`clipcount' is from userspace and thus needs validation.  Otherwise,
a large `clipcount' could overflow the vmalloc() size, leading to
out-of-bounds access.

| setup_window()
| zoran_s_fmt_vid_overlay()
| __video_do_ioctl()
| video_ioctl2()

Use 2048 as the maximum `clipcount'.  Also change the corresponding
parameter type to `unsigned int'.
Signed-off-by: NXi Wang <xi.wang@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

release_firmware() tests for NULL pointers on its own - there's no
reason to do an explicit check before calling the function.
Signed-off-by: NJesper Juhl <jj@chaosbits.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

[media] staging: as102: Remove redundant NULL check before release_firmware() and pointless comments

release_firmware() deals gracefullt with NULL pointers - it's
redundant to check for them before calling the function.

Also remove a few pointless comments - it's rather obvious from the
code that kfree() free's a buffer and that release_firmware() releases
firmware - comments just stating that add no value.
Signed-off-by: NJesper Juhl <jj@chaosbits.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

A large cs->count from userspace may overflow the allocation size,
leading to memory corruption.  try_set_ext_ctrls() can be reached
from subdev_do_ioctl() or __video_do_ioctl().

Use kmalloc_array() to avoid the overflow.
Signed-off-by: NXi Wang <xi.wang@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

A large cs->count from userspace may overflow the allocation size,
leading to memory corruption.  v4l2_g_ext_ctrls() can be reached
from subdev_do_ioctl() or __video_do_ioctl().

Use kmalloc_array() to avoid the overflow.
Signed-off-by: NXi Wang <xi.wang@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

kfifo_avail expands to __kfifo_max_r which is not an exported symbol.
Any kernel module using kfifo_avail will result in build failures
because of this.
This patch just exports __kfifo_max_r symbol to fix such problems in
future.
Reported-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NSrinivas Kandagatla <srinivas.kandagatla@st.com>
Acked-by: NStefani Seibold <stefani@seibold.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The default_value for the Bt878 V4L2_CID_CONTRAST control is currently
set to 32768. Internally this gets translated to an analog input
circuit gain of 1.19. However, the default gain should be 1.0. This
patch alters the default value to 27648 which corresponds to a gain of
1.0. It also alters the probe routine so that the correct value is
written on board initialisation.

[mchehab@redhat.com: behavior confirmed via Fusion 878a datasheet]
Signed-off-by: NAlan McIvor <alan.mcivor@reveal.co.nz>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Add support for another Medion X10 remote. This was apparently
originally used with the Medion Digitainer box, but is now sold
separately without any Digitainer labeling.

A peculiarity of this remote is a scrollwheel in place of up/down
buttons. Each direction is mapped to 8 different scancodes, each
corresponding to 1..8 notches, allowing multiple notches to the same
direction to be transmitted in a single scancode. The driver transforms
the multi-notch scancodes to multiple events of the single-notch
scancode.
(0x70..0x77 = 1..8 notches down, 0x78..0x7f = 1..8 notches up)

Since the scrollwheel scancodes are the same that are used for mouse on
some other X10 (ati_remote) remotes, the driver will now check whether
the active keymap has a keycode defined for the single-notch scancode
when a mouse/scrollwheel scancode (0x70..0x7f) is received. If set,
scrollwheel is assumed, otherwise mouse is assumed.

This remote ships with a different receiver than the already supported
Medion X10 remote, but they share the same USB ID. The only difference
in the USB descriptors is that the Digitainer receiver has the Remote
Wakeup bit set in bmAttributes of the Configuration Descriptor.
Therefore that is used to select the default keymap.

Thanks to Stephan Raue from OpenELEC (www.openelec.tv) for providing me
both a Medion X10 Digitainer remote+receiver and an already supported
Medion X10 remote+receiver. Thanks to Martin Beyss for providing some
useful information about the remote (including the "Digitainer" name).
This patch has been tested by both of them and myself.
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Tested-by: NStephan Raue <stephan@openelec.tv>
Tested-by: NMartin Beyss <Martin.Beyss@rwth-aachen.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Currently the ati_remote default keymap is selected directly based on
the USB device id.

Add support for instead specifying a function returning the default
keymap, allowing more complex selection logic to be added when needed.

This will be used for Medion X10 remotes in a following commit.
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This patch fixes following compilation warning:
Error: no ID for constraint linkend: v4l2-jpeg-chroma-subsampling.

and adds missing JPEG control class at the Table A.58.
Signed-off-by: NSylwester Nawrocki <sylvester.nawrocki@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

As long as there is no other non-const variable marked __initdata in the
same compilation unit it doesn't hurt. If there were one however
compilation would fail with

	error: $variablename causes a section type conflict

because a section containing const variables is marked read only and so
cannot contain non-const variables.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Tomasz Stanislawski <t.stanislaws@samsung.com>
Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-media@vger.kernel.org
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This patch contains code change only to remove redundant
code to set priv->crop_rect.width/height in probe function.
Signed-off-by: NLiu Ying <Ying.Liu@freescale.com>
Acked-by: NChris Lalancette <clalancette@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NEzequiel Garcia <elezegarcia@gmail.com>
[mchehab@redhat.com: Changed the default to follow the em28xx selection]
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This functions are no longer used from another file,
so they should be declared as static.
Also is it necessary to move some of them before they
are used, since they are no longer header-declared.
Signed-off-by: NEzequiel Garcia <elezegarcia@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This function is only used in em28xx-input.c so it
makes no sense to have it anywhere but in em28xx-input.c.
Signed-off-by: NEzequiel Garcia <elezegarcia@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Moving this helps isolating em28xx_input and will help
converting it into a separate module.
Signed-off-by: NEzequiel Garcia <elezegarcia@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Those functions will be needed by em28xx-input module, to be
added on the next patches.
Signed-off-by: NEzequiel Garcia <elezegarcia@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

If, in drivers/staging/media/as102/as102_fw.c::as102_fw_upload(), the call
	cmd_buf = kzalloc(MAX_FW_PKT_SIZE, GFP_KERNEL);
should fail and return NULL so that we jump to the 'error:' label,
then we'll end up calling 'release_firmware(firmware);' with
'firmware' still uninitialized - not good.

The easy fix is to just initialize 'firmware' to NULL when we declare
it, since release_firmware() deals gracefully with being passed NULL
pointers.
Signed-off-by: NJesper Juhl <jj@chaosbits.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

dev->ctl_input() is always set before a call to video_mux(),
but then video_mux() sets it again with the same value.
Signed-off-by: NEzequiel Garcia <elezegarcia@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Add PnP support to radio-gemtek for AOpen FX-3D/Pro Radio card
(AD1816 + Gemtek radio).
Signed-off-by: NOndrej Zary <linux@rainbow-software.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Add PnP support to the new ISA radio framework.
Signed-off-by: NOndrej Zary <linux@rainbow-software.org>
Reviewed-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

These two IOCTLS are obsoleted by VIDIOC_SUBDEV_G_SELECTION and
VIDIOC_SUBDEV_S_SELECTION. Mark them obsolete.
Signed-off-by: NSakari Ailus <sakari.ailus@iki.fi>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Add documentation for V4L2 subdev selection API. This changes also
experimental V4L2 subdev API so that scaling now works through selection API
only.
Signed-off-by: NSakari Ailus <sakari.ailus@iki.fi>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Add svga and dia files for V4L2 subdev selections documentation.
Signed-off-by: NSakari Ailus <sakari.ailus@iki.fi>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Get rid of several unused parameters in struct em28xx_usb_isoc_ctl.
Signed-off-by: NGianluca Gennari <gennarone@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Stop the URBs in em28xx_stop_streaming(), so that em28xx_irq_callback()
cannot be called after the streaming has stopped.

This should eliminate the crashes reported by Antti Palosaari and the warnings
reported by Andy Furniss.
Signed-off-by: NGianluca Gennari <gennarone@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This patch removes the non-required spinlock acquire/release calls on
'queue_irqlock' from 'uvc_queue_next_buffer' routine.

This routine is called from 'video->encode' function (which translates to either
'uvc_video_encode_bulk' or 'uvc_video_encode_isoc') in 'uvc_video.c'.
As, the 'video->encode' routines are called with 'queue_irqlock' already held,
so acquiring a 'queue_irqlock' again in 'uvc_queue_next_buffer' routine causes
a spin lock recursion.
Signed-off-by: NBhupesh Sharma <bhupesh.sharma@st.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NKonstantin Khlebnikov <khlebnikov@openvz.org>
Cc: linux-media@vger.kernel.org
Cc: devel@driverdev.osuosl.org
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: John Stultz <john.stultz@linaro.org>
Cc: "Arve Hjønnevåg" <arve@android.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

copy_in_user() already checks for write permission, so we don't need to
do it here.  This was added in 1a5e4c86 "[media] uvcvideo: Implement
compat_ioctl32 for custom ioctls".
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This patch removes BUG_ON in ir_raw_event_thread which IMO is a
over-kill, and this kills the ir_raw_event_thread too. With a bit of
additional logic in this patch, we nomore need to kill this thread.
Other disadvantage of having a BUG-ON is,
wake_up_process(dev->raw->thread) called on dead thread via
ir_raw_event_handle will result in total lockup in SMP system.

Advantage of this patch is ir-raw event thread is left in a usable state
even if the fifo does not have enough bytes.

This patch sets the thread into TASK_INTERRUPTIBLE if raw-fifo has less
then sizeof(struct ir_raw_event) bytes.
Signed-off-by: NSrinivas Kandagatla <srinivas.kandagatla@st.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Userptr can be very useful if this device
is requested to use video buffers allocated
by another processing device. So that
buffers don't need to be copied.
Signed-off-by: NJavier Martin <javier.martin@vista-silicon.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The lirc sasem and imon drivers now use the module_usb_driver macro, so the old
init/exit function prototypes are useless.

This patch eliminates this warnings:

media_build/v4l/lirc_imon.c:74:19: warning: 'imon_init' declared 'static' but never defined [-Wunused-function]
media_build/v4l/lirc_imon.c:75:20: warning: 'imon_exit' declared 'static' but never defined [-Wunused-function]
media_build/v4l/lirc_sasem.c:84:19: warning: 'sasem_init' declared 'static' but never defined [-Wunused-function]
media_build/v4l/lirc_sasem.c:85:20: warning: 'sasem_exit' declared 'static' but never defined [-Wunused-function]
Signed-off-by: NGianluca Gennari <gennarone@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

In this driver there are several entities associated with separate
platform or I2C client devices, which may get probed in random order.

When the platform device bound to the media device driver is probed
all other entity drivers need to be already in place and initialized.
If any of them is not, fail the media device probe and return an error
indicating we need to be retried once any new driver gets registered.
The media device driver probe will not succeed until there are available
all needed sub-drivers, as specified in the platform data.

While at it, make sure the s5p-csis module (MIPI-CSI receiver driver)
does not get unloaded when in use, by guarding its usage with
try_module_get/module_put.

This patch is a prerequisite for adding the device tree support.
It now also allows again to unbind/bind the driver at runtime from
user space via sysfs.
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

irq is used only locally and num_clocks is constant, so remove them.
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Remove redundant H/W setup logic by merging fimc_prepare_config()
and the device_run() callback.
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Access to the memory-to-memory video node is serialized through a
mutex so now there is no point in having per device context structure
spinlock.
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This patch prevents blocking on DQBUF at a video capture node in some
conditions, after STREAOMOFF/STREAMON sequence. The ST_CAPT_SUSPEND
flag should not be set during normal stream off, otherwise the
capture engine is not properly enabled at stream on.
Reported-by: NBernard Debbasch <b.debbasch@ssi.samsung.com>
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The MIPI-CSI2 data alignment parameter can be derived from media bus
pixel code, so it can be now dropped from the platform data structure.
This is a prerequisite for adding the device tree support. Once this
patch is merged the corresponding fields will be removed from the
drivers' public headers and corresponding board files.
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Fall back to s_selection if s_crop isn't implemented by a driver. Same for
g_selection / g_crop.
Signed-off-by: NSakari Ailus <sakari.ailus@iki.fi>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Unify functions to get try pointers and validate the pad number accessed by
the user.
Signed-off-by: NSakari Ailus <sakari.ailus@iki.fi>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>