user/sven/linux.git/drivers/media/platform/amphion, branch master

media: amphion: Fix race between m2m job_abort and device_run

2026-03-23T10:18:34Z

Fix kernel panic caused by race condition where v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run with the same context. Race sequence: v4l2_m2m_try_run(): v4l2_m2m_ctx_release(): lock/unlock v4l2_m2m_cancel_job() job_abort() v4l2_m2m_job_finish() kfree(m2m_ctx) <- frees ctx device_run() <- use-after-free crash at 0x538 Crash trace: Unable to handle kernel read from unreadable memory at virtual address 0000000000000538 v4l2_m2m_try_run+0x78/0x138 v4l2_m2m_device_run_work+0x14/0x20 The amphion vpu driver does not rely on the m2m framework's device_run callback to perform encode/decode operations. Fix the race by preventing m2m framework job scheduling entirely: - Add job_ready callback returning 0 (no jobs ready for m2m framework) - Remove job_abort callback to avoid the race condition Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Cc: stable@vger.kernel.org Signed-off-by: Ming Qian Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51Z

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28Z

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

media: amphion: Drop min_queued_buffers assignment

2026-01-13T08:41:59Z

The min_queued_buffers field controls when start_streaming() is called by the vb2 core (it delays the callback until at least N buffers are queued). Setting it to 1 affects the timing of start_streaming(), which breaks the seek flow in decoder scenarios and causes test failures. The current driver implementation does not rely on this minimum buffer requirement and handles streaming start correctly with the default value of 0, so remove these assignments. Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Cc: stable@vger.kernel.org Signed-off-by: Ming Qian Reviewed-by: Nicolas Dufresne Reviewed-by: Frank Li Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: amphion: Use kmalloc instead of vmalloc

2026-01-13T08:41:59Z

Replace vmalloc/vfree with kmalloc/kfree for allocating small driver structures (vpu_inst, vdec_t, venc_t, vpu_cmd_t, and frame objects). vmalloc() is designed for large memory allocations and incurs unnecessary overhead for small objects due to virtual memory mapping. kmalloc() is more appropriate as it allocates physically contiguous memory with lower overhead. ftrace measurements of vpu_alloc_cmd() show significant improvement: Before (vmalloc): 35-72 us (avg ~45.7 us) After (kmalloc): 11-26 us (avg ~16.8 us) This reduces allocation time by approximately 63%. No functional changes are intended. Signed-off-by: Ming Qian Reviewed-by: Nicolas Dufresne Reviewed-by: Frank Li Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: amphion: Trigger source change if colorspace changed

2026-01-13T08:41:59Z

After encountering a colorspace change in the stream, the decoder sends a V4L2_EVENT_SOURCE_CHANGE event with changes set to V4L2_EVENT_SRC_CH_RESOLUTION. Then the client can detect and handle the colorspace change without any buffer reallocation Signed-off-by: Ming Qian Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START

2026-01-13T08:41:59Z

The V4L2_DEC_CMD_START command may be used to handle the dynamic source change, which will triggers an implicit decoder drain. The last_buffer_dequeued flag is set in the implicit decoder drain, so driver need to clear it to continue the following decoding flow. Signed-off-by: Ming Qian Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: Use of_reserved_mem_region_to_resource() for "memory-region"

2025-11-06T10:18:09Z

Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Reviewed-by: Dikshita Agarwal Reviewed-by: Ming Qian Signed-off-by: Rob Herring (Arm) Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: amphion: Remove dummy PM handling

2025-11-03T14:58:41Z

Since commit 63d00be69348fda4 ("PM: runtime: Allow unassigned ->runtime_suspend|resume callbacks"), unassigned .runtime_{suspend,resume}() callbacks are treated the same as dummy callbacks that just return zero. Unassigned system sleep callbacks were always treated the same as dummy callbacks that just return zero. As the driver has no other PM callbacks than dummy callbacks, all PM handling can be removed. Signed-off-by: Geert Uytterhoeven Reviewed-by: Ming Qian Signed-off-by: Hans Verkuil

media: amphion: Cancel message work before releasing the VPU core

2025-10-20T07:23:17Z

To avoid accessing the VPU register after release of the VPU core, cancel the message work and destroy the workqueue that handles the VPU message before release of the VPU core. Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Cc: stable@vger.kernel.org Signed-off-by: Ming Qian Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil