79 Commits
Author SHA1 Message Date
Sean YoungandHans Verkuil dccc0c3ddf media: rc: fix race between unregister and urb/irq callbacks
Some rc device drivers have a race condition between rc_unregister_device()
and irq or urb callbacks. This is because rc_unregister_device() does two
things, it marks the device as unregistered so no new commands can be
issued and then it calls rc_free_device(). This means the driver has no
chance to cancel any pending urb callbacks or interrupts after the device
has been marked as unregistered. Those callbacks may access struct rc_dev
or its members (e.g. struct ir_raw_event_ctrl), which have been freed by
rc_free_device().

This change removes the implicit call to rc_free_device() from
rc_unregister_device(). This means that device drivers can call
rc_unregister_device() in their remove or disconnect function, then cancel
all the urbs and interrupts before explicitly calling rc_free_device().

Note this is an alternative fix for an issue found by Haotian Zhang, see
the Closes: tags.

Reported-by: Haotian Zhang <vulab@iscas.ac.cn>
Closes: https://lore.kernel.org/linux-media/20251114101432.2566-1-vulab@iscas.ac.cn/
Closes: https://lore.kernel.org/linux-media/20251114101418.2548-1-vulab@iscas.ac.cn/
Closes: https://lore.kernel.org/linux-media/20251114101346.2530-1-vulab@iscas.ac.cn/
Closes: https://lore.kernel.org/linux-media/20251114090605.2413-1-vulab@iscas.ac.cn/
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 14:43:56 +01:00
Linus Torvalds bf4afc53b7 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21 17:09:51 -08:00
Kees Cook 69050f8d6d treewide: Replace kmalloc with kmalloc_obj for non-scalar types
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-21 01:02:28 -08:00
Haotian ZhangandHans Verkuil c43bcd2b2a media: cec: Fix debugfs leak on bus_register() failure
In cec_devnode_init(), the debugfs directory created with
debugfs_create_dir() is not removed if bus_register() fails.
This leaves a stale "cec" entry in debugfs and prevents
proper module reloading.

Fix this by removing the debugfs directory in the error path.

Fixes: a56960e8b4 ("[media] cec: add HDMI CEC framework (core)")
Cc: stable@vger.kernel.org
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2025-10-14 15:07:37 +02:00
Hans VerkuilandMauro Carvalho Chehab ce4c356d76 media: update Hans Verkuil's email address
Replace hansverk@cisco.com by hverkuil@kernel.org.

Signed-off-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-09-09 15:58:44 +02:00
Hans VerkuilandMauro Carvalho Chehab a9fc2adc14 media: cec: core: add rx-no-low-drive setting
If rx-no-low-drive is set, then the CEC pin framework will disable
the detection of situations where a Low Drive has to be generated.

So if this is set, then we will never generate Low Drives.

This helps testing whether other CEC devices generate Low Drive
pulses by ensuring it is not us that is generating them.

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:35:26 +02:00
Hans VerkuilandMauro Carvalho Chehab 36e713438a media: cec: core: add glitch error injection
This adds support for inserting 'glitches' after a falling and/or
rising edge. This tests what happens when there are little voltage
spikes after falling or rising edges, which can be caused due to
noise or reflections on the CEC line.

A proper CEC implementation will deglitch this, but a poor implementation
can create a Low Drive pulse in response, effectively making CEC unusable.

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-07-08 08:35:26 +02:00
Linus Torvalds 1e26c5e28c Merge tag 'media/v6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media updates from Mauro Carvalho Chehab:

 - platform: synopsys: hdmirx: Fix 64-bit division for 32-bit targets

 - vim2m: print device name after registering device

 - Synopsys DesignWare HDMI RX Driver and various fixes

 - cec/printk fixes and the removal of the vidioc_g/s_ctrl and
   vidioc_queryctrl callbacks

 - AVerMedia H789-C PCIe support and rc-core structs padding

 - Several camera sensor patches

 - uvcvideo improvements

 - visl: Fix ERANGE error when setting enum controls

 - codec fixes

 - V4L2 camera sensor patches mostly

 - chips-media: wave5: Fixes

 - Add SDM670 camera subsystem

 - Qualcomm iris video decoder driver

 - dt-bindings: update clocks for sc7280-camss

 - various fixes and enhancements

* tag 'media/v6.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (264 commits)
  media: pci: mgb4: include linux/errno.h
  media: synopsys: hdmirx: Fix signedness bug in hdmirx_parse_dt()
  media: platform: synopsys: hdmirx: Fix 64-bit division for 32-bit targets
  media: vim2m: print device name after registering device
  media: vivid: Introduce VIDEO_VIVID_OSD
  media: vivid: Move all fb_info references into vivid-osd
  media: platform: synopsys: hdmirx: Optimize struct snps_hdmirx_dev
  media: platform: synopsys: hdmirx: Remove unused HDMI audio CODEC relics
  media: platform: synopsys: hdmirx: Remove duplicated header inclusion
  media: qcom: Clean up Kconfig dependencies
  media: dvb-frontends: tda10048: Make the range of z explicit.
  media: platform: stm32: Add check for clk_enable()
  media: xilinx-tpg: fix double put in xtpg_parse_of()
  media: siano: Fix error handling in smsdvb_module_init()
  media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
  media: i2c: tda1997x: Call of_node_put(ep) only once in tda1997x_parse_dt()
  dt-bindings: media: mediatek,vcodec: Revise description
  dt-bindings: media: mediatek,jpeg: Relax IOMMU max item count
  media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
  media: rockchip: rga: fix rga offset lookup
  ...
2025-03-25 21:00:31 -07:00
Vitaliy ShevtsovandHans Verkuil c0c1a6bf80 media: cec: use us_to_ktime() where appropriate
[Why]
There are several ns_to_ktime() calls that require using nanoseconds. It is
better to replace them with us_to_ktime() to make code clear, getting rid
of multiplication by 1000.

Also the timer function code may have an integer wrap-around issue. Since
both tx_custom_low_usecs and tx_custom_high_usecs can be set to up to
9999999 from the user space via cec_pin_error_inj_parse_line(), this may
cause usecs to be overflowed when adap->monitor_pin_cnt is zero and usecs
is multiplied by 1000.

[How]
Take advantage of using an appropriate helper func us_to_ktime() instead of
ns_to_ktime() to improve readability and to make the code clearer. And this
also mitigates possible integer wrap-arounds when usecs value is too large
and it is multiplied by 1000.

Found by Linux Verification Center (linuxtesting.org) with Svace.

Signed-off-by: Vitaliy Shevtsov <v.shevtsov@mt-integration.ru>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-03-06 17:28:25 +01:00
Hans VerkuilandMauro Carvalho Chehab fff538822c media: cec: core: allow raw msg transmit while configuring
While the CEC adapter is configuring, it is not possible to transmit a
CEC message with the CEC_MSG_FL_RAW flag set as this is blocked at the
ioctl level. Check if this flag is set, and if so, allow the message to
be transmitted. This is useful for debugging if the display has no
physical address (typically because the HPD is pulled low while in
Standby).

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-03-05 10:43:23 +01:00
Nam CaoandThomas Gleixner 0ebb5e74db media: Switch to use hrtimer_setup()
hrtimer_setup() takes the callback function pointer as argument and
initializes the timer completely.

Replace hrtimer_init() and the open coded initialization of
hrtimer::function with the new setup mechanism.

Patch was created by using Coccinelle.

Signed-off-by: Nam Cao <namcao@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://lore.kernel.org/all/c725ad8d0ecac3cf6bbc532af567e56d47a6b75c.1738746904.git.namcao@linutronix.de
2025-02-18 11:19:04 +01:00
Jani NikulaandHans Verkuil d76bf5267a media: cec: include linux/debugfs.h and linux/seq_file.h where needed
Having cec.h include linux/debugfs.h leads to all users of all cec
headers include and depend on debugfs.h and its dependencies for no
reason. Drop the include from cec.h, and include debugfs.h and
seq_file.h where needed.

Sort all the modified include lists while at it.

Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2025-01-07 12:21:38 +01:00
Hans Verkuil b855f02427 media: replace obsolete hans.verkuil@cisco.com alias
The old hans.verkuil@cisco.com email address was discontinued years ago.

Replace it with the correct hansverk@cisco.com email.

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
2024-11-08 13:38:09 +01:00
Al ViroandLinus Torvalds cb787f4ac0 [tree-wide] finally take no_llseek out
no_llseek had been defined to NULL two years ago, in commit 868941b144
("fs: remove no_llseek")

To quote that commit,

  At -rc1 we'll need do a mechanical removal of no_llseek -

  git grep -l -w no_llseek | grep -v porting.rst | while read i; do
	sed -i '/\<no_llseek\>/d' $i
  done

  would do it.

Unfortunately, that hadn't been done.  Linus, could you do that now, so
that we could finally put that thing to rest? All instances are of the
form
	.llseek = no_llseek,
so it's obviously safe.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2024-09-27 08:18:43 -07:00
Hans VerkuilandMauro Carvalho Chehab 6bb8ef90c4 media: cec: move cec_get/put_device to header
Move cec_get/put_device to the media/cec.h header. This
allows CEC drivers to use this.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2024-09-05 20:12:15 +02:00
Hans VerkuilandMauro Carvalho Chehab 31aaa7d95e media: cec: cec-adap.c: improve CEC_MSG_FL_REPLY_VENDOR_ID check
The new CEC_MSG_FL_REPLY_VENDOR_ID flag only makes sense in combination
with CEC_MSG_VENDOR_COMMAND_WITH_ID. So rather than reporting an error
if that flag is set with another command, just clear the flag instead.

Only keep the message length check, since otherwise the flag would not
make sense.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2024-08-08 15:24:03 +02:00
Hans VerkuilandMauro Carvalho Chehab 613f21505b media: cec: core: add new CEC_MSG_FL_REPLY_VENDOR_ID flag
If this flag is set, then the reply is expected to consist of
the CEC_MSG_VENDOR_COMMAND_WITH_ID opcode followed by the Vendor ID (as
used in bytes 1-4 of the message), followed by the struct cec_msg reply
field.

Note that this assumes that the byte after the Vendor ID is a
vendor-specific opcode.

This flag makes it easier to wait for replies to vendor commands,
using the same CEC framework support for waiting for regular replies.

Support for this flag is indicated by setting the new
CEC_CAP_REPLY_VENDOR_ID capability.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2024-08-05 09:38:46 +02:00
Hans VerkuilandMauro Carvalho Chehab cbe499977b media: cec: core: avoid confusing "transmit timed out" message
If, when waiting for a transmit to finish, the wait is interrupted,
then you might get a "transmit timed out" message, even though the
transmit was interrupted and did not actually time out.

Set transmit_in_progress_aborted to true if the
wait_for_completion_killable() call was interrupted and ensure
that the transmit is properly marked as ABORTED.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: Yang, Chenyuan <cy54@illinois.edu>
Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/
Fixes: 590a8e564c ("media: cec: abort if the current transmit was canceled")
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2024-05-02 19:01:00 +01:00
Hans VerkuilandMauro Carvalho Chehab 47c82aac10 media: cec: core: avoid recursive cec_claim_log_addrs
Keep track if cec_claim_log_addrs() is running, and return -EBUSY
if it is when calling CEC_ADAP_S_LOG_ADDRS.

This prevents a case where cec_claim_log_addrs() could be called
while it was still in progress.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: Yang, Chenyuan <cy54@illinois.edu>
Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/
Fixes: ca684386e6 ("[media] cec: add HDMI CEC framework (api)")
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2024-05-02 18:59:59 +01:00
Hans VerkuilandMauro Carvalho Chehab 42bcaacae9 media: cec: cec-api: add locking in cec_release()
When cec_release() uses fh->msgs it has to take fh->lock,
otherwise the list can get corrupted.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: Yang, Chenyuan <cy54@illinois.edu>
Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/
Fixes: ca684386e6 ("[media] cec: add HDMI CEC framework (api)")
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2024-05-02 18:59:09 +01:00
Hans VerkuilandMauro Carvalho Chehab 9fe2816816 media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
Do not check for !data->completed, just always call
cancel_delayed_work_sync(). This fixes a small race condition.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: Yang, Chenyuan <cy54@illinois.edu>
Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/
Fixes: 490d84f6d7 ("media: cec: forgot to cancel delayed work")
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2024-05-02 18:57:24 +01:00
Hans Verkuil dd05fd125e media: cec: return -ENODEV instead of -ENXIO if unregistered
If the CEC device is unregistered, then an attempt to open
the device node should result in an -ENODEV error instead of
-ENXIO.

Document this as well in cec-func-open.rst.

This is consistent with the error code returned by other
file operations such as ioctl.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-04-24 13:49:55 +02:00
Ricardo B. MarliereandHans Verkuil 009d312a3f media: cec: make cec_bus_type const
Now that the driver core can properly handle constant struct bus_type,
move the cec_bus_type variable to be a constant structure as well,
placing it into read-only memory which can not be modified at runtime.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ricardo B. Marliere <ricardo@marliere.net>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-02-05 12:57:46 +01:00
Nini SongandHans Verkuil ce5d241c3a media: cec: core: remove length check of Timer Status
The valid_la is used to check the length requirements,
including special cases of Timer Status. If the length is
shorter than 5, that means no Duration Available is returned,
the message will be forced to be invalid.

However, the description of Duration Available in the spec
is that this parameter may be returned when these cases, or
that it can be optionally return when these cases. The key
words in the spec description are flexible choices.

Remove the special length check of Timer Status to fit the
spec which is not compulsory about that.

Signed-off-by: Nini Song <nini.song@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-02-05 12:57:44 +01:00
Hans VerkuilandMauro Carvalho Chehab 632b8b044a media: cec: core: count low-drive, error and arb-lost conditions
Count how many Low Drive, Error and Arbitration Lost transmit
status errors occurred, and expose that in debugfs.

Also log the first 8 transmits that result in Low Drive or Error
conditions. That really should not happen with well-behaved CEC devices
and good HDMI cables.

This is useful to detect and debug HDMI cable issues.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2023-11-23 12:59:24 +01:00