drop VPFE_CMD_S_CCDC_RAW_PARAMS ioctl from dm355/dm644x following reasons:

- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t
  numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is
  described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user
  the user input over the kernel settings, and then compare them
  for inequality.
- We then go on to use an address provided by user space as both the
  __user pointer for input and pass it through phys_to_virt to come up
  with a kernel pointer to copy the data to. This looks like a trivially
  exploitable root hole.
Signed-off-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

this patch makes sure VPFE_CMD_S_CCDC_RAW_PARAMS ioctl no longer works
for vpfe_capture driver with a minimal patch suitable for backporting.

- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t
  numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is
  described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user
  the user input over the kernel settings, and then compare them
  for inequality.
- We then go on to use an address provided by user space as both the
  __user pointer for input and pass it through phys_to_virt to come up
  with a kernel pointer to copy the data to. This looks like a trivially
  exploitable root hole.

Due to these reasons we make sure this ioctl now returns -EINVAL and backport
this patch as far as possible.

Fixes: 5f15fbb6 ("V4L/DVB (12251): v4l: dm644x ccdc module for vpfe capture driver")
Signed-off-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Cc: <stable@vger.kernel.org>      # for v3.7 and up
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fix to avoid possible memory leak if the decoder initialization got failed.
Free the allocated memory for file handle object before return in case
decoder initialization fails.
Signed-off-by: NShailendra Verma <shailendra.v@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Drop the FSF's postal address from the source code files that typically
contain mostly the license text. Of the 628 removed instances, 578 are
outdated.

The patch has been created with the following command without manual edits:

git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \
	drivers/media/ include/media|while read i; do i=$i perl -e '
open(F,"< $ENV{i}");
$a=join("", <F>);
$a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m
	&& $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m;
close(F);
open(F, "> $ENV{i}");
print F $a;
close(F);'; done
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>

A recent cleanup had the right idea to remove the initialization
of the error variable, but missed the actual benefit of that,
which is that we get warnings if there is a bug in it. Now
we get a warning about a bug that was introduced by this cleanup:

drivers/media/platform/davinci/vpfe_capture.c: In function 'vpfe_probe':
drivers/media/platform/davinci/vpfe_capture.c:1992:9: error: 'ret' may be used uninitialized in this function [-Werror=maybe-uninitialized]

This adds the missing initialization that the warning is about,
and another one that was preexisting and that we did not get
a warning for. That second bug has existed since the driver
was first added.

Fixes: efb74461 ("[media] DaVinci-VPFE-Capture: Delete an unnecessary variable initialisation in vpfe_probe()")
Fixes: 7da8a6cb ("V4L/DVB (12248): v4l: vpfe capture bridge driver for DM355 and DM6446")

[mchehab@s-opensource.com: fix a merge conflict]
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

davinci/vpfe_capture.c: In function 'vpfe_probe':
davinci/vpfe_capture.c:1992:9: warning: 'ret' may be used uninitialized
in this function [-Wmaybe-uninitialized]
   return ret;
          ^~~

This is indeed correct, so if the kmalloc fails set ret to -ENOMEM.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Use a direct assignment for an array element which can be set over the
pointer variable "inp" instead of calling the function "memcpy" here.
Suggested-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

[media] DaVinci-VPFE-Capture: Delete an unnecessary return statement in vpfe_unregister_ccdc_device()

The script "checkpatch.pl" pointed information out like the following.

WARNING: void function return statements are not generally useful

Thus remove such a statement here.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Do not use curly brackets at one source code place
where a single statement should be sufficient.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Move assignments for two local variables into an else branch so that
their setting will only be performed after corresponding data processing
succeeded by this function.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The local variable "ret" will be set to an appropriate value a bit later.
Thus omit the explicit initialisation at the beginning.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Convert comparisons with the preprocessor symbol "NULL" to condition checks
without it.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Replace the specification of a data structure by a pointer dereference
as the parameter for the operator "sizeof" to make the corresponding size
determination a bit safer.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

* Return an error code as a constant after a failed call of
  the function "vpfe_initialize".

* The local variable "ret" will be set then to an appropriate value
  a bit later. Thus omit the explicit initialisation at the beginning.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Replace the specification of a data structure by a pointer dereference
as the parameter for the operator "sizeof" to make the corresponding size
determination a bit safer.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The script "checkpatch.pl" pointed information out like the following.

WARNING: Possible unnecessary 'out of memory' message

Thus remove such a logging statement in two functions.

Link: http://events.linuxfoundation.org/sites/events/files/slides/LCJ16-Refactor_Strings-WSang_0.pdfSigned-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

* A multiplication for the size determination of a memory allocation
  indicated that an array data structure should be processed.
  Thus use the corresponding function "kmalloc_array".

  This issue was detected by using the Coccinelle software.

* Replace the specification of a data type by a pointer dereference
  to make the corresponding size determination a bit safer according to
  the Linux coding style convention.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Due to the 80-cols restrictions, and latter due to checkpatch
warnings, several strings were broken into multiple lines. This
is not considered a good practice anymore, as it makes harder
to grep for strings at the source code.

As we're right now fixing other drivers due to KERN_CONT, we need
to be able to identify what printk strings don't end with a "\n".
It is a way easier to detect those if we don't break long lines.

So, join those continuation lines.

The patch was generated via the script below, and manually
adjusted if needed.

</script>
use Text::Tabs;
while (<>) {
	if ($next ne "") {
		$c=$_;
		if ($c =~ /^\s+\"(.*)/) {
			$c2=$1;
			$next =~ s/\"\n$//;
			$n = expand($next);
			$funpos = index($n, '(');
			$pos = index($c2, '",');
			if ($funpos && $pos > 0) {
				$s1 = substr $c2, 0, $pos + 2;
				$s2 = ' ' x ($funpos + 1) . substr $c2, $pos + 2;
				$s2 =~ s/^\s+//;

				$s2 = ' ' x ($funpos + 1) . $s2 if ($s2 ne "");

				print unexpand("$next$s1\n");
				print unexpand("$s2\n") if ($s2 ne "");
			} else {
				print "$next$c2\n";
			}
			$next="";
			next;
		} else {
			print $next;
		}
		$next="";
	} else {
		if (m/\"$/) {
			if (!m/\\n\"$/) {
				$next=$_;
				next;
			}
		}
	}
	print $_;
}
</script>
Acked-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This is part of a final push to convert all drivers to g/s_selection.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Cc: Prabhakar Lad <prabhakar.csengg@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The g_mbus_fmt video op is a duplicate of the pad op. Replace all uses
by the get_fmt pad op and remove the video op.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Acked-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: NPrabhakar Lad <prabhakar.csengg@gmail.com>
Cc: Kamil Debski <k.debski@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Embed the video_device struct to simplify the error handling and in
order to (eventually) get rid of video_device_alloc/release.
Signed-off-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Querycap shouldn't set the version field (the core does that for you),
but it should set the device_caps field.

In addition, remove the CAPTURE and OUTPUT caps for M2M devices. These
were already slated for removal, so it's time to do so.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Acked-by: NKamil Debski <k.debski@samsung.com>
Acked-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Acked-by: NJacek Anaszewski <j.anaszewski@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

In order to have subsytem agnostic media bus format definitions we've
moved media bus definition to include/uapi/linux/media-bus-format.h and
prefixed values with MEDIA_BUS_FMT instead of V4L2_MBUS_FMT.

Reference new definitions in all platform drivers.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: NSekhar Nori <nsekhar@ti.com>
Acked-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

A platform_driver does not need to set an owner, it will be populated by the
driver core.
Signed-off-by: NWolfram Sang <wsa@the-dreams.de>

We don't need to check "ret", we know it's zero.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

make vpfe_standards[] static.
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Instead of allocating a var to store 0 and just return it,
change the code to return 0 directly.
Acked-by: N"Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>

Shut up several warnings about invalid casting when printing
the values of two pointers.
Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>

Since all the drivers that use `struct v4l2_fh' use the core
priority checking, the setting of the flag in the drivers can
be removed.
Signed-off-by: NRamakrishnan Muthukrishnan <ramakrmu@cisco.com>
Reviewed-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>

The g_std and s_std operations are video-related, move them to the video
ops where they belong.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Acked-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>

This patch migrates the vpfe driver to use v4l2_fh for
priority handling.
Signed-off-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>

this patch makes sure that it terminates if any IO in
progress and also makes sure that all the buffers are unmapped.
It was observed that with several runs of application the application
sometimes failed to allocate memory, This patch makes sure it
all the buffers are released.

Using kmemleak it was found that buffer were not released, this patch
fixes following issue,

 echo scan > /sys/kernel/debug/kmemleak
  Kernel message reads:
      memleak: 3 new suspected memory leaks (see /sys/kernel/debug/kmemleak)

Then,
     cat /sys/kernel/debug/kmemleak

  unreferenced object 0xc564a480 (size 192):
  comm "mttest", pid 764, jiffies 4294945878 (age 487.160s)
  hex dump (first 32 bytes):
    00 00 00 00 28 07 07 20 d0 02 00 00 e0 01 00 00  ....(.. ........
    00 00 00 00 00 64 05 00 01 00 00 00 01 00 00 00  .....d..........
  backtrace:
    [<c00a98dc>] create_object+0x10c/0x28c
    [<c03ba8ec>] kmemleak_alloc+0x3c/0x70
    [<c00a67c0>] __kmalloc+0x11c/0x1d4
    [<c02b6f48>] __videobuf_alloc+0x1c/0x3c
    [<c02b6194>] videobuf_alloc_vb+0x38/0x80
    [<c02b6638>] __videobuf_mmap_setup+0x9c/0x108
    [<c02b6da0>] videobuf_reqbufs.part.10+0x12c/0x1bc
    [<c02b6e9c>] videobuf_reqbufs+0x6c/0x8c
    [<c02be2c4>] vpfe_reqbufs+0xcc/0x130
    [<c02aae90>] v4l_reqbufs+0x50/0x54
    [<c02aab54>] __video_do_ioctl+0x260/0x2c4
    [<c02a9dd4>] video_usercopy+0xf0/0x310
    [<c02aa008>] video_ioctl2+0x14/0x1c
    [<c02a562c>] v4l2_ioctl+0x104/0x14c
    [<c00bd320>] do_vfs_ioctl+0x80/0x2d0
    [<c00bd5b4>] SyS_ioctl+0x44/0x64
unreferenced object 0xc564ac00 (size 192):
  comm "mttest", pid 764, jiffies 4294945878 (age 487.160s)
  hex dump (first 32 bytes):
    01 00 00 00 28 07 07 20 d0 02 00 00 e0 01 00 00  ....(.. ........
    00 00 00 00 00 64 05 00 01 00 00 00 01 00 00 00  .....d..........
  backtrace:
    [<c00a98dc>] create_object+0x10c/0x28c
    [<c03ba8ec>] kmemleak_alloc+0x3c/0x70
    [<c00a67c0>] __kmalloc+0x11c/0x1d4
    [<c02b6f48>] __videobuf_alloc+0x1c/0x3c
    [<c02b6194>] videobuf_alloc_vb+0x38/0x80
    [<c02b6638>] __videobuf_mmap_setup+0x9c/0x108
    [<c02b6da0>] videobuf_reqbufs.part.10+0x12c/0x1bc
    [<c02b6e9c>] videobuf_reqbufs+0x6c/0x8c
    [<c02be2c4>] vpfe_reqbufs+0xcc/0x130
    [<c02aae90>] v4l_reqbufs+0x50/0x54
    [<c02aab54>] __video_do_ioctl+0x260/0x2c4
    [<c02a9dd4>] video_usercopy+0xf0/0x310
    [<c02aa008>] video_ioctl2+0x14/0x1c
    [<c02a562c>] v4l2_ioctl+0x104/0x14c
    [<c00bd320>] do_vfs_ioctl+0x80/0x2d0
    [<c00bd5b4>] SyS_ioctl+0x44/0x64
unreferenced object 0xc564a180 (size 192):
  comm "mttest", pid 764, jiffies 4294945880 (age 487.140s)
  hex dump (first 32 bytes):
    02 00 00 00 28 07 07 20 d0 02 00 00 e0 01 00 00  ....(.. ........
    00 00 00 00 00 64 05 00 01 00 00 00 01 00 00 00  .....d..........
  backtrace:
    [<c00a98dc>] create_object+0x10c/0x28c
    [<c03ba8ec>] kmemleak_alloc+0x3c/0x70
    [<c00a67c0>] __kmalloc+0x11c/0x1d4
    [<c02b6f48>] __videobuf_alloc+0x1c/0x3c
    [<c02b6194>] videobuf_alloc_vb+0x38/0x80
    [<c02b6638>] __videobuf_mmap_setup+0x9c/0x108
    [<c02b6da0>] videobuf_reqbufs.part.10+0x12c/0x1bc
    [<c02b6e9c>] videobuf_reqbufs+0x6c/0x8c
    [<c02be2c4>] vpfe_reqbufs+0xcc/0x130
    [<c02aae90>] v4l_reqbufs+0x50/0x54
    [<c02aab54>] __video_do_ioctl+0x260/0x2c4
    [<c02a9dd4>] video_usercopy+0xf0/0x310
    [<c02aa008>] video_ioctl2+0x14/0x1c
    [<c02a562c>] v4l2_ioctl+0x104/0x14c
    [<c00bd320>] do_vfs_ioctl+0x80/0x2d0
    [<c00bd5b4>] SyS_ioctl+0x44/0x64
Reported-by: NJimmy Ho <jimmygge@gmail.com>
Signed-off-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>

This patch proposes to remove the IRQF_DISABLED flag from
davinci media platform drivers.
It's a NOOP since 2.6.35 and it will be removed one day.
Signed-off-by: NMichael Opdenacker <michael.opdenacker@free-electrons.com>
Acked-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>

Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The error path on failure was calling mutex_unlock(), but there was
no actuall call before for mutex_lock(). This patch fixes this issue
by pointing it to proper go label.
Reported-by: NJose Pablo Carballo <jose.carballo@ridgerun.com>
Signed-off-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

ioctl's number is unsigned int. Fix it at vidioc_default.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This ioctl is defined as IOW, so pass the argument by value instead of by
reference. I could have chosen to add const instead, but this is 1) easier
to handle in drivers and 2) consistent with the s_std subdev operation.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NJonathan Corbet <corbet@lwn.net>
Acked-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: NLad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Since vpfe_capture already provided a g_std op setting current_norm
does not actually do anything. Remove it.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Acked-by: NLad, Prabhakar <prabhakar.lad@ti.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Acked-by: NLad, Prabhakar <prabhakar.lad@ti.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

CONFIG_HOTPLUG is going away as an option.  As a result, the __dev*
markings need to be removed.

This change removes the use of __devinit, __devexit_p, __devinitdata,
__devinitconst, and __devexit from these drivers.

Based on patches originally written by Bill Pemberton, but redone by me
in order to handle some of the coding style issues better, by hand.

Cc: Bill Pemberton <wfp5p@virginia.edu>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>