summaryrefslogtreecommitdiff
path: root/drivers/media/pci/intel
AgeCommit message (Collapse)Author
2026-02-21Convert 'alloc_obj' family to use the new default GFP_KERNEL argumentLinus Torvalds
This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21treewide: Replace kmalloc with kmalloc_obj for non-scalar typesKees Cook
This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-11Merge tag 'media/v7.0-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - Add support for GMSL1 and GMSL‑coax modules (PCI mgb4) - Add driver for TI VIP - AV1 – first kernel support (pixel‑format, decoder, transcoder) - Three new camera‑sensor drivers (os05b10, s5k3m5, s5kjn1) - Synopsys CSI‑2 receiver driver - Verisilicon & rkvdec – major fixes and enhancements - IPU6 (and 7) fixes and preparation for metadata - omap3isp: v4l2-compliance updates - Fix DVB streaming, drop wait_prepare/finish (dvb/vb2) * tag 'media/v7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (307 commits) media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer media: uvcvideo: Fix allocation for small frame sizes media: uvcvideo: Return queued buffers on start_streaming() failure media: uvcvideo: Create an ID namespace for streaming output terminals media: rkvdec: Add HEVC support for the VDPU383 variant media: rkvdec: Add HEVC support for the VDPU381 variant media: rkvdec: Add H264 support for the VDPU383 variant media: rkvdec: Add H264 support for the VDPU381 variant media: rkvdec: Disable multicore support media: rkvdec: Enable all clocks without naming them media: rkvdec: Support per-variant interrupt handler media: rkvdec: Add RCB and SRAM support media: rkvdec: Add variant specific coded formats list media: rkvdec: Move hevc functions to common file media: rkvdec: Move h264 functions to common file media: rkvdec: Use structs to represent the HW RPS media: rkvdec: Move cabac tables to their own source file media: rkvdec: Switch to using structs instead of writel media: visl: Add HEVC short and long term RPS sets media: v4l2-ctrls: Add hevc_ext_sps_[ls]t_rps controls ...
2026-01-16media: ipu6: Update e-mail addressesSakari Ailus
Remove Hongju's e-mail address that no longer works. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Always call video_device_pipeline_alloc_start()Sakari Ailus
Even if a video device is part of a pipeline already, video_device_pipeline_alloc_start() handles that case gracefully. Don't explicitly differentiate between video_device_pipeline_start() and video_device_pipeline_alloc_start() based on the existence of a pipeline. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Drop custom functions to obtain sd state informationSakari Ailus
Drop the custom functions that are used to obtain information from the sub-device state. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Remove source_entity from struct ipu6_isys_streamSakari Ailus
Remove source_entity from struct ipu6_isys_stream and instead pass it on in function arguments. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Obtain unique source pad from remote sub-deviceSakari Ailus
Obtain unique source pad from a remote sub-device, instead of the first one. This means that only one link may be active at stream start. There's no functional change in practice, unless multiple CSI-2 transmitters are directly connected to the receiver. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Obtain remote pad using media_pad_remote_pad_unique()Sakari Ailus
There's no reason to use media_entity_remote_source_pad_unique() as we know our pads. Use media_pad_remote_pad_unique() instead. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Drop error argument from ipu6_isys_stream_start()Sakari Ailus
error argument for ipu6_isys_stream_start() is always false, remove the argument. The IPU6_ISYS_BUFFER_LIST_FL_SET_STATE buffer flag also becomes redundant as a result, remove it as well. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Always close firmware streamSakari Ailus
Close the firmware stream even when disabling a stream on an upstream sub-device fails. This allows the firmware to release resources related to a stream that is stopped in any case. Suggested-by: Bingbu Cao <bingbu.cao@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Close firmware streams on streaming enable failureSakari Ailus
When enabling streaming fails, the stream is stopped in firmware but not closed. Do this to release resources on firmware side. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Don't check pipeline in stream_startSakari Ailus
A pipeline exists when start_streaming has returned so the check for start_streaming_called is equivalent to having media_pipeline. Use vb2_start_streaming_called() to perform the check. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Remove redundant streaming start via buffer queueingSakari Ailus
The videobuf2 framework will ensure buffers are queued before streaming is started. Remove support for starting streaming via the buf_queue() callback. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Make symbols staticSakari Ailus
Make isys_setup_hw and isys_isr static as they're only used in a single file. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Remove redundant driver data checksSakari Ailus
Both runtime PM resume and suspend callbacks check whether the driver's data is set for the device. This is done in probe(); drop the redundant checks. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Drop MMU hardware initialisation in probe()Sakari Ailus
The MMU hardware is initialised and cleaned up in the runtime PM resume callbacks. Do not do this in probe(). Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315 Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Ensure stream_mutex is acquired when dealing with node listSakari Ailus
The ipu6 isys driver maintains the list of video buffer queues related to a stream (in ipu6 context streams on the same CSI-2 virtual channel) and this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs. Ensure the common mutex is acquired when accessing the linked list, i.e. the isys device context's stream_mutex. Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard() while at it as the error handling becomes more simple this way. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Fix RPM reference leak in probe error pathsBingbu Cao
Several error paths in ipu6_pci_probe() were jumping directly to out_ipu6_bus_del_devices without releasing the runtime PM reference. Add pm_runtime_put_sync() before cleaning up other resources. Cc: Stable@vger.kernel.org Fixes: 25fedc021985 ("media: intel/ipu6: add Intel IPU6 PCI device driver") Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-13media: ipu6: Fix typo and wrong constant in ipu6-mmu.cBingbu Cao
Fix two coding errors in ipu6-mmu.c: 1. Fix syntax error in page_table_dump() where the closing parenthesis and semicolon were swapped in the TBL_PHYS_ADDR macro call. 2. Fix incorrect loop bound in alloc_l2_pt(). When initializing L2 page table entries, the loop was incorrectly using ISP_L1PT_PTES instead of ISP_L2PT_PTES. Fixes: 9163d83573e4 ("media: intel/ipu6: add IPU6 DMA mapping API and MMU table") Cc: stable@vger.kernel.org Signed-off-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-01-06media: ipu-bridge: Add DMI quirk for Dell XPS laptops with upside down sensorsHans de Goede
The Dell XPS 13 9350 and XPS 16 9640 both have an upside-down mounted OV02C10 sensor. This rotation of 180° is reported in neither the SSDB nor the _PLD for the sensor (both report a rotation of 0°). Add a DMI quirk mechanism for upside-down sensors and add 2 initial entries to the DMI quirk list for these 2 laptops. Note the OV02C10 driver was originally developed on a XPS 16 9640 which resulted in inverted vflip + hflip settings making it look like the sensor was upright on the XPS 16 9640 and upside down elsewhere this has been fixed in commit d5ebe3f7d13d ("media: ov02c10: Fix default vertical flip"). This makes this commit a regression fix since now the video is upside down on these Dell XPS models where it was not before. Fixes: d5ebe3f7d13d ("media: ov02c10: Fix default vertical flip") Cc: stable@vger.kernel.org Reviewed-by: Bryan O'Donoghue <bod@kernel.org> Reviewed-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-11-13media: ipu6: isys: Add support for monochrome media bus formatsHans de Goede
Add support for monochrome media bus formats, for use with monochrome/IR camera sensors. This has been tested on a Dell XPS 13 9320 with OV1A1B IR sensor. Signed-off-by: Hans de Goede <hansg@kernel.org> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-11-13media: ipu-bridge: Add OV05C10 to the list of supported sensorsHao Yao
Add the OV05C10 sensor to the list of supported sensors. Signed-off-by: Hao Yao <hao.yao@intel.com> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-11-13media: ipu-bridge: Add IMX471 to the list of supported sensorsJimmy Su
Add the IMX471 sensor, which is used with a SONY471A ACPI HID on the Lenovo ThinkPad X9 15 laptop to the list of supported sensors. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2362064 Signed-off-by: Jimmy Su <jimmy.su@intel.com> Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-29media: ivsc: Release csi_dev reference early in mei_ace_setup_dev_link()Ma Ke
Put the reference to csi_dev acquired during driver probe in mei_ace_setup_dev_link() inside the same function, instead of during driver unbind in mei_ace_remove(). This can be done as device_link_add() already takes a reference to csi_dev. Signed-off-by: Ma Ke <make24@iscas.ac.cn> [Sakari Ailus: Rework commit message.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-17media: ipu6: isys: Use %pe format specifierRicardo Ribalda
The %pe format specifier is designed to print error pointers. It prints a symbolic error name (eg. -EINVAL) and it makes the code simpler by omitting PTR_ERR(). This patch fixes this cocci report: ./pci/intel/ipu6/ipu6-isys-csi2.c:91:22-29: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-17media: ipu3-cio2: Use %pe format specifierRicardo Ribalda
The %pe format specifier is designed to print error pointers. It prints a symbolic error name (eg. -EINVAL) and it makes the code simpler by omitting PTR_ERR(). This patch fixes this cocci report: ./pci/intel/ipu3/ipu3-cio2.c:318:19-26: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-17media: ipu-bridge: Use %pe format specifierRicardo Ribalda
The %pe format specifier is designed to print error pointers. It prints a symbolic error name (eg. -EINVAL) and it makes the code simpler by omitting PTR_ERR(). This patch fixes this cocci report: ./pci/intel/ipu-bridge.c:567:3-10: WARNING: Consider using %pe to print PTR_ERR() Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25media: ipu6: isys: Set embedded data type correctly for metadata formatsSakari Ailus
The IPU6 ISYS driver supported metadata formats but was missing correct embedded data type in the receiver configuration. Add it now. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-25media: ipu6: isys: Use v4l2_ctrl_subdev_subscribe_event()Laurent Pinchart
The ipu6-isys driver uses v4l2_ctrl_subscribe_event() to handle control event subscription on a subdev. While this works, it is the wrong API. Use the subdev-specific v4l2_ctrl_subdev_subscribe_event() helper instead. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-08-13media: ipu6: isys: Don't set V4L2_FL_USES_V4L2_FH manuallyLaurent Pinchart
The V4L2_FL_USES_V4L2_FH flag is set by v4l2_fh_init(). It is not meant to be set manually by drivers. Drop it from the ipu6-isys driver. Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-07-10media: ipu6: isys: Set minimum height to 1Sakari Ailus
For image data generally 2 seems like a minimum height that surely won't cause any issues, but some sensors have metadata the height of which is just one line. Set the minimum height to 1. Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-07-10media: ipu6: isys: Use correct pads for xlate_streams()Sakari Ailus
The pad argument to v4l2_subdev_state_xlate_streams() is incorrect, static pad number is used for the source pad even though the pad number is dependent on the stream. Fix it. Fixes: 3a5c59ad926b ("media: ipu6: Rework CSI-2 sub-device streaming control") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-30media: ipu-bridge: Improve error logging when waiting for IVSC to become readyHans de Goede
The ipu-bridge code waits for the IVSC to become ready (on platforms with an IVSC chip). It does this by returning -EPROBE_DEFER, but it does not use dev_err_probe() so no reason for deferring gets registered. After 30 seconds the kernel logs a warning that the probe is still deferred, which looks like this: [ 33.951709] pci 0000:00:14.3: deferred probe pending: (reason unknown) Use dev_err_probe() when returning -EPROBE_DEFER to register the probe deferral reason changing the error to: deferred probe pending: waiting for IVSC to become ready to help with debugging why drivers are not binding if the iVSC does not become ready for some reason. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-30media: ipu-bridge: Add Onsemi MT9M114 HID to list of supported sensorsHans de Goede
Add INT33F0 ACPI HID for the Onsemi MT9M114 sensor to the list of supported sensors. This sensor is found on the Asus T100TA using this HID. Tested-by: Hans de Goede <hdegoede@redhat.com> # Asus T100TA with MT9M114 Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-30media: ipu-bridge: Add Toshiba T4KA3 HID to list of supported sensorHans de Goede
The Xiaomi Mi Pad 2 tablet uses a Toshiba T4KA3 sensor, using a Xiaomi specific Hardware-ID of "XMMC0003" add this to the sensor-list of the ipu-bridge code. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-30media: ivsc: Remove Wentong's e-mail addressSakari Ailus
Remove Wentong's e-mail address from MODULE_AUTHOR() macro as the current e-mail address is no longer valid. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-30media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() callsHans de Goede
Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function. This causes the mei_cl client to stay part of the mei_device->file_list list even though its memory is freed by mei_cl_bus_dev_release() calling kfree(cldev->cl). This leads to a use-after-free when mei_vsc_remove() runs mei_stop() which first removes all mei bus devices calling mei_ace_remove() and mei_csi_remove() followed by mei_cl_bus_dev_release() and then calls mei_cl_all_disconnect() which walks over mei_device->file_list dereferecing the just freed cldev->cl. And mei_vsc_remove() it self is run at shutdown because of the platform_device_unregister(tp->pdev) in vsc_tp_shutdown() When building a kernel with KASAN this leads to the following KASAN report: [ 106.634504] ================================================================== [ 106.634623] BUG: KASAN: slab-use-after-free in mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634683] Read of size 4 at addr ffff88819cb62018 by task systemd-shutdow/1 [ 106.634729] [ 106.634767] Tainted: [E]=UNSIGNED_MODULE [ 106.634770] Hardware name: Dell Inc. XPS 16 9640/09CK4V, BIOS 1.12.0 02/10/2025 [ 106.634773] Call Trace: [ 106.634777] <TASK> ... [ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) [ 106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei [ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei ... [ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei [ 106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc [ 106.635066] platform_remove (drivers/base/platform.c:1424) Add the missing mei_cldev_disable() calls so that the mei_cl gets removed from mei_device->file_list before it is freed to fix this. Fixes: 78876f71b3e9 ("media: pci: intel: ivsc: Add ACE submodule") Fixes: 29006e196a56 ("media: pci: intel: ivsc: Add CSI submodule") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede <hansg@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-30media: ipu-bridge: Add support for additional link frequenciesJason Chen
Support two additional frequencies for the ov08x40 sensor using 2 lanes Signed-off-by: Jason Chen <jason.z.chen@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-30media: ipu3-cio2: Use V4L2 subdev active stateLaurent Pinchart
Replace storage of the active format in the cio2_queue structure with usage of V4L2 subdev active state. This simplifies locking in the driver, and drops usage of the deprecated subdev .open() internal operation. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> [Sakari Ailus: keep fmt_default non-static to keep clang happy.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-30media: ipu-bridge: Add _HID for OV5670Daniel Scally
The OV5670 is found on Dell 7212 tablets paired with an IPU3 ISP and needs to be connected by the ipu-bridge. Add it to the list of supported devices. Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-06-30media: ipu-bridge: Add link-frequency to the GC0310 entryHans de Goede
Add the missing link-frequency to the ipu_supported_sensors[] array's Galaxy Core GC0310 entry. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-05-06media: intel/ipu6: Change deprecated lock commentStanislaw Gruszka
pre_streamon_queued is no longer used. The lock now is protecting active and incoming lists. Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-05-06media: intel/ipu6: Remove line_alignStanislaw Gruszka
isys->line_align value is only used in one place and we can just use the proper value directly there. Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-05-06media: intel/ipu6: Remove pin_ready function pointerStanislaw Gruszka
We can call ipu6_isys_queue_buf_ready() directly. The only current usage is pin_ready pointer is to check if pin was prepared before IPU6_FW_ISYS_RESP_TYPE_PIN_DATA_READY interrupt, we can use queue pointer for that purpose. Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-05-06media: intel/ipu6: Remove unused ipu6_isys_csi2_pdataStanislaw Gruszka
The pointer to ipu6_isys_csi2_pdata is not used. Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-04-25media: intel/ipu6: Fix dma mask for non-secure modeStanislaw Gruszka
We use dma_get_mask() of auxdev device for calculate iova pfn limit. This is always 32 bit mask as we do not initialize the mask (and we can not do so, since dev->dev_mask is NULL anyways for auxdev). Since we need 31 bit mask for non-secure mode use mmu_info->aperture_end which is properly initialized to correct mask for both modes. Fixes: daabc5c64703 ("media: ipu6: not override the dma_ops of device in driver") Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-04-25media: intel/ipu6: Minor dma_mask clenaupStanislaw Gruszka
Remove unused dma_mask field and ipu-dma.h includes. Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-04-25media: intel/ipu6: Replace deprecated PCI functionsPhilipp Stanner
pcim_iomap_table() and pcim_iomap_regions() have been deprecated. Furthermore, the "name" parameter in pcim_iomap_regions() and its successor, pcim_iomap_region(), should always reflect the driver name, whereas currently it is the device's name. Replace the deprecated functions with pcim_iomap_region() and pass the actual driver name. Signed-off-by: Philipp Stanner <phasta@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-04-25media: ipu3-cio2: Replace deprecated PCI functionsPhilipp Stanner
pcim_iomap_table() and pcim_iomap_regions() have been deprecated. Replace them with pcim_iomap_region(), and pass the actual driver name to that function. Signed-off-by: Philipp Stanner <phasta@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
generated by cgit v1.2.3 (git 2.0.4) at 2026-03-25 11:44:17 +0000