summaryrefslogtreecommitdiff
path: root/drivers/media
AgeCommit message (Collapse)Author
2026-01-13media: i2c: ov01a10: Add ov01a1b supportHans de Goede
Add support for the ov01a1b model which is the exact same sensor as the ov01a10 without a color-filter. Note since there is no color-filter there is also no need to shift the crop-window when flipping, so the crop window set by userspace may cover the full sensor (border_size=0). Signed-off-by: Hans de Goede <hansg@kernel.org> Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Optimize setting h/vflip valuesHans de Goede
Since ov01a10_global_setting[] sets the initial format1 register value, there is no need to do a read-write-modify when setting the flip controls. Only write format1 when setting the flip-controls and remove the now unnecessary format1 register init from ov01a10_global_setting[]. Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Add ov01a10_sensor_cfg structHans de Goede
Add a struct with some sensor variant (ov01a10 / ov01a1b / ov01a1s) specific settings. This is a preparation patch for adding support for the ov01a1s sensor which uses the same sensor with a different (RGBI) color-filter. Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Remove values set by controls from global_setting[]Hans de Goede
Registers 0x3501 (exposure), 0x3508 (analogue-gain) and 0x4503 (test- pattern) are already set through __v4l2_ctrl_handler_setup() drop them from ov01a10_global_setting[]. Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Only set register 0x0305 onceHans de Goede
Stop setting register 0x0305 to one value from mipi_data_rate_720mbps only to override it with a different value from sensor_1280x800_setting. Instead directly set it to 0xf4. Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Replace exposure->min/step with direct define useHans de Goede
The exposure minimum and step are constant use the defines for this instead of retrieving these from the exposure-control. Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Remove struct ov01a10_reg_listHans de Goede
After the conversion to the CCI register access helpers, struct ov01a10_reg_list is only used inside struct ov01a10_link_freq_config. Simplify things by embedding the ov01a10_reg_list members directly into struct ov01a10_link_freq_config. Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Add cropping support / allow arbitrary sizesHans de Goede
Remove the fixed mode list and add cropping support. The main reason for doing this is to allow libcamera to select 1292x812 instead of 1280x800 so that after the extra border which the CPU debayer code needs libcamera can output 1280x720 instead of 1276x720. This in turn allows google-meet to use 720p instead of it falling back to a pretty bad 360p. This has been tested on a Dell XPS 9320, with both libcamera as well as with Intel's out-of-tree psys driver + proprietary userspace stack. Libcamera asks for 1292x812 where as the Intel stack asks for 1280x800 and neither stack explicitly sets the crop-window. Hence the need for ov01a10_set_format() to adjust the crop-window if necessary. Note the differentiating between pattern_size and border_size is done in preparation for adding support for the monochrome OV01A1B model where coordinates still need to be aligned to a multiple of 2, but there will be no need for a border (border_size=0). Link: https://bugzilla.redhat.com/show_bug.cgi?id=2337593 Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Use native and default for pixel-array size namesHans de Goede
According to the OV01A10 product-brief PDF the OV01A10 has an active pixel array size of 1296x816. In otherwords the native and active sizes are the same. Replace the (misspelled) ACTIVE defines for the default resolution of 1280x800 with DEFAULT to avoid giving the impression that the active pixel array size is only 1280x800. And replace PIXEL_ARRAY with NATIVE to make clear this is the native pixel array size / to match the V4L2_SEL_TGT_NATIVE_SIZE naming. Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Move setting of ctrl->flags to after checking ↵Hans de Goede
ctrl_hdlr->error Instead of checking successful creation of the link_freq and vblank controls, set their flags after checking ctrl_hdlr->error where it is guaranteed that the controls will exist. Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Don't update pixel_rate and link_freq from set_fmtHans de Goede
The pixel_rate and link_freq never change, stop updating them on every set_fmt. Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Add power on/off sequencing supportHans de Goede
So far the ov01a10 driver has only been used on laptops with an IVSC chip where the IVSC chip controls the power on/off sequencing of the sensor. But there are also designs with an ov01a10 sensor where the kernel needs to directly take care of the power-sequencing, controlling clks, regulators and GPIOs. Add support for these designs. The 2 ms minimum reset assertion time is taken from other Omnivision sensor drivers like the ov5675. The 20 ms delay after reset de-assert comes from the out of tree ov01a1s driver. Signed-off-by: Hans de Goede <hansg@kernel.org> Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Add ov01a10_check_hwcfg() functionHans de Goede
Add a function to check that the number of mipi-lanes and there frequency are what the driver expects. Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Store dev pointer in struct ov01a10Hans de Goede
Now that the cci_* register access helpers are used we no longer need the i2c_client in various functions. Some code is still getting the client just to be able to get to the device pointer. Directly store a struct device *dev pointing to &client->dev inside struct ov01a10 to make the code simpler. This also fixes a mismatch of using dev vs &client->dev in the runtime_pm_*() calls in probe(). Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Remove overly verbose probe() error reportingHans de Goede
Many of the functions called from ov01a10_probe() are expected to never fail and they should all already log some message if they fail. Remove the unnecessarily verbose dev_err[_probe]() calls from the error-exit paths in probe(). Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Convert to new CCI register access helpersHans de Goede
Use the new comon CCI register access helpers to replace the private register access helpers in the ov01a10 driver. Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Change default vblank value to a vblank resulting in 30 fpsHans de Goede
The ov01a10 is quite a small sensor, which does not capture a lot of light, increase the default vblank so that the sensor runs at 30 fps by default, doubling the default exposure. Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Fix test-pattern disablingHans de Goede
When the test-pattern control gets set to 0 (Disabled) 0 should be written to the test-pattern register, rather then doing nothing. Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Fix passing stream instead of pad to ↵Hans de Goede
v4l2_subdev_state_get_format() The 2 argument version of v4l2_subdev_state_get_format() takes the pad as second argument, not the stream. Fixes: bc0e8d91feec ("media: v4l: subdev: Switch to stream-aware state functions") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() callsHans de Goede
Add missing v4l2_subdev_cleanup() calls to cleanup after v4l2_subdev_init_finalize(). Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Fix analogue gain rangeHans de Goede
A analogue maximum gain of 0xffff / 65525 seems unlikely and testing indeed shows that the gain control wraps-around at 16383, so set the maximum gain to 0x3fff / 16383. The minimum gain of 0x100 is correct. Setting bits 8-11 to 0x0 results in the same gain values as setting these bits to 0x1, with bits 0-7 still increasing the gain when going from 0x000 - 0x0ff in the exact same range as when going from 0x100 - 0x1ff. Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> [Sakari Ailus: mention analogue gain and update the limit from 4096.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Fix reported pixel-rate valueHans de Goede
CSI lanes are double-clocked so with a single lane at 400MHZ the resulting pixel-rate for 10-bits pixels is 400 MHz * 2 / 10 = 80 MHz, not 40 MHz. This also matches with the observed frame-rate of 60 fps with the default vblank setting: 80000000 / (1488 * 896) = 60. Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c: ov01a10: Fix the horizontal flip controlHans de Goede
During sensor calibration I noticed that with the hflip control set to false/disabled the image was mirrored. So it seems that the horizontal flip control is inverted and needs to be set to 1 to not flip (just like the similar problem recently fixed on the ov08x40 sensor). Invert the hflip control to fix the sensor mirroring by default. As the comment above the newly added OV01A10_MEDIA_BUS_FMT define explains the control being inverted also means that the native Bayer-order of the sensor actually is GBRG not BGGR, but so as to not break userspace the Bayer-order is kept at BGGR. Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede <hansg@kernel.org> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-14media: iris: Add internal buffer calculation for AV1 decoderDeepa Guthyappa Madivalara
Implement internal buffer count and size calculations for AV1 decoder for all the buffer types required by the AV1 decoder, including BIN, COMV, PERSIST, LINE, and PARTIAL. This ensures the hardware decoder has properly allocated memory for AV1 decoding operations, enabling correct AV1 video playback. Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Deepa Guthyappa Madivalara <deepa.madivalara@oss.qualcomm.com> Tested-by: Val Packett <val@packett.cool> Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-14media: iris: Define AV1-specific platform capabilities and propertiesDeepa Guthyappa Madivalara
Defining platform specific capabilities specific to AV1 decoder. Set and subscribe to manadatory properties to firmware for AV1. Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Deepa Guthyappa Madivalara <deepa.madivalara@oss.qualcomm.com> Tested-by: Val Packett <val@packett.cool> Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-14media: iris: Add support for AV1 format in iris decoderDeepa Guthyappa Madivalara
Extend iris decoder driver to support format V4L2_PIX_FMT_AV1. This change updates the format enumeration (VIDIOC_ENUM_FMT) and allows setting AV1 format via VIDIOC_S_FMT for gen2 and beyond. Gen1 iris hardware decoder does not support AV1 format. Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com> Signed-off-by: Deepa Guthyappa Madivalara <deepa.madivalara@oss.qualcomm.com> Tested-by: Val Packett <val@packett.cool> Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-14media: v4l2: Add description for V4L2_PIX_FMT_AV1 in v4l_fill_fmtdesc()Deepa Guthyappa Madivalara
Add a descriptive string for the AV1 pixel format to v4l_fill_fmtdesc(), enabling proper reporting of AV1 support via VIDIOC_ENUM_FMT. Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Deepa Guthyappa Madivalara <deepa.madivalara@oss.qualcomm.com> Tested-by: Val Packett <val@packett.cool> Signed-off-by: Bryan O'Donoghue <bod@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13Revert "media: uvcvideo: Remove nodrop parameter"Ricardo Ribalda
This reverts commit 27ccc44a511b0cd76dc607e2a4893b876192ee1b. A user has reported that the Zoom Video Conferencing tool is not capable of handling invalid frames. Due to this, he has to continue using this parameter. We will keep working with Zoom so they can handle invalid frames correctly, but for this cycle the safest option is to revert this parameter drop. Fixes: 27ccc44a511b ("media: uvcvideo: Remove nodrop parameter") Reported-by: Ralf Jung <post@ralfj.de> Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121718 Closes: https://lore.kernel.org/linux-media/uboug5ectzm4s32yfgopjbcxq2uhsoc4kluaby7a4b7nzfjave@boco7oocnftr/ Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: cx25821: Fix a resource leak in cx25821_dev_setup()Haoxiang Li
Add release_mem_region() if ioremap() fails to release the memory region obtained by cx25821_get_resources(). Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c/tw9906: Fix potential memory leak in tw9906_probe()Abdun Nihaal
In one of the error paths in tw9906_probe(), the memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that by calling v4l2_ctrl_handler_free() on the handler in that error path. Cc: stable@vger.kernel.org Fixes: a000e9a02b58 ("[media] tw9906: add Techwell tw9906 video decoder") Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: i2c/tw9903: Fix potential memory leak in tw9903_probe()Abdun Nihaal
In one of the error paths in tw9903_probe(), the memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that by calling v4l2_ctrl_handler_free() on the handler in that error path. Cc: stable@vger.kernel.org Fixes: 0890ec19c65d ("[media] tw9903: add new tw9903 video decoder") Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: pvrusb2: fix URB leak in pvr2_send_request_exSzymon Wilczek
When pvr2_send_request_ex() submits a write URB successfully but fails to submit the read URB (e.g. returns -ENOMEM), it returns immediately without waiting for the write URB to complete. Since the driver reuses the same URB structure, a subsequent call to pvr2_send_request_ex() attempts to submit the still-active write URB, triggering a 'URB submitted while active' warning in usb_submit_urb(). Fix this by ensuring the write URB is unlinked and waited upon if the read URB submission fails. Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16 Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com> Acked-by: Mike Isely <isely@pobox.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: solo6x10: Check for out of bounds chip_idKees Cook
Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type (literal "1" is an "int") could end up being shifted beyond 32 bits, so instrumentation was added (and due to the double is_tw286x() call seen via inlining), Clang decides the second one must now be undefined behavior and elides the rest of the function[1]. This is a known problem with Clang (that is still being worked on), but we can avoid the entire problem by actually checking the existing max chip ID, and now there is no runtime instrumentation added at all since everything is known to be within bounds. Additionally use an unsigned value for the shift to remove the instrumentation even without the explicit bounds checking. Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1] Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <kees@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> [hverkuil: fix checkpatch warning for is_tw286x]
2026-01-13media: synopsys: hdmirx: Detect broken interruptDmitry Osipenko
Downstream version of RK3588 U-Boot uses customized TF-A that remaps HDMIRX hardware interrupt, routing it via firmware that isn't supported by upstream driver. Detect broken interrupt and print a clarifying error message about a need to use open-source TF-A with this driver. Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: cx25821: Add missing unmap in snd_cx25821_hw_params()Haoxiang Li
In error path, add cx25821_alsa_dma_unmap() to release the resource acquired by cx25821_alsa_dma_map() Fixes: 8d8e6d6005de ("[media] cx28521: drop videobuf abuse in cx25821-alsa") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: cx23885: Add missing unmap in snd_cx23885_hw_params()Haoxiang Li
In error path, add cx23885_alsa_dma_unmap() to release the resource acquired by cx23885_alsa_dma_map(). Fixes: 9529a4b0cf49 ("[media] cx23885: drop videobuf abuse in cx23885-alsa") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: cx88: Add missing unmap in snd_cx88_hw_params()Haoxiang Li
In error path, add cx88_alsa_dma_unmap() to release resource acquired by cx88_alsa_dma_map(). Fixes: b2c75abde0de ("[media] cx88: drop videobuf abuse in cx88-alsa") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: radio-keene: fix memory leak in error pathShaurya Rane
Fix a memory leak in usb_keene_probe(). The v4l2 control handler is initialized and controls are added, but if v4l2_device_register() or video_register_device() fails afterward, the handler was never freed, leaking memory. Add v4l2_ctrl_handler_free() call in the err_v4l2 error path to ensure the control handler is properly freed for all error paths after it is initialized. Reported-by: syzbot+a41b73dce23962a74c72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a41b73dce23962a74c72 Fixes: 1bf20c3a0c61 ("[media] radio-keene: add a driver for the Keene FM Transmitter") Cc: stable@vger.kernel.org Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: adv7180: fix frame interval in progressive modeThorsten Schmelzer
The ADV7280-M may internally convert interlaced video input to progressive video. If this mode is enabled, the ADV7280-M delivers progressive video frames at the field rate of 50 fields per second (PAL) or 60 fields per second (NTSC). Fix the reported frame interval if progressive video is enabled. Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Michael Tretter <m.tretter@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: adv7180: implement g_register and s_registerThorsten Schmelzer
The g_register and s_register callbacks are useful for debugging the adv7180. Implement the callbacks to expose the register debugging to userspace. Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Michael Tretter <m.tretter@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: adv7180: add support for ancillary devicesThorsten Schmelzer
Depending on other devices on the i2c bus, using a non-default address for the CSI and VPP devices may be necessary. Replace calls to i2c_new_dummy_device with i2c_new_ancillary_device, which can directly use an i2c address from the device tree. Program the actual addresses of the sub-devices when configuring the chip. Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com> Signed-off-by: Michael Tretter <m.tretter@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: aspeed: Fix dram hang at res-changeJammy Huang
Dram hang could happen in the steps below: 1. start capture/compression 2. out-of-lock watchdog raise irq because of res-change. 3. aspeed_video_irq_res_change do clk-off At step3, capture/compression could be not accomplished yet. If clk-off in the middle of video operation, dram controller could hang at ast2500. Use reset rather than clk-off/on to avoid this problem. Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: v4l2-core: simplify v4l2_m2m_register_entity()Dmitry Antipov
Avoid 'strlen()'/'kmalloc()'/'snprintf()' sequence by using the convenient 'kasprintf()' in 'v4l2_m2m_register_entity()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: saa6588: Remove dprintk macro and use v4l2_info()Shrikant Raskar
The existing 'dprintk' macro used an unwrapped 'if' statement which was flagged by checkpatch, but instead of wrapping it, the debug handling can be simplified. This patch removes the 'dprintk' macro entirely and replaces all its usages with v4l2_info() helper. The unused 'PREFIX' macro is also removed. Signed-off-by: Shrikant Raskar <raskar.shree97@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-14media: verisilicon: AV1: Set IDR flag for intra_only frame typeBenjamin Gaignard
Intra_only frame could be considered as a key frame so Instantaneous Decoding Refresh (IDR) flag must be set of the both case and not only for key frames. Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com> Reported-by: Jianfeng Liu <liujianfeng1994@gmail.com> Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder") Cc: stable@vger.kernel.org Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: mediatek: vcodec: Discard pm_runtime_put() return valueRafael J. Wysocki
Printing error messages on pm_runtime_put() returning negative values is not particularly useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. Accordingly, update mtk_vcodec_enc_pw_off() and mtk_vcodec_dec_pw_off() to simply discard the return value of pm_runtime_put(). This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()Alper Ak
rga_get_frame() can return ERR_PTR(-EINVAL) when buffer type is unsupported or invalid. rga_buf_init() does not check the return value and unconditionally dereferences the pointer when accessing f->size. Add proper ERR_PTR checking and return the error to prevent dereferencing an invalid pointer. Fixes: 6040702ade23 ("media: rockchip: rga: allocate DMA descriptors per buffer") Cc: stable@vger.kernel.org Signed-off-by: Alper Ak <alperyasinak1@gmail.com> Reviewed-by: Michael Tretter <m.tretter@pengutronix.de> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: amphion: Drop min_queued_buffers assignmentMing Qian
The min_queued_buffers field controls when start_streaming() is called by the vb2 core (it delays the callback until at least N buffers are queued). Setting it to 1 affects the timing of start_streaming(), which breaks the seek flow in decoder scenarios and causes test failures. The current driver implementation does not rely on this minimum buffer requirement and handles streaming start correctly with the default value of 0, so remove these assignments. Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Cc: stable@vger.kernel.org Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: amphion: Use kmalloc instead of vmallocMing Qian
Replace vmalloc/vfree with kmalloc/kfree for allocating small driver structures (vpu_inst, vdec_t, venc_t, vpu_cmd_t, and frame objects). vmalloc() is designed for large memory allocations and incurs unnecessary overhead for small objects due to virtual memory mapping. kmalloc() is more appropriate as it allocates physically contiguous memory with lower overhead. ftrace measurements of vpu_alloc_cmd() show significant improvement: Before (vmalloc): 35-72 us (avg ~45.7 us) After (kmalloc): 11-26 us (avg ~16.8 us) This reduces allocation time by approximately 63%. No functional changes are intended. Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: amphion: Trigger source change if colorspace changedMing Qian
After encountering a colorspace change in the stream, the decoder sends a V4L2_EVENT_SOURCE_CHANGE event with changes set to V4L2_EVENT_SRC_CH_RESOLUTION. Then the client can detect and handle the colorspace change without any buffer reallocation Signed-off-by: Ming Qian <ming.qian@oss.nxp.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>