platform/kernel/linux-rpi.git
16 months agomedia: samsung: exynos4-is: drop simple-bus from compatibles
Krzysztof Kozlowski [Mon, 13 Mar 2023 14:49:09 +0000 (15:49 +0100)]
media: samsung: exynos4-is: drop simple-bus from compatibles

The FIMC camera node wrapper is not a bus, so using simple-bus fallback
compatible just to instantiate its children nodes was never correct.
Driver should explicitly populate all its children devices.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: samsung: exynos4-is: do not require pinctrl
Krzysztof Kozlowski [Mon, 13 Mar 2023 14:49:08 +0000 (15:49 +0100)]
media: samsung: exynos4-is: do not require pinctrl

Driver does not handle pin configuration switching and several DTS
provide empty pinctrl property, just to satisfy the driver's requirement
for it.  Drop requirement for pinctrl property as it is really optional.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: dt-bindings: samsung-fimc: drop simple-bus
Krzysztof Kozlowski [Mon, 13 Mar 2023 14:49:07 +0000 (15:49 +0100)]
media: dt-bindings: samsung-fimc: drop simple-bus

The FIMC camera node wrapper is not a bus, so using simple-bus fallback
compatible just to instantiate its children nodes was never correct.
Drop the simple-bus compatible and expect driver to explicitly populate
children devices.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: docs: media: v4l: uapi: Fix field type for SUBDEV_ENUM_FRAME_SIZE
Paul Elder [Mon, 13 Feb 2023 10:56:28 +0000 (11:56 +0100)]
media: docs: media: v4l: uapi: Fix field type for SUBDEV_ENUM_FRAME_SIZE

The documentation for the VIDIOC_SUBDEV_ENUM_FRAME_SIZE ioctl
incorrectly refers to struct v4l2_subdev_mbus_code_enum as the
parameter. Fix this.

[Sakari Ailus: Rebased on top of Dorota's documentation patch]

Signed-off-by: Paul Elder <paul.elder@ideasonboard.com>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: media api: Try to make enum usage clearer
Dorota Czaplejewicz [Sun, 19 Feb 2023 11:01:21 +0000 (12:01 +0100)]
media: media api: Try to make enum usage clearer

This clarifies which side of the calls is responsible for doing what to
which parts of the struct. It also expands the terse description of the
access algorithm into more prose-like, active voice description, which
trades conciseness for ease of comprehension.

Fixed: typo "format" -> "frame size" in enum-frame-size
Added: no holes in the enumeration
Added: enumerations per what?
Added: who fills in what in calls
Changed: "given" -> "specified"

[Sakari Ailus: Rewrap text]

Signed-off-by: Dorota Czaplejewicz <dorota.czaplejewicz@puri.sm>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: doc/media api: Try to make enum usage clearer
Dorota Czaplejewicz [Sun, 19 Feb 2023 11:00:34 +0000 (12:00 +0100)]
media: doc/media api: Try to make enum usage clearer

This clarifies which side of the calls is responsible for doing what to
which parts of the struct. This also explicitly states that repeating
values are disallowed. It also expands the terse description of the access
algorithm into more prose-like, active voice description, which trades
conciseness for ease of comprehension.

Added: mbus codes must not repeat
Added: no holes in the enumeration
Added: enumerations per what?
Added: who fills in what in calls
Changed: "zero" -> "0"
Changed: "given" -> "specified"

Still unclear how it works so didn't describe: "which". What is a "try
format" vs "active format"?

[Sakari Ailus: Rewrap lines, fix build issue]

Signed-off-by: Dorota Czaplejewicz <dorota.czaplejewicz@puri.sm>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Add support for imx327 variant
Alexander Stein [Fri, 17 Feb 2023 09:52:21 +0000 (10:52 +0100)]
media: i2c: imx290: Add support for imx327 variant

Both sensors are quite similar. Their specs only differ regarding LVDS
and parallel output but are identical regarding MIPI-CSI-2 interface.
But they use a different init setting of hard-coded values, taken from
the datasheet.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: dt-bindings: media: i2c: Add imx327 version to IMX327 bindings
Alexander Stein [Fri, 17 Feb 2023 09:52:20 +0000 (10:52 +0100)]
media: dt-bindings: media: i2c: Add imx327 version to IMX327 bindings

The imx290 driver can be used for both imx290 and imx327 as they have a
similar register set and configuration. imx327 lacks 8 lanes LVDS and
120 FPS support.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Add the error code to logs in start_streaming
Dave Stevenson [Wed, 15 Feb 2023 22:30:03 +0000 (23:30 +0100)]
media: i2c: imx290: Add the error code to logs in start_streaming

imx290_start_streaming logs what failed, but not the error
code from that function. Add it into the log message.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Add support for H & V Flips
Dave Stevenson [Wed, 15 Feb 2023 22:30:02 +0000 (23:30 +0100)]
media: i2c: imx290: Add support for H & V Flips

The sensor supports H & V flips, so add the relevant hooks for
V4L2_CID_HFLIP and V4L2_CID_VFLIP to configure them.

Note that the Bayer order is maintained as the readout area
shifts by 1 pixel in the appropriate direction (note the
comment about the top margin being 8 pixels whilst the bottom
margin is 9). The V4L2_SEL_TGT_CROP region is therefore
adjusted appropriately.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Add support for 74.25MHz external clock
Dave Stevenson [Wed, 15 Feb 2023 22:30:01 +0000 (23:30 +0100)]
media: i2c: imx290: Add support for 74.25MHz external clock

The sensor supports either a 37.125 or 74.25MHz external, but
the driver only supported 37.125MHz.

Add the relevant register configuration for either clock
frequency option.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Remove duplicated write to IMX290_CTRL_07
Dave Stevenson [Wed, 15 Feb 2023 22:30:00 +0000 (23:30 +0100)]
media: i2c: imx290: Remove duplicated write to IMX290_CTRL_07

IMX290_CTRL_07 was written from both imx290_global_init_settings
and imx290_1080p_settings and imx290_720p_settings.

Remove it from imx290_global_init_settings as the setting varies
based on the mode.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: VMAX is mode dependent
Dave Stevenson [Wed, 15 Feb 2023 22:29:59 +0000 (23:29 +0100)]
media: i2c: imx290: VMAX is mode dependent

The default VMAX for 60fps in 720p mode is 750 according to the
datasheet, however the driver always left it at 1125 thereby stopping
60fps being achieved.

Make VMAX (and therefore V4L2_CID_VBLANK) mode dependent so that 720p60
can be achieved.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Convert V4L2_CID_VBLANK to read/write
Dave Stevenson [Wed, 15 Feb 2023 22:29:58 +0000 (23:29 +0100)]
media: i2c: imx290: Convert V4L2_CID_VBLANK to read/write

The driver exposed V4L2_CID_VBLANK as a read only control to allow
for exposure calculations and determination of the frame rate.

Convert to a read/write control so that the frame rate can be
controlled.
V4L2_CID_VBLANK also sets the limits for the exposure control,
therefore exposure ranges have to be updated when vblank changes
(either via s_ctrl, or via changing mode).

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Convert V4L2_CID_HBLANK to read/write
Dave Stevenson [Wed, 15 Feb 2023 22:29:57 +0000 (23:29 +0100)]
media: i2c: imx290: Convert V4L2_CID_HBLANK to read/write

The driver exposed V4L2_CID_HBLANK as a read only control to allow
for exposure calculations and determination of the frame rate.

Convert to a read/write control so that the frame rate can be
controlled.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Use CSI timings as per datasheet
Dave Stevenson [Wed, 15 Feb 2023 22:29:56 +0000 (23:29 +0100)]
media: i2c: imx290: Use CSI timings as per datasheet

Commit "98e0500eadb7 media: i2c: imx290: Add configurable link frequency
and pixel rate" added support for the increased link frequencies
on 2 data lanes, but didn't update the CSI timing registers in
accordance with the datasheet.

Use the specified settings.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Support 60fps in 2 lane operation
Dave Stevenson [Wed, 15 Feb 2023 22:29:55 +0000 (23:29 +0100)]
media: i2c: imx290: Support 60fps in 2 lane operation

Commit "97589ad61c73 media: i2c: imx290: Add support for 2 data lanes"
added support for running in two lane mode (instead of 4), but
without changing the link frequency that resulted in a max of 30fps.

Commit "98e0500eadb7 media: i2c: imx290: Add configurable link frequency
and pixel rate" then doubled the link frequency when in 2 lane mode,
but didn't undo the correction for running at only 30fps, just extending
horizontal blanking instead.

Remove the 30fps limit on 2 lane by correcting the register config
in accordance with the datasheet for 60fps operation over 2 lanes.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Fix the pixel rate at 148.5Mpix/s
Dave Stevenson [Wed, 15 Feb 2023 22:29:54 +0000 (23:29 +0100)]
media: i2c: imx290: Fix the pixel rate at 148.5Mpix/s

The datasheet lists the link frequency changes between
1080p and 720p modes. This is correct that the link frequency
changes as measured on an oscilloscope.

Link frequency is not necessarily the same as pixel rate.

The datasheet gives standard configurations for 1080p and 720p
modes at a number of frame rates.
Looking at the 1080p mode it gives:
HMAX = 0x898 = 2200
VMAX = 0x465 = 1125
2200 * 1125 * 60fps = 148.5MPix/s

Looking at the 720p mode it gives:
HMAX = 0xce4 = 3300
VMAX = 0x2ee = 750
3300 * 750 * 60fps = 148.5Mpix/s

This driver currently scales the pixel rate proportionally to the
link frequency, however the above shows that this is not the
correct thing to do, and currently all frame rate and exposure
calculations give incorrect results.

Correctly report the pixel rate as being 148.5MPix/s under any
mode.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Add V4L2_SUBDEV_FL_HAS_EVENTS and subscribe hooks
Dave Stevenson [Wed, 15 Feb 2023 22:29:53 +0000 (23:29 +0100)]
media: i2c: imx290: Add V4L2_SUBDEV_FL_HAS_EVENTS and subscribe hooks

Any V4L2 subdevice that implements controls and declares
V4L2_SUBDEV_FL_HAS_DEVNODE should also declare V4L2_SUBDEV_FL_HAS_EVENTS
and implement subscribe_event and unsubscribe_event hooks.

This driver didn't and would therefore fail v4l2-compliance
testing.

Add the relevant hooks.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Set the colorspace fields in the format
Dave Stevenson [Wed, 15 Feb 2023 22:29:52 +0000 (23:29 +0100)]
media: i2c: imx290: Set the colorspace fields in the format

The colorspace fields were left untouched in imx290_set_fmt
which lead to a v4l2-compliance failure.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Match kernel coding style on whitespace
Dave Stevenson [Wed, 15 Feb 2023 22:29:51 +0000 (23:29 +0100)]
media: i2c: imx290: Match kernel coding style on whitespace

Fix up a couple of coding style issues regarding missing blank
lines after declarations, double blank lines, and incorrect
indentation.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Add support for the mono sensor variant
Dave Stevenson [Wed, 15 Feb 2023 22:29:50 +0000 (23:29 +0100)]
media: i2c: imx290: Add support for the mono sensor variant

The IMX290 module is available as either mono or colour (Bayer).

Update the driver so that it can advertise the correct mono
formats instead of the colour ones.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: dt-bindings: media: i2c: Add mono version to IMX290 bindings
Dave Stevenson [Wed, 15 Feb 2023 22:29:49 +0000 (23:29 +0100)]
media: dt-bindings: media: i2c: Add mono version to IMX290 bindings

The IMX290 module is available as either monochrome or colour and
the variant is not detectable at runtime.

Add a new compatible string for the monochrome version, based on the
full device name IMX290LLR. For consistency, add a new compatible string
for the colour version based on the IMX290LQR full device name, and
deprecate the current ambiguous compatible string.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: ov5647: Use bus-locked i2c_transfer()
Jacopo Mondi [Tue, 21 Feb 2023 17:10:48 +0000 (18:10 +0100)]
media: i2c: ov5647: Use bus-locked i2c_transfer()

The ov5647_read() functions calls i2c_master_send() and
i2c_master_read() in sequence. However this leaves space for other
clients to contend the bus and insert an unrelated transaction in between
the two calls.

Replace the two calls with a single i2c_transfer() one, that locks the
bus in between the transactions.

Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Tommaso Merciai <tomm.merciai@gmail.com>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: ov5647: Add test pattern control
Valentine Barshak [Tue, 21 Feb 2023 17:10:47 +0000 (18:10 +0100)]
media: i2c: ov5647: Add test pattern control

This adds V4L2_CID_TEST_PATTERN control support.

Signed-off-by: Valentine Barshak <valentine.barshak@cogentembedded.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Tommaso Merciai <tomm.merciai@gmail.com>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Use device_property_read_u32() directly
Andy Shevchenko [Thu, 9 Feb 2023 22:09:54 +0000 (23:09 +0100)]
media: i2c: imx290: Use device_property_read_u32() directly

No need to call fwnode_property_read_u32(dev_fwnode()), when
we have already existing helper. So use it.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: Make use of get_unaligned_le24(), put_unaligned_le24()
Andy Shevchenko [Thu, 9 Feb 2023 22:12:05 +0000 (23:12 +0100)]
media: i2c: imx290: Make use of get_unaligned_le24(), put_unaligned_le24()

Since we have a proper endianness converters for LE 24-bit data use them.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: subdev: Add V4L2_SUBDEV_ROUTING_NO_MULTIPLEXING
Tomi Valkeinen [Thu, 2 Mar 2023 09:57:48 +0000 (10:57 +0100)]
media: subdev: Add V4L2_SUBDEV_ROUTING_NO_MULTIPLEXING

A common case with subdev routing is that on the subdevice just before
the DMA engines (video nodes), no multiplexing is allowed on the source
pads, as the DMA engine can only handle a single stream.

In some other situations one might also want to do the same check on the
sink side.

Add new routing validation flags to check these:
V4L2_SUBDEV_ROUTING_NO_SINK_MULTIPLEXING and
V4L2_SUBDEV_ROUTING_NO_SOURCE_MULTIPLEXING.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: subdev: Split V4L2_SUBDEV_ROUTING_NO_STREAM_MIX
Tomi Valkeinen [Thu, 2 Mar 2023 09:57:47 +0000 (10:57 +0100)]
media: subdev: Split V4L2_SUBDEV_ROUTING_NO_STREAM_MIX

V4L2_SUBDEV_ROUTING_NO_STREAM_MIX routing validation flag means that all
routes from a sink pad must go to the same source pad and all routes
going to the same source pad must originate from the same sink pad.

This does not cover all use cases. For example, if a device routes
all streams from a single sink pad to any of the source pads, but
streams from multiple sink pads can go to the same source pad, the
current flag is too restrictive.

Split the flag into two parts, V4L2_SUBDEV_ROUTING_NO_SINK_STREAM_MIX
and V4L2_SUBDEV_ROUTING_NO_SOURCE_STREAM_MIX, which add the restriction
only on one side of the device. Together they mean the same as
V4L2_SUBDEV_ROUTING_NO_STREAM_MIX.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: subdev: Use 'shall' instead of 'may' in route validation
Tomi Valkeinen [Thu, 2 Mar 2023 09:57:46 +0000 (10:57 +0100)]
media: subdev: Use 'shall' instead of 'may' in route validation

Route validation docs use the word 'may'. Change that to 'shall' for
emphasis.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: st-vgxy61: Use VGXY61_NB_POLARITIES instead of hardcoded value in tx_from_ep
Benjamin Mugnier [Wed, 1 Feb 2023 14:04:17 +0000 (15:04 +0100)]
media: i2c: st-vgxy61: Use VGXY61_NB_POLARITIES instead of hardcoded value in tx_from_ep

tx_from_ep's for loop uses '5' as bound, while in fact it refers to the
number of polarities. Replace it by VGXY61_NB_POLARITIES for
factorization.

Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: st-vgxy61: Fix control flow error on probe
Benjamin Mugnier [Wed, 1 Feb 2023 14:04:16 +0000 (15:04 +0100)]
media: i2c: st-vgxy61: Fix control flow error on probe

In case of error 'update_hdr' now goes through 'power_off' instead of
returning, effectively shutting down the sensor.

Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: st-vgxy61: Move 'detect' call to 'power_on'
Benjamin Mugnier [Wed, 1 Feb 2023 14:04:15 +0000 (15:04 +0100)]
media: i2c: st-vgxy61: Move 'detect' call to 'power_on'

Previously the device detection was performed after patching.
Move it right after the reset to make sure we have the correct sensor
before trying to patch it.

Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: st-vgxy61: Remove duplicate default mode set on probe
Benjamin Mugnier [Wed, 1 Feb 2023 14:04:14 +0000 (15:04 +0100)]
media: i2c: st-vgxy61: Remove duplicate default mode set on probe

At this stage the default mode is unknown.
This is done correctly by vgxy61_fill_framefmt right after.

Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: Documentation: userspace-api: media: drop clipping, destructive overlays
Hans Verkuil [Thu, 2 Mar 2023 12:57:31 +0000 (13:57 +0100)]
media: Documentation: userspace-api: media: drop clipping, destructive overlays

Support for clipping for overlays has been removed, update the
documentation.

Support for destructive overlay support has been removed as well,
also update the documentation for this.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: v4l2-core: zero field base in struct v4l2_framebuffer
Hans Verkuil [Thu, 2 Mar 2023 12:57:30 +0000 (13:57 +0100)]
media: v4l2-core: zero field base in struct v4l2_framebuffer

Make sure this field is always 0 since destructive overlays
are no longer supported.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: videodev.h: drop V4L2_FBUF_CAP_LIST/BITMAP_CLIPPING
Hans Verkuil [Thu, 2 Mar 2023 12:57:29 +0000 (13:57 +0100)]
media: videodev.h: drop V4L2_FBUF_CAP_LIST/BITMAP_CLIPPING

These two capabilities are no longer supported, so no
longer define them when compiling the kernel.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: v4l2-core: drop v4l2_window clipping and bitmap support
Hans Verkuil [Thu, 2 Mar 2023 12:57:28 +0000 (13:57 +0100)]
media: v4l2-core: drop v4l2_window clipping and bitmap support

There are no longer any drivers that support clipping and bitmap
support for the capture or output overlay interfaces, so drop
this.

Always set the bitmap, clips and clipcount fields to 0, and
remove the compat32 support.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: vivid: drop bitmap and clipping output overlay support
Hans Verkuil [Thu, 2 Mar 2023 12:57:27 +0000 (13:57 +0100)]
media: vivid: drop bitmap and clipping output overlay support

This test driver is the only remaining driver still using
the clipping and bitmap method. Drop support for this so
we can remove this in the V4L2 API as well.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: vivid: drop overlay support
Hans Verkuil [Thu, 2 Mar 2023 12:57:26 +0000 (13:57 +0100)]
media: vivid: drop overlay support

Destructive overlay support (i.e. where the video frame is DMA-ed
straight into a framebuffer) is effectively dead. It was a
necessary evil in the early days when computers were not fast enough
to copy SDTV video frames around, but today that's no longer a problem.

It requires access to the framebuffer memory, which is a bad idea and
very hard to do safely. In addition, in drm it is today almost
impossible to get hold of the framebuffer address.

So drop support for this.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: bttv: drop overlay support
Hans Verkuil [Thu, 2 Mar 2023 12:57:25 +0000 (13:57 +0100)]
media: bttv: drop overlay support

Destructive overlay support (i.e. where the video frame is DMA-ed
straight into a framebuffer) is effectively dead. It was a
necessary evil in the early days when computers were not fast enough
to copy SDTV video frames around, but today that's no longer a problem.

It requires access to the framebuffer memory, which is a bad idea and
very hard to do safely. In addition, in drm it is today almost
impossible to get hold of the framebuffer address.

So drop support for this.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: saa7134: drop overlay support
Hans Verkuil [Thu, 2 Mar 2023 12:57:24 +0000 (13:57 +0100)]
media: saa7134: drop overlay support

Destructive overlay support (i.e. where the video frame is DMA-ed
straight into a framebuffer) is effectively dead. It was a
necessary evil in the early days when computers were not fast enough
to copy SDTV video frames around, but today that's no longer a problem.

It requires access to the framebuffer memory, which is a bad idea and
very hard to do safely. In addition, in drm it is today almost
impossible to get hold of the framebuffer address.

So drop support for this.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: saa7146: drop overlay support
Hans Verkuil [Thu, 2 Mar 2023 12:57:23 +0000 (13:57 +0100)]
media: saa7146: drop overlay support

Destructive overlay support (i.e. where the video frame is DMA-ed
straight into a framebuffer) is effectively dead. It was a
necessary evil in the early days when computers were not fast enough
to copy SDTV video frames around, but today that's no longer a problem.

It requires access to the framebuffer memory, which is a bad idea and
very hard to do safely. In addition, in drm it is today almost
impossible to get hold of the framebuffer address.

So drop support for this.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: common: btcx-risc.h: drop obsolete header
Hans Verkuil [Wed, 1 Mar 2023 11:48:06 +0000 (12:48 +0100)]
media: common: btcx-risc.h: drop obsolete header

This header is no longer used, drop it.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: zoran: drop two obsolete prototypes from zoran_device.h
Hans Verkuil [Wed, 1 Mar 2023 11:47:36 +0000 (12:47 +0100)]
media: zoran: drop two obsolete prototypes from zoran_device.h

These overlay-related functions no longer exist, so drop them
from the header.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: stm32: dma2d: remove unused fb_buf
Hans Verkuil [Wed, 1 Mar 2023 11:13:45 +0000 (12:13 +0100)]
media: stm32: dma2d: remove unused fb_buf

Drop the unused struct v4l2_framebuffer fb_buf in struct dma2d_ctx.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
CC: Hugues Fruchet <hugues.fruchet@foss.st.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: admin-guide/media/cec.rst: update CEC debugging doc
Hans Verkuil [Wed, 15 Feb 2023 11:01:51 +0000 (12:01 +0100)]
media: admin-guide/media/cec.rst: update CEC debugging doc

The documentation on how to create your own Raspberry Pi CEC debugger was a
bit out of date. Update it to the Raspberry Pi 4B, drop the mention of the RTC
and a link to a picture that no longer works.

Also reorganize the text to make it easier to follow and change the pins to
match the pins I use.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: docs: vidioc-g-ext-ctrls.rst: Document p_s32 and p_s64 fields
Daniel Lundberg Pedersen [Tue, 7 Mar 2023 13:36:17 +0000 (14:36 +0100)]
media: docs: vidioc-g-ext-ctrls.rst: Document p_s32 and p_s64 fields

p_s32 and p_s64 were added to the v4l2_ext_control struct, so these
should have documentation as well.

Signed-off-by: Daniel Lundberg Pedersen <dlp@qtec.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: pvrusb2: VIDEO_PVRUSB2 depends on DVB_CORE to use dvb_* symbols
Tom Rix [Sat, 11 Mar 2023 13:48:47 +0000 (14:48 +0100)]
media: pvrusb2: VIDEO_PVRUSB2 depends on DVB_CORE to use dvb_* symbols

A rand config causes this link error
vmlinux.o: In function `pvr2_dvb_create':
(.text+0x8af1d2): undefined reference to `dvb_register_adapter'

The rand config has
CONFIG_VIDEO_PVRUSB2=y
CONFIG_VIDEO_DEV=y
CONFIG_DVB_CORE=m

VIDEO_PVRUSB2 should also depend on DVB_CORE.

Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: platform: cros-ec: Add Gladios/Lisbon to the match table
Kevin Chiu [Tue, 7 Mar 2023 12:58:45 +0000 (13:58 +0100)]
media: platform: cros-ec: Add Gladios/Lisbon to the match table

The Google Gladios/Lisbon device uses the same approach as the Google Brask
which enables the HDMI CEC via the cros-ec-cec driver.

Signed-off-by: Kevin Chiu <kevin.chiu.17802@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: av7110: prevent underflow in write_ts_to_decoder()
Dan Carpenter [Tue, 7 Mar 2023 10:00:23 +0000 (11:00 +0100)]
media: av7110: prevent underflow in write_ts_to_decoder()

The buf[4] value comes from the user via ts_play().  It is a value in
the u8 range.  The final length we pass to av7110_ipack_instant_repack()
is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is
not negative.  It's not clear that passing a negative len value does
anything bad necessarily, but it's not best practice.

With the new bounds checking the "if (!len)" condition is no longer
possible or required so remove that.

Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: mtk-jpegenc: Fix a compilation issue
oushixiong [Tue, 7 Mar 2023 05:57:48 +0000 (06:57 +0100)]
media: mtk-jpegenc: Fix a compilation issue

‘mtk8195_jpegenc_drvdata’ defined but not used [-Werror=unused-variable]

Signed-off-by: oushixiong <oushixiong@kylinos.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: stm32-dcmi: Enable incoherent buffer allocation
Marek Vasut [Sun, 5 Mar 2023 20:51:07 +0000 (21:51 +0100)]
media: stm32-dcmi: Enable incoherent buffer allocation

Set allow_cache_hints to 1 for the vb2_queue capture queue in the
STM32MP15xx DCMI V4L2 driver. This allows us to allocate buffers
with the V4L2_MEMORY_FLAG_NON_COHERENT set. On STM32MP15xx SoCs,
this enables caching for this memory, which improves performance
when being read from CPU.

This change should be safe from race conditions since videobuf2
already invalidates or flushes the appropriate cache lines in
its prepare() and finish() methods.

Tested on a STM32MP157F SoC. Resulted in 4x buffer access speedup.

Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish
harperchen [Fri, 3 Mar 2023 15:30:11 +0000 (16:30 +0100)]
media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish

When the driver calls tw68_risc_buffer() to prepare the buffer, the
function call dma_alloc_coherent may fail, resulting in a empty buffer
buf->cpu. Later when we free the buffer or access the buffer, null ptr
deref is triggered.

This bug is similar to the following one:
https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.

We believe the bug can be also dynamically triggered from user side.
Similarly, we fix this by checking the return value of tw68_risc_buffer()
and the value of buf->cpu before buffer free.

Signed-off-by: harperchen <harperchen1110@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: platform: via: Handle error for dma_set_mask
harperchen [Fri, 3 Mar 2023 11:16:24 +0000 (12:16 +0100)]
media: platform: via: Handle error for dma_set_mask

As the potential failure of the dma_set_mask(), we fix this
bug by checking its return value and performing proper error
handling.

Signed-off-by: harperchen <harperchen1110@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: MAINTAINERS: Add myself as CAMSS maintainer
Bryan O'Donoghue [Thu, 2 Mar 2023 15:53:53 +0000 (16:53 +0100)]
media: MAINTAINERS: Add myself as CAMSS maintainer

I discussed with Robert a few ago lending a hand with CAMSS. Following up
on that discussion, I'm happy to help.

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()
harperchen [Thu, 2 Mar 2023 12:39:05 +0000 (13:39 +0100)]
media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()

When the driver calls cx23885_risc_buffer() to prepare the buffer, the
function call dma_alloc_coherent may fail, resulting in a empty buffer
risc->cpu. Later when we free the buffer or access the buffer, null ptr
deref is triggered.

This bug is similar to the following one:
https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.

We believe the bug can be also dynamically triggered from user side.
Similarly, we fix this by checking the return value of cx23885_risc_buffer()
and the value of risc->cpu before buffer free.

Signed-off-by: harperchen <harperchen1110@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: amphion: decoder implement display delay enable
Ming Qian [Thu, 2 Mar 2023 05:34:10 +0000 (06:34 +0100)]
media: amphion: decoder implement display delay enable

amphion vpu support a low latency mode,
when V4L2_CID_MPEG_VIDEO_DEC_DISPLAY_DELAY_ENABLE is enabled,
decoder can display frame immediately after it's decoded.
Only h264 is support yet.

Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: platform: cros-ec: Add aurash to the match table
Zoey Wu [Thu, 23 Feb 2023 05:41:38 +0000 (06:41 +0100)]
media: platform: cros-ec: Add aurash to the match table

The Google aurash device uses the same approach as the Google Brask
which enables the HDMI CEC via the cros-ec-cec driver.

Signed-off-by: Zoey Wu <zoey_wu@wistron.corp-partner.google.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: platform: mtk-mdp3: Add missing check and free for ida_alloc
Jiasheng Jiang [Thu, 9 Feb 2023 13:52:45 +0000 (14:52 +0100)]
media: platform: mtk-mdp3: Add missing check and free for ida_alloc

Add the check for the return value of the ida_alloc in order to avoid
NULL pointer dereference.
Moreover, free allocated "ctx->id" if mdp_m2m_open fails later in order
to avoid memory leak.

Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: platform: stm32: use devm_platform_get_and_ioremap_resource()
Ye Xingchen [Wed, 8 Feb 2023 09:01:06 +0000 (10:01 +0100)]
media: platform: stm32: use devm_platform_get_and_ioremap_resource()

Convert platform_get_resource(), devm_ioremap_resource() to a single
call to devm_platform_get_and_ioremap_resource(), as this is exactly
what this function does.

Signed-off-by: Ye Xingchen <ye.xingchen@zte.com.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: platform: renesas: use devm_platform_get_and_ioremap_resource()
Ye Xingchen [Wed, 8 Feb 2023 08:59:40 +0000 (09:59 +0100)]
media: platform: renesas: use devm_platform_get_and_ioremap_resource()

Convert platform_get_resource(), devm_ioremap_resource() to a single
call to devm_platform_get_and_ioremap_resource(), as this is exactly
what this function does.

Signed-off-by: Ye Xingchen <ye.xingchen@zte.com.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: dw100: use devm_platform_get_and_ioremap_resource()
Ye Xingchen [Wed, 8 Feb 2023 08:35:44 +0000 (09:35 +0100)]
media: dw100: use devm_platform_get_and_ioremap_resource()

Convert platform_get_resource(), devm_ioremap_resource() to a single
call to devm_platform_get_and_ioremap_resource(), as this is exactly
what this function does.

Signed-off-by: Ye Xingchen <ye.xingchen@zte.com.cn>
Reviewed-by: Xavier Roumegue <xavier.roumegue@oss.nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: bdisp: Add missing check for create_workqueue
Jiasheng Jiang [Wed, 8 Feb 2023 07:14:42 +0000 (08:14 +0100)]
media: bdisp: Add missing check for create_workqueue

Add the check for the return value of the create_workqueue
in order to avoid NULL pointer dereference.

Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: imx-jpeg: Bounds check sizeimage access
Kees Cook [Sat, 4 Feb 2023 18:38:05 +0000 (19:38 +0100)]
media: imx-jpeg: Bounds check sizeimage access

The call of mxc_jpeg_get_plane_size() from mxc_jpeg_dec_irq() sets
plane_no argument to 1. The compiler sees that it's possible to end up
with an access beyond the bounds of sizeimage, if mem_planes was too
large:

        if (plane_no >= fmt->mem_planes)        // mem_planes = 2+
                return 0;

        if (fmt->mem_planes == fmt->comp_planes) // comp_planes != mem_planes
                return q_data->sizeimage[plane_no];

        if (plane_no < fmt->mem_planes - 1)     // mem_planes = 2
                return q_data->sizeimage[plane_no];

comp_planes == 0 or 1 is safe. comp_planes > 2 would be out of bounds.

(This isn't currently possible given the contents of mxc_formats, though.)

Silence the warning by bounds checking comp_planes for future
robustness. Seen with GCC 13:

In function 'mxc_jpeg_get_plane_size',
    inlined from 'mxc_jpeg_dec_irq' at ../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c:729:14:
../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c:641:42: warning: array subscript 2 is above array bounds of 'u32[2]' {aka 'unsigned int[2]'} [-Warray-bounds=]
  641 |                 size += q_data->sizeimage[i];
      |                         ~~~~~~~~~~~~~~~~~^~~
In file included from ../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h:112,
                 from ../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c:63:
../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h: In function 'mxc_jpeg_dec_irq':
../drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h:84:41: note: while referencing 'sizeimage'
   84 |         u32                             sizeimage[MXC_JPEG_MAX_PLANES];
      |                                         ^~~~~~~~~

Cc: Mirela Rabulea <mirela.rabulea@nxp.com>
Cc: NXP Linux Team <linux-imx@nxp.com>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: linux-arm-kernel@lists.infradead.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: mxl5005s: Bounds check size used for max array index
Kees Cook [Sat, 4 Feb 2023 18:36:17 +0000 (19:36 +0100)]
media: mxl5005s: Bounds check size used for max array index

The use of state->CH_Ctrl[i].size in a shift operation implies that its
value can be as much as 32, but the state->CH_Ctrl[i].val array is only
25 in size. Bounds check the size before shifting and looping. Fixes
warnings seen with GCC 13:

../drivers/media/tuners/mxl5005s.c: In function 'MXL_ControlWrite_Group.isra':
../drivers/media/tuners/mxl5005s.c:3450:70: warning: array subscript 32 is above array bounds of 'u16[25]' {aka 'short unsigned int[25]'} [-Warray-bounds=]
 3450 | state->CH_Ctrl[i].val[j] = (u8)((value >> j) & 0x01);
      |  ~~~~~~~~~~~~~~~~~~~~~^~~
../drivers/media/tuners/mxl5005s.c:238:13: note: while referencing 'val'
  238 |         u16 val[25];    /* Binary representation of Value */
      |             ^~~

Cc: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: drop unnecessary networking includes
Jakub Kicinski [Fri, 3 Feb 2023 23:31:29 +0000 (00:31 +0100)]
media: drop unnecessary networking includes

dvb_net.h includes a bunch of core networking headers which increases
the number of objects rebuilt when we touch them. They are unnecessary
for the header itself and only one driver has an indirect dependency.

tveeprom.h includes if_packet to gain access to ETH_ALEN. This
is a bit of an overkill because if_packet.h pulls in skbuff.h.
The definition of ETH_ALEN is in the uAPI header, which is
very rarely touched, so switch to including that.

This results in roughly 250 fewer objects built when skbuff.h
is touched (6028 -> 5788).

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: dvb-frontends: Fix a typo ("Unknow sleep mode")
Jonathan Neuschäfer [Sun, 29 Jan 2023 16:16:18 +0000 (17:16 +0100)]
media: dvb-frontends: Fix a typo ("Unknow sleep mode")

Spell "unknown" correctly.

Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: dt-bindings: silabs,si470x: Convert to DT schema
Krzysztof Kozlowski [Fri, 9 Dec 2022 17:59:26 +0000 (18:59 +0100)]
media: dt-bindings: silabs,si470x: Convert to DT schema

Convert the Silicon Labs Si470x FM Radio Receiver bindings to DT schema.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: platform: exynos4-is: Fix spelling mistake "palne" -> "plane"
Colin Ian King [Thu, 8 Dec 2022 11:58:47 +0000 (12:58 +0100)]
media: platform: exynos4-is: Fix spelling mistake "palne" -> "plane"

There are spelling mistakes in a literal string and a comment. Fix them.

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: tc358746: Remove unneeded semicolon
Yang Li [Thu, 10 Nov 2022 01:36:48 +0000 (02:36 +0100)]
media: tc358746: Remove unneeded semicolon

./drivers/media/i2c/tc358746.c:857:3-4: Unneeded semicolon
./drivers/media/i2c/tc358746.c:861:2-3: Unneeded semicolon

Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=2832
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: rc: add Beelink Mini MXIII keymap
Christian Hewitt [Sat, 4 Feb 2023 07:45:01 +0000 (08:45 +0100)]
media: rc: add Beelink Mini MXIII keymap

Add a keymap for the simple IR (NEC) remote used with the Beelink
Mini MXIII Android STB device.

Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: dt-bindings: rc: add rc-beelink-mxiii
Christian Hewitt [Sat, 4 Feb 2023 07:45:00 +0000 (08:45 +0100)]
media: dt-bindings: rc: add rc-beelink-mxiii

Add a binding for the rc-beelink-mxiii remote keymap

Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: rc: add common keymap for Dreambox RC10/RC0 and RC20/RC-BT remotes
Emanuel Strobel [Fri, 3 Feb 2023 09:34:05 +0000 (10:34 +0100)]
media: rc: add common keymap for Dreambox RC10/RC0 and RC20/RC-BT remotes

Add a common keymap for the RC10/RC0 and RC20/RC-BT remotes used with
the Dreambox One and Dreambox Two DVB-S/T boxes. The maps are combined
since the IR codes do not conflict and both boxes have shipped with
both remote designs over time.

Both remote types can be programmed to control TVs, so include non-IR
keys that are used to switch-to or toggle the remote mode:

- DREAM in RC10/RC0 switches to (Dreambox) STB control mode
- TV in RC10/RC0 switches to TV control mode
- MODE in RC20/RC-BT toggles between STB/TV/BT control modes

In the RC20 keymap the Android MIC (voice search) key maps to KEY_HELP
and EXIT is mapped to KEY_ESC to replicate the go-backwards navigation
behaviour in the Android vendor OS that ships on Dreambox devices.

Signed-off-by: Emanuel Strobel <emanuel.strobel@yahoo.com>
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: dt-bindings: rc: add rc-dreambox
Christian Hewitt [Fri, 3 Feb 2023 09:34:04 +0000 (10:34 +0100)]
media: dt-bindings: rc: add rc-dreambox

Add a binding for the rc-dreambox remote keymap

Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: cx18: fix format compliance issues
Hans Verkuil [Wed, 1 Feb 2023 12:56:46 +0000 (13:56 +0100)]
media: cx18: fix format compliance issues

This properly fills in all the format fields and calculates the
width and height correctly.

Esp. the minimum width and height was wrong.

When changing the standard the width and height also have to be
reset to the corresponding default width/height for the chosen
standard.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: cx18: reorder fmt_vid_cap functions in cx18-ioctl.c
Hans Verkuil [Wed, 1 Feb 2023 12:56:20 +0000 (13:56 +0100)]
media: cx18: reorder fmt_vid_cap functions in cx18-ioctl.c

No actual code changed, this just reorders functions so that the
g/try/s_fmt_vid_cap functions are all together rather than mixed in
with the vbi format functions.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: cx18: missing CAP_AUDIO for vbi stream
Hans Verkuil [Wed, 1 Feb 2023 12:54:20 +0000 (13:54 +0100)]
media: cx18: missing CAP_AUDIO for vbi stream

The v4l2-compliance test complained about this. You can change the
input connector for the vbi stream, but that means that you can have to
be able to do the same for the audio input.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: cx18: properly report pixelformats
Hans Verkuil [Wed, 1 Feb 2023 11:50:30 +0000 (12:50 +0100)]
media: cx18: properly report pixelformats

The MPEG device reported non-MPEG pixelformats, and the YUV device reported
the MPEG pixelformat as well.

Separate the two: either report MPEG or HM12/UYUV, not all three.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: cx18: fix incorrect input counting
Hans Verkuil [Wed, 1 Feb 2023 11:19:46 +0000 (12:19 +0100)]
media: cx18: fix incorrect input counting

Counting the number of video and audio inputs was wrong if the
number of inputs equalled CX18_CARD_MAX_VIDEO_INPUTS or
CX18_CARD_MAX_AUDIO_INPUTS. This was a copy-and-paste from the
ivtv driver. That driver has been fixed quite a long time ago,
but we missed that this driver had the same bug.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: cx18: convert to vb2
Hans Verkuil [Tue, 31 Jan 2023 10:34:54 +0000 (11:34 +0100)]
media: cx18: convert to vb2

This patch converts cx18 from the old deprecated videobuf framework
to the 'new' vb2 framework.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: v4l2-dev.c: check for V4L2_CAP_STREAMING to enable streaming ioctls
Hans Verkuil [Wed, 1 Feb 2023 11:48:54 +0000 (12:48 +0100)]
media: v4l2-dev.c: check for V4L2_CAP_STREAMING to enable streaming ioctls

Rather than checking which device type it is, just check the STREAMING
cap since that indicates support for streaming ioctls.

Some drivers only support READWRITE (typically MPEG encoders).

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: vb2: set owner before calling vb2_read
Hans Verkuil [Wed, 1 Feb 2023 13:06:47 +0000 (14:06 +0100)]
media: vb2: set owner before calling vb2_read

Before vb2_read is called, the owner must be set since vb2_read will
actually start streaming. If vb2_read returns an error and q->fileio is
NULL, then it failed to start streaming and the owner is set back to NULL.

When the vb2 start_streaming callback is called, it expects the owner
pointer to be set, and that wasn't the case in this particular situation.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: v4l: subdev: Make link validation safer
Sakari Ailus [Fri, 24 Feb 2023 15:00:46 +0000 (16:00 +0100)]
media: v4l: subdev: Make link validation safer

Link validation currently accesses invalid pointers if the link passed to
it is not between two sub-devices. This is of course a driver bug.

Ignore the error but print a warning message, as this is how it used to
work previously.

Fixes: a6b995ed03ff ("media: subdev: use streams in v4l2_subdev_link_validate()")
Reported-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Tested-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: subdev: Fix validation state lockdep issue
Tomi Valkeinen [Fri, 3 Mar 2023 15:52:49 +0000 (16:52 +0100)]
media: subdev: Fix validation state lockdep issue

The new subdev state code has a possible deadlock scenario during link
validation when the pipeline contains subdevs that support state and
that do not support state.

The current code locks the states of the subdevs on both ends of the
link when starting the link validation, locking the sink side first,
then the source. If either (or both) of the subdevs does not support
state, nothing is done for that subdev at this point, and instead the
locking is handled the old way, i.e. the subdev's ops do the locking
internally.

The issue arises when the sink doesn't support state, but source does,
so the validation code locks the source for the duration of the
validation, and then the sink is locked only when the get_fmt op is
called. So lockdep sees the source locked first, then the sink.

Later, when the streaming is started, the sink's s_stream op is called,
which probably takes the subdev's lock. The op then calls the source's
s_stream, which takes the source's lock. So, the sink is locked first,
then the source.

Note that link validation and stream starting is not done at the same
time, so an actual deadlock should never happen. However, it's still a
clear bug.

Fix this by locking the subdev states only if both subdevs support
state. In other words, we have two scenarios:

1. Both subdevs support state. Lock sink first, then source, and keep
   the locks while validating the link.
2. At least one of the subdevs do not support state. Take the lock only
   for the duration of the operation (get_fmt or looking at the
   routing), and release after the op is done.

Obviously 1. is better, as we have a more consistent view of the states
of the subdevs during validation. 2. is how it has been so far, so it's
no worse than this used to be.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: i2c: imx290: fix conditional function definitions
Arnd Bergmann [Tue, 7 Feb 2023 16:13:12 +0000 (17:13 +0100)]
media: i2c: imx290: fix conditional function definitions

The runtime suspend/resume functions are only referenced from the
dev_pm_ops, but they use the old SET_RUNTIME_PM_OPS() helper
that requires a __maybe_unused annotation to avoid a warning:

drivers/media/i2c/imx290.c:1082:12: error: unused function 'imx290_runtime_resume' [-Werror,-Wunused-function]
static int imx290_runtime_resume(struct device *dev)
           ^
drivers/media/i2c/imx290.c:1090:12: error: unused function 'imx290_runtime_suspend' [-Werror,-Wunused-function]
static int imx290_runtime_suspend(struct device *dev)
           ^

Convert this to the new RUNTIME_PM_OPS() helper that so this
is not required. To improve this further, also use the pm_ptr()
helper that lets the dev_pm_ops get dropped entirely when
CONFIG_PM is disabled.

A related mistake happened in the of_match_ptr() macro here, which
like SET_RUNTIME_PM_OPS() requires the match table to be marked
as __maybe_unused, though I could not reproduce building this without
CONFIG_OF. Remove the of_match_ptr() here as there is no point in
dropping the match table in configurations without CONFIG_OF.

Fixes: 02852c01f654 ("media: i2c: imx290: Initialize runtime PM before subdev")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agomedia: Revert "venus: firmware: Correct non-pix start and end addresses"
Javier Martinez Canillas [Tue, 7 Feb 2023 10:22:54 +0000 (11:22 +0100)]
media: Revert "venus: firmware: Correct non-pix start and end addresses"

This reverts commit a837e5161cfffbb3242cc0eb574f8bf65fd32640, which broke
probing of the venus driver, at least on the SC7180 SoC HP X2 Chromebook:

  [   11.455782] qcom-venus aa00000.video-codec: Adding to iommu group 11
  [   11.506980] qcom-venus aa00000.video-codec: non legacy binding
  [   12.143432] qcom-venus aa00000.video-codec: failed to reset venus core
  [   12.156440] qcom-venus: probe of aa00000.video-codec failed with error -110

Matthias Kaehlcke also reported that the same change caused a regression in
SC7180 and sc7280, that prevents AOSS from entering sleep mode during system
suspend. So let's revert this commit for now to fix both issues.

Fixes: a837e5161cff ("venus: firmware: Correct non-pix start and end addresses")
Reported-by: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
16 months agoLinux 6.3-rc2
Linus Torvalds [Sun, 12 Mar 2023 23:36:44 +0000 (16:36 -0700)]
Linux 6.3-rc2

16 months agowifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
Hector Martin [Sat, 11 Mar 2023 14:19:14 +0000 (23:19 +0900)]
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"

This reverts part of commit 015b8cc5e7c4 ("wifi: cfg80211: Fix use after
free for wext")

This commit broke WPA offload by unconditionally clearing the crypto
modes for non-WEP connections. Drop that part of the patch.

Signed-off-by: Hector Martin <marcan@marcan.st>
Reported-by: Ilya <me@0upti.me>
Reported-and-tested-by: Janne Grunau <j@jannau.net>
Reviewed-by: Eric Curtin <ecurtin@redhat.com>
Fixes: 015b8cc5e7c4 ("wifi: cfg80211: Fix use after free for wext")
Cc: stable@kernel.org
Link: https://lore.kernel.org/linux-wireless/ZAx0TWRBlGfv7pNl@kroah.com/T/#m11e6e0915ab8fa19ce8bc9695ab288c0fe018edf
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
16 months agoMerge tag 'tpm-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko...
Linus Torvalds [Sun, 12 Mar 2023 23:15:36 +0000 (16:15 -0700)]
Merge tag 'tpm-v6.3-rc3' of git://git./linux/kernel/git/jarkko/linux-tpmdd

Pull tpm fixes from Jarkko Sakkinen:
 "Two additional bug fixes for v6.3"

* tag 'tpm-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  tpm: disable hwrng for fTPM on some AMD designs
  tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address

16 months agotpm: disable hwrng for fTPM on some AMD designs
Mario Limonciello [Tue, 28 Feb 2023 02:44:39 +0000 (20:44 -0600)]
tpm: disable hwrng for fTPM on some AMD designs

AMD has issued an advisory indicating that having fTPM enabled in
BIOS can cause "stuttering" in the OS.  This issue has been fixed
in newer versions of the fTPM firmware, but it's up to system
designers to decide whether to distribute it.

This issue has existed for a while, but is more prevalent starting
with kernel 6.1 because commit b006c439d58db ("hwrng: core - start
hwrng kthread also for untrusted sources") started to use the fTPM
for hwrng by default. However, all uses of /dev/hwrng result in
unacceptable stuttering.

So, simply disable registration of the defective hwrng when detecting
these faulty fTPM versions.  As this is caused by faulty firmware, it
is plausible that such a problem could also be reproduced by other TPM
interactions, but this hasn't been shown by any user's testing or reports.

It is hypothesized to be triggered more frequently by the use of the RNG
because userspace software will fetch random numbers regularly.

Intentionally continue to register other TPM functionality so that users
that rely upon PCR measurements or any storage of data will still have
access to it.  If it's found later that another TPM functionality is
exacerbating this problem a module parameter it can be turned off entirely
and a module parameter can be introduced to allow users who rely upon
fTPM functionality to turn it on even though this problem is present.

Link: https://www.amd.com/en/support/kb/faq/pa-410
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216989
Link: https://lore.kernel.org/all/20230209153120.261904-1-Jason@zx2c4.com/
Fixes: b006c439d58d ("hwrng: core - start hwrng kthread also for untrusted sources")
Cc: stable@vger.kernel.org
Cc: Jarkko Sakkinen <jarkko@kernel.org>
Cc: Thorsten Leemhuis <regressions@leemhuis.info>
Cc: James Bottomley <James.Bottomley@hansenpartnership.com>
Tested-by: reach622@mailcuk.com
Tested-by: Bell <1138267643@qq.com>
Co-developed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
16 months agotpm/eventlog: Don't abort tpm_read_log on faulty ACPI address
Morten Linderud [Wed, 15 Feb 2023 09:25:52 +0000 (10:25 +0100)]
tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address

tpm_read_log_acpi() should return -ENODEV when no eventlog from the ACPI
table is found. If the firmware vendor includes an invalid log address
we are unable to map from the ACPI memory and tpm_read_log() returns -EIO
which would abort discovery of the eventlog.

Change the return value from -EIO to -ENODEV when acpi_os_map_iomem()
fails to map the event log.

The following hardware was used to test this issue:
    Framework Laptop (Pre-production)
    BIOS: INSYDE Corp, Revision: 3.2
    TPM Device: NTC, Firmware Revision: 7.2

Dump of the faulty ACPI TPM2 table:
    [000h 0000   4]                    Signature : "TPM2"    [Trusted Platform Module hardware interface Table]
    [004h 0004   4]                 Table Length : 0000004C
    [008h 0008   1]                     Revision : 04
    [009h 0009   1]                     Checksum : 2B
    [00Ah 0010   6]                       Oem ID : "INSYDE"
    [010h 0016   8]                 Oem Table ID : "TGL-ULT"
    [018h 0024   4]                 Oem Revision : 00000002
    [01Ch 0028   4]              Asl Compiler ID : "ACPI"
    [020h 0032   4]        Asl Compiler Revision : 00040000

    [024h 0036   2]               Platform Class : 0000
    [026h 0038   2]                     Reserved : 0000
    [028h 0040   8]              Control Address : 0000000000000000
    [030h 0048   4]                 Start Method : 06 [Memory Mapped I/O]

    [034h 0052  12]            Method Parameters : 00 00 00 00 00 00 00 00 00 00 00 00
    [040h 0064   4]           Minimum Log Length : 00010000
    [044h 0068   8]                  Log Address : 000000004053D000

Fixes: 0cf577a03f21 ("tpm: Fix handling of missing event log")
Tested-by: Erkki Eilonen <erkki@bearmetal.eu>
Signed-off-by: Morten Linderud <morten@linderud.pw>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
16 months agoMerge tag 'xfs-6.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Linus Torvalds [Sun, 12 Mar 2023 16:47:08 +0000 (09:47 -0700)]
Merge tag 'xfs-6.3-fixes-1' of git://git./fs/xfs/xfs-linux

Pull xfs fixes from Darrick Wong:

 - Fix a crash if mount time quotacheck fails when there are inodes
   queued for garbage collection.

 - Fix an off by one error when discarding folios after writeback
   failure.

* tag 'xfs-6.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: fix off-by-one-block in xfs_discard_folio()
  xfs: quotacheck failure can race with background inode inactivation

16 months agoMerge tag 'staging-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh...
Linus Torvalds [Sun, 12 Mar 2023 16:17:30 +0000 (09:17 -0700)]
Merge tag 'staging-6.3-rc2' of git://git./linux/kernel/git/gregkh/staging

Pull staging driver fixes and removal from Greg KH:
 "Here are four small staging driver fixes, and one big staging driver
  deletion for 6.3-rc2.

  The fixes are:

   - rtl8192e driver fixes for where the driver was attempting to
     execute various programs directly from the disk for unknown reasons

   - rtl8723bs driver fixes for issues found by Hans in testing

  The deleted driver is the removal of the r8188eu wireless driver as
  now in 6.3-rc1 we have a "real" wifi driver for one that includes
  support for many many more devices than this old driver did. So it's
  time to remove it as it is no longer needed. The maintainers of this
  driver all have acked its removal. Many thanks to them over the years
  for working to clean it up and keep it working while the real driver
  was being developed.

  All of these have been in linux-next this week with no reported
  problems"

* tag 'staging-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: r8188eu: delete driver
  staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss()
  staging: rtl8723bs: Fix key-store index handling
  staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh
  staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script

16 months agoMerge tag 'x86_urgent_for_v6.3_rc2' of git://git.kernel.org/pub/scm/linux/kernel...
Linus Torvalds [Sun, 12 Mar 2023 16:12:03 +0000 (09:12 -0700)]
Merge tag 'x86_urgent_for_v6.3_rc2' of git://git./linux/kernel/git/tip/tip

Pull x86 fix from Borislav Petkov:
 "A single erratum fix for AMD machines:

   - Disable XSAVES on AMD Zen1 and Zen2 machines due to an erratum. No
     impact to anything as those machines will fallback to XSAVEC which
     is equivalent there"

* tag 'x86_urgent_for_v6.3_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/CPU/AMD: Disable XSAVES on AMD family 0x17

16 months agoMerge tag 'kernel.fork.v6.3-rc2' of gitolite.kernel.org:pub/scm/linux/kernel/git...
Linus Torvalds [Sun, 12 Mar 2023 16:04:28 +0000 (09:04 -0700)]
Merge tag 'kernel.fork.v6.3-rc2' of gitolite.pub/scm/linux/kernel/git/brauner/linux

Pull clone3 fix from Christian Brauner:
 "A simple fix for the clone3() system call.

  The CLONE_NEWTIME allows the creation of time namespaces. The flag
  reuses a bit from the CSIGNAL bits that are used in the legacy clone()
  system call to set the signal that gets sent to the parent after the
  child exits.

  The clone3() system call doesn't rely on CSIGNAL anymore as it uses a
  dedicated .exit_signal field in struct clone_args. So we blocked all
  CSIGNAL bits in clone3_args_valid(). When CLONE_NEWTIME was introduced
  and reused a CSIGNAL bit we forgot to adapt clone3_args_valid()
  causing CLONE_NEWTIME with clone3() to be rejected. Fix this"

* tag 'kernel.fork.v6.3-rc2' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux:
  selftests/clone3: test clone3 with CLONE_NEWTIME
  fork: allow CLONE_NEWTIME in clone3 flags

16 months agoMerge tag 'vfs.misc.v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs...
Linus Torvalds [Sun, 12 Mar 2023 16:00:54 +0000 (09:00 -0700)]
Merge tag 'vfs.misc.v6.3-rc2' of git://git./linux/kernel/git/vfs/idmapping

Pull vfs fixes from Christian Brauner:

 - When allocating pages for a watch queue failed, we didn't return an
   error causing userspace to proceed even though all subsequent
   notifcations would be lost. Make sure to return an error.

 - Fix a misformed tree entry for the idmapping maintainers entry.

 - When setting file leases from an idmapped mount via
   generic_setlease() we need to take the idmapping into account
   otherwise taking a lease would fail from an idmapped mount.

 - Remove two redundant assignments, one in splice code and the other in
   locks code, that static checkers complained about.

* tag 'vfs.misc.v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping:
  filelocks: use mount idmapping for setlease permission check
  fs/locks: Remove redundant assignment to cmd
  splice: Remove redundant assignment to ret
  MAINTAINERS: repair a malformed T: entry in IDMAPPED MOUNTS
  watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths

16 months agoMerge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git...
Linus Torvalds [Sun, 12 Mar 2023 15:55:55 +0000 (08:55 -0700)]
Merge tag 'ext4_for_linus_stable' of git://git./linux/kernel/git/tytso/ext4

Pull ext4 fixes from Ted Ts'o:
 "Bug fixes and regressions for ext4, the most serious of which is a
  potential deadlock during directory renames that was introduced during
  the merge window discovered by a combination of syzbot and lockdep"

* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: zero i_disksize when initializing the bootloader inode
  ext4: make sure fs error flag setted before clear journal error
  ext4: commit super block if fs record error when journal record without error
  ext4, jbd2: add an optimized bmap for the journal inode
  ext4: fix WARNING in ext4_update_inline_data
  ext4: move where set the MAY_INLINE_DATA flag is set
  ext4: Fix deadlock during directory rename
  ext4: Fix comment about the 64BIT feature
  docs: ext4: modify the group desc size to 64
  ext4: fix another off-by-one fsmap error on 1k block filesystems
  ext4: fix RENAME_WHITEOUT handling for inline directories
  ext4: make kobj_type structures constant
  ext4: fix cgroup writeback accounting with fs-layer encryption

16 months agocpumask: relax sanity checking constraints
Linus Torvalds [Sun, 12 Mar 2023 15:52:03 +0000 (08:52 -0700)]
cpumask: relax sanity checking constraints

The cpumask_check() was unnecessarily tight, and causes problems for the
users of cpumask_next().

We have a number of users that take the previous return value of one of
the bit scanning functions and subtract one to keep it in "range".  But
since the scanning functions end up returning up to 'small_cpumask_bits'
instead of the tighter 'nr_cpumask_bits', the range really needs to be
using that widened form.

[ This "previous-1" behavior is also the reason we have all those
  comments about /* -1 is a legal arg here. */ and separate checks for
  that being ok.  So we could have just made "small_cpumask_bits-1"
  be a similar special "don't check this" value.

  Tetsuo Handa even suggested a patch that only does that for
  cpumask_next(), since that seems to be the only actual case that
  triggers, but that all makes it even _more_ magical and special. So
  just relax the check ]

One example of this kind of pattern being the 'c_start()' function in
arch/x86/kernel/cpu/proc.c, but also duplicated in various forms on
other architectures.

Reported-by: syzbot+96cae094d90877641f32@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=96cae094d90877641f32
Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Link: https://lore.kernel.org/lkml/c1f4cc16-feea-b83c-82cf-1a1f007b7eb9@I-love.SAKURA.ne.jp/
Fixes: 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask optimizations")
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
16 months agoMerge tag 'i2c-for-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa...
Linus Torvalds [Sat, 11 Mar 2023 17:24:05 +0000 (09:24 -0800)]
Merge tag 'i2c-for-6.3-rc2' of git://git./linux/kernel/git/wsa/linux

Pull i2c updates from Wolfram Sang:
 "This marks the end of a transition to let I2C have the same probe
  semantics as other subsystems. Uwe took care that no drivers in the
  current tree nor in -next use the deprecated .probe call. So, it is a
  good time to switch to the new, standard semantics now.

  There is also a regression fix:

   - regression fix for the notifier handling of the I2C core

   - final coversions of drivers away from deprecated .probe

   - make .probe_new the standard probe and convert I2C core to use it

* tag 'i2c-for-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: dev: Fix bus callback return values
  i2c: Convert drivers to new .probe() callback
  i2c: mux: Convert all drivers to new .probe() callback
  i2c: Switch .probe() to not take an id parameter
  media: i2c: ov2685: convert to i2c's .probe_new()
  media: i2c: ov5695: convert to i2c's .probe_new()
  w1: ds2482: Convert to i2c's .probe_new()
  serial: sc16is7xx: Convert to i2c's .probe_new()
  mtd: maps: pismo: Convert to i2c's .probe_new()
  misc: ad525x_dpot-i2c: Convert to i2c's .probe_new()