qiurui/Centos-kernel-stream-9
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git synced 2026-09-09 00:08:12 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,198,313 Commits 5 Branches 2,299 Tags
main
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kate Hsuan 1ab7394154 Revert "media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935" 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 4fbeef21f5387234111b5d52924e77757626faa5
Author: Bradford Love <brad@nextdimension.cc>
Date: Thu, 26 Mar 2026 12:10:23 -0500

  This reverts commit bb2a3912549d3b5cef5ed27200402fe8f6fb0694.

  The USB ID 2040:8360 was reported as a new revision
  of Hauppauge HVR-935 and requested to be added to
  the cx231xx driver. The issue is current generation
  of Hauppauge 9x5 devices including 935, 955, and 975
  have moved to em2828x usb bridge. Support for the
  em2828x usb bridge and USB ID's for the new devices
  has been submitted.

  Signed-off-by: Bradford Love <brad@nextdimension.cc>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:55 +08:00
Kate Hsuan ef4ad82795 media: uvcvideo: Fix bug in error path of uvc_alloc_urb_buffers 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 7c39f48568e0aec9bf6988cdbf833fdf8af19901
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 20 Mar 2026 07:49:10 +0000

  Recent cleanup introduced a bug in the error path of
  uvc_alloc_urb_buffers(). If there is not enough memory for the
  allocation the following error will be triggered:

  [  739.196672] UBSAN: shift-out-of-bounds in mm/page_alloc.c:1403:22
  [  739.196710] shift exponent 52 is too large for 32-bit type 'int'

  Resulting in:
  [  740.464422] BUG: unable to handle page fault for address: fffffac1c0800000

  The reason for the bug is that usb_free_noncoherent is called with an
  invalid size (0) instead of the actual size of the urb.

  This patch takes care of that.

  Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
  Closes: https://lore.kernel.org/linux-media/abycbXzYupZpGkvR@hyeyoo/T/#t
  Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
  Fixes: c824345288d1 ("media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer")
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Link: https://patch.msgid.link/20260320-uvc-urb-free-error-v1-1-b12cc3762a19@chromium.org
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:55 +08:00
Kate Hsuan ac464f0478 media: uvcvideo: Add support for P010 pixel format 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 2c8fe1f14240d75f2002e16b2b69c5c2d27ed41c
Author: Oliver Collyer <ovcollyer@mac.com>
Date: Fri, 26 Dec 2025 06:57:18 +0000

  Add support for the P010 (10-bit Y/UV 4:2:0) pixel format to the
  uvcvideo driver. This format is exposed by USB capture devices such as
  the Magewell USB Capture HDMI 4K Pro when capturing HDR10 content.

  P010 stores 10-bit Y and interleaved UV samples in 16-bit little-endian
  words, with data in the upper 10 bits and zeros in the lower 6 bits.
  This requires 2 bytes per sample, so bytesperline is wWidth * 2.

  V4L2_PIX_FMT_P010 was added to the V4L2 core in commit 5374d8fb75f3
  ("media: Add P010 video format").

  Based on the community DKMS patch from awawa-dev/P010_for_V4L2.

  Link: https://github.com/awawa-dev/P010_for_V4L2
  Signed-off-by: Oliver Collyer <ovcollyer@mac.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Link: https://patch.msgid.link/20251226065718.95504-1-ovcollyer@mac.com
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:55 +08:00
Kate Hsuan d0daaf0cce media: uvcvideo: Add D436 and D555 cameras metadata support 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 45507b100929cac15d4466a3feb29b8a910ffbb3
Author: Yogev Modlin <yogev.modlin@realsenseai.com>
Date: Sun, 26 Oct 2025 18:43:03 +0200

  Add support for Intel RealSense D436 and D555 depth cameras metadata.
  These cameras use the D4XX metadata format for transmitting depth and
  sensor information.

  The D555 camera uses UVC protocol version 1.5, while the D436 uses
  an undefined protocol version. Both cameras require the D4XX metadata
  format flag to properly handle their metadata streams.

  Signed-off-by: Yogev Modlin <yogev.modlin@realsenseai.com>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://patch.msgid.link/20251026-fix-uvc-v4-2-610eb1329600@realsenseai.com
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:55 +08:00
Kate Hsuan 6eeeccee97 media: uvcvideo: Change comment to 'Intel RealSense' 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit bc4da279ef3ef73b7ed50f9016cf7d7143a0a4c0
Author: Yogev Modlin <yogev.modlin@realsenseai.com>
Date: Sun, 26 Oct 2025 18:43:02 +0200

  RealSense branding is now independent of Intel. Update all driver
  comments referencing "Intel" to "Intel RealSense" to reflect
  current ownership. No code logic changes.

  Signed-off-by: Yogev Modlin <yogev.modlin@realsenseai.com>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://patch.msgid.link/20251026-fix-uvc-v4-1-610eb1329600@realsenseai.com
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:55 +08:00
Kate Hsuan 7743d11e5f media: uvcvideo: Add a stream backpointer in uvc_video_queue 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit c3a29052db80f5069486491930409468d7cc2d78
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Wed, 18 Mar 2026 20:22:36 +0000

  It is less prone to errors if we add a backpointer to stream from
  struct uvc_video_queue.

  Refactor the code.

  Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Link: https://patch.msgid.link/20260318202352.1374443-1-ribalda@chromium.org
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:55 +08:00
Kate Hsuan 031ac89526 media: uvcvideo: Allow userspace to increase the meta buffersize 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 2ac27db04608a7ce4d46a3bf23d2262c7b20db38
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 9 Mar 2026 15:01:56 +0000

  Now we have the metadata size hardcoded to 10 KiB, this is a value that
  works fine for bulk cameras or frames with no extra metadata. But not
  for all usecases.

  We have seen some cameras that produce more metadata per frame. Eg:
  Frame 1 captured (Bytes: 11154)
  Frame 2 captured (Bytes: 11616)
  Frame 3 captured (Bytes: 11374)
  Frame 4 captured (Bytes: 11132)
  Frame 5 captured (Bytes: 11594)
  Frame 6 captured (Bytes: 11352)
  Frame 7 captured (Bytes: 11110)
  Frame 8 captured (Bytes: 11572)
  Frame 9 captured (Bytes: 11308)

  When this happens, the driver (correctly) marks the metadata as ERROR.

  This patch let userspace set bigger buffersize via S_FMT.

  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-3-fc8b87bd29c5@chromium.org
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:55 +08:00
Kate Hsuan 7c6120a19e media: uvcvideo: uvc_queue_to_stream(): Support meta queues 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 33dd4bb261bd4e539551d60511574cd64845bf84
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 9 Mar 2026 15:01:55 +0000

  The stream data structure has two queues: the metadata and the data
  queues, but uvc_queue_to_stream() only supports the data queue. If we
  pass the metadata queue the function will return an invalid pointer.

  This patch add a parameter to the function to explicitly tell the
  function which queue are we using.

  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-2-fc8b87bd29c5@chromium.org
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:55 +08:00
Kate Hsuan 9ed21cba62 media: uvcvideo: Enable VB2_DMABUF for metadata stream 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit fbac03467e53d8d72e5099c03df26d9adae11416
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 9 Mar 2026 15:01:54 +0000

  The UVC driver has two video streams, one for the frames and another one
  for the metadata. Both streams share most of the codebase, but only the
  data stream declares support for DMABUF transfer mode.

  I have tried the DMABUF transfer mode with CONFIG_DMABUF_HEAPS_SYSTEM
  and the frames looked correct.

  This patch announces the support for DMABUF for the metadata stream.
  This is useful for apps/HALs that only want to support DMABUF.

  Cc: stable@vger.kernel.org
  Fixes: 088ead2552 ("media: uvcvideo: Add a metadata device node")
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-1-fc8b87bd29c5@chromium.org
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:54 +08:00
Kate Hsuan 66a0dc3221 media: subdev: Split v4l2_subdev_get_frame_desc_passthrough() into locked and unlocked 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 64d712aa31f30a125291e7c47209ef7ebd3285a3
Author: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
Date: Tue, 17 Mar 2026 14:09:42 +0200

  The recently added v4l2_subdev_get_frame_desc_passthrough() can be used
  directly as an implementation for .get_frame_desc subdev op. However, in
  some cases the drivers may want to add some customizations, while the
  bulk of the work is still identical to what
  v4l2_subdev_get_frame_desc_passthrough() does. Current locking scheme
  makes this impossible to do properly.

  Split v4l2_subdev_get_frame_desc_passthrough() into two functions:

  __v4l2_subdev_get_frame_desc_passthrough(), which takes a locked subdev
  state as a parameter, instead of locking and getting the active state
  internally. Other than that, it does the same as
  v4l2_subdev_get_frame_desc_passthrough() used to do.

  v4l2_subdev_get_frame_desc_passthrough(), which locks the active state
  and calls __v4l2_subdev_get_frame_desc_passthrough().

  In other words, v4l2_subdev_get_frame_desc_passthrough() works as
  before, but drivers can now alternatively add custom .get_frame_desc
  code and call v4l2_subdev_get_frame_desc_passthrough().

  An example use case is with DS90UB953 serializer: in normal use the
  serializer passes through everything, but when test-pattern-generator
  (TPG) is used, an internal TPG source is used. After this commit, the
  UB953 get_frame_desc() can lock the state, look at the routing table to
  see if we're in normal or TPG mode, then either call
  __v4l2_subdev_get_frame_desc_passthrough() if in normal mode, or
  construct a TPG frame desc if in TPG mode.

  Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
  [Sakari Ailus: Rebase on an earlier remote source pad error code fix.]
  Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:54 +08:00
Kate Hsuan 12436b0d0e media: subdev: Improve v4l2_subdev_get_frame_desc_passthrough() kdoc 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 754ec1f19614948a0af3484815eec98ef27951c5
Author: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
Date: Tue, 17 Mar 2026 14:09:40 +0200

  Improve the v4l2_subdev_get_frame_desc_passthrough() kernel doc:

  - Fix 'v4l2_get_frame_desc' operation to 'get_frame_desc' operation
  - Rewrite the body text to be more understandable and specific, and
    specifically mention the frame desc type handling.

  Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:54 +08:00
Kate Hsuan 42ca30e8a4 media: subdev: Minor v4l2_subdev_get_frame_desc_passthrough() cleanups 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit f40306e08627bd4a51a1bcdc4ec864209448bdc0
Author: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
Date: Tue, 17 Mar 2026 14:09:41 +0200

  Minor code cleanups, no functional change.

  Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:54 +08:00
Kate Hsuan fe843e085a media: v4l2-subdev: Fix error check in v4l2_subdev_get_frame_desc_passthrough() 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 9f1af89a75983264706849ecea83cd97f11d1c86
Author: Chen Ni <nichen@iscas.ac.cn>
Date: Tue, 17 Mar 2026 15:20:20 +0800

  Use IS_ERR() and PTR_ERR() to properly handle the error return from
  media_pad_remote_pad_unique(), which returns ERR_PTR() on failure but
  never NULL. The previous code only checked for NULL, leading to invalid
  pointer dereference.

  Detected by Smatch:
  drivers/media/v4l2-core/v4l2-subdev.c:2588 v4l2_subdev_get_frame_desc_passthrough() warn:
  'remote_source_pad' is an error pointer or valid

  drivers/media/v4l2-core/v4l2-subdev.c:2595 v4l2_subdev_get_frame_desc_passthrough() error:
  'remote_source_pad' dereferencing possible ERR_PTR()

  Fixes: a564839e630c ("media: subdev: Add v4l2_subdev_get_frame_desc_passthrough helper")
  Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
  Reviewed-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
  Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:54 +08:00
Kate Hsuan a6739a5725 media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

CVE: CVE-2026-31473

commit bef4f4a88b73e4cc550d25f665b8a9952af22773
Author: Yuchan Nam <entropy1110@gmail.com>
Date: Fri, 6 Mar 2026 21:52:23 +0900

  MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)
  queue teardown paths. This can race request object cleanup against vb2
  queue cancellation and lead to use-after-free reports.

  We already serialize request queueing against STREAMON/OFF with
  req_queue_mutex. Extend that serialization to REQBUFS, and also take
  the same mutex in media_request_ioctl_reinit() so REINIT is in the
  same exclusion domain.

  This keeps request cleanup and queue cancellation from running in
  parallel for request-capable devices.

  Fixes: 6093d3002e ("media: vb2: keep a reference to the request until dqbuf")
  Cc: stable@vger.kernel.org
  Signed-off-by: Yuchan Nam <entropy1110@gmail.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 15:46:41 +08:00
Kate Hsuan d01ca79254 media: cx231xx: Fix AGC levels for NTSC-M 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 69426c6c9bb1601a200dc5dd7ffcc5d542e545b1
Author: Bradford Love <brad@nextdimension.cc>
Date: Thu, 12 Mar 2026 16:35:25 -0500

  Windows uses the implemented command sequence to set AGC for NTSC-M.
  The previous Linux values work, mostly, but on some embedded
  platforms NTSC-M is very unstable. The Windows default values
  completely fix any signal stability issues and produce a clear image.

  Signed-off-by: Bradford Love <brad@nextdimension.cc>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:30 +08:00
Kate Hsuan 270f877169 media: cx25840: Fix NTSC-J, PAL-N, and SECAM standards 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 36200241f5a3dd28b95fdefb2885ca9fd52f6387
Author: Bradford Love <brad@nextdimension.cc>
Date: Thu, 12 Mar 2026 16:35:23 -0500

  Formats did not correctly decode prior.

  Modifications are based off cx25840 datasheet.

  Signed-off-by: Bradford Love <brad@nextdimension.cc>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:30 +08:00
Kate Hsuan 3ac03199a4 media: cx231xx: add USB ID 2040:8360 for Hauppauge WinTV-HVR-935 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit bb2a3912549d3b5cef5ed27200402fe8f6fb0694
Author: Hans Verkuil <hverkuil+cisco@kernel.org>
Date: Mon, 16 Mar 2026 14:43:03 +0100

  The Hauppauge WinTV-HVR-935 HD stick is supported as 2040:b151
  (CX231XX_BOARD_HAUPPAUGE_935C).
  Some units report USB id 2040:8360 with product string "HVR-935 Audio"
  and are not bound by cx231xx, so no DVB adapter is created.

  Please consider adding 2040:8360 to the cx231xx_id_table with the same
  driver_info as 0xb151 so these devices work without out-of-tree
  patches.

  How the ID was obtained (Debian, kernel 6.1.0-40-amd64):

    $ lsusb -d 2040:8360
    Bus 001 Device 006: ID 2040:8360 Hauppauge HVR-935 Audio

    $ lsusb -t | grep -A3 "Port 3"
  |__ Port 3: Dev 6, If 2, Class=Audio, Driver=snd-usb-audio, 480M
  |__ Port 3: Dev 6, If 0, Class=Vendor Specific Class, Driver=, 480M
  |__ Port 3: Dev 6, If 1, Class=Audio, Driver=snd-usb-audio, 480M

  Interface 0 (Vendor Specific) has no driver; the stock cx231xx module
  has no 2040:8360 in its alias table.

  Reported-by: Lucian Onicescu <lucian.onicescu@gmail.com>
  Closes: https://lore.kernel.org/linux-media/CALbYB1O79OnqKMF--HWVx-nuKtYKJbE+Ux=yK_45HDb4oujQyA@mail.gmail.com/
  Suggested-by: Lucian Onicescu <lucian.onicescu@gmail.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:30 +08:00
Kate Hsuan 76afbd4f1d media: pulse8-cec: Handle partial deinit 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 323f52e02be68889c8630c4a0415ef5b78f9dc63
Author: Vicki Pfau <vi@endrift.com>
Date: Mon, 9 Mar 2026 21:50:34 -0700

  In the event that the cec dev node is held open while the adapter is
  disconnected the serio device will be cleaned up but the cec device won't
  be. As the serio device is freed but the ping_eeprom_work is not canceled,
  the next ping will still attempt to send, leading to a kernel oops.

  This patch both cancels the ping_eeprom_work in the serio cleanup as well
  as checking to make sure the serio is still present before attempting to
  write to it. Note that while the added serio = NULL line looks similar to
  one that was removed in commit 024e01dead ("media: pulse8-cec: fix
  duplicate free at disconnect or probe error"), it notably happens before
  calling cec_unregister_adapter, and as such shouldn't lead to the
  user-after-free that removing it fixed.

  Signed-off-by: Vicki Pfau <vi@endrift.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:30 +08:00
Kate Hsuan b143d830d6 media: cx231xx: drop redundant device reference 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 68380ec2161ee61ce4f23001dfb536bbaa8f4979
Author: Johan Hovold <johan@kernel.org>
Date: Thu, 5 Mar 2026 14:00:25 +0100

  Driver core holds a reference to the USB interface and its parent USB
  device while the interface is bound to a driver and there is no need to
  take additional references unless the structures are needed after
  disconnect.

  Drop the redundant device reference to reduce cargo culting, make it
  easier to spot drivers where an extra reference is needed, and reduce
  the risk of memory leaks when drivers fail to release it.

  Signed-off-by: Johan Hovold <johan@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:30 +08:00
Kate Hsuan 5796aa1efb media: remove unnecessary module_init/exit functions 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit c64122124c482df1bf606d34d30895359f501cf5
Author: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Date: Fri, 30 Jan 2026 18:00:47 -0800

  Three media drivers have unnecessary module_init and module_exit
  functions that are empty or just print a message. Remove them. Note
  that if a module_init function exists, a module_exit function must also
  exist; otherwise, the module cannot be unloaded.

  Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:30 +08:00
Kate Hsuan 2bddfe919f media: subdev: Add v4l2_subdev_get_frame_desc_passthrough helper 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit a564839e630c11b089470d2e010b0019b7cf61bc
Author: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
Date: Mon, 24 Mar 2025 10:04:44 +0200

  Add a helper for v4l2_subdev_pad_ops.v4l2_get_frame_desc operation. The
  helper can be used when the subdevice directly passes through the
  streams.

  Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:30 +08:00
Kate Hsuan c48fb5d045 media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit c824345288d11e269ce41b36c105715bc2286050
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Wed, 14 Jan 2026 10:32:14 +0000

  The uvc_alloc_urb_buffer() function implicitly depended on the
  stream->urb_size field, which was set by its caller,
  uvc_alloc_urb_buffers(). This implicit data flow makes the code harder
  to follow.

  More importantly, stream->urb_size was updated within the allocation
  loop before the allocation was confirmed to be successful. If the
  allocation failed, the stream object would be left with a urb_size that
  doesn't correspond to valid, allocated URB buffers.

  Refactor uvc_alloc_urb_buffer() to accept the buffer size as an explicit
  argument. This makes the function's dependencies clear and improves the
  robustness of the error handling path. The stream->urb_size is now set only
  after a complete and successful allocation.

  This is a pure refactoring and introduces no functional changes.

  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Tested-by: Itay Chamiel <itay.chamiel@q.ai>
  Link: https://patch.msgid.link/20260114-uvc-alloc-urb-v1-2-cedf3fb66711@chromium.org
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:30 +08:00
Kate Hsuan d38106e308 media: uvcvideo: Fix allocation for small frame sizes 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 40d3ac25c11310bfaa50ed7614846ef75cb69a1e
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Wed, 14 Jan 2026 10:32:13 +0000

  If a frame has size of less or equal than one packet size
  uvc_alloc_urb_buffers() is unable to allocate memory for it due to a
  off-by-one error.

  Fix the off-by-one-error and now that we are at it, make sure that
  stream->urb_size has always a valid value when we return from the
  function, even when an error happens.

  Fixes: efdc8a9585 ("V4L/DVB (10295): uvcvideo: Retry URB buffers allocation when the system is low on memory.")
  Reported-by: Itay Chamiel <itay.chamiel@q.ai>
  Closes: https://lore.kernel.org/linux-media/CANiDSCsSoZf2LsCCoWAUbCg6tJT-ypXR1B85aa6rAdMVYr2iBQ@mail.gmail.com/T/#t
  Co-developed-by: Itay Chamiel <itay.chamiel@q.ai>
  Signed-off-by: Itay Chamiel <itay.chamiel@q.ai>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Tested-by: Itay Chamiel <itay.chamiel@q.ai>
  Link: https://patch.msgid.link/20260114-uvc-alloc-urb-v1-1-cedf3fb66711@chromium.org
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:30 +08:00
Kate Hsuan 4a74ff65ce media: uvcvideo: Return queued buffers on start_streaming() failure 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

CVE: CVE-2026-43290

commit 4cf3b6fd54ebb1ebc977bdc47fb6cfcf9a471a22
Author: Michal Pecio <michal.pecio@gmail.com>
Date: Wed, 15 Oct 2025 13:36:42 +0200

  Return buffers if streaming fails to start due to uvc_pm_get() error.

  This bug may be responsible for a warning I got running

      while :; do yavta -c3 /dev/video0; done

  on an xHCI controller which failed under this workload.
  I had no luck reproducing this warning again to confirm.

  xhci_hcd 0000:09:00.0: HC died; cleaning up
  usb 13-2: USB disconnect, device number 2
  WARNING: CPU: 2 PID: 29386 at drivers/media/common/videobuf2/videobuf2-core.c:1803 vb2_start_streaming+0xac/0x120

  Fixes: 7dd56c47784a ("media: uvcvideo: Remove stream->is_streaming field")
  Cc: stable@vger.kernel.org
  Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Link: https://patch.msgid.link/20251015133642.3dede646.michal.pecio@gmail.com
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:13 +08:00
Kate Hsuan 3b07a711ba media: uvcvideo: Create an ID namespace for streaming output terminals 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 3d9f32e02c2ed85338be627de672e2b81b88a836
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Thu, 13 Nov 2025 23:04:00 +0200

  Some devices, such as the Grandstream GUV3100 and the LSK Meeting Eye
  for Business & Home, exhibit entity ID collisions between units and
  streaming output terminals.

  The UVC specification requires unit and terminal IDs to be unique, and
  uses the ID to reference entities:

  - In control requests, to identify the target entity
  - In the UVC units and terminals descriptors' bSourceID field, to
    identify source entities
  - In the UVC input header descriptor's bTerminalLink, to identify the
    terminal associated with a streaming interface

  Entity ID collisions break accessing controls and make the graph
  description in the UVC descriptors ambiguous. However, collisions where
  one of the entities is a streaming output terminal and the other entity
  is not a streaming terminal are less severe. Streaming output terminals
  have no controls, and, as they are the final entity in pipelines, they
  are never referenced in descriptors as source entities. They are
  referenced by ID only from innput header descriptors, which by
  definition only reference streaming terminals.

  For these reasons, we can work around the collision by giving streaming
  output terminals their own ID namespace. Do so by setting bit
  UVC_TERM_OUTPUT (15) in the uvc_entity.id field, which is normally never
  set as the ID is a 8-bit value.

  This ID change doesn't affect the entity name in the media controller
  graph as the name isn't constructed from the ID, so there should not be
  any impact on the uAPI.

  Although this change handles some ID collisions automagically, keep
  printing an error in uvc_alloc_new_entity() when a camera has invalid
  descriptors. Hopefully this message will help vendors fix their invalid
  descriptors.

  This new method of handling ID collisions includes a revert of commit
  758dbc756aad ("media: uvcvideo: Use heuristic to find stream entity")
  that attempted to fix the problem urgently due to regression reports.

  Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Tested-by: Lili Orosz <lily@floofy.city>
  Co-developed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Link: https://patch.msgid.link/20251113210400.28618-1-laurent.pinchart@ideasonboard.com
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:09 +08:00
Kate Hsuan 1a740ad359 media: v4l: ctrls: add a control for enabling strobe output 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 5be4154f6255d92d9d2ad5da658d7d33a655386f
Author: Richard Leitner <richard.leitner@linux.dev>
Date: Tue, 9 Dec 2025 23:44:37 +0100

  Add a control V4L2_CID_FLASH_STROBE_OE to en- or disable the
  strobe output of v4l2 devices (most likely sensors).

  Signed-off-by: Richard Leitner <richard.leitner@linux.dev>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan a2e0ee64be media: v4l: ctrls: add a control for flash/strobe duration 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit d89ccbf3dde727d91a242a5a3f3b70a90579b057
Author: Richard Leitner <richard.leitner@linux.dev>
Date: Tue, 9 Dec 2025 23:44:36 +0100

  Add a V4L2_CID_FLASH_DURATION control to set the duration of a
  flash/strobe pulse. This controls the length of the flash/strobe pulse
  output by device (typically a camera sensor) and connected to the flash
  controller. This is different to the V4L2_CID_FLASH_TIMEOUT control,
  which is implemented by the flash controller and defines a limit after
  which the flash is "forcefully" turned off again.

  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Richard Leitner <richard.leitner@linux.dev>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan 55f0eab258 media: v4l2-subdev: Extend VIDIOC_SUBDEV_S_ROUTING error codes 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

Conflicts:
    The following files weren't found in RHEL9
        drivers/media/platform/nxp/imx8-isi/imx8-isi-crossbar.c
        drivers/media/platform/raspberrypi/rp1-cfe/csi2.c

commit 04ec8572f8689f577781ba0229b5bb1671c520e0
Author: Sakari Ailus <sakari.ailus@linux.intel.com>
Date: Mon, 25 Aug 2025 10:28:52 +0300

  Return -ENXIO from routing configuration errors other than generic IOCTL
  argument validation.

  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan 7c949fb0be media: v4l2-ctrls: Set error v4l2_ctrl_new_fwnode_properties consistently 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit e3d5436c7099881e3604826757c8d65acc2d94f3
Author: Sakari Ailus <sakari.ailus@linux.intel.com>
Date: Tue, 11 Nov 2025 13:07:29 +0200

  The vast majority of the callers of v4l2_ctrl_new_fwnode_properties() do
  check the returned error code but the function does not set the control
  handler's error on failure. This will make error handling more complicated
  and prone for bugs.

  Always assign the control handler's error field on error in
  v4l2_ctrl_new_fwnode_properties().

  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan 2e10eb61ce Revert "media: uvcvideo: Remove nodrop parameter" 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 17526c7e69d07395e9d39794aacba42dcb02ff49
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Tue, 13 Jan 2026 13:29:46 +0000

  This reverts commit 27ccc44a511b0cd76dc607e2a4893b876192ee1b.

  A user has reported that the Zoom Video Conferencing tool is not capable
  of handling invalid frames. Due to this, he has to continue using this
  parameter.

  We will keep working with Zoom so they can handle invalid frames
  correctly, but for this cycle the safest option is to revert this
  parameter drop.

  Fixes: 27ccc44a511b ("media: uvcvideo: Remove nodrop parameter")
  Reported-by: Ralf Jung <post@ralfj.de>
  Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121718
  Closes: https://lore.kernel.org/linux-media/uboug5ectzm4s32yfgopjbcxq2uhsoc4kluaby7a4b7nzfjave@boco7oocnftr/
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan 8c321f58dd media: mc: add debugfs node to keep track of requests 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit de9f0c2a1ce3d97561d5cf4678b80e13943647fd
Author: Hans Verkuil <hverkuil+cisco@kernel.org>
Date: Fri, 28 Nov 2025 14:16:14 -0500

  Keep track of the number of requests and request objects of a media
  device. Helps to verify that all request-related memory is freed.

  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
  Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan b6a42254b9 media: mc: add manual request completion 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit c789a7f40288c19004f786a6da67c3733d38c6af
Author: Hans Verkuil <hverkuil+cisco@kernel.org>
Date: Fri, 28 Nov 2025 14:16:12 -0500

  By default when the last request object is completed, the whole
  request completes as well.

  But sometimes you want to delay this completion to an arbitrary point in
  time so add a manual complete mode for this.

  In req_queue the driver marks the request for manual completion by
  calling media_request_mark_manual_completion, and when the driver
  wants to manually complete the request it calls
  media_request_manual_complete().

  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
  Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan 65ee49e143 media: uvcvideo: Document how to format GUIDs 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit ee5b462b97162dbb6c536e18a37b3048f6520019
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Wed, 19 Nov 2025 19:37:13 +0000

  Manual formatting the GUIDs can lead to errors, document a
  programmatically way to format the GUIDs from lsusb into something that
  the driver can use.

  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan 3b88109207 media: uvcvideo: Remove nodrop parameter 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 27ccc44a511b0cd76dc607e2a4893b876192ee1b
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Wed, 19 Nov 2025 19:37:10 +0000

  We announced the deprecation intentions one year ago in the commit
  commit 40ed9e9b2808 ("media: uvcvideo: Announce the user our deprecation
  intentions").

  We have not hear any complains, lets remove the nodrop parameter.

  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan 1bd72d7899 media: uvcvideo: UVC minimum relative pan/tilt/zoom speed fix. 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit f0487a90b2c50d4021c578a809144d800a703676
Author: John Bauer <johnebgood@securitylive.com>
Date: Mon, 1 Dec 2025 17:06:53 +0100

  In Video4Linux, a negative value in V4L2_CID_ZOOM_CONTINUOUS,
  V4L2_CID_PAN_SPEED and V4L2_CID_TILT_SPEED indicates a movement in the
  "opposite" direction to the standard direction.

  Currently, we were using -UVC_GET_MIN as the negative value, which
  resulted in the camera moving in the slowest possible speed.

  Quirk the driver to return -UVC_GET_MAX for the affected controls.

  Note that the get/set function from the mapping cannot be used for
  this, because we need to use the information from GET_MAX for GET_MIN
  and hacking uvc_ctrl_populate_cache seems like a worse alternative.

  Tested on OBSBOT Tiny 2.

  lsusb -v:

  Bus 008 Device 002: ID 3564:fef8 Remo Tech Co., Ltd. OBSBOT Tiny 2
  Negotiated speed: SuperSpeed (5Gbps)
  Device Descriptor:
    bLength                18
    bDescriptorType         1
    bcdUSB               3.10
    bDeviceClass          239 Miscellaneous Device
    bDeviceSubClass         2 [unknown]
    bDeviceProtocol         1 Interface Association
    bMaxPacketSize0         9
    idVendor           0x3564 Remo Tech Co., Ltd.
    idProduct          0xfef8 OBSBOT Tiny 2
    bcdDevice            4.09
    iManufacturer           1 Remo Tech Co., Ltd.
    iProduct                2 OBSBOT Tiny 2
    iSerial                 0
    bNumConfigurations      1
    Configuration Descriptor:
      bLength                 9
      bDescriptorType         2
      wTotalLength       0x04fc
      bNumInterfaces          4
      bConfigurationValue     1
      iConfiguration          4 OBSBOT Multifunction
      bmAttributes         0xc0
        Self Powered
      MaxPower                0mA
      Interface Association:
        bLength                 8
        bDescriptorType        11
        bFirstInterface         0
        bInterfaceCount         2
        bFunctionClass         14 Video
        bFunctionSubClass       3 Video Interface Collection
        bFunctionProtocol       0
        iFunction               5 OBSBOT Tiny 2 StreamCamera
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        0
        bAlternateSetting       0
        bNumEndpoints           1
        bInterfaceClass        14 Video
        bInterfaceSubClass      1 Video Control
        bInterfaceProtocol      0
        iInterface              5 OBSBOT Tiny 2 StreamCamera
        VideoControl Interface Descriptor:
          bLength                13
          bDescriptorType        36
          bDescriptorSubtype      1 (HEADER)
          bcdUVC               1.00
          wTotalLength       0x0050
          dwClockFrequency       48.000000MHz
          bInCollection           1
          baInterfaceNr( 0)       1
        VideoControl Interface Descriptor:
          bLength                18
          bDescriptorType        36
          bDescriptorSubtype      2 (INPUT_TERMINAL)
          bTerminalID             1
          wTerminalType      0x0201 Camera Sensor
          bAssocTerminal          0
          iTerminal               0
          wObjectiveFocalLengthMin      0
          wObjectiveFocalLengthMax      0
          wOcularFocalLength            0
          bControlSize                  3
          bmControls           0x00023e3e
            Auto-Exposure Mode
            Auto-Exposure Priority
            Exposure Time (Absolute)
            Exposure Time (Relative)
            Focus (Absolute)
            Zoom (Absolute)
            Zoom (Relative)
            PanTilt (Absolute)
            PanTilt (Relative)
            Roll (Absolute)
            Focus, Auto
        VideoControl Interface Descriptor:
          bLength                11
          bDescriptorType        36
          bDescriptorSubtype      5 (PROCESSING_UNIT)
        Warning: Descriptor too short
          bUnitID                 3
          bSourceID               1
          wMaxMultiplier        400
          bControlSize            2
          bmControls     0x0000f7df
            Brightness
            Contrast
            Hue
            Saturation
            Sharpness
            White Balance Temperature
            White Balance Component
            Backlight Compensation
            Gain
            Power Line Frequency
            White Balance Temperature, Auto
            White Balance Component, Auto
            Digital Multiplier
            Digital Multiplier Limit
          iProcessing             0
          bmVideoStandards     0x1d
            None
            PAL - 625/50
            SECAM - 625/50
            NTSC - 625/50
        VideoControl Interface Descriptor:
          bLength                29
          bDescriptorType        36
          bDescriptorSubtype      6 (EXTENSION_UNIT)
          bUnitID                 2
          guidExtensionCode         {9a1e7291-6843-4683-6d92-39bc7906ee49}
          bNumControls           19
          bNrInPins               1
          baSourceID( 0)          3
          bControlSize            4
          bmControls( 0)       0xff
          bmControls( 1)       0xff
          bmControls( 2)       0x04
          bmControls( 3)       0x00
          iExtension              0
        VideoControl Interface Descriptor:
          bLength                 9
          bDescriptorType        36
          bDescriptorSubtype      3 (OUTPUT_TERMINAL)
          bTerminalID             7
          wTerminalType      0x0101 USB Streaming
          bAssocTerminal          0
          bSourceID               2
          iTerminal               0
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x84  EP 4 IN
          bmAttributes            3
            Transfer Type            Interrupt
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0010  1x 16 bytes
          bInterval               8
          bMaxBurst               0
          VideoControl Endpoint Descriptor:
            bLength                 5
            bDescriptorType        37
            bDescriptorSubtype      3 (EP_INTERRUPT)
            wMaxTransferSize       16
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        1
        bAlternateSetting       0
        bNumEndpoints           1
        bInterfaceClass        14 Video
        bInterfaceSubClass      2 Video Streaming
        bInterfaceProtocol      0
        iInterface              6 Video Streaming
        VideoStreaming Interface Descriptor:
          bLength                            16
          bDescriptorType                    36
          bDescriptorSubtype                  1 (INPUT_HEADER)
          bNumFormats                         3
          wTotalLength                   0x03f8
          bEndpointAddress                 0x81  EP 1 IN
          bmInfo                              0
          bTerminalLink                       7
          bStillCaptureMethod                 0
          bTriggerSupport                     0
          bTriggerUsage                       0
          bControlSize                        1
          bmaControls( 0)                     4
          bmaControls( 1)                     0
          bmaControls( 2)                     4
        VideoStreaming Interface Descriptor:
          bLength                            11
          bDescriptorType                    36
          bDescriptorSubtype                  6 (FORMAT_MJPEG)
          bFormatIndex                        1
          bNumFrameDescriptors                6
          bFlags                              0
            Fixed-size samples: No
          bDefaultFrameIndex                  1
          bAspectRatioX                       0
          bAspectRatioY                       0
          bmInterlaceFlags                 0x00
            Interlaced stream or variable: No
            Fields per frame: 1 fields
            Field 1 first: No
            Field pattern: Field 1 only
          bCopyProtect                        0
        VideoStreaming Interface Descriptor:
          bLength                            62
          bDescriptorType                    36
          bDescriptorSubtype                  7 (FRAME_MJPEG)
          bFrameIndex                         1
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1920
          wHeight                          1080
          dwMinBitRate                995328000
          dwMaxBitRate                1990656000
          dwMaxVideoFrameBufferSize     4147200
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  9
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            166833
          dwFrameInterval( 2)            200000
          dwFrameInterval( 3)            333333
          dwFrameInterval( 4)            333666
          dwFrameInterval( 5)            400000
          dwFrameInterval( 6)            416666
          dwFrameInterval( 7)            500000
          dwFrameInterval( 8)            666666
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                  7 (FRAME_MJPEG)
          bFrameIndex                         2
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           3840
          wHeight                          2160
          dwMinBitRate                1327104000
          dwMaxBitRate                1327104000
          dwMaxVideoFrameBufferSize    16588800
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwFrameInterval( 0)            333333
          dwFrameInterval( 1)            333666
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                            62
          bDescriptorType                    36
          bDescriptorSubtype                  7 (FRAME_MJPEG)
          bFrameIndex                         3
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1280
          wHeight                           720
          dwMinBitRate                221184000
          dwMaxBitRate                884736000
          dwMaxVideoFrameBufferSize     1843200
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  9
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            166833
          dwFrameInterval( 2)            200000
          dwFrameInterval( 3)            333333
          dwFrameInterval( 4)            333666
          dwFrameInterval( 5)            400000
          dwFrameInterval( 6)            416666
          dwFrameInterval( 7)            500000
          dwFrameInterval( 8)            666666
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                  7 (FRAME_MJPEG)
          bFrameIndex                         4
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1280
          wHeight                           960
          dwMinBitRate                294912000
          dwMaxBitRate                1179648000
          dwMaxVideoFrameBufferSize     2457600
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            333333
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                  7 (FRAME_MJPEG)
          bFrameIndex                         5
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1920
          wHeight                          1440
          dwMinBitRate                663552000
          dwMaxBitRate                1327104000
          dwMaxVideoFrameBufferSize     5529600
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            333333
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                            46
          bDescriptorType                    36
          bDescriptorSubtype                  7 (FRAME_MJPEG)
          bFrameIndex                         6
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           4000
          wHeight                          3000
          dwMinBitRate                1920000000
          dwMaxBitRate                1920000000
          dwMaxVideoFrameBufferSize    24000000
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  5
          dwFrameInterval( 0)            333333
          dwFrameInterval( 1)            400000
          dwFrameInterval( 2)            416666
          dwFrameInterval( 3)            500000
          dwFrameInterval( 4)            666666
        VideoStreaming Interface Descriptor:
          bLength                             6
          bDescriptorType                    36
          bDescriptorSubtype                 13 (COLORFORMAT)
          bColorPrimaries                     1 (BT.709,sRGB)
          bTransferCharacteristics            1 (BT.709)
          bMatrixCoefficients                 4 (SMPTE 170M (BT.601))
        VideoStreaming Interface Descriptor:
          bLength                            27
          bDescriptorType                    36
          bDescriptorSubtype                  4 (FORMAT_UNCOMPRESSED)
          bFormatIndex                        2
          bNumFrameDescriptors                7
          guidFormat           {32595559-0000-0010-8000-00aa00389b71}
          bBitsPerPixel                      16
          bDefaultFrameIndex                  5
          bAspectRatioX                       0
          bAspectRatioY                       0
          bmInterlaceFlags                 0x00
            Interlaced stream or variable: No
            Fields per frame: 2 fields
            Field 1 first: No
            Field pattern: Field 1 only
          bCopyProtect                        0
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
          bFrameIndex                         1
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                            640
          wHeight                           360
          dwMinBitRate                 55296000
          dwMaxBitRate                221184000
          dwMaxVideoFrameBufferSize      460800
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            333333
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
          bFrameIndex                         2
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                            640
          wHeight                           480
          dwMinBitRate                 73728000
          dwMaxBitRate                294912000
          dwMaxVideoFrameBufferSize      614400
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            333333
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
          bFrameIndex                         3
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1280
          wHeight                           720
          dwMinBitRate                221184000
          dwMaxBitRate                884736000
          dwMaxVideoFrameBufferSize     1843200
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            333333
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
          bFrameIndex                         4
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1280
          wHeight                           960
          dwMinBitRate                294912000
          dwMaxBitRate                1179648000
          dwMaxVideoFrameBufferSize     2457600
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            333333
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                            46
          bDescriptorType                    36
          bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
          bFrameIndex                         5
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1920
          wHeight                          1080
          dwMinBitRate                497664000
          dwMaxBitRate                995328000
          dwMaxVideoFrameBufferSize     4147200
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  5
          dwFrameInterval( 0)            333333
          dwFrameInterval( 1)            400000
          dwFrameInterval( 2)            416666
          dwFrameInterval( 3)            500000
          dwFrameInterval( 4)            666666
        VideoStreaming Interface Descriptor:
          bLength                            46
          bDescriptorType                    36
          bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
          bFrameIndex                         6
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1920
          wHeight                          1440
          dwMinBitRate                663552000
          dwMaxBitRate                1327104000
          dwMaxVideoFrameBufferSize     5529600
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  5
          dwFrameInterval( 0)            333333
          dwFrameInterval( 1)            400000
          dwFrameInterval( 2)            416666
          dwFrameInterval( 3)            500000
          dwFrameInterval( 4)            666666
        VideoStreaming Interface Descriptor:
          bLength                            30
          bDescriptorType                    36
          bDescriptorSubtype                  5 (FRAME_UNCOMPRESSED)
          bFrameIndex                         7
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           3840
          wHeight                          2160
          dwMinBitRate                1990656000
          dwMaxBitRate                1990656000
          dwMaxVideoFrameBufferSize    16588800
          dwDefaultFrameInterval         666666
          bFrameIntervalType                  1
          dwFrameInterval( 0)            666666
        VideoStreaming Interface Descriptor:
          bLength                             6
          bDescriptorType                    36
          bDescriptorSubtype                 13 (COLORFORMAT)
          bColorPrimaries                     1 (BT.709,sRGB)
          bTransferCharacteristics            1 (BT.709)
          bMatrixCoefficients                 4 (SMPTE 170M (BT.601))
        VideoStreaming Interface Descriptor:
          bLength                            28
          bDescriptorType                    36
          bDescriptorSubtype                 16 (FORMAT_FRAME_BASED)
          bFormatIndex                        3
          bNumFrameDescriptors                5
          guidFormat           {34363248-0000-0010-8000-00aa00389b71}
          bBitsPerPixel                      16
          bDefaultFrameIndex                  1
          bAspectRatioX                       0
          bAspectRatioY                       0
          bmInterlaceFlags                 0x00
            Interlaced stream or variable: No
            Fields per frame: 2 fields
            Field 1 first: No
            Field pattern: Field 1 only
          bCopyProtect                        0
          bVariableSize                     1
        VideoStreaming Interface Descriptor:
          bLength                            62
          bDescriptorType                    36
          bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
          bFrameIndex                         1
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1920
          wHeight                          1080
          dwMinBitRate                497664000
          dwMaxBitRate                1990656000
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  9
          dwBytesPerLine                      0
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            166833
          dwFrameInterval( 2)            200000
          dwFrameInterval( 3)            333333
          dwFrameInterval( 4)            333666
          dwFrameInterval( 5)            400000
          dwFrameInterval( 6)            416666
          dwFrameInterval( 7)            500000
          dwFrameInterval( 8)            666666
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
          bFrameIndex                         2
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           3840
          wHeight                          2160
          dwMinBitRate                1327104000
          dwMaxBitRate                1327104000
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwBytesPerLine                      0
          dwFrameInterval( 0)            333333
          dwFrameInterval( 1)            333666
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                            62
          bDescriptorType                    36
          bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
          bFrameIndex                         4
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1280
          wHeight                           720
          dwMinBitRate                221184000
          dwMaxBitRate                884736000
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  9
          dwBytesPerLine                      0
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            166833
          dwFrameInterval( 2)            200000
          dwFrameInterval( 3)            333333
          dwFrameInterval( 4)            333666
          dwFrameInterval( 5)            400000
          dwFrameInterval( 6)            416666
          dwFrameInterval( 7)            500000
          dwFrameInterval( 8)            666666
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
          bFrameIndex                         5
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1280
          wHeight                           960
          dwMinBitRate                294912000
          dwMaxBitRate                1179648000
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwBytesPerLine                      0
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            333333
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                            50
          bDescriptorType                    36
          bDescriptorSubtype                 17 (FRAME_FRAME_BASED)
          bFrameIndex                         6
          bmCapabilities                   0x00
            Still image unsupported
          wWidth                           1920
          wHeight                          1440
          dwMinBitRate                663552000
          dwMaxBitRate                1327104000
          dwDefaultFrameInterval         333333
          bFrameIntervalType                  6
          dwBytesPerLine                      0
          dwFrameInterval( 0)            166666
          dwFrameInterval( 1)            333333
          dwFrameInterval( 2)            400000
          dwFrameInterval( 3)            416666
          dwFrameInterval( 4)            500000
          dwFrameInterval( 5)            666666
        VideoStreaming Interface Descriptor:
          bLength                             6
          bDescriptorType                    36
          bDescriptorSubtype                 13 (COLORFORMAT)
          bColorPrimaries                     1 (BT.709,sRGB)
          bTransferCharacteristics            1 (BT.709)
          bMatrixCoefficients                 4 (SMPTE 170M (BT.601))
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x81  EP 1 IN
          bmAttributes            2
            Transfer Type            Bulk
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0400  1x 1024 bytes
          bInterval               0
          bMaxBurst              13
      Interface Association:
        bLength                 8
        bDescriptorType        11
        bFirstInterface         2
        bInterfaceCount         2
        bFunctionClass          1 Audio
        bFunctionSubClass       0 [unknown]
        bFunctionProtocol       0
        iFunction               8 OBSBOT Tiny2 Audio
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        2
        bAlternateSetting       0
        bNumEndpoints           0
        bInterfaceClass         1 Audio
        bInterfaceSubClass      1 Control Device
        bInterfaceProtocol      0
        iInterface              8 OBSBOT Tiny2 Audio
        AudioControl Interface Descriptor:
          bLength                 9
          bDescriptorType        36
          bDescriptorSubtype      1 (HEADER)
          bcdADC               1.00
          wTotalLength       0x0027
          bInCollection           1
          baInterfaceNr(0)        3
        AudioControl Interface Descriptor:
          bLength                12
          bDescriptorType        36
          bDescriptorSubtype      2 (INPUT_TERMINAL)
          bTerminalID             3
          wTerminalType      0x0201 Microphone
          bAssocTerminal          0
          bNrChannels             2
          wChannelConfig     0x0003
            Left Front (L)
            Right Front (R)
          iChannelNames          13 Capture Channels
          iTerminal              12 OBSBOT Tiny2 Microphone
        AudioControl Interface Descriptor:
          bLength                 9
          bDescriptorType        36
          bDescriptorSubtype      3 (OUTPUT_TERMINAL)
          bTerminalID             4
          wTerminalType      0x0101 USB Streaming
          bAssocTerminal          0
          bSourceID               5
          iTerminal              14 Capture Output terminal
        AudioControl Interface Descriptor:
          bLength                 9
          bDescriptorType        36
          bDescriptorSubtype      6 (FEATURE_UNIT)
          bUnitID                 5
          bSourceID               3
          bControlSize            2
          bmaControls(0)     0x0003
            Mute Control
            Volume Control
          iFeature                0
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        3
        bAlternateSetting       0
        bNumEndpoints           0
        bInterfaceClass         1 Audio
        bInterfaceSubClass      2 Streaming
        bInterfaceProtocol      0
        iInterface             17 OBSBOT Tiny2 Microphone
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        3
        bAlternateSetting       1
        bNumEndpoints           1
        bInterfaceClass         1 Audio
        bInterfaceSubClass      2 Streaming
        bInterfaceProtocol      0
        iInterface             18 Capture Active
        AudioStreaming Interface Descriptor:
          bLength                 7
          bDescriptorType        36
          bDescriptorSubtype      1 (AS_GENERAL)
          bTerminalLink           4
          bDelay                  1 frames
          wFormatTag         0x0001 PCM
        AudioStreaming Interface Descriptor:
          bLength                11
          bDescriptorType        36
          bDescriptorSubtype      2 (FORMAT_TYPE)
          bFormatType             1 (FORMAT_TYPE_I)
          bNrChannels             2
          bSubframeSize           2
          bBitResolution         16
          bSamFreqType            1 Discrete
          tSamFreq[ 0]        48000
        Endpoint Descriptor:
          bLength                 9
          bDescriptorType         5
          bEndpointAddress     0x82  EP 2 IN
          bmAttributes            5
            Transfer Type            Isochronous
            Synch Type               Asynchronous
            Usage Type               Data
          wMaxPacketSize     0x00c0  1x 192 bytes
          bInterval               4
          bRefresh                0
          bSynchAddress           0
          bMaxBurst               0
          AudioStreaming Endpoint Descriptor:
            bLength                 7
            bDescriptorType        37
            bDescriptorSubtype      1 (EP_GENERAL)
            bmAttributes         0x01
              Sampling Frequency
            bLockDelayUnits         0 Undefined
            wLockDelay         0x0000
  Binary Object Store Descriptor:
    bLength                 5
    bDescriptorType        15
    wTotalLength       0x0016
    bNumDeviceCaps          2
    USB 2.0 Extension Device Capability:
      bLength                 7
      bDescriptorType        16
      bDevCapabilityType      2
      bmAttributes   0x00000006
        BESL Link Power Management (LPM) Supported
    SuperSpeed USB Device Capability:
      bLength                10
      bDescriptorType        16
      bDevCapabilityType      3
      bmAttributes         0x00
      wSpeedsSupported   0x000f
        Device can operate at Low Speed (1Mbps)
        Device can operate at Full Speed (12Mbps)
        Device can operate at High Speed (480Mbps)
        Device can operate at SuperSpeed (5Gbps)
      bFunctionalitySupport   1
        Lowest fully-functional device speed is Full Speed (12Mbps)
      bU1DevExitLat           1 micro seconds
      bU2DevExitLat         500 micro seconds
  Device Status:     0x0001
    Self Powered

  Signed-off-by: John Bauer <johnebgood@securitylive.com>
  Signed-off-by: Gergo Koteles <soyer@irl.hu>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan eae616858e media: uvcvideo: Fix support for V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 4238bd6dc6ba36f44d89a60338223d5a4f708cbf
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Wed, 19 Nov 2025 20:17:36 +0000

  The VIDIOC_G_EXT_CTRLS with which V4L2_CTRL_WHICH_(MIN|MAX)_VAL can only
  work for controls that have previously announced support for it.

  This patch fixes the following v4l2-compliance error:

    info: checking extended control 'User Controls' (0x00980001)
    fail: v4l2-test-controls.cpp(980): ret != EINVAL (got 13)
          test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL

  Fixes: 39d2c891c96e ("media: uvcvideo: support V4L2_CTRL_WHICH_MIN/MAX_VAL")
  Cc: stable@vger.kernel.org
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan 7a21622a59 media: uvcvideo: Replace dev_dbg() with uvc_dbg() 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 85883141d3bea47e5bce688cc300800da7b1ea61
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Tue, 16 Sep 2025 19:10:55 +0300

  The uvcvideo driver uses a uvc_dbg() macro that supports enabling debug
  message categories selectively, and prints a KERN_DEBUG message. The
  macro is used through the driver, but one direct dev_dbg() call creeped
  in. Replace it with uvc_dbg().

  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:08 +08:00
Kate Hsuan b613ef729e media: vb2: drop wait_prepare/finish callbacks 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit b70886ff5833cf499e77af77d2324ce8f68b60ce
Author: Hans Verkuil <hverkuil@xs4all.nl>
Date: Thu, 5 Jun 2025 08:57:39 +0200

  Drop the wait_prepare/finish callbacks. Instead require that the vb2_queue
  lock field is always set and use that lock when waiting for buffers to
  arrive.

  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
  Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:07 +08:00
Kate Hsuan 52fa0aa1d8 media: vb2: remove vb2_ops_wait_prepare/finish helpers 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

Conflicts:
    Due to missing commit 2a2fffb488a3 (media: remove the old videobuf framework)

commit d0730006dac2922bcd3cd16818516ddd3ffb7302
Author: Hans Verkuil <hverkuil@xs4all.nl>
Date: Thu, 5 Jun 2025 08:57:38 +0200

  Since vb2 now relies on the presence of the vb2_queue lock
  field and there are no more drivers that use these helpers, it is safe
  to drop them.

  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
  Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:07 +08:00
Kate Hsuan dba75a7bba media: v4l: Add helper to get number of active lanes via a pad 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit fd3f646e1c9d783d1f4ef30e5376ccf315a8ae30
Author: Isaac Scott <isaac.scott@ideasonboard.com>
Date: Wed, 29 Oct 2025 18:03:18 +0000

  Sometimes, users will not use all of the MIPI CSI 2 lanes available when
  connecting to the MIPI CSI receiver of their device. Add a helper
  function that checks the mbus_config for the device driver to allow
  users to define the number of active data lanes through the
  get_mbus_config op.

  If the driver does not implement this op, fall back to using the maximum
  number of lanes available.

  Reviewed-by: Frank Li <Frank.Li@nxp.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Isaac Scott <isaac.scott@ideasonboard.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:41:07 +08:00
Kate Hsuan 9d1884f00e media: videobuf2: forbid remove_bufs when legacy fileio is active 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

CVE: CVE-2025-40302

commit 27afd6e066cfd80ddbe22a4a11b99174ac89cced
Author: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Thu, 23 Oct 2025 16:26:34 +0200

  vb2_ioctl_remove_bufs() call manipulates queue internal buffer list,
  potentially overwriting some pointers used by the legacy fileio access
  mode. Forbid that ioctl when fileio is active to protect internal queue
  state between subsequent read/write calls.

  CC: stable@vger.kernel.org
  Fixes: a3293a85381e ("media: v4l2: Add REMOVE_BUFS ioctl")
  Reported-by: Shuangpeng Bai <SJB7183@psu.edu>
  Closes: https://lore.kernel.org/linux-media/5317B590-AAB4-4F17-8EA1-621965886D49@psu.edu/
  Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:58 +08:00
Kate Hsuan 8ed5ba9282 media: uvcvideo: Use heuristic to find stream entity 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 758dbc756aad429da11c569c0d067f7fd032bcf7
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Tue, 21 Oct 2025 10:36:17 +0000

  Some devices, like the Grandstream GUV3100 webcam, have an invalid UVC
  descriptor where multiple entities share the same ID, this is invalid
  and makes it impossible to make a proper entity tree without heuristics.

  We have recently introduced a change in the way that we handle invalid
  entities that has caused a regression on broken devices.

  Implement a new heuristic to handle these devices properly.

  Reported-by: Angel4005 <ooara1337@gmail.com>
  Closes: https://lore.kernel.org/linux-media/CAOzBiVuS7ygUjjhCbyWg-KiNx+HFTYnqH5+GJhd6cYsNLT=DaA@mail.gmail.com/
  Fixes: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID")
  Cc: stable@vger.kernel.org
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:49 +08:00
Kate Hsuan 32c8e6981e media: cec: Fix debugfs leak on bus_register() failure 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit c43bcd2b2aa3c2ca9d2433c3990ecbc2c47d10eb
Author: Haotian Zhang <vulab@iscas.ac.cn>
Date: Mon, 29 Sep 2025 19:12:29 +0800

  In cec_devnode_init(), the debugfs directory created with
  debugfs_create_dir() is not removed if bus_register() fails.
  This leaves a stale "cec" entry in debugfs and prevents
  proper module reloading.

  Fix this by removing the debugfs directory in the error path.

  Fixes: a56960e8b4 ("[media] cec: add HDMI CEC framework (core)")
  Cc: stable@vger.kernel.org
  Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:49 +08:00
Kate Hsuan 3d103adcc8 media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

CVE: CVE-2025-40016

commit 0e2ee70291e64a30fe36960c85294726d34a103e
Author: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Date: Wed, 20 Aug 2025 16:08:16 +0000

  Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero
  unique ID.

  ```
  Each Unit and Terminal within the video function is assigned a unique
  identification number, the Unit ID (UID) or Terminal ID (TID), contained in
  the bUnitID or bTerminalID field of the descriptor. The value 0x00 is
  reserved for undefined ID,
  ```

  If we add a new entity with id 0 or a duplicated ID, it will be marked
  as UVC_INVALID_ENTITY_ID.

  In a previous attempt commit 3dd075fe8ebb ("media: uvcvideo: Require
  entities to have a non-zero unique ID"), we ignored all the invalid units,
  this broke a lot of non-compatible cameras. Hopefully we are more lucky
  this time.

  This also prevents some syzkaller reproducers from triggering warnings due
  to a chain of entities referring to themselves. In one particular case, an
  Output Unit is connected to an Input Unit, both with the same ID of 1. But
  when looking up for the source ID of the Output Unit, that same entity is
  found instead of the input entity, which leads to such warnings.

  In another case, a backward chain was considered finished as the source ID
  was 0. Later on, that entity was found, but its pads were not valid.

  Here is a sample stack trace for one of those cases.

  [   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd
  [   20.830206] usb 1-1: Using ep0 maxpacket: 8
  [   20.833501] usb 1-1: config 0 descriptor??
  [   21.038518] usb 1-1: string descriptor 0 read error: -71
  [   21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201)
  [   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!
  [   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!
  [   21.042218] ------------[ cut here ]------------
  [   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0
  [   21.043195] Modules linked in:
  [   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444
  [   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
  [   21.044639] Workqueue: usb_hub_wq hub_event
  [   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0
  [   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00
  [   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246
  [   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1
  [   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290
  [   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000
  [   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003
  [   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000
  [   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
  [   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0
  [   21.051136] PKRU: 55555554
  [   21.051331] Call Trace:
  [   21.051480]  <TASK>
  [   21.051611]  ? __warn+0xc4/0x210
  [   21.051861]  ? media_create_pad_link+0x2c4/0x2e0
  [   21.052252]  ? report_bug+0x11b/0x1a0
  [   21.052540]  ? trace_hardirqs_on+0x31/0x40
  [   21.052901]  ? handle_bug+0x3d/0x70
  [   21.053197]  ? exc_invalid_op+0x1a/0x50
  [   21.053511]  ? asm_exc_invalid_op+0x1a/0x20
  [   21.053924]  ? media_create_pad_link+0x91/0x2e0
  [   21.054364]  ? media_create_pad_link+0x2c4/0x2e0
  [   21.054834]  ? media_create_pad_link+0x91/0x2e0
  [   21.055131]  ? _raw_spin_unlock+0x1e/0x40
  [   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210
  [   21.055837]  uvc_mc_register_entities+0x358/0x400
  [   21.056144]  uvc_register_chains+0x1fd/0x290
  [   21.056413]  uvc_probe+0x380e/0x3dc0
  [   21.056676]  ? __lock_acquire+0x5aa/0x26e0
  [   21.056946]  ? find_held_lock+0x33/0xa0
  [   21.057196]  ? kernfs_activate+0x70/0x80
  [   21.057533]  ? usb_match_dynamic_id+0x1b/0x70
  [   21.057811]  ? find_held_lock+0x33/0xa0
  [   21.058047]  ? usb_match_dynamic_id+0x55/0x70
  [   21.058330]  ? lock_release+0x124/0x260
  [   21.058657]  ? usb_match_one_id_intf+0xa2/0x100
  [   21.058997]  usb_probe_interface+0x1ba/0x330
  [   21.059399]  really_probe+0x1ba/0x4c0
  [   21.059662]  __driver_probe_device+0xb2/0x180
  [   21.059944]  driver_probe_device+0x5a/0x100
  [   21.060170]  __device_attach_driver+0xe9/0x160
  [   21.060427]  ? __pfx___device_attach_driver+0x10/0x10
  [   21.060872]  bus_for_each_drv+0xa9/0x100
  [   21.061312]  __device_attach+0xed/0x190
  [   21.061812]  device_initial_probe+0xe/0x20
  [   21.062229]  bus_probe_device+0x4d/0xd0
  [   21.062590]  device_add+0x308/0x590
  [   21.062912]  usb_set_configuration+0x7b6/0xaf0
  [   21.063403]  usb_generic_driver_probe+0x36/0x80
  [   21.063714]  usb_probe_device+0x7b/0x130
  [   21.063936]  really_probe+0x1ba/0x4c0
  [   21.064111]  __driver_probe_device+0xb2/0x180
  [   21.064577]  driver_probe_device+0x5a/0x100
  [   21.065019]  __device_attach_driver+0xe9/0x160
  [   21.065403]  ? __pfx___device_attach_driver+0x10/0x10
  [   21.065820]  bus_for_each_drv+0xa9/0x100
  [   21.066094]  __device_attach+0xed/0x190
  [   21.066535]  device_initial_probe+0xe/0x20
  [   21.066992]  bus_probe_device+0x4d/0xd0
  [   21.067250]  device_add+0x308/0x590
  [   21.067501]  usb_new_device+0x347/0x610
  [   21.067817]  hub_event+0x156b/0x1e30
  [   21.068060]  ? process_scheduled_works+0x48b/0xaf0
  [   21.068337]  process_scheduled_works+0x5a3/0xaf0
  [   21.068668]  worker_thread+0x3cf/0x560
  [   21.068932]  ? kthread+0x109/0x1b0
  [   21.069133]  kthread+0x197/0x1b0
  [   21.069343]  ? __pfx_worker_thread+0x10/0x10
  [   21.069598]  ? __pfx_kthread+0x10/0x10
  [   21.069908]  ret_from_fork+0x32/0x40
  [   21.070169]  ? __pfx_kthread+0x10/0x10
  [   21.070424]  ret_from_fork_asm+0x1a/0x30
  [   21.070737]  </TASK>

  Reported-by: syzbot+0584f746fde3d52b4675@syzkaller.appspotmail.com
  Closes: https://syzkaller.appspot.com/bug?extid=0584f746fde3d52b4675
  Reported-by: syzbot+dd320d114deb3f5bb79b@syzkaller.appspotmail.com
  Closes: https://syzkaller.appspot.com/bug?extid=dd320d114deb3f5bb79b
  Reported-by: Youngjun Lee <yjjuny.lee@samsung.com>
  Fixes: a3fbc2e6bb ("media: mc-entity.c: use WARN_ON, validate link pads")
  Cc: stable@vger.kernel.org
  Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
  Co-developed-by: Ricardo Ribalda <ribalda@chromium.org>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:30 +08:00
Kate Hsuan f268a0fce0 media: uvcvideo: Support UVC_CROSXU_CONTROL_IQ_PROFILE 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 0f99b8bed426b8f5434b10c3f6f6b92d7ce3c467
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 18 Aug 2025 20:15:39 +0000

  The ChromeOS XU provides a control to change the IQ profile for a camera.
  It can be switched from VIVID (a.k.a. standard) to NONE (a.k.a. natural).

  Wire it up to the standard v4l2 control.

  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:27 +08:00
Kate Hsuan 318f88f9a6 media: uvcvideo: Run uvc_ctrl_init_ctrl for all controls 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 04ddfcdb711d94d05a5b4c8a8c3f9c283bbb518a
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 18 Aug 2025 20:15:38 +0000

  The function uvc_ctrl_init_ctrl() is called for every control for every
  entity, but it exits early if the entity is a extension unit. The comment
  claims that this is done to avoid querying XU controls during probe.

  We only query a control if its entity GUIDs and index matches the
  uvc_ctrls list. There are only controls for the following GUIDs:
  UVC_GUID_UVC_PROCESSING, UVC_GUID_UVC_CAMERA and
  UVC_GUID_EXT_GPIO_CONTROLLER.

  In other words, XU controls will not be queried even without this
  condition.

  In future patches we want to add ChromeOS XU controls that need to the
  initialized. We will make sure that all cameras with ChromeOS XU can
  be queried at probe time.

  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:27 +08:00
Kate Hsuan 166c634940 media: uvcvideo: Shorten the transfer size non compliance message 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit c01ae95eeb145892f9ed325a5947ed2f108170c4
Author: Michal Pecio <michal.pecio@gmail.com>
Date: Thu, 4 Sep 2025 08:14:29 +0200

  This message is much longer than others and doesn't fit even in a 160
  column window when printed, despite providing little real information.

  Also replace 'transmission' with 'transfer' because that's the actual
  name and 'max packet' with 'limit' because it isn't same thing with
  isochronus endpoints. Remove cryptic abbreviations like 'ep'.

  Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:27 +08:00
Kate Hsuan 7d1834bffb media: uvcvideo: Do not re-reference dev->udev 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit eb5ec760c25b1fd0af3cc43fb0dbc8e5eba11025
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 25 Jul 2025 11:01:30 +0000

  dev->udev is already referenced by the variable udev. Let's use it.

  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:27 +08:00
Kate Hsuan b3bfd39133 media: uvcvideo: Use intf instead of udev for printks 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 5cdbca8967dc804829883e251a9d197b5fab4aed
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 25 Jul 2025 11:01:29 +0000

  The UVC driver is a usb_interface driver. Use the correct device for
  printks to avoid confusions with other interface drivers associated to
  the same usb device.

  With this change:
  uvcvideo 3-6:1.0: Found UVC 1.10 device USB2.0 WebCam (1234:abcd)

  Without this change:
  usb 3-6: Found UVC 1.10 device USB2.0 WebCam (1234:abcd)

  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:27 +08:00
Kate Hsuan 91394b3be4 media: uvcvideo: Move video_device under video_queue 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 3e412a7b57c32410b05f659045a64c28b0acbb24
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 25 Jul 2025 13:12:49 +0000

  It is more natural that the "struct video_device" belongs to
  uvc_video_queue instead of uvc_streaming.

  This is an aesthetic change. No functional change expected.

  Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:26 +08:00
Kate Hsuan 7e81793618 media: uvcvideo: Drop stream->mutex 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 97b6ff8603f2bdd8863a4d9b8b5432e8f3272b64
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 25 Jul 2025 13:12:48 +0000

  Since commit c93d73c9c2cf ("media: uvcvideo: Use vb2 ioctl and fop
  helpers"), the IOCTLs are serialized. Due to this there is no more need
  to protect ctrl, cur_format or cur_frame from concurrent access.

  Drop stream->mutex after thanking it for years of good service.

  Use this opportunity to do fix some CodeStyle.

  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:26 +08:00
Kate Hsuan 4f8130baa9 media: uvcvideo: Move MSXU_CONTROL_METADATA definition to header 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 1ab40529ad52f339975886a6a9e815dfdcb8d011
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Tue, 15 Jul 2025 21:52:54 +0300

  Move the MSXU_CONTROL_METADATA control definitino to the
  include/linux/usb/uvc.h header, alongside the corresponding XU GUID. Add
  a UVC_ prefix to avoid namespace clashes.

  While at it, add the definition for the other controls for that
  extension unit, as defined in
  https://learn.microsoft.com/en-us/windows-hardware/drivers/stream/uvc-extensions-1-5#222-extension-unit-controls.

  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:26 +08:00
Kate Hsuan d5f119cfe8 media: uvcvideo: Add missing curly braces 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 50c320a5f7065de7b0bcba67f72d23e40188bc70
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Tue, 15 Jul 2025 21:52:53 +0300

  The uvc_meta_v4l2_try_format() function is missing curly braces on an
  outer for loop statement to comply with the driver coding style. Add
  them.

  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:26 +08:00
Kate Hsuan 4e9a259c79 media: uvcvideo: Drop unneeded memset() in meta device ioctl handlers 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 1dcfbdb361c86c29b084432696f5d847c5599e2b
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Tue, 15 Jul 2025 21:52:52 +0300

  The .vidioc_g_fmt_meta_cap() and .vidioc_enum_fmt_meta_cap() ioctl
  handlers for meta capture devices memset the ioctl argument structure to
  zero. This is unnecessary as the memory is already zeroed by the V4L2
  ioctl core. Drop the memset(), which, in uvc_meta_v4l2_enum_formats(),
  also allows further simplification as structure fields don't need to be
  saved and restored.

  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:26 +08:00
Kate Hsuan 937119384c media: uvcvideo: Fix comments in uvc_meta_detect_msxu 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit e8e65d9237e590a953e17beb15bfd13dcfbe3ebf
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Wed, 16 Jul 2025 10:43:44 +0000

  The comments can be more precise. Let's fix them.

  Fixes: 6cb786f040ad ("media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META")
  Cc: stable+noautosel@kernel.org # Coment change only, no need to backport
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:26 +08:00
Kate Hsuan 73e75d9485 media: uvcvideo: Avoid variable shadowing in uvc_ctrl_cleanup_fh 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit f4da0de6b4b470a60c5c0cc4c09b0c987f9df35f
Author: Desnes Nunes <desnesn@redhat.com>
Date: Tue, 8 Jul 2025 11:46:28 -0300

  This avoids a variable loop shadowing occurring between the local loop
  iterating through the uvc_entity's controls and the global one going
  through the pending async controls of the file handle.

  Fixes: 10acb9101355 ("media: uvcvideo: Increase/decrease the PM counter per IOCTL")
  Cc: stable@vger.kernel.org
  Signed-off-by: Desnes Nunes <desnesn@redhat.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:26 +08:00
Kate Hsuan 1331330a6e media: uvcvideo: Fix assignment in if condition 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit e67b5f8313229d058bddc88e29a73b9b6cdab7a9
Author: Darshan Rathod <darshanrathod475@gmail.com>
Date: Tue, 15 Jul 2025 11:30:56 +0000

  The function uvc_input_init() uses an assignment of the return value
  of input_register_device() within the condition of an if statement.

  This coding style is discouraged by the Linux kernel coding style guide
  as it can be confused with a comparison and hide potential bugs.
  The checkpatch.pl script flags this as an error:
  "ERROR: do not use assignment in if condition"

  Separate the assignment into its own statement before the conditional
  check to improve code readability and adhere to the kernel's
  coding standards.

  Signed-off-by: Darshan Rathod <darshanrathod475@gmail.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:26 +08:00
Kate Hsuan da4ad88f53 media: mc: Clear minor number before put device 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

CVE: CVE-2025-40197

commit 8cfc8cec1b4da88a47c243a11f384baefd092a50
Author: Edward Adam Davis <eadavis@qq.com>
Date: Wed, 10 Sep 2025 09:15:27 +0800

  The device minor should not be cleared after the device is released.

  Fixes: 9e14868dc952 ("media: mc: Clear minor number reservation at unregistration time")
  Cc: stable@vger.kernel.org
  Reported-by: syzbot+031d0cfd7c362817963f@syzkaller.appspotmail.com
  Closes: https://syzkaller.appspot.com/bug?extid=031d0cfd7c362817963f
  Tested-by: syzbot+031d0cfd7c362817963f@syzkaller.appspotmail.com
  Signed-off-by: Edward Adam Davis <eadavis@qq.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:07 +08:00
Kate Hsuan 95dff52177 media: v4l2-common: Add legacy camera sensor clock helper 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit dd235b07b65e123c0fdadc2883b9c16aa4749164
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Wed, 13 Aug 2025 00:45:53 +0300

  The recently introduced devm_v4l2_sensor_clk_get() helper aims at
  simplifying sensor drivers by centralizing clock handling code, as well
  as reducing cargo-cult and deprecated behaviour.

  A set of drivers implement external clock handling in a non-standard
  way. This can't be changed as there is a high risk of breaking existing
  platforms, but keeping the code as-is creates a risk of new drivers
  copying deprecated behaviour.

  To fix this, introduce a new devm_v4l2_sensor_clk_get_legacy() helper
  and use it in those driver. Compared to devm_v4l2_sensor_clk_get(), the
  new helper takes the "clock-frequency" property into account and sets
  the external clock rate on OF platforms, and adds the ability to specify
  a fixed default or fallback clock rate in case the "clock-frequency"
  property is not present.

  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan f20ad82f2c media: mc: Clear minor number reservation at unregistration time 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 6a79e9c91e9e0fb9d4fdcdb288952f62333fa5dc
Author: Sakari Ailus <sakari.ailus@linux.intel.com>
Date: Mon, 11 Mar 2024 13:13:08 +0200

  Clear the media device's minor number reservation at unregister time as
  there's no need to keep it reserved for longer. This makes it possible to
  reserve the same minor right after unregistration.

  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan 356fd03025 media: v4l2-core: v4l2-dv-timings: support DRM IFs 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 0b6cb344829b4b8605a3f6e930b207d47dee1d12
Author: Hans Verkuil <hverkuil+cisco@kernel.org>
Date: Tue, 22 Jul 2025 09:34:35 +0200

  Add support for DRM (Dynamic Range and Mastering) InfoFrames.

  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
  Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan 8370989e81 media: uvcvideo: eUSB2 double isochronous bandwidth support 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 0aa0b0326cc5642e97af968d21cbd8836368b707
Author: Tao Q Tao <tao.q.tao@intel.com>
Date: Wed, 20 Aug 2025 17:38:24 +0300

  Use usb_endpoint_max_esit_payload() from the USB framework to find the
  maximum bytes per interval for the endpoint. Consequently this adds eUSB2
  isochronous mode and SuperSpeedPlus Isochronous Endpoint Companion support
  where larger payloads within a service interval are possible.

  Co-developed-by: Amardeep Rai <amardeep.rai@intel.com>
  Signed-off-by: Amardeep Rai <amardeep.rai@intel.com>
  Signed-off-by: Tao Q Tao <tao.q.tao@intel.com>
  Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
  Co-developed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
  Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  Link: https://lore.kernel.org/r/20250820143824.551777-10-sakari.ailus@linux.intel.com

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan 02d5a3cff2 media: uapi: v4l2-controls: Cleanup codec definitions 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 34837c444cd42236b2b43ce871f30d83776a3431
Author: Paul Kocialkowski <paulk@sys-base.io>
Date: Sun, 24 Aug 2025 20:07:34 +0200

  Move some fields closer to where they are used, add missing tabs
  and remove an extra newline.

  Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
  Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
  Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan bb3b5ac426 media: v4l2-common: Constify media_pad argument to v4l2_get_link_freq() 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 6234d0df236ab1a71c6bd75e4f5fa15339d5272b
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Fri, 22 Aug 2025 03:27:21 +0300

  The v4l2_get_link_freq() macro doesn't modify the pad argument. Make it
  possible to call it with a const media_pad pointer.

  Link: https://lore.kernel.org/r/20250822002734.23516-2-laurent.pinchart@ideasonboard.com
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Frank Li <Frank.Li@nxp.com>
  Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan af5987cc77 media: uapi: Cleanup tab after define in headers 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 481c12018c252f7fc88b4bd05e882b9e1bf260c3
Author: Paul Kocialkowski <paulk@sys-base.io>
Date: Tue, 5 Aug 2025 22:47:18 +0200

  Some definitions use a tab after the define keyword instead of the
  usual single space. Replace it for better consistency.

  Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan f0f3796bf8 media: uapi: Move colorimetry controls at the end of the file 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 4247053aaacda75480e1918e0d58a687ae5a266a
Author: Paul Kocialkowski <paulk@sys-base.io>
Date: Tue, 5 Aug 2025 22:47:17 +0200

  The colorimetry controls class is defined after the stateless codec
  class at the top of the controls header. It is currently defined in
  the middle of stateless codec controls.

  Move the colorimetry controls after the stateless codec controls,
  at the end of the file.

  Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan 2d8d379668 media: mc: Improve unconnected pads debugging message in link exploration 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 16428e2449ab96cce27be6ab17b750b404c76c7c
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Wed, 20 Aug 2025 17:00:21 +0300

  When exploring links, a message is printed to indicate unconnected pads
  being added. The message prints the entity name only. Print the origin
  pad number as well to help with debugging pipeline start issues. While
  at it, get the entity name from origin->entity instead of local->entity.
  Both point to the same entity, but the former conveys the meaning
  better.

  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan 135b51fdd8 media: mc: Fix MUST_CONNECT handling for pads with no links 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit eec81250219a209b863f11d02128ec1dd8e20877
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Wed, 20 Aug 2025 17:00:20 +0300

  Commit b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always
  require an enabled link") expanded the meaning of the MUST_CONNECT flag
  to require an enabled link in all cases. To do so, the link exploration
  code was expanded to cover unconnected pads, in order to reject those
  that have the MUST_CONNECT flag set. The implementation was however
  incorrect, ignoring unconnected pads instead of ignoring connected pads.
  Fix it.

  Reported-by: Martin Kepplinger-Novaković <martink@posteo.de>
  Closes: https://lore.kernel.org/linux-media/20250205172957.182362-1-martink@posteo.de
  Reported-by: Maud Spierings <maudspierings@gocontroll.com>
  Closes: https://lore.kernel.org/linux-media/20250818-imx8_isi-v1-1-e9cfe994c435@gocontroll.com
  Fixes: b3decc5ce7d7 ("media: mc: Expand MUST_CONNECT flag to always require an enabled link")
  Cc: stable@vger.kernel.org # 6.1
  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Tested-by: Maud Spierings <maudspierings@gocontroll.com>
  Tested-by: Martin Kepplinger-Novaković <martink@posteo.de>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan 9148a58f09 media: v4l2-common: Drop the workaround from v4l2_get_link_freq() 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 683342ce3c0dae068bf0ee157ee12c13088193f7
Author: Sakari Ailus <sakari.ailus@linux.intel.com>
Date: Mon, 18 Aug 2025 16:49:39 +0300

  Remove the workaround that allowed calling v4l2_get_link_freq() on the
  control handler.

  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
  Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:02 +08:00
Kate Hsuan 1104cf7f3f media: v4l2-subdev: Make struct v4l2_subdev_stream_config private 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 5195b777552d2e2fa735c6cad75797efa132bd60
Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Tue, 29 Jul 2025 02:50:10 +0300

  The v4l2_subdev_stream_config structure holds configuration data for a
  stream. It was meant to be used internally only, but already found its
  way into the ds90ub913 driver. Now that the driver has been fixed, make
  the structure private to v4l2-subdev.c to avoid using it by accident.

  Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan 086395bcc5 media: v4l2-common: Add a helper for obtaining the clock producer 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 7ecb662b717a34305beacf71e9fadd1559b4b9ee
Author: Mehdi Djait <mehdi.djait@linux.intel.com>
Date: Mon, 7 Jul 2025 16:32:53 +0200

  Introduce a helper for v4l2 sensor drivers on both DT- and ACPI-based
  platforms to retrieve a reference to the clock producer from firmware.

  This helper behaves the same as devm_clk_get() except where there is
  no clock producer like in ACPI-based platforms.

  For ACPI-based platforms the function will read the "clock-frequency"
  ACPI _DSD property and register a fixed frequency clock with the frequency
  indicated in the property.

  This function also handles the special ACPI-based system case where:
  . The clock-frequency _DSD property is present.
  . A reference to the clock producer is present, where the clock is provided
    by a camera sensor PMIC driver (e.g. int3472/tps68470.c)
  In this case try to set the clock-frequency value to the provided clock.

  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
  Signed-off-by: Mehdi Djait <mehdi.djait@linux.intel.com>
  Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan 17dff6bf20 media: v4l2: Rename second ioctl handlers argument to 'void *priv' 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

Conflicts:
    The following files weren't found in RHEL9
        drivers/media/platform/st/stm32/dma2d/dma2d.c
        drivers/media/platform/sunxi/sun6i-csi/sun6i_csi_capture.c
        drivers/media/platform/synopsys/hdmirx/snps_hdmirx.c
        drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c

commit 5396f5ae0e7b210ee5098c257ccb1c3fdd4bd04f
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:57 +0300

  The second argument to the ioctl handlers is not a file handle any more.
  The standard practice is to name it 'void *priv' in drivers. Many
  drivers still name it 'void *fh', and a few use more exotic names.
  Replace those more exotic names with 'void *priv' in all media drivers.

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Acked-by: Jai Luthra <jai.luthra@linux.dev>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan 494c10025d media: v4l2-core: Rename second ioctl handlers argument to 'void *priv' 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 9d05191c4ed31bb817c03a1b7028ed81fefa8bfb
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:56 +0300

  The second argument to the ioctl handlers is not a file handle any more.
  Rename it from 'void *fh' to 'void *priv' in the V4L2 core, to avoid
  misconceptions.

  While at it, align function arguments in include/media/v4l2-mem2mem.h.

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan 0290cbb1be media: uvcvideo: Rename second ioctl handlers argument to 'void *priv' 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 0960b6937bd99d775b3a7220135ecc546bfb9623
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:54 +0300

  The second argument to the ioctl handlers is not a file handle any more.
  Rename it from 'void *fh' to 'void *priv', to avoid misconceptions. This
  is particularly important in the uvcvideo driver, as it is widely used
  and can be taken as an example for new drivers.

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan 084219998a media: v4l2-ioctl: Push NULL fh argument down to ioctl wrappers 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 35c0ae6d7a2f9b61644c38836929a27a86bcaa1d
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:52 +0300

  As ioctl handlers do not expect a priv argument anymore, start pushing
  the NULL pointer down from __video_do_ioctl() to the ioctl wrappers.
  This paves the way to dropping the void *priv argument to ioctl handlers
  themselves.

  Changes to ioctl wrappers have been generated with the following
  coccinelle semantic patch:

  @ioctl@
  identifier v4l2_ioctls;
  identifier ioctl;
  identifier fn;
  identifier debug;
  expression flags;
  @@
  struct v4l2_ioctl_info v4l2_ioctls[] = {
  	...,
  	IOCTL_INFO(ioctl, fn, debug, flags),
  	...,
  };

  @depends on ioctl@
  identifier ioctl.fn;
  identifier ops;
  identifier file;
  identifier fh;
  identifier arg;
  identifier handler;
  expression list args;
  @@
  -int fn(const struct v4l2_ioctl_ops *ops, struct file *file, void *fh, void *arg)
  +int fn(const struct v4l2_ioctl_ops *ops, struct file *file, void *arg)
  {
  	<...
  -	ops->handler(file, fh, args)
  +	ops->handler(file, NULL, args)
  	...>
  }

  Manual changes have been added to handle the calls to
  v4l_[gs]_selection(), drop the fh argument in the v4l2_ioctl_info
  structure definition and in the DEFINE_V4L_STUB_FUNC() macro, and stop
  passing NULL to the wrappers in __video_do_ioctl()

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan d3d72caa15 media: v4l2-ioctl: Stop passing fh pointer to ioctl handlers 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 0f1a7facb64abe5104c3eb235824ea8d6296474d
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:51 +0300

  Now that all drivers access the v4l2_fh from the file structure, there
  is no need to pass it as an explicit argument to ioctl handlers. Set the
  argument to NULL in the __video_do_ioctl() function, and rename the 'fh'
  argument in the ioctl handler declarations to 'priv' indicate it does
  not contain a file handle.

  The argument could be removed altogether with a mechanical change
  (probably using coccinelle), but there are plans to pass a new argument
  to the ioctl handlers in the near future. The tree-wide change to remove
  the argument, only to add another one soon after, would be too much
  churn.

  While at it, fix argument alignment in vidioc_try_fmt_vid_out_overlay().

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan 7e1ddc869d media: usb: uvc: Access v4l2_fh from file 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit ee7aa3dff32e1745bd501b0d442f347aa111d04f
Author: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:49 +0300

  The v4l2_fh associated with an open file handle is now guaranteed
  to be available in file->private_data, initialised by v4l2_fh_add().

  Access the v4l2_fh, and from there the driver-specific structure,
  from the file * in all ioctl handlers.

  Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan 724c115cb9 media: v4l2-ioctl: Access v4l2_fh from private_data 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit ae76d82230844d8d7cbbcf3e3a9dd7228a7cb994
Author: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:17 +0300

  Now that it is guaranteed that file->private_data is set to point to the
  'struct v4l2_fh' initialised by v4l2_fh_add() the v4l2-ioctl layer can
  be modified to retrieve the v4l2_fh pointer from the file *.

  As the __video_do_ioctl() function, that calls all the handlers modified
  by this patch goes as:

  static long __video_do_ioctl(struct file *file,
  		unsigned int cmd, void *arg)
  {
  	void *fh = file->private_data;

  	...

  	ret = info->func(ops, file, fh, arg);

  }

  This patch introduces no functional changes and makes it possible to
  remove in future the 'fh' argument to all ioctl handlers.

  Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan 7495fe4457 media: Drop V4L2_FL_USES_V4L2_FH checks 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit bb4d6be205dae94aa2d3c3a1ad814dad90d4fd62
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:14 +0300

  Now that all drivers use v4l2_fh, we can drop the V4L2_FL_USES_V4L2_FH
  checks through the V4L2 core.

  To ensure that all new drivers use v4l2_fh, keep setting the
  V4L2_FL_USES_V4L2_FH flag in v4l2_fh_init(), and verify it is set after
  the .open() file operation returns.

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:01 +08:00
Kate Hsuan 009ac6b2bb media: v4l2-dev: Make open and release file operations mandatory 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit b3d945ba42dd640255492a523baeb6b6946a99bf
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:13 +0300

  All V4L2 drivers implement the open and release file operations. As all
  new drivers will need to use v4l2_fh, this situation won't change. Make
  those two file operation mandatory at registration time. This allows
  simplifying v4l2_open() and v4l2_release().

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan 37c922a5bb media: v4l2-ctrls: Move v4l2_fh retrieval after V4L2_FL_USES_V4L2_FH check 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 5410bad3326f3557a7d996b19fa4adc2c70b3c0e
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:12 +0300

  The v4l2_ctrl_log_status() function retrieves the v4l2_fh from the file
  with file_to_v4l2_fh() before checking the V4L2_FL_USES_V4L2_FH to see
  if the device makes use of v4l2_fh. While this doesn't cause any
  practical issue given the current implementation of file_to_v4l2_fh(),
  it is cleaner to retrieve the v4l2_fh after checking the flag. This
  could prevent future issues if the implementation of file_to_v4l2_fh()
  changes.

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan abf3d08a18 media: Reset file->private_data to NULL in v4l2_fh_del() 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

Conflicts:
    The following files weren't found in RHEL9
        drivers/media/platform/amphion/vpu_v4l2.c
        drivers/media/platform/chips-media/wave5/wave5-helper.c
        drivers/media/platform/imagination/e5010-jpeg-enc.c
        drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c
        drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
        drivers/media/platform/nvidia/tegra-vde/v4l2.c
        drivers/media/platform/nxp/dw100/dw100.c
        drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m
        drivers/media/platform/qcom/iris/iris_vidc.c
        drivers/media/platform/st/stm32/dma2d/dma2d.c
        drivers/media/test-drivers/visl/visl-core.c
    The following files weren't enabled in RHEL9 so skip updating them.
        drivers/media/pci/cx18/cx18-fileops.c
        drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
        drivers/media/platform/qcom/venus/core.c

commit 277966749f46bc6292c4052b4e66a554f193a78a
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:09 +0300

  Multiple drivers that use v4l2_fh and call v4l2_fh_del() manually reset
  the file->private_data pointer to NULL in their video device .release()
  file operation handler. Move the code to the v4l2_fh_del() function to
  avoid direct access to file->private_data in drivers. This requires
  adding a file pointer argument to the function.

  Changes to drivers have been generated with the following coccinelle
  semantic patch:

  @@
  expression fh;
  identifier filp;
  identifier release;
  type ret;
  @@
  ret release(..., struct file *filp, ...)
  {
  	<...
  -	filp->private_data = NULL;
  	...
  -	v4l2_fh_del(fh);
  +	v4l2_fh_del(fh, filp);
  	...>
  }

  @@
  expression fh;
  identifier filp;
  identifier release;
  type ret;
  @@
  ret release(..., struct file *filp, ...)
  {
  	<...
  -	v4l2_fh_del(fh);
  +	v4l2_fh_del(fh, filp);
  	...
  -	filp->private_data = NULL;
  	...>
  }

  @@
  expression fh;
  identifier filp;
  identifier release;
  type ret;
  @@
  ret release(..., struct file *filp, ...)
  {
  	<...
  -	v4l2_fh_del(fh);
  +	v4l2_fh_del(fh, filp);
  	...>
  }

  Manual changes have been applied to Documentation/ to update the usage
  patterns, to drivers/media/v4l2-core/v4l2-fh.c to update the
  v4l2_fh_del() prototype and reset file->private_data, and to
  include/media/v4l2-fh.h to update the v4l2_fh_del() function prototype
  and its documentation.

  Additionally, white space issues have been fixed manually in
  drivers/usb/gadget/function/uvc_v4l2.c

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan 6c80b5632e media: Set file->private_data in v4l2_fh_add() 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

Conflicts:
    The following files weren't found in RHEL9
        drivers/media/platform/amphion/vpu_v4l2.c
        drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
        drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
        drivers/media/platform/imagination/e5010-jpeg-enc.c
        drivers/media/platform/mediatek/mdp3/mtk-mdp3-m2m.c
        drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
        drivers/media/platform/nvidia/tegra-vde/v4l2.c
        drivers/media/platform/nxp/dw100/dw100.c
        drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c
        drivers/media/platform/qcom/iris/iris_vidc.c
        drivers/media/platform/st/stm32/dma2d/dma2d.c
        drivers/media/test-drivers/visl/visl-core.c
    File wasn't enabled in RHEL9 so skip updating it.
        drivers/media/pci/saa7164/saa7164-encoder.c
        drivers/media/pci/saa7164/saa7164-vbi.c
        drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
        drivers/media/platform/ti-vpe/vpe.c
        drivers/media/usb/hdpvr/hdpvr-video.c
        drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
        drivers/staging/media/rkvdec/rkvdec.c
        drivers/staging/most/video/video.c

commit 47f4b1acb4d505b1e7e81d8e0ebce774422b8c2e
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:30:08 +0300

  All the drivers that use v4l2_fh and call v4l2_fh_add() manually store a
  pointer to the v4l2_fh instance in file->private_data in their video
  device .open() file operation handler. Move the code to the
  v4l2_fh_add() function to avoid direct access to file->private_data in
  drivers. This requires adding a file pointer argument to the function.

  Changes to drivers have been generated with the following coccinelle
  semantic patch:

  @@
  expression fh;
  identifier filp;
  identifier open;
  type ret;
  @@
  ret open(..., struct file *filp, ...)
  {
  	<...
  -	filp->private_data = fh;
  	...
  -	v4l2_fh_add(fh);
  +	v4l2_fh_add(fh, filp);
  	...>
  }

  @@
  expression fh;
  identifier filp;
  identifier open;
  type ret;
  @@
  ret open(..., struct file *filp, ...)
  {
  	<...
  -	v4l2_fh_add(fh);
  +	v4l2_fh_add(fh, filp);
  	...
  -	filp->private_data = fh;
  	...>
  }

  Manual changes have been applied to Documentation/ to update the usage
  patterns, to drivers/media/v4l2-core/v4l2-fh.c to update the
  v4l2_fh_add() prototype set file->private_data, and to
  include/media/v4l2-fh.h to update the v4l2_fh_add() function prototype
  and its documentation.

  Additionally, white space issues have been fixed manually in
  drivers/media/platform/nvidia/tegra-vde/v4l2.c,
  drivers/media/platform/rockchip/rkvdec/rkvdec.c,
  drivers/media/v4l2-core/v4l2-fh.c and
  drivers/staging/most/video/video.c.

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan c1086f04ea media: Replace file->private_data access with file_to_v4l2_fh() 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

Conflicts:
    The following files weren't found in RHEL9
        drivers/media/platform/amphion/vpu.h
        drivers/media/platform/imagination/e5010-jpeg-enc.h
        drivers/media/platform/nxp/dw100/dw100.c
        drivers/media/platform/qcom/iris/iris_vidc.c
        drivers/media/test-drivers/visl/visl.h
    and the following file wasn't enabled in RHEL9 so skip updating it.
        drivers/media/pci/cx18/cx18-fileops.c
        drivers/media/pci/saa7164/saa7164.h
        drivers/media/platform/ti-vpe/vpe.c
        drivers/media/test-drivers/vivid/vivid-core.c
        drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
        drivers/staging/most/video/video.c

commit 8003313d388f11cfcaaa88a731f113afda171887
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:29:51 +0300

  Accessing file->private_data manually to retrieve the v4l2_fh pointer is
  error-prone, as the field is a void * and will happily cast implicitly
  to any pointer type.

  Replace all remaining locations that read the v4l2_fh pointer directly
  from file->private_data with usage of the file_to_v4l2_fh() function.
  The change was generated manually.

  No functional change is intended, this only paves the way to remove
  direct accesses to file->private_data and make V4L2 drivers safer.
  Other accesses to the field will be addressed separately.

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan ddca4e996e media: Wrap file->private_data access with a helper function 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

Conflicts:
    The following files weren't found in RHEL9
        drivers/media/platform/nvidia/tegra-vde/v4l2.c
        drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
    The following file wasn't enabled in RHEL9 so skip updating it.
        drivers/media/platform/vsp1/vsp1_video.c

commit 618882c92681de18e9bd99d2a88bb21c897283f3
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:29:50 +0300

  Accessing file->private_data manually to retrieve the v4l2_fh pointer is
  error-prone, as the field is a void * and will happily convert
  implicitly to any pointer type. To avoid direct access to
  file->private_data, introduce a new inline function that retrieves the
  v4l2_fh pointer, and use it to replace common access patterns through
  the kernel.

  Changes to drivers have been generated with the following coccinelle
  semantic patch:

  @@
  struct file *filp;
  identifier fh;
  @@

  -       struct v4l2_fh *fh = filp->private_data;
  +       struct v4l2_fh *fh = file_to_v4l2_fh(filp);

  Manual changes have been applied to Documentation/ to update the usage
  patterns, and to include/media/v4l2-fh.h to add the new function.

  While at it, fix a typo in the title of v4l2-fh.rst: the file describes
  the "file handles" API, not "file handlers".

  No functional change is intended, this only paves the way to remove
  direct accesses to file->private_data and make V4L2 drivers safer.
  Other accesses to the field will be addressed separately.

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan a8cdf57665 media: v4l2: Add mem2mem helpers for REMOVE_BUFS ioctl 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

Conflicts:
    The following files weren't found in RHEL9
        drivers/media/test-drivers/visl/visl-video.c

commit 2f2419502f6957b110dbc7d4b75e764e5f370ec2
Author: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Date: Thu, 14 Mar 2024 16:32:25 +0100

  Create v4l2-mem2mem helpers for VIDIOC_REMOVE_BUFS ioctl and
  make test drivers use it.

  Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
  Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan 9fc6757cba media: usb: uvcvideo: Store v4l2_fh pointer in file->private_data 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 7b6cf051dff7b35299ce52b0b00d6e21e656fb4f
Author: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 10 Aug 2025 04:29:48 +0300

  Most V4L2 drivers store the v4l2_fh pointer in file->private_data. The
  uvcvideo driver instead stores the pointer to the driver-specific
  structure that embeds the v4l2_fh. Switch to storing the v4l2_fh pointer
  itself to standardize behaviour across drivers. This also prepares for
  future refactoring that depends on v4l2_fh being stored in private_data.

  Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan 5c64c11366 media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit f7546da1d6eb8928efb89b7faacbd6c2f8f0de5c
Author: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Fri, 11 Jul 2025 11:41:58 +0200

  Commit 6f1466123d73 ("media: s5p-mfc: Add YV12 and I420 multiplanar
  format support") added support for the new formats to s5p-mfc driver,
  what in turn required some internal calls to the v4l2_format_info()
  function while setting up formats. This in turn broke support for the
  "old" tiled NV12MT* formats, which are not recognized by this function.
  Fix this by adding those variants of NV12M pixel format to
  v4l2_format_info() function database.

  Fixes: 6f1466123d73 ("media: s5p-mfc: Add YV12 and I420 multiplanar format support")
  Cc: stable@vger.kernel.org
  Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
  Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan be5eb3e7dc media: uvcvideo: Use a count variable for meta_formats instead of 0 terminating 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit c56c437b140ed9c9e91d82f4ca705cdb021a9343
Author: Hans de Goede <hansg@kernel.org>
Date: Tue, 8 Jul 2025 12:46:22 +0200

  The code dealing with the 0 terminated meta_formats array is a bit klunky
  especially for the uvc_meta_v4l2_enum_formats() case.

  Instead of 0 terminating add an unsigned int nmeta_formats member to struct
  uvc_device and use that. This leads to slightly cleaner code.

  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Reviewed-by: Ricardo Ribalda <ribalda@chrium.org>
  Tested-by: Ricardo Ribalda <ribalda@chromium.org> # Camera with MSXU_CONTROL_METADATA
  Link: https://lore.kernel.org/r/20250708104622.73237-2-hansg@kernel.org
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:40:00 +08:00
Kate Hsuan 28c8c693bf media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 6cb786f040ad35b23b4a7bff8b9d772f22909d48
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 7 Jul 2025 18:34:05 +0000

  If the camera supports the MSXU_CONTROL_METADATA control, auto set the
  MSXU_META quirk.

  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-5-ed17f8b1218b@chromium.org
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan 73a44582d6 media: uvcvideo: Introduce V4L2_META_FMT_UVC_MSXU_1_5 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

Conflicts:
    due to a missing commit
    dc51b3cc9d4d (MAINTAINERS: update location of media main tree)

commit 2ab4019aa34dc2aec4a0824fbf1e49300884fbbf
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 7 Jul 2025 18:34:04 +0000

  The UVC driver provides two metadata types V4L2_META_FMT_UVC, and
  V4L2_META_FMT_D4XX. The only difference between the two of them is that
  V4L2_META_FMT_UVC only copies PTS, SCR, size and flags, and
  V4L2_META_FMT_D4XX copies the whole metadata section.

  Now we only enable V4L2_META_FMT_D4XX for the Intel D4xx family of
  devices, but it is useful to have the whole metadata payload for any
  device where vendors include other metadata, such as the one described by
  Microsoft:
  https://learn.microsoft.com/en-us/windows-hardware/drivers/stream/mf-capture-metadata

  This patch introduces a new format V4L2_META_FMT_UVC_MSXU_1_5, that is
  identical to V4L2_META_FMT_D4XX.

  Let the user enable this format with a quirk for now. This way they can
  test if their devices provide useful metadata without rebuilding the
  kernel. They can later contribute patches to auto-quirk their devices.
  We will also work in methods to auto-detect devices compatible with this
  new metadata format.

  Suggested-by: Hans de Goede <hdegoede@redhat.com>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-4-ed17f8b1218b@chromium.org
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan cf07a85147 media: uvcvideo: Introduce dev->meta_formats 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 0bb51c8897395de5bd5f571874130aec214ef534
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 7 Jul 2025 18:34:03 +0000

  Right now, there driver supports devices with one or two metadata
  formats. Prepare it to support more than two metadata formats.

  This is achieved with the introduction of a new field `meta_formats`,
  that contains the array of metadata formats supported by the device, in
  the order expected by userspace.

  Suggested-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-3-ed17f8b1218b@chromium.org
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan f39302a10d media: uvcvideo: Do not mark valid metadata as invalid 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit bda2859bff0b9596a19648f3740c697ce4c71496
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 7 Jul 2025 18:34:01 +0000

  Currently, the driver performs a length check of the metadata buffer
  before the actual metadata size is known and before the metadata is
  decided to be copied. This results in valid metadata buffers being
  incorrectly marked as invalid.

  Move the length check to occur after the metadata size is determined and
  is decided to be copied.

  Cc: stable@vger.kernel.org
  Fixes: 088ead2552 ("media: uvcvideo: Add a metadata device node")
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-1-ed17f8b1218b@chromium.org
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan 109980dc29 media: uvcvideo: uvc_v4l2_unlocked_ioctl: Invert PM logic 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 2acded8aa2c89b858495488f6a14cd1d04fc5784
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Tue, 1 Jul 2025 06:45:19 +0000

  Instead of listing the IOCTLs that do not need to turn on the camera,
  list the IOCTLs that need to turn it on. This makes the code more
  maintainable.

  This patch changes the behaviour for unsupported IOCTLs. Those IOCTLs
  will not turn on the camera.

  Suggested-by: Hans Verkuil <hans@jjverkuil.nl>
  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Reviewed-by: Hans Verkuil <hans@hverkuil.nl>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250701-uvc-grannular-invert-v4-7-8003b9b89f68@chromium.org
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan afc2d0f687 media: core: export v4l2_translate_cmd 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 1657624a69fcfd3f27ba6223e1c8fb6a16815568
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Tue, 1 Jul 2025 06:45:18 +0000

  video_translate_cmd() can be useful for drivers to convert between the
  VIDIOC_*32 and VIDIOC_ defines. Let's export it.

  Now that the function is exported, use this opportunity to rename the
  function with the v4l2_ prefix, that is less ambiguous than video_

  The VIDIOC_*32 defines are not accessible by the drivers, they live in
  v4l2-compat-ioctl32.c.

  Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250701-uvc-grannular-invert-v4-6-8003b9b89f68@chromium.org
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan f6de070b50 media: uvcvideo: Turn on the camera if V4L2_EVENT_SUB_FL_SEND_INITIAL 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit a03e32e60141058d46ea8cf4631654c43c740fdb
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Tue, 1 Jul 2025 06:45:17 +0000

  If we subscribe to an event with V4L2_EVENT_SUB_FL_SEND_INITIAL, the
  driver needs to report back some values that require the camera to be
  powered on. But VIDIOC_SUBSCRIBE_EVENT is not part of the ioctls that
  turn on the camera.

  We could unconditionally turn on the camera during
  VIDIOC_SUBSCRIBE_EVENT, but it is more efficient to turn it on only
  during V4L2_EVENT_SUB_FL_SEND_INITIAL, which we believe is not a common
  usecase.

  To avoid a list_del if uvc_pm_get() fails, we move list_add_tail to the
  end of the function.

  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Fixes: d1b618e79548 ("media: uvcvideo: Do not turn on the camera for some ioctls")
  Cc: stable@vger.kernel.org
  Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250701-uvc-grannular-invert-v4-5-8003b9b89f68@chromium.org
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan 59225491a4 media: uvcvideo: Remove stream->is_streaming field 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 7dd56c47784a466b03df62ca766207f483353cdc
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 16 Jun 2025 15:24:41 +0000

  The is_streaming field is used by modular PM to know if the device is
  currently streaming or not.

  With the transition to vb2 and fop helpers, we can use vb2 functions for
  the same functionality. The great benefit is that vb2 already tracks the
  streaming state for us.

  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250616-uvc-fop-v4-4-250286570ee7@chromium.org
  Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan bb2a8f22d8 media: uvcvideo: Split uvc_stop_streaming() 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit 54828c0d4f909bd706e15cfaa29758f2c1d59212
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 16 Jun 2025 15:24:40 +0000

  uvc_stop_streaming() is used for meta and video nodes. Split the function
  in two to avoid confusion.

  Use this opportunity to rename uvc_start_streaming() to
  uvc_start_streaming_video(), as it is only called by the video nodes.

  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250616-uvc-fop-v4-3-250286570ee7@chromium.org
  Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan adf0d38e2b media: uvcvideo: Handle locks in uvc_queue_return_buffers 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit b7ef53670321327f45de8bde5d38f1215927336f
Author: Ricardo Ribalda <ribalda@chromium.org>
Date: Mon, 16 Jun 2025 15:24:39 +0000

  Most of the calls to uvc_queue_return_buffers() wrap the call with
  spin_lock_irq()/spin_unlock_irq().

  Rename uvc_queue_return_buffers to __uvc_queue_return_buffers to
  indicate that this is the version that does not handle locks and create
  a new version of the function that handles the lock.

  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250616-uvc-fop-v4-2-250286570ee7@chromium.org
  Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00
Kate Hsuan 6a3ead77bf media: uvcvideo: Use vb2 ioctl and fop helpers 
JIRA: https://redhat.atlassian.net/browse/RHEL-162130

commit c93d73c9c2cfa7658f7100d201a47c4856746222
Author: Hans Verkuil <hverkuil@xs4all.nl>
Date: Mon, 16 Jun 2025 15:24:38 +0000

  When uvc was written the vb2 ioctl and file operation helpers didn't exist.

  This patch switches uvc over to those helpers, which removes a lot of
  boilerplate code and allows us to drop the 'privileges' scheme, since
  that's now handled inside the vb2 helpers.

  This makes it possible for uvc to fix the v4l2-compliance streaming tests:
   warn: v4l2-test-formats.cpp(1075): Could not set fmt2

  This patch introduces a change on behavior on the uvcdriver to be
  aligned with the rest of the subsystem. Now S_INPUT, S_PARM and
  S_FORMAT do no grant exclusive ownership of the device.

  There are other side effects, some better than others:
  - Locking is now more coarse than before, the queue is locked for almost
    every ioctl.
  - vidioc_querybuf() can now work when the queue is busy.

  Future patches should look into the locking architecture of UVC to
  remove one of stream->mutex or queue->mutex.

  Reviewed-by: Hans de Goede <hansg@kernel.org>
  Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
  Co-developed-by: Ricardo Ribalda <ribalda@chromium.org>
  Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
  Link: https://lore.kernel.org/r/20250616-uvc-fop-v4-1-250286570ee7@chromium.org
  Signed-off-by: Hans de Goede <hansg@kernel.org>
  Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

Signed-off-by: Kate Hsuan <hpa@redhat.com>
 2026-05-15 14:39:59 +08:00