summaryrefslogtreecommitdiff
path: root/drivers/media/platform/qcom
AgeCommit message (Collapse)Author
2023-12-07media: qcom: camss: Flag VFE-lites to support more VFEsMatti Lehtimäki
Some platforms such as SC7280 have three VFEs and two VFE-lites. Current code has hard-coded two as the maximum number of VFEs. Remove the hard-coded maximum number of VFEs to handle all possible combinations of VFEs and VFE-lites. Signed-off-by: Matti Lehtimäki <matti.lehtimaki@gmail.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202311200405.h6G4L9oe-lkp@intel.com Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-12-07media: qcom: camss: Add support for named power-domainsBryan O'Donoghue
Right now we use fixed indexes to assign power-domains, with a requirement for the TOP GDSC to come last in the list. Adding support for named power-domains means the declaration in the dtsi can come in any order. After this change we continue to support the old indexing - if a SoC resource declaration or the in-use dtb doesn't declare power-domain names we fall back to the default legacy indexing. From this point on though new SoC additions should contain named power-domains, eventually we will drop support for legacy indexing. Tested-by: Matti Lehtimäki <matti.lehtimaki@gmail.com> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-12-07media: qcom: camss: Move VFE power-domain specifics into vfe.cBryan O'Donoghue
Moving the location of the hooks to VFE power domains has several advantages. 1. Separation of concerns and functional decomposition. vfe.c should be responsible for and know best how manage power-domains for a VFE, excising from camss.c follows this principle. 2. Embedding a pointer to genpd in struct camss_vfe{} meas that we can dispense with a bunch of kmalloc array inside of camss.c. 3. Splitting up titan top gdsc from vfe/ife gdsc provides a base for breaking up magic indexes in dtsi. Suggested-by: Matti Lehtimäki <matti.lehtimaki@gmail.com> Tested-by: Matti Lehtimäki <matti.lehtimaki@gmail.com> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-12-07media: qcom: camss: Use common VFE pm_domain_on/pm_domain_off where applicableBryan O'Donoghue
For the various versions of VFE we have a boiler-plate pm_domain_on/pm_domain_off callback pair of the general form. - Error check. Not always done but applicable to all. - device_link_add (DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE); - Error check returning -EINVAL on error. - Return 0 Reduce the pattern down to a common callback. VFE 4.1 is a special case which to me also indicates that it is worthwhile maintaining an indirection for the vfe_pm_domain_{on|off} for now. Otherwise lets chuck out a bunch of needlessly replicated code. Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Suggested-by: Matti Lehtimäki <matti.lehtimaki@gmail.com> Tested-by: Matti Lehtimäki <matti.lehtimaki@gmail.com> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-12-07media: qcom: camss: Convert to per-VFE pointer for power-domain linkagesBryan O'Donoghue
Right now we use the top-level camss structure to provide pointers via VFE id index back to genpd linkages. In effect this hard-codes VFE indexes to power-domain indexes in the dtsi and mandates a very particular ordering of power domains in the dtsi, which bears no relationship to a real hardware dependency. As a first step to rationalising the VFE power-domain code and breaking the magic indexing in dtsi use per-VFE pointers to genpd linkages. The top-level index in msm_vfe_subdev_init is still used to attain the initial so no functional or logical change arises from this change. Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Tested-by: Matti Lehtimäki <matti.lehtimaki@gmail.com> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-12-07media: qcom: camss: Flag which VFEs require a power-domainBryan O'Donoghue
At the moment we have some complex code for determining if a VFE requires a power-domain attachment. Particularly discordant in this scheme is the subtle reliance on VFE and VFE Lite declaration ordering in our resources. VFE id is used to determine if a VFE is lite or not and consequently if a VFE requires power-domain attachment. VFE Lite though is not a correct delineation between power-domain and non power-domain state since early SoCs have neither VFE Lite nor power-domains attached to VFEs. Introduce has_pd to the VFE resource structure to allow the CAMSS code to understand if it needs to try to attach a power-domain for a given VFE. As a side-effect from this we no longer need to care about VFE Lite or non-Lite or the id number associated with either and which order the VFE/VFE Lite was declared in. Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Tested-by: Matti Lehtimäki <matti.lehtimaki@gmail.com> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-11-23media: v4l: subdev: Switch to stream-aware state functionsSakari Ailus
Switch all drivers accessing sub-device state to use the stream-aware functions. We will soon remove the old ones. This patch has been generated using the following Coccinelle script: ---------8<------------ @@ expression E1, E2, E3; @@ - v4l2_subdev_get_pad_format(E1, E2, E3) + v4l2_subdev_state_get_format(E2, E3) @@ expression E1, E2, E3; @@ - v4l2_subdev_get_pad_crop(E1, E2, E3) + v4l2_subdev_state_get_crop(E2, E3) @@ expression E1, E2, E3; @@ - v4l2_subdev_get_pad_compose(E1, E2, E3) + v4l2_subdev_state_get_compose(E2, E3) @@ expression E1, E2, E3; @@ - v4l2_subdev_get_try_format(E1, E2, E3) + v4l2_subdev_state_get_format(E2, E3) @@ expression E1, E2, E3; @@ - v4l2_subdev_get_try_crop(E1, E2, E3) + v4l2_subdev_state_get_crop(E2, E3) @@ expression E1, E2, E3; @@ - v4l2_subdev_get_try_compose(E1, E2, E3) + v4l2_subdev_state_get_compose(E2, E3) ---------8<------------ Additionally drivers/media/i2c/s5k5baf.c and drivers/media/platform/samsung/s3c-camif/camif-capture.c have been manually changed as Coccinelle didn't. Further local variables have been removed as they became unused as a result of the other changes. Also Coccinelle introduced indentation by space in files drivers/media/i2c/st-mipid02.c and drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c. This has been also corrected. The diff from Coccinelle-generated changes are: > diff --git b/drivers/media/i2c/imx319.c a/drivers/media/i2c/imx319.c > index e549692ff478..420984382173 100644 > --- b/drivers/media/i2c/imx319.c > +++ a/drivers/media/i2c/imx319.c > @@ -2001,7 +2001,6 @@ static int imx319_do_get_pad_format(struct imx319 *imx319, > struct v4l2_subdev_format *fmt) > { > struct v4l2_mbus_framefmt *framefmt; > - struct v4l2_subdev *sd = &imx319->sd; > > if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { > framefmt = v4l2_subdev_state_get_format(sd_state, fmt->pad); > diff --git b/drivers/media/i2c/imx355.c a/drivers/media/i2c/imx355.c > index 96bdde685d65..e1b1d2fc79dd 100644 > --- b/drivers/media/i2c/imx355.c > +++ a/drivers/media/i2c/imx355.c > @@ -1299,7 +1299,6 @@ static int imx355_do_get_pad_format(struct imx355 *imx355, > struct v4l2_subdev_format *fmt) > { > struct v4l2_mbus_framefmt *framefmt; > - struct v4l2_subdev *sd = &imx355->sd; > > if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { > framefmt = v4l2_subdev_state_get_format(sd_state, fmt->pad); > diff --git b/drivers/media/i2c/ov08x40.c a/drivers/media/i2c/ov08x40.c > index ca799bbcfdb7..abbb0b774d43 100644 > --- b/drivers/media/i2c/ov08x40.c > +++ a/drivers/media/i2c/ov08x40.c > @@ -2774,7 +2774,6 @@ static int ov08x40_do_get_pad_format(struct ov08x40 *ov08x, > struct v4l2_subdev_format *fmt) > { > struct v4l2_mbus_framefmt *framefmt; > - struct v4l2_subdev *sd = &ov08x->sd; > > if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { > framefmt = v4l2_subdev_state_get_format(sd_state, fmt->pad); > diff --git b/drivers/media/i2c/ov13858.c a/drivers/media/i2c/ov13858.c > index 7816d9787c61..09387e335d80 100644 > --- b/drivers/media/i2c/ov13858.c > +++ a/drivers/media/i2c/ov13858.c > @@ -1316,7 +1316,6 @@ static int ov13858_do_get_pad_format(struct ov13858 *ov13858, > struct v4l2_subdev_format *fmt) > { > struct v4l2_mbus_framefmt *framefmt; > - struct v4l2_subdev *sd = &ov13858->sd; > > if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { > framefmt = v4l2_subdev_state_get_format(sd_state, fmt->pad); > diff --git b/drivers/media/i2c/ov13b10.c a/drivers/media/i2c/ov13b10.c > index 268cd4b03f9c..c06411d5ee2b 100644 > --- b/drivers/media/i2c/ov13b10.c > +++ a/drivers/media/i2c/ov13b10.c > @@ -1001,7 +1001,6 @@ static int ov13b10_do_get_pad_format(struct ov13b10 *ov13b, > struct v4l2_subdev_format *fmt) > { > struct v4l2_mbus_framefmt *framefmt; > - struct v4l2_subdev *sd = &ov13b->sd; > > if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { > framefmt = v4l2_subdev_state_get_format(sd_state, fmt->pad); > diff --git b/drivers/media/i2c/s5c73m3/s5c73m3-core.c a/drivers/media/i2c/s5c73m3/s5c73m3-core.c > index 47605e36bc60..8f9b5713daf7 100644 > --- b/drivers/media/i2c/s5c73m3/s5c73m3-core.c > +++ a/drivers/media/i2c/s5c73m3/s5c73m3-core.c > @@ -819,7 +819,6 @@ static void s5c73m3_oif_try_format(struct s5c73m3 *state, > struct v4l2_subdev_format *fmt, > const struct s5c73m3_frame_size **fs) > { > - struct v4l2_subdev *sd = &state->sensor_sd; > u32 code; > > switch (fmt->pad) { > diff --git a/drivers/media/i2c/s5k5baf.c b/drivers/media/i2c/s5k5baf.c > index 67da2045f543..03ccfb0e1e11 100644 > --- a/drivers/media/i2c/s5k5baf.c > +++ b/drivers/media/i2c/s5k5baf.c > @@ -1472,14 +1472,11 @@ static int s5k5baf_set_selection(struct v4l2_subdev *sd, > > if (sel->which == V4L2_SUBDEV_FORMAT_TRY) { > rects = (struct v4l2_rect * []) { > - &s5k5baf_cis_rect, > - v4l2_subdev_get_try_crop(sd, sd_state, > - PAD_CIS), > - v4l2_subdev_get_try_compose(sd, sd_state, > - PAD_CIS), > - v4l2_subdev_get_try_crop(sd, sd_state, > - PAD_OUT) > - }; > + &s5k5baf_cis_rect, > + v4l2_subdev_state_get_crop(sd_state, PAD_CIS), > + v4l2_subdev_state_get_compose(sd_state, PAD_CIS), > + v4l2_subdev_state_get_crop(sd_state, PAD_OUT) > + }; > s5k5baf_set_rect_and_adjust(rects, rtype, &sel->r); > return 0; > } > diff --git b/drivers/media/platform/samsung/s3c-camif/camif-capture.c a/drivers/media/platform/samsung/s3c-camif/camif-capture.c > index 295e083f38e8..be58260ea67e 100644 > --- b/drivers/media/platform/samsung/s3c-camif/camif-capture.c > +++ a/drivers/media/platform/samsung/s3c-camif/camif-capture.c > @@ -1216,7 +1216,7 @@ static int s3c_camif_subdev_get_fmt(struct v4l2_subdev *sd, > struct v4l2_mbus_framefmt *mf = &fmt->format; > > if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { > - mf = v4l2_subdev_get_try_format(sd, sd_state, fmt->pad); > + mf = v4l2_subdev_state_get_format(sd_state, fmt->pad); > fmt->format = *mf; > return 0; > } > @@ -1305,7 +1305,7 @@ static int s3c_camif_subdev_set_fmt(struct v4l2_subdev *sd, > __camif_subdev_try_format(camif, mf, fmt->pad); > > if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) { > - mf = v4l2_subdev_get_try_format(sd, sd_state, fmt->pad); > + mf = v4l2_subdev_state_get_format(sd_state, fmt->pad); > *mf = fmt->format; > mutex_unlock(&camif->lock); > return 0; > diff --git b/drivers/media/platform/ti/cal/cal-camerarx.c a/drivers/media/platform/ti/cal/cal-camerarx.c > index cea454ed9c20..61433744c6c4 100644 > --- b/drivers/media/platform/ti/cal/cal-camerarx.c > +++ a/drivers/media/platform/ti/cal/cal-camerarx.c > @@ -621,8 +621,6 @@ static int cal_camerarx_sd_enum_mbus_code(struct v4l2_subdev *sd, > struct v4l2_subdev_state *state, > struct v4l2_subdev_mbus_code_enum *code) > { > - struct cal_camerarx *phy = to_cal_camerarx(sd); > - > /* No transcoding, source and sink codes must match. */ > if (cal_rx_pad_is_source(code->pad)) { > struct v4l2_mbus_framefmt *fmt; > diff --git b/drivers/staging/media/imx/imx-ic-prp.c a/drivers/staging/media/imx/imx-ic-prp.c > index dd558fac6477..61d69f19657e 100644 > --- b/drivers/staging/media/imx/imx-ic-prp.c > +++ a/drivers/staging/media/imx/imx-ic-prp.c > @@ -82,8 +82,6 @@ static struct v4l2_mbus_framefmt * > __prp_get_fmt(struct prp_priv *priv, struct v4l2_subdev_state *sd_state, > unsigned int pad, enum v4l2_subdev_format_whence which) > { > - struct imx_ic_priv *ic_priv = priv->ic_priv; > - > if (which == V4L2_SUBDEV_FORMAT_TRY) > return v4l2_subdev_state_get_format(sd_state, pad); > else > diff --git b/drivers/staging/media/imx/imx-ic-prpencvf.c a/drivers/staging/media/imx/imx-ic-prpencvf.c > index 02db7dbb884b..ec73c901079e 100644 > --- b/drivers/staging/media/imx/imx-ic-prpencvf.c > +++ a/drivers/staging/media/imx/imx-ic-prpencvf.c > @@ -790,8 +790,6 @@ static struct v4l2_mbus_framefmt * > __prp_get_fmt(struct prp_priv *priv, struct v4l2_subdev_state *sd_state, > unsigned int pad, enum v4l2_subdev_format_whence which) > { > - struct imx_ic_priv *ic_priv = priv->ic_priv; > - > if (which == V4L2_SUBDEV_FORMAT_TRY) > return v4l2_subdev_state_get_format(sd_state, pad); > else > diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c > index 9c9361354c00..b08a249b5fdd 100644 > --- a/drivers/media/i2c/st-mipid02.c > +++ b/drivers/media/i2c/st-mipid02.c > @@ -751,7 +751,7 @@ static void mipid02_set_fmt_source(struct v4l2_subdev *sd, > format->format = bridge->fmt; > else > format->format = *v4l2_subdev_state_get_format(sd_state, > - MIPID02_SINK_0); > + MIPID02_SINK_0); > > /* but code may need to be converted */ > format->format.code = serial_to_parallel_code(format->format.code); > diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c > index 117912d3bfbd..96353648c032 100644 > --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c > +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c > @@ -319,7 +319,7 @@ static void rkisp1_isp_start(struct rkisp1_isp *isp, > rkisp1_write(rkisp1, RKISP1_CIF_ISP_CTRL, val); > > src_fmt = v4l2_subdev_state_get_format(sd_state, > - RKISP1_ISP_PAD_SOURCE_VIDEO); > + RKISP1_ISP_PAD_SOURCE_VIDEO); > src_info = rkisp1_mbus_info_get_by_code(src_fmt->code); > > if (src_info->pixel_enc != V4L2_PIXEL_ENC_BAYER) > @@ -475,9 +475,9 @@ static void rkisp1_isp_set_src_fmt(struct rkisp1_isp *isp, > sink_fmt = v4l2_subdev_state_get_format(sd_state, > RKISP1_ISP_PAD_SINK_VIDEO); > src_fmt = v4l2_subdev_state_get_format(sd_state, > - RKISP1_ISP_PAD_SOURCE_VIDEO); > + RKISP1_ISP_PAD_SOURCE_VIDEO); > src_crop = v4l2_subdev_state_get_crop(sd_state, > - RKISP1_ISP_PAD_SOURCE_VIDEO); > + RKISP1_ISP_PAD_SOURCE_VIDEO); > > /* > * Media bus code. The ISP can operate in pass-through mode (Bayer in, Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2023-11-23media: qcom: camss: Fix references to pad configLaurent Pinchart
V4L2 subdev operations have moved from operating on a v4l2_subdev_pad_config to a v4l2_subdev_state a long time ago. Fix remaining incorrect references to pad config in comments. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2023-11-23media: qcom: camss: clean up a checkDan Carpenter
Imagine that "->vfe_num" is zero, then the subtraction will underflow to UINT_MAX. Plus it's just cleaner to use >= instead. Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2023-10-23media: venus: Fix firmware path for resourcesPatrick Whewell
The firmware path for some of the resources is still the old format. This fixes the path to address the firmware correctly using the new .mbn format. Signed-off-by: Patrick Whewell <patrick.whewell@sightlineapplications.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-23media: venus: hfi_cmds: Replace one-element array with flex-array member and ↵Gustavo A. R. Silva
use __counted_by Array `data` in `struct hfi_sfr` is being used as a fake flexible array at run-time: drivers/media/platform/qcom/venus/hfi_venus.c: 1033 p = memchr(sfr->data, '\0', sfr->buf_size); 1034 /* 1035 * SFR isn't guaranteed to be NULL terminated since SYS_ERROR indicates 1036 * that Venus is in the process of crashing. 1037 */ 1038 if (!p) 1039 sfr->data[sfr->buf_size - 1] = '\0'; 1040 1041 dev_err_ratelimited(dev, "SFR message from FW: %s\n", sfr->data); Fake flexible arrays are deprecated, and should be replaced by flexible-array members. So, replace one-element array with a flexible-array member in `struct hfi_sfr`. While there, also annotate array `data` with __counted_by() to prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). This results in no differences in binary output. This issue was found with the help of Coccinelle, and audited and fixed manually. Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-23media: venus: hfi_parser: Add check to keep the number of codecs within rangeVikash Garodia
Supported codec bitmask is populated from the payload from venus firmware. There is a possible case when all the bits in the codec bitmask is set. In such case, core cap for decoder is filled and MAX_CODEC_NUM is utilized. Now while filling the caps for encoder, it can lead to access the caps array beyong 32 index. Hence leading to OOB write. The fix counts the supported encoder and decoder. If the count is more than max, then it skips accessing the caps. Cc: stable@vger.kernel.org Fixes: 1a73374a04e5 ("media: venus: hfi_parser: add common capability parser") Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-23media: venus: hfi: add checks to handle capabilities from firmwareVikash Garodia
The hfi parser, parses the capabilities received from venus firmware and copies them to core capabilities. Consider below api, for example, fill_caps - In this api, caps in core structure gets updated with the number of capabilities received in firmware data payload. If the same api is called multiple times, there is a possibility of copying beyond the max allocated size in core caps. Similar possibilities in fill_raw_fmts and fill_profile_level functions. Cc: stable@vger.kernel.org Fixes: 1a73374a04e5 ("media: venus: hfi_parser: add common capability parser") Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-23media: venus: hfi: fix the check to handle session buffer requirementVikash Garodia
Buffer requirement, for different buffer type, comes from video firmware. While copying these requirements, there is an OOB possibility when the payload from firmware is more than expected size. Fix the check to avoid the OOB possibility. Cc: stable@vger.kernel.org Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)") Reviewed-by: Nathan Hebert <nhebert@chromium.org> Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-23media: venus: hfi: add checks to perform sanity on queue pointersVikash Garodia
Read and write pointers are used to track the packet index in the memory shared between video driver and firmware. There is a possibility of OOB access if the read or write pointer goes beyond the queue memory size. Add checks for the read and write pointer to avoid OOB access. Cc: stable@vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-12media: qcom: venus: fix incorrect return valueHans Verkuil
'pd' can be NULL, and in that case it shouldn't be passed to PTR_ERR. Fixes a smatch warning: drivers/media/platform/qcom/venus/pm_helpers.c:873 vcodec_domains_get() warn: passing zero to 'PTR_ERR' Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
2023-10-07media: qcom: camss: Comment CSID dt_id fieldBryan O'Donoghue
Digging into the documentation we find that the DT_ID bitfield is used to map the six bit DT to a two bit ID code. This value is concatenated to the VC bitfield to create a CID value. DT_ID is the two least significant bits of CID and VC the most significant bits. Originally we set dt_id = vc * 4 in and then subsequently set dt_id = vc. commit 3c4ed72a16bc ("media: camss: sm8250: Virtual channels for CSID") silently fixed the multiplication by four which would give a better value for the generated CID without mentioning what was being done or why. Next up I haplessly changed the value back to "dt_id = vc * 4" since there didn't appear to be any logic behind it. Hans asked what the change was for and I honestly couldn't remember the provenance of it, so I dug in. Link: https://lore.kernel.org/linux-arm-msm/edd4bf9b-0e1b-883c-1a4d-50f4102c3924@xs4all.nl/ Add a comment so the next hapless programmer doesn't make this same mistake. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Propagate vfe_reset error up the callstackBryan O'Donoghue
A previous patch I had removed the returns from vfe_disable() since we didn't trap any meaningful errors. Konrad pointed out vfe_reset() could return an error, which is true. Trap the vfe_reset() error code and throw it up the callstack. Suggested-by: Konrad Dybcio <konrad.dybcio@linaro.org> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Move vfe_disable into a common routine where applicableBryan O'Donoghue
We can move vfe_disable() into a common routine in the core VFE file provided we make wm_stop() a VFE specific callback. The callback is required to capture the case where VFE 17x currently isn't VC enabled where as VFE 480 is. Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Support RDI3 for VFE 17xBryan O'Donoghue
Some VFEs have four RDIs apiece. Right now the ISR code has a hard-coded value which tops-out at RDI2 meaning only three RDIs can be utilised in practice. Extend out the various routines in camss-vfe-17x.c to support the higher RDI count. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Fix support for setting CSIPHY clock name csiphyXBryan O'Donoghue
Several of our upstream and soon-to-be upstream SoC CAMSS dtsi declare csiphyX as opposed to the older clock name csiX_phy. Right now the CAMSS code will fail to set the csiphyX clock even if we have declared it in our list of clocks. For sdm845 and sm8250 we appear to "get away" with this error, however on sc8280xp we don't. The right approach here is to set the clock when it is declared. If a SoC doesn't require or a SoC driver implementer doesn't think we need, then the clock ought to simply be omitted from the clock list. Include csiphyX in the set of permissible strings which will subsequently lead to the csiphyX clock being set during csiphy_set_clock_rates() phase. sdm845 and sm8250 will work with the code as-is so I've omitted this from a suggested Fixes list. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Functionally decompose CSIPHY clock lookupsBryan O'Donoghue
The csiphyX_timer and csiX_phy values need not be hard-coded. We can functionally decompose the string matching inside of a loop. Static string values are brittle, difficult to extend and not required anyway since the camss->res->csiphy_num value informs us of the number of CSIPHYs and hence the set of potential clocks for a given CSIPHY. In simple terms if we have five CSIPHYs we can have no more and no less than five csiphy_timer clocks. Similarly csi_phy core clocks have a 1:1 relationship with the PHY they clock. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Allow clocks vfeN vfe_liteN or vfe_liteBryan O'Donoghue
The number of Video Front End - VFE or Image Front End - IFE supported with new SoCs can vary both for the full and lite cases. For example sdm845 has one vfe_lite and two vfe interfaces with the vfe clock called simply "vfe_lite" with no integer postfix. sc8280xp has four vfe and four vfe lite blocks. At the moment we declare vfe_lite0 and vfe_lite1 for sm8250 but never set those clocks because we don't match the strings. We need to support the following clock name formats - vfeN - vfe_liteN - vfe_lite with N being any reasonably sized integer. There are two sites in this code which need to do the same thing, constructing and matching strings with the pattern above, so encapsulate the logic in one function. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Untangle if/else spaghetti in camssBryan O'Donoghue
We have a very convoluted if/else legacy here which needs to be rationalised to make it more sustainable. Adding in another Soc or two will make some of these if statements into increasingly large multi-clause behemoths. Introduce switches in the obvious places to despaghetiify. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Remove special case for VFE get/putBryan O'Donoghue
From sdm845 onwards we need to ensure the VFE is powered on prior to switching on the CSID. Currently the code tests for sdm845, sm8250 and then does get/set. This is not extensible and it turns out is not necessary either since vfe_get and vfe_set reference count. Remove the over-conservative SoC version check. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # rb3 # db410c Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Assign the correct number of RDIs per VFEBryan O'Donoghue
Each Video Front End - VFE - has a variable number of Raw Data Interfaces - RDIs associated with it. The CAMSS code started from a naive implementation where a fixed define was used as a control in a for(){} loop iterating through RDIs. That model scales badly. An attempt was made with VFE_LINE_NUM_GEN2 and VFE_LINE_NUM_GEN1 to differentiate between SoCs but, the problem with that is "gen1" and "gen2" have no meaning in the silicon. There is no fixed constraint in the silicon between VFE and RDI, it is entirely up to the SoC designers how many VFEs are populated and how many RDIs to associate with each VFE. As an example sdm845 has VFE version 175 and sm8250 VFE version 480. sdm845 has 2 VFEs with 4 RDIs and 1 VFE Lite with 4 RDIs. sm8250 has 2 VFEs with 3 RDIs and 2 VFE Lite with 4 RDIs. Clearly then we need a more granular model to capture the necessary data. The defines have gone away to be replaced with per-SoC data but, we haven't populated the parameter data with the real values. Let's call those values out now msm8916: 1 x VFE 3 x RDI per VFE (not 4) msm8996: 2 x VFE 3 x RDI per VFE (not 4) sdm660: 2 x VFE 3 x RDI per VFE (not 4) sdm845: 2 x VFE 4 x RDI per VFE (not 3) 1 x VFE Lite 4 x RDI per VFE Lite (not 3) sm8250: 2 x VFE 3 x RDI per VFE (not 4) 2 x VFE Lite 4 x RDI per VFE Lite This more complex and correct mapping was not possible prior to passing values via driver data. Now that we have that change in place we can correctly map VFEs to RDIs for each VFE. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Pass CAMSS subdev callbacks via resource ops pointerBryan O'Donoghue
It is possible to pass all of the CAMSS subdevice internal operations pointers from the controlling resources structure with an additional pointer added to the resources structure. This allows for the removal of most of the probe-time control structures. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Pass line_num from compat resourcesBryan O'Donoghue
line_num indicates the number of RDI - raw data interface channels which are associated with a given IFE/VFE - image/video front end. On several SoCs the RDI number is not static for each VFE - for example on sm8250 VFE Lite has four RDIs where regular VFE has three. Assigning line_num statically in the subdev_init() phase initialises each VFE to the lower number, meaning in practical terms that we are lobbing off one RDI on some VFEs. Interrupt handling uses static for (i = RDI0; i < RDI2; i++) {} in some of our VFE blocks but this can't work for situations where we have a mixture of VFE @ 3 RDI and VFE-lite @ 4 RDI blocks. First step to remediate is to pass line_num from a compat string controlled data-structure and do so on a per-VFE basis. Later patches will assign the correct number of RDI blocks per VFE. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Pass remainder of variables as resourcesBryan O'Donoghue
The following variables are being assigned statically based on compatible strings in the probe path. * enum camss_version version; * unsigned int csiphy_num; * unsigned int csid_num; * unsigned int vfe_num; * unsigned int vfe_lite_num; * unsigned int vfe_total_num; Migrate those variables to resource parameters passed in on platform probe arguments. The one caveat is for VFE it has been necessary to intoduce a new variable vfe_total_num to capture the aggregate value of vfe_num + vfe_lite_num. All the rest of the changes are rote camss->variable to camss->res->variable with the parameter tables now populating the listed variables. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Pass icc bandwidth table as a platform parameterBryan O'Donoghue
Pass the bandwidth table as a platform parameter not if/else derived pointer to the static table. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Start to move to module compat matched resourcesBryan O'Donoghue
There is a lot of unnecessary if/elsing in this code that arguably should never have made it upstream when adding a second let alone subsequent SoC. I'm guilty of not fixing the mess myself when adding in the sm8250. Before adding in any new SoCs or resources lets take the time to cleanup the resource passing. First step is to pass the generic struct camss_resources as a parameter per the compatible list. Subsequent patches will address the other somewhat disparate strutures which we are also doing if/else on and assigning statically. Squashed down a commit to drop useless NULL assignment for ispif resources. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Rename camss struct resources to camss_subdev_resourcesBryan O'Donoghue
Rename non-specific struct resources {} to struct camss_subdev_resources {} Each logical block in CAMSS has a number of regulators, clocks and resets associated with it. We represent these blocks as v4l subdevices. The name "struct camss_subdev_resources" is a more descriptive and accurate name. Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-10-07media: qcom: camss: Amalgamate struct resource with struct resource_ispifBryan O'Donoghue
There is no good reason to differentiate the two resource structures here. As part of a general tidyup of the declaration and passing of resources within in the CAMSS driver it will be advantageous to have one unified resource structure. The two structures are very similar anyway thus leading more credence still to the argument there should be only one. Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom/camss: use 1X16 formats instead of 2X8Martin Dørum
Platforms with qcom-camss use CSI-2, which means 1X16 is more correct than 2X8. The fact that qcom-camss supported only 2X8 meant it was incompatible with camera sensors it should have been compatible with. For example, the ov5645 driver (correctly) reports that its format is UYVY8_1X16 (after ba449bb56203aedc4530a82b0f3f83358808b7f2). Since qcom-camss only supports 2X8, the qcom-camss system is incompatible with the ov5645 driver, even though they should be compatible. This patch replaces all uses of UYVY8_2X8/VYUY8_2X8/YUYV8_2X8/YVYU8_2X8 with the equivalent 1X16 formats. Signed-off-by: Martin Dørum <dorum@noisolation.com> Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom: camss: Fix csid-gen2 for test pattern generatorAndrey Konovalov
In the current driver csid Test Pattern Generator (TPG) doesn't work. This change: - fixes writing frame width and height values into CSID_TPG_DT_n_CFG_0 - fixes the shift by one between test_pattern control value and the actual pattern. - drops fixed VC of 0x0a which testing showed prohibited some test patterns in the CSID to produce output. So that TPG starts working, but with the below limitations: - only test_pattern=9 works as it should - test_pattern=8 and test_pattern=7 produce black frame (all zeroes) - the rest of test_pattern's don't work (yavta doesn't get the data) - regardless of the CFA pattern set by 'media-ctl -V' the actual pixel order is always the same (RGGB for any RAW8 or RAW10P format in 4608x2592 resolution). Tested with: RAW10P format, VC0: media-ctl -V '"msm_csid0":0[fmt:SRGGB10/4608x2592 field:none]' media-ctl -V '"msm_vfe0_rdi0":0[fmt:SRGGB10/4608x2592 field:none]' media-ctl -l '"msm_csid0":1->"msm_vfe0_rdi0":0[1]' v4l2-ctl -d /dev/v4l-subdev6 -c test_pattern=9 yavta -B capture-mplane --capture=3 -n 3 -f SRGGB10P -s 4608x2592 /dev/video0 RAW10P format, VC1: media-ctl -V '"msm_csid0":2[fmt:SRGGB10/4608x2592 field:none]' media-ctl -V '"msm_vfe0_rdi1":0[fmt:SRGGB10/4608x2592 field:none]' media-ctl -l '"msm_csid0":2->"msm_vfe0_rdi1":0[1]' v4l2-ctl -d /dev/v4l-subdev6 -c test_pattern=9 yavta -B capture-mplane --capture=3 -n 3 -f SRGGB10P -s 4608x2592 /dev/video1 RAW8 format, VC0: media-ctl --reset media-ctl -V '"msm_csid0":0[fmt:SRGGB8/4608x2592 field:none]' media-ctl -V '"msm_vfe0_rdi0":0[fmt:SRGGB8/4608x2592 field:none]' media-ctl -l '"msm_csid0":1->"msm_vfe0_rdi0":0[1]' yavta -B capture-mplane --capture=3 -n 3 -f SRGGB8 -s 4608x2592 /dev/video0 Fixes: eebe6d00e9bf ("media: camss: Add support for CSID hardware version Titan 170") Cc: stable@vger.kernel.org Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom: camss: Fix set CSI2_RX_CFG1_VC_MODE when VC is greater than 3Bryan O'Donoghue
VC_MODE = 0 implies a two bit VC address. VC_MODE = 1 is required for VCs with a larger address than two bits. Fixes: eebe6d00e9bf ("media: camss: Add support for CSID hardware version Titan 170") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom: camss: Fix invalid clock enable bit disjunctionBryan O'Donoghue
define CSIPHY_3PH_CMN_CSI_COMMON_CTRL5_CLK_ENABLE BIT(7) disjunction for gen2 ? BIT(7) : is a nop we are setting the same bit either way. Fixes: 4abb21309fda ("media: camss: csiphy: Move to hardcode CSI Clock Lane number") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom: camss: Fix missing vfe_lite clocks checkBryan O'Donoghue
check_clock doesn't account for vfe_lite which means that vfe_lite will never get validated by this routine. Add the clock name to the expected set to remediate. Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom: camss: Fix VFE-480 vfe_disable_output()Bryan O'Donoghue
vfe-480 is copied from vfe-17x and has the same racy idle timeout bug as in 17x. Fix the vfe_disable_output() logic to no longer be racy and to conform to the 17x way of quiescing and then resetting the VFE. Fixes: 4edc8eae715c ("media: camss: Add initial support for VFE hardware version Titan 480") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom: camss: Fix VFE-17x vfe_disable_output()Bryan O'Donoghue
There are two problems with the current vfe_disable_output() routine. Firstly we rightly use a spinlock to protect output->gen2.active_num everywhere except for in the IDLE timeout path of vfe_disable_output(). Even if that is not racy "in practice" somehow it is by happenstance not by design. Secondly we do not get consistent behaviour from this routine. On sc8280xp 50% of the time I get "VFE idle timeout - resetting". In this case the subsequent capture will succeed. The other 50% of the time, we don't hit the idle timeout, never do the VFE reset and subsequent captures stall indefinitely. Rewrite the vfe_disable_output() routine to - Quiesce write masters with vfe_wm_stop() - Set active_num = 0 remembering to hold the spinlock when we do so followed by - Reset the VFE Testing on sc8280xp and sdm845 shows this to be a valid fix. Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom: camss: Fix vfe_get() error jumpBryan O'Donoghue
Right now it is possible to do a vfe_get() with the internal reference count at 1. If vfe_check_clock_rates() returns non-zero then we will leave the reference count as-is and run: - pm_runtime_put_sync() - vfe->ops->pm_domain_off() skip: - camss_disable_clocks() Subsequent vfe_put() calls will when the ref-count is non-zero unconditionally run: - pm_runtime_put_sync() - vfe->ops->pm_domain_off() - camss_disable_clocks() vfe_get() should not attempt to roll-back on error when the ref-count is non-zero as the upper layers will still do their own vfe_put() operations. vfe_put() will drop the reference count and do the necessary power domain release, the cleanup jumps in vfe_get() should only be run when the ref-count is zero. [ 50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ #80 [ 50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023 [ 50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 50.095802] pc : refcount_warn_saturate+0xf4/0x148 [ 50.095804] lr : refcount_warn_saturate+0xf4/0x148 [ 50.095805] sp : ffff80000c7cb8b0 [ 50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000 [ 50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000 [ 50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005 [ 50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff [ 50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320 [ 50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520 [ 50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954 [ 50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8 [ 50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000 [ 50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040 [ 50.095835] Call trace: [ 50.095836] refcount_warn_saturate+0xf4/0x148 [ 50.095838] device_link_put_kref+0x84/0xc8 [ 50.095843] device_link_del+0x38/0x58 [ 50.095846] vfe_pm_domain_off+0x3c/0x50 [qcom_camss] [ 50.095860] vfe_put+0x114/0x140 [qcom_camss] [ 50.095869] csid_set_power+0x2c8/0x408 [qcom_camss] [ 50.095878] pipeline_pm_power_one+0x164/0x170 [videodev] [ 50.095896] pipeline_pm_power+0xc4/0x110 [videodev] [ 50.095909] v4l2_pipeline_pm_use+0x5c/0xa0 [videodev] [ 50.095923] v4l2_pipeline_pm_get+0x1c/0x30 [videodev] [ 50.095937] video_open+0x7c/0x100 [qcom_camss] [ 50.095945] v4l2_open+0x84/0x130 [videodev] [ 50.095960] chrdev_open+0xc8/0x250 [ 50.095964] do_dentry_open+0x1bc/0x498 [ 50.095966] vfs_open+0x34/0x40 [ 50.095968] path_openat+0xb44/0xf20 [ 50.095971] do_filp_open+0xa4/0x160 [ 50.095974] do_sys_openat2+0xc8/0x188 [ 50.095975] __arm64_sys_openat+0x6c/0xb8 [ 50.095977] invoke_syscall+0x50/0x128 [ 50.095982] el0_svc_common.constprop.0+0x4c/0x100 [ 50.095985] do_el0_svc+0x40/0xa8 [ 50.095988] el0_svc+0x2c/0x88 [ 50.095991] el0t_64_sync_handler+0xf4/0x120 [ 50.095994] el0t_64_sync+0x190/0x198 [ 50.095996] ---[ end trace 0000000000000000 ]--- Fixes: 779096916dae ("media: camss: vfe: Fix runtime PM imbalance on error") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom: camss: Fix genpd cleanupBryan O'Donoghue
Right now we never release the power-domains properly on the error path. Add a routine to be reused for this purpose and appropriate jumps in probe() to run that routine where necessary. Fixes: 2f6f8af67203 ("media: camss: Refactor VFE power domain toggling") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-27media: qcom: camss: Fix V4L2 async notifier error pathBryan O'Donoghue
Previously the jump label err_cleanup was used higher in the probe() function to release the async notifier however the async notifier registration was moved later in the code rendering the previous four jumps redundant. Rename the label from err_cleanup to err_v4l2_device_unregister to capture what the jump does. Fixes: 51397a4ec75d ("media: qcom: Initialise V4L2 async notifier later") Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil: fix old name in commit log: err_v4l2_device_register -> err_v4l2_device_unregister]
2023-09-27media: qcom: camss: Fix pm_domain_on sequence in probeBryan O'Donoghue
We need to make sure camss_configure_pd() happens before camss_register_entities() as the vfe_get() path relies on the pointer provided by camss_configure_pd(). Fix the ordering sequence in probe to ensure the pointers vfe_get() demands are present by the time camss_register_entities() runs. In order to facilitate backporting to stable kernels I've moved the configure_pd() call pretty early on the probe() function so that irrespective of the existence of the old error handling jump labels this patch should still apply to -next circa Aug 2023 to v5.13 inclusive. Fixes: 2f6f8af67203 ("media: camss: Refactor VFE power domain toggling") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-01Merge tag 'media/v6.6-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - new i2c drivers: ds90ub913, ds90ub953, ds90ub960, dw9719, ds90ub913 - new Intel IVSC MEI drivers - some Mediatek platform drivers were moved to a common location - Intel atomisp2 driver is now working with the main ov2680 driver. Due to that, the atomisp2 ov2680 staging one was removed - the bttv driver was finally converted to videobuf2 framework. This was the last one upstream using videobuf version 1 core. We'll likely remove the old videobuf framework on 6.7 - lots of improvements at atomisp driver: it now works with normal I2C sensors. Several compile-mode dependecies to select between ISP2400 and ISP2401 are now solved in runtime - a new ipu-bridge logic was added to work with IVSC MEI drivers - venus driver gained better support for new VPU versions - the v4l core async framework has gained lots of improvements and cleanups - lots of other cleanups, improvements and driver fixes * tag 'media/v6.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (358 commits) media: ivsc: Add ACPI dependency media: bttv: convert to vb2 media: bttv: use audio defaults for winfast2000 media: bttv: refactor bttv_set_dma() media: bttv: move vbi_skip/vbi_count out of buffer media: bttv: remove crop info from bttv_buffer media: bttv: remove tvnorm field from bttv_buffer media: bttv: remove format field from bttv_buffer media: bttv: move do_crop flag out of bttv_fh media: bttv: copy vbi_fmt from bttv_fh media: bttv: copy vid fmt/width/height from fh media: bttv: radio use v4l2_fh instead of bttv_fh media: bttv: replace BUG with WARN_ON media: bttv: use video_drvdata to get bttv media: i2c: rdacm21: Fix uninitialized value media: coda: Remove duplicated include media: vivid: fix the racy dev->radio_tx_rds_owner media: i2c: ccs: Check rules is non-NULL media: i2c: ds90ub960: Fix PLL config for 1200 MHz CSI rate media: i2c: ds90ub953: Fix use of uninitialized variables ...
2023-08-10media: venus: Fix firmware path for sm8250Patrick Whewell
The firmware path for the sm8250 resources is incorrect. This fixes the path to address the firmware correctly. Signed-off-by: Patrick Whewell <patrick.whewell@sightlineapplications.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-08-10media: venus: firmware: Use of_reserved_mem_lookup()Stephan Gerhold
Reserved memory can be either looked up using the generic function of_address_to_resource() or using the special of_reserved_mem_lookup(). The latter has the advantage that it ensures that the referenced memory region was really reserved and is not e.g. status = "disabled". of_reserved_mem also supports allocating reserved memory dynamically at boot time. This works only when using of_reserved_mem_lookup() since there won't be a fixed address in the device tree. Switch the code to use of_reserved_mem_lookup(). There is no functional difference for static reserved memory allocations. Signed-off-by: Stephan Gerhold <stephan@gerhold.net> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-08-10media: venus: core: Set up secure memory ranges for SC7180Konrad Dybcio
Not all SC7180 devices ship with ChromeOS firmware. WoA devices use Android-like TZ, which uses PAS for image authentication. That requires the predefined virtual address ranges to be passed via scm calls. Define them to enable Venus on non-CrOS SC7180 devices. Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-08-10media: venus: hfi_venus: Restrict writing SCIACMDARG3 to Venus V1/V2Konrad Dybcio
This write was last present on msm-3.10, which means before HFI3XX platforms were introduced. Guard it with an appropriate if condition. Does not seem to have any adverse effects on at least SM8250. Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-08-10media: venus: Use newly-introduced hfi_buffer_requirements accessorsKonrad Dybcio
Now that we have a way which is independent of the HFI version to set the correct fields in hfi_buffer_requirements, use it! Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>