Unregistering the i2c_client of the demod driver destroys the frontend
object.
Calling vb2_dvb_unregister_bus later accesses the frontend (and with the
refcount_t) conversion the refcount_t code complains:

kernel: ------------[ cut here ]------------
kernel: WARNING: CPU: 0 PID: 7883 at lib/refcount.c:128 refcount_sub_and_test+0x70/0x80
kernel: refcount_t: underflow; use-after-free.
kernel: Modules linked in: bluetooth si2165(O) a8293(O) tda10071(O) tea5767(O) tuner(O) cx23885(O-) tda18271(O) videobuf2_dvb(O) videobuf2_dma_sg(O) m88ds3103(O) tveeprom(O) cx2341x(O) v4l2_common(O) dvb_core(O) rc_core(O) videobuf2_memops(O) videobuf2_v4l2(O) ums_realtek videobuf2_core(O) uas videodev(O) media(O) rtl8192cu i2c_mux usb_storage rtl_usb rtl8192c_common rtlwifi snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core x86_pkg_temp_thermal kvm_intel kvm irqbypass
kernel: CPU: 0 PID: 7883 Comm: rmmod Tainted: G        W  O    4.11.3-gentoo #3
kernel: Hardware name: MEDION E2050 2391/H81H3-EM2, BIOS H81EM2W08.308 08/25/2014
kernel: Call Trace:
kernel:  dump_stack+0x4d/0x66
kernel:  __warn+0xc6/0xe0
kernel:  warn_slowpath_fmt+0x46/0x50
kernel:  ? kobject_put+0x2f/0x60
kernel:  refcount_sub_and_test+0x70/0x80
kernel:  refcount_dec_and_test+0x11/0x20
kernel:  dvb_unregister_frontend+0x42/0x60 [dvb_core]
kernel:  vb2_dvb_dealloc_frontends+0x9e/0x100 [videobuf2_dvb]
kernel:  vb2_dvb_unregister_bus+0xd/0x20 [videobuf2_dvb]
kernel:  cx23885_dvb_unregister+0xc3/0x110 [cx23885]
kernel:  cx23885_dev_unregister+0xea/0x150 [cx23885]
kernel:  cx23885_finidev+0x4f/0x70 [cx23885]
kernel:  pci_device_remove+0x34/0xb0
kernel:  device_release_driver_internal+0x150/0x200
kernel:  driver_detach+0x33/0x70
kernel:  bus_remove_driver+0x47/0xa0
kernel:  driver_unregister+0x27/0x50
kernel:  pci_unregister_driver+0x34/0x90
kernel:  cx23885_fini+0x10/0x12 [cx23885]
kernel:  SyS_delete_module+0x166/0x220
kernel:  ? exit_to_usermode_loop+0x7b/0x80
kernel:  entry_SYSCALL_64_fastpath+0x17/0x98
kernel: RIP: 0033:0x7f5901680b07
kernel: RSP: 002b:00007ffdf6cdb028 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
kernel: RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5901680b07
kernel: RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000000001500258
kernel: RBP: 00000000015001f0 R08: 0000000000000000 R09: 1999999999999999
kernel: R10: 0000000000000884 R11: 0000000000000206 R12: 00007ffdf6cda010
kernel: R13: 0000000000000000 R14: 00000000015001f0 R15: 00000000014ff010
kernel: ---[ end trace c3a4659b89086061 ]---
Signed-off-by: NMatthias Schwarzott <zzam@gentoo.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These clamp_t() calls are no-ops because we don't save the results.  It
leads to an array out of bounds bug.

Fixes: a49d2536 ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Do not include the paragraph about writing to the Free Software
Foundation's mailing address from the sample GPL notice. The FSF has
changed addresses in the past, and may do so again. Linux already includes
a copy of the GPL.

remove the unnecessary paragraph
Signed-off-by: NHarold Gomez <haroldgmz11@gmail.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Making some functions 'static' has uncovered a few functions that
have no caller, through the gcc warnings:

atomisp/i2c/imx/imx.c:1111:12: error: 'imx_t_focus_vcm' defined but not used [-Werror=unused-function]
atomisp/i2c/imx/imx.c:1103:12: error: 'imx_vcm_init' defined but not used [-Werror=unused-function]
atomisp/i2c/imx/imx.c:1095:12: error: 'imx_vcm_power_down' defined but not used [-Werror=unused-function]
atomisp/i2c/imx/imx.c:1087:12: error: 'imx_vcm_power_up' defined but not used [-Werror=unused-function]

All four of these can be removed. Since they call indirect functions,
I also looked at how those are used in turn:

- The power_up/power_down callbacks are called from other functions
  and are still needed.

- The t_focus_vcm callbacks pointers are completely unused and can
  be removed in both imx and ov8858. Some of the handlers are called
  directly and can now be marked static, the others are dummy
  implemntations that we can remove.

- vcm_init is unused in imx, but dw9718_vcm_init is used in ov8858,
  but is not used in imx, so that one needs to stay around. The callback
  pointers in imx can be removed.

Fixes: 9a5a6911 ("staging: imx: fix non-static declarations")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add the as3645a flash controller to the DT source.
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: NSebastian Reichel <sebastian.reichel@collabora.co.uk>
Acked-by: NPavel Machek <pavel@ucw.cz>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add a LED flash class driver for the as3654a flash controller. A V4L2 flash
driver for it already exists (drivers/media/i2c/as3645a.c), and this driver
is based on that.
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: NJacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Document DT bindings for Analog Devices as3645a flash LED controller which
also supports an indicator LED.
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: NJacek Anaszewski <jacek.anaszewski@gmail.com>
Acked-by: NRob Herring <robh@kernel.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The v4l2_flash_init() keeps a reference to the ops struct but not to the
config struct (nor anything it contains). Document this.
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: NPavel Machek <pavel@ucw.cz>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The V4L2 flash interface allows controlling multiple LEDs through a single
sub-devices if, and only if, these LEDs are of different types. This
approach scales badly for flash controllers that drive multiple flash LEDs
or for LED specific associations. Essentially, the original assumption of a
LED driver chip that drives a single flash LED and an indicator LED is no
longer valid.

Address the matter by registering one sub-device per LED.
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: NJacek Anaszewski <jacek.anaszewski@gmail.com>
Acked-by: NPavel Machek <pavel@ucw.cz>
Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> (for greybus/light)
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

We are allocating memory for the v4l2 flash configuration structure and
leak it in the normal path. Just use the stack for this as we do not
use it outside of this function.

Also use IS_ERR() instead of IS_ERR_OR_NULL() to check return value from
v4l2_flash_init() for it never returns NULL.

Fixes: 2870b52b ("greybus: lights: add lights implementation")
Reported-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NRui Miguel Silva <rmfrfs@gmail.com>
Reviewed-by: NViresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Solve the following issues:

	Documentation/media/uapi/v4l/dev-sliced-vbi.rst:208: ERROR: Content block expected for the "raw" directive; none found.
	Documentation/media/uapi/v4l/dev-sliced-vbi.rst:216: ERROR: Content block expected for the "raw" directive; none found.
	Documentation/media/uapi/v4l/pixfmt-packed-rgb.rst:645: ERROR: Content block expected for the "raw" directive; none found.

Fixes: 70b074df ("media: fix pdf build with Spinx 1.6")
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Check memory allocation failure and return -ENOMEM in such a case.
Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

A debug printk statement was copied incorrectly into the new
csi1 parser code and causes a warning there:

drivers/media/platform/omap3isp/isp.c: In function 'isp_probe':
include/linux/dynamic_debug.h:134:3: error: 'i' may be used uninitialized in this function [-Werror=maybe-uninitialized]

Since there is only one lane, the index is never set. This
changes the debug print to always print a zero instead,
keeping the original format of the message.

Fixes: 9211434b ("media: omap3isp: Parse CSI1 configuration from the device tree")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Reviewed-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: NSebastian Reichel <sebastian.reichel@collabora.co.uk>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Sphinx 1.6 generates some LaTeX code before each table,
starting its own environment before calling tabulary,
apparently to improve table layout.

The problem is that such environment is incompatible with
adjustbox. While, in thesis, it should be possible to override
it or to redefine tabulary, I was unable to produce such patch.

Also, that would likely break on some future Sphinx version.

So, instead, let's just change the font size on bigger tables,
in order for them to fit into the page size. That is not as
good as adjustbox, and require some manual work, but it should
be less sensitive to Sphinx changes.

While here, adjust a few other tables whose text is exceeding
the cell boundaries.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

As reported by smatch:

	drivers/media/platform/qcom/camss-8x16/camss-vfe.c:1136 vfe_release_wm() error: buffer overflow 'vfe->wm_output_map' 7 <= 7
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fix those warnings when building on i386:

	drivers/media/platform/qcom/camss-8x16/camss-csiphy.c:333:22: warning: constant 1000000000000 is so big it is long long
	drivers/media/platform/qcom/camss-8x16/camss-csiphy.c:339:32: warning: constant 1000000000000 is so big it is long long
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add abbreviations explanation at the top header blocks in source files.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add explanations for VFE's PIX and RDI interfaces.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Update the Qualcomm Camera Subsystem driver document with a media
controller pipeline graph diagram.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Use standard V4L2 control to get pixel clock rate from a sensor
linked in the media controller pipeline. Then calculate clock
rates on CSIPHY, CSID and VFE to use the lowest possible.

If the currnet pixel clock rate of the sensor cannot be read then
use the highest possible. This case covers also the CSID test
generator usage.

If VFE is already powered on by another pipeline, check that the
current VFE clock rate is high enough for the new pipeline.
If not return busy error code as VFE clock rate cannot be changed
while VFE is running.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Update the Qualcomm Camera Subsystem driver document for VFE scale
and crop modules support.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add crop module configuration support to be able to apply cropping.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Extend selection ioctls to handle cropping configuration.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add scaler module configuration support to be able to apply scaling.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add compose selection ioctls to handle scaling configuration.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add support for horizontal and vertical frame padding.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Update Qualcomm Camera Subsystem driver document for the PIX interface
and format conversion support.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Use VFE PIX input interface and do format conversion in VFE.

Supported input format is UYVY (single plane YUV 4:2:2) and
its different sample order variations.

Supported output formats are:
- NV12/NV21 (two plane YUV 4:2:0)
- NV16/NV61 (two plane YUV 4:2:2)
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add Makefile and update platform/Kconfig and platform/Makefile
to enable building of the QCom CAMSS driver.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These files implement the platform driver code.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These files handle the video device nodes of the camss driver.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These files control the VFE module. The VFE has different input
interfaces. The PIX input interface feeds the input data to an image
processing pipeline. Three RDI input interfaces bypass the image
processing pipeline. The VFE also contains the AXI bus interface which
writes the output data to memory.

RDI interfaces are supported in this version. PIX interface is not
supported.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These files control the ISPIF module which handles the routing of the data
streams from the CSIDs to the inputs of the VFE.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These files control the CSID modules which handle the protocol and
application layer of the CSI2 receivers.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These files control the CSIPHY modules which are responsible for the
physical layer of the CSI2 receivers.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add a document to describe Qualcomm Camera Subsystem driver.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add an entry for Qualcomm Camera subsystem driver.
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add DT binding document for Qualcomm Camera subsystem driver.

CC: Rob Herring <robh+dt@kernel.org>
CC: devicetree@vger.kernel.org
Signed-off-by: NTodor Tomov <todor.tomov@linaro.org>
Acked-by: NRob Herring <robh@kernel.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These formats are compressed 12-bit raw bayer formats with four different
pixel orders. They are similar to 10-bit variants. The formats added by
this patch are

	V4L2_PIX_FMT_SBGGR12P
	V4L2_PIX_FMT_SGBRG12P
	V4L2_PIX_FMT_SGRBG12P
	V4L2_PIX_FMT_SRGGB12P
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Call function v4l2_m2m_dst_buf_remove_by_buf() instead of
v4l2_m2m_src_buf_remove_by_buf()

Addresses-Coverity-ID: 1415317
Signed-off-by: NGustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: NStanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: NHans Verkuil <hansverk@cisco.com>
Cc: <stable@vger.kernel.org>      # for v4.13
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>