon in a couple of places

* tag 'xfs-6.11-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: convert comma to semicolon
  xfs: convert comma to semicolon
  xfs: remove unused parameter in macro XFS_DQUOT_LOGRES
  xfs: fix file_path handling in tracepoints
  xfs: allow SECURE namespace xattrs to use reserved block pool
  xfs: fix a memory leak

11 months agoMerge tag 'parisc-for-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git...
Linus Torvalds [Sat, 3 Aug 2024 16:03:21 +0000 (09:03 -0700)]
Merge tag 'parisc-for-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux

Pull parisc architecture fixes from Helge Deller:

 - fix unaligned memory accesses when calling BPF functions

 - adjust memory size constants to fix possible DMA corruptions

* tag 'parisc-for-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: fix a possible DMA corruption
  parisc: fix unaligned accesses in BPF

11 months agoruntime constants: deal with old decrepit linkers
Linus Torvalds [Sat, 3 Aug 2024 01:12:06 +0000 (18:12 -0700)]
runtime constants: deal with old decrepit linkers

The runtime constants linker script depended on documented linker
behavior [1]:

 "If an output section’s name is the same as the input section’s name
  and is representable as a C identifier, then the linker will
  automatically PROVIDE two symbols: __start_SECNAME and __stop_SECNAME,
  where SECNAME is the name of the section. These indicate the start
  address and end address of the output section respectively"

to just automatically define the symbol names for the bounds of the
runtime constant arrays.

It turns out that this isn't actually something we can rely on, with old
linkers not generating these automatic symbols.  It looks to have been
introduced in binutils-2.29 back in 2017, and we still support building
with versions all the way back to binutils-2.25 (from 2015).

And yes, Oleg actually seems to be using such ancient versions of
binutils.

So instead of depending on the implicit symbols from "section names
match and are representable C identifiers", just do this all manually.
It's not like it causes us any extra pain, we already have to do that
for all the other sections that we use that often have special
characters in them.

Reported-and-tested-by: Oleg Nesterov <oleg@redhat.com>
Link: https://sourceware.org/binutils/docs/ld/Input-Section-Example.html
Link: https://lore.kernel.org/all/20240802114518.GA20924@redhat.com/
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
11 months agoMerge tag 'tags/fixes-media-uvc-20230722' of git://git.kernel.org/pub/scm/linux/kerne...
Hans Verkuil [Sat, 3 Aug 2024 09:01:04 +0000 (11:01 +0200)]
Merge tag 'tags/fixes-media-uvc-20230722' of git://git.kernel.org/pub/scm/linux/kernel/git/pinchartl/linux.git

uvcvideo v6.11 regression fix: fix custom control mapping probing

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
11 months agoMerge tag 'io_uring-6.11-20240802' of git://git.kernel.dk/linux
Linus Torvalds [Fri, 2 Aug 2024 21:18:31 +0000 (14:18 -0700)]
Merge tag 'io_uring-6.11-20240802' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:
 "Two minor tweaks for the NAPI handling, both from Olivier:

   - Kill two unused list definitions

   - Ensure that multishot NAPI doesn't age away"

* tag 'io_uring-6.11-20240802' of git://git.kernel.dk/linux:
  io_uring: remove unused local list heads in NAPI functions
  io_uring: keep multishot request NAPI timeout current

11 months agoMerge tag 'thermal-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael...
Linus Torvalds [Fri, 2 Aug 2024 21:10:11 +0000 (14:10 -0700)]
Merge tag 'thermal-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull thermal control fixes from Rafael Wysocki:
 "These fix a few issues related to the MSI IRQs management in the
  int340x thermal driver, fix a thermal core issue that may lead to
  missing trip point crossing events and update the thermal core
  documentation.

  Specifics:

   - Fix MSI error path cleanup in int340x, allow it to work with a
     subset of thermal MSI IRQs if some of them are not working and make
     it free all MSI IRQs on module exit (Srinivas Pandruvada)

   - Fix a thermal core issue that may lead to missing trip point
     crossing events in some cases when thermal_zone_set_trips() is used
     and update the thermal core documentation (Rafael Wysocki)"

* tag 'thermal-6.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal: core: Update thermal zone registration documentation
  thermal: trip: Avoid skipping trips in thermal_zone_set_trips()
  thermal: intel: int340x: Free MSI IRQ vectors on module exit
  thermal: intel: int340x: Allow limited thermal MSI support
  thermal: intel: int340x: Fix kernel warning during MSI cleanup

11 months agoMerge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Linus Torvalds [Fri, 2 Aug 2024 20:46:43 +0000 (13:46 -0700)]
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Catalin Marinas:

 - Expand the speculative SSBS errata workaround to more CPUs

 - Ensure jump label changes are visible to all CPUs with a
   kick_all_cpus_sync() (and also enable jump label batching as part of
   the fix)

 - The shadow call stack sanitiser is currently incompatible with Rust,
   make CONFIG_RUST conditional on !CONFIG_SHADOW_CALL_STACK

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: jump_label: Ensure patched jump_labels are visible to all CPUs
  rust: SHADOW_CALL_STACK is incompatible with Rust
  arm64: errata: Expand speculative SSBS workaround (again)
  arm64: cputype: Add Cortex-A725 definitions
  arm64: cputype: Add Cortex-X1C definitions

11 months agoMerge tag 'ceph-for-6.11-rc2' of https://github.com/ceph/ceph-client
Linus Torvalds [Fri, 2 Aug 2024 17:33:06 +0000 (10:33 -0700)]
Merge tag 'ceph-for-6.11-rc2' of https://github.com/ceph/ceph-client

Pull ceph fix from Ilya Dryomov:
 "A fix for a potential hang in the MDS when cap revocation races with
  the client releasing the caps in question, marked for stable"

* tag 'ceph-for-6.11-rc2' of https://github.com/ceph/ceph-client:
  ceph: force sending a cap update msg back to MDS for revoke op