Add the missing endianness conversions to a debug call printing the
USB device-descriptor idVendor and idProduct fields during probe.
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The VIDIOC_G/S_EDID ioctls can return valid data even if an error is returned.

Mark those ioctls accordingly. Rather than using an explicit 'if' to check for the
ioctl (as was done until now for VIDIOC_QUERY_DV_TIMINGS) just set a new flag in the
v4l2_ioctls array.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

In 'commit 295ab497 ("[media] media: platform: pxa_camera: make
printk consistent")' a pointer to the device structure in
mclk_get_divisor() was changed to pcdev_to_dev(pcdev). The pointer used
by pcdev_to_dev() is still uninitialized during the call to
mclk_get_divisor() as it happens in v4l2_device_register() at the end
of the probe. The dev_warn and dev_dbg caused a line in the log:

	(NULL device *): Limiting master clock to 26000000

Fix this by using an initialized pointer from the platform_device
(as before the old patch).
Signed-off-by: NPetr Cvek <petr.cvek@tul.cz>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The v4l2-compliance complains about nonexistent vidioc_subscribe_event
and vidioc_unsubscribe_event calls. Add them to fix the complaints.
Signed-off-by: NPetr Cvek <petr.cvek@tul.cz>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

During the transfer from the soc_camera a test in pxa_mbus_image_size()
got removed. Without it any PXA_MBUS_LAYOUT_PACKED format causes either
the return of a wrong value (PXA_MBUS_PACKING_2X8_PADHI doubles
the correct value) or EINVAL (PXA_MBUS_PACKING_NONE and
PXA_MBUS_PACKING_EXTEND16). This was observed in an error from the ffmpeg
(for some of the YUYV subvariants).

This patch re-adds the same test as in soc_camera version.
Signed-off-by: NPetr Cvek <petr.cvek@tul.cz>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch adds Bayer 8 GBRG and RGGB support and move GRBG definition
close to BGGR (so all Bayer 8 variants are together). No other changes are
needed as the driver handles them as RAW data stream.

The RGGB variant was tested in a modified OV9640 driver.
Signed-off-by: NPetr Cvek <petr.cvek@tul.cz>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Permits distinguishing between two /dev/videoX entries from the same
physical UVC device (that naturally share the same iProduct name).

This change matches current Windows behavior by prioritizing iFunction
over iInterface, but unlike Windows it displays both iProduct and
iFunction/iInterface strings when both are available.
Signed-off-by: NPeter Boström <pbos@google.com>
Reviewed-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add the probe def quirk for the webcam found in the Apple MacBook Pro
2016, to get it working out of the box.
Signed-off-by: NDaniel Roschka <danielroschka@phoenitydawn.de>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

- avoid duplicate debugging messages in em28xx_read_reg_req_len()
- do not describe successful usb transfers in em28xx_read_reg_len()
  as "failed"
- report errors in em28xx_write_regs_req(), too
- print the usb error numbers, too
Signed-off-by: NFrank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

trivial fix to spelling mistake and add in a white space in
a CX18_ERR error message
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

In functions cx25840_initialize(), cx231xx_initialize(), and
cx23885_initialize(), the return value of create_singlethread_workqueue()
is used without validation. This may result in NULL dereference and cause
kernel crash. This patch fixes it.
Signed-off-by: NPan Bian <bianpan2016@163.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Function pci_find_ext_capability() may return 0, which is an invalid
address. In function cobalt_pcie_status_show(), its return value is used
without validation. This patch adds checks to validate the return
address.
Signed-off-by: NPan Bian <bianpan2016@163.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Function kthread_create() returns an ERR_PTR on error. However, in
function s5k83a_start(), its return value is used without validation.
This may result in a bad memory access bug. This patch fixes the bug.
Signed-off-by: NPan Bian <bianpan2016@163.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The recent changes in 4.9 to mandate USB buffers be heap allocated
broke this driver, which was allocating the buffers on the stack.
This resulted in the device failing at initialization.

Introduce dedicated send/receive buffers as part of the state
structure, and add a mutex to protect access to them.

Note: we also had to tweak the API to mxl111sf_ctrl_msg to pass
the pointer to the state struct rather than the device, since
we need it inside the function to access the buffers and the
mutex.  This patch adjusts the callers to match the API change.
Signed-off-by: NDevin Heitmueller <dheitmueller@kernellabs.com>
Reported-by: NDoug Lung <dlung0@gmail.com>
Cc: Michael Ira Krufky <mkrufky@linuxtv.org>
Cc: <stable@vger.kernel.org>      # for v4.5 and up
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Sometimes 'DMA single access' is not enough to transfer
a frame of image, '8-beat burst access' is set as the
default DMA memory burst size.
Signed-off-by: NSongjun Wu <songjun.wu@microchip.com>
Acked-by: NNicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Setting initial standard at the top of cx8800_initdev would cause the
first call to cx88_set_tvnorm() to return without programming any
registers (leaving the driver saying it's set to NTSC but the hardware
isn't programmed).  Even worse, any subsequent attempt to explicitly
set it to NTSC-M will return success but actually fail to program the
underlying registers unless first changing the standard to something
other than NTSC-M.

Set the initial standard later in the process, and make sure the field
is zero at the beginning to ensure that the call always goes through.

This regression was introduced in the following commit:

commit ccd6f1d4 ("[media] cx88: move width, height and field to core
struct")

Author: Hans Verkuil <hans.verkuil@cisco.com>

[media] cx88: move width, height and field to core struct
Signed-off-by: NDevin Heitmueller <dheitmueller@kernellabs.com>
Cc: <stable@vger.kernel.org>      # for v3.19 and up
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This V4L2 subdev driver enables Digital Camera Memory Interface (DCMI)
of STMicroelectronics STM32 SoC series.
Signed-off-by: NYannick Fertre <yannick.fertre@st.com>
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Without annotations, gcc 7.1 will complain.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

On this driver, it can fall through a switch. I tried to
annotate it, in order to shut up a gcc warning, but that
didn't work, as the logic there is somewhat complex.

So, instead, let's just repeat the code. gcc should likely
optimize it anyway, and this makes the code better readable,
IMHO.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Clearly, hsync and vsinc bool vars are part of the return
logic on the second case of the switch. Annotate that, in
order to shut up gcc warnings.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

There are two cases here that it does a switch fall through.
Annotate it, in order to shut up gcc warnings.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

On two switches, this driver have unannotated switch
fall through.

in the first case, it falls through a return. On the second
one, it prints undesired log messages on fall through.

Solve that by copying the commands that it should be
running. Gcc will very likely optimize it anyway, so this
sholdn't be causing any harm, and shuts up gcc warnings.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Gcc 7.1 complains that:

	drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c: In function 'mtk_vdec_pic_info_update':
	drivers/media/platform/mtk-vcodec/mtk_vcodec_dec.c:284:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable]
	  int ret;
	      ^~~

Indeed, if debug is disabled, "ret" is never used. The best
fix for it seems to make the fuction to return an error code.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Gcc 7.1 complains about:

drivers/media/platform/s5p-jpeg/jpeg-core.c: In function 's5p_jpeg_parse_hdr.isra.9':
drivers/media/platform/s5p-jpeg/jpeg-core.c:1207:12: warning: 'width' may be used uninitialized in this function [-Wmaybe-uninitialized]
  result->w = width;
  ~~~~~~~~~~^~~~~~~
drivers/media/platform/s5p-jpeg/jpeg-core.c:1208:12: warning: 'height' may be used uninitialized in this function [-Wmaybe-uninitialized]
  result->h = height;
  ~~~~~~~~~~^~~~~~~~

Indeed the code would allow it to return a random value (although
it shouldn't happen, in practice). So, explicitly set both to zero,
just in case.
Acked-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Avoid warnings like those:

drivers/media/pci/ddbridge/ddbridge-core.c: In function 'dvb_input_detach':
drivers/media/pci/ddbridge/ddbridge-core.c:787:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
   if (input->fe) {
      ^
drivers/media/pci/ddbridge/ddbridge-core.c:792:2: note: here
  case 4:
  ^~~~
...

On several cases, it is just that gcc 7.1 is not capable of
understanding the comment, but on other places, we need an
annotation.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

When a REMOTE_KEY_PRESSED event happens, it does the right
thing. However, if debug is enabled, it will print a bogus
message warning that "key repeated".

Fix it.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The logic that handles CA_SET_PID is clearly missing a
break: it prints that the command succeeded, but, due to the
missing break, it would be returning -EOPNOTSUPP, as if the
driver weren't supporting such ioctl.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Right now, the driver is doing the right thing for
PVC_ERRORCODE_UNKNOWN and PVC_ERRORCODE_INVALID_CONTROL:
for both, it returns an error code (SAA_ERR_NOT_SUPPORTED).

However, it is printing two error messages instead of one
on those cases.

Fix the logic.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

There's a missing break for VSB16 modulation logic, with would
cause it to return -EINVAL, instead of handling it.

Fix it.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

gcc-7 suggests that an expression using a bitwise not and a bitmask
on a 'bool' variable is better written using boolean logic:

drivers/media/rc/imon.c: In function 'imon_incoming_scancode':
drivers/media/rc/imon.c:1725:22: error: '~' on a boolean expression [-Werror=bool-operation]
    ictx->pad_mouse = ~(ictx->pad_mouse) & 0x1;
                      ^
drivers/media/rc/imon.c:1725:22: note: did you mean to use logical not?

I agree.

Fixes: 21677cfc ("V4L/DVB: ir-core: add imon driver")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The below mentioned fix contains a small but severe bug,
fix it to make the driver work again.

Fixes: 3538aa6e ("[media] tc358743: fix register i2c_rd/wr functions")

Cc: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hansverk@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

We should ensure that 'plane_no' is '< vb->num_planes' as done in
'vb2_plane_cookie' just a few lines below.

Fixes: e23ccc0a ("[media] v4l: add videobuf2 Video for Linux 2 driver framework")

Cc: stable@vger.kernel.org
Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Remove including <linux/version.h> that is not needed.
Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The driver allocates the spinlock but not initialize it.
Use spin_lock_init() on it to initialize it correctly.

This is detected by Coccinelle semantic patch.

Fixes: 0f314f6c ("[media] rainshadow-cec: new RainShadow Tech HDMI
CEC driver")
Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The conversion from soc_camera omitted a correct handling of the clock
gating for a sensor. When the pxa_camera driver module was removed it
tried to unregister clk, but this caused a similar warning:

  WARNING: CPU: 0 PID: 6740 at drivers/media/v4l2-core/v4l2-clk.c:278
  v4l2_clk_unregister(): Refusing to unregister ref-counted 0-0030 clock!

The clock was at time still refcounted by the sensor driver. Before
the removing of the pxa_camera the clock must be dropped by the sensor
driver. This should be triggered by v4l2_async_notifier_unregister() call
which removes sensor driver module too, calls unbind() function and then
tries to probe sensor driver again. Inside unbind() we can safely
unregister the v4l2 clock as the sensor driver got removed. The original
v4l2_clk_unregister() should be put inside test as the clock can be
already unregistered from unbind(). If there was not any bound sensor
the clock is still present.

The codepath is practically a copy from the old soc_camera. The bug was
tested with a pxa_camera+ov9640 combination during the conversion
of the ov9640 from the soc_camera.
Signed-off-by: NPetr Cvek <petr.cvek@tul.cz>
Tested-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Changing the IS_REACHABLE() into a plain #ifdef broke the case of
CONFIG_MEDIA_RC=m && CONFIG_MEDIA_CEC=y:

drivers/media/cec/cec-core.o: In function `cec_unregister_adapter':
cec-core.c:(.text.cec_unregister_adapter+0x18): undefined reference to `rc_unregister_device'
drivers/media/cec/cec-core.o: In function `cec_delete_adapter':
cec-core.c:(.text.cec_delete_adapter+0x54): undefined reference to `rc_free_device'
drivers/media/cec/cec-core.o: In function `cec_register_adapter':
cec-core.c:(.text.cec_register_adapter+0x94): undefined reference to `rc_register_device'
cec-core.c:(.text.cec_register_adapter+0xa4): undefined reference to `rc_free_device'
cec-core.c:(.text.cec_register_adapter+0x110): undefined reference to `rc_unregister_device'
drivers/media/cec/cec-core.o: In function `cec_allocate_adapter':
cec-core.c:(.text.cec_allocate_adapter+0x234): undefined reference to `rc_allocate_device'
drivers/media/cec/cec-adap.o: In function `cec_received_msg':
cec-adap.c:(.text.cec_received_msg+0x734): undefined reference to `rc_keydown'
cec-adap.c:(.text.cec_received_msg+0x768): undefined reference to `rc_keyup'

This adds an additional dependency to explicitly forbid this combination.

Fixes: 5f2c467c ("[media] cec: add MEDIA_CEC_RC config option")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The barrier implied by spin_unlock() in rain_irq_work_handler makes it hard
for gcc to figure out the state of the variables, leading to a false-positive
warning:

drivers/media/usb/rainshadow-cec/rainshadow-cec.c: In function 'rain_irq_work_handler':
drivers/media/usb/rainshadow-cec/rainshadow-cec.c:171:31: error: 'data' may be used uninitialized in this function [-Werror=maybe-uninitialized]

Slightly rearranging the code makes it easier for the compiler to see that the
code is correct, and gets rid of the warning.

Fixes: 0f314f6c ("[media] rainshadow-cec: new RainShadow Tech HDMI CEC driver")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

gcc warns about an obviously incorrect use of strncat():

drivers/media/usb/rainshadow-cec/rainshadow-cec.c: In function 'rain_cec_adap_transmit':
drivers/media/usb/rainshadow-cec/rainshadow-cec.c:299:4: error: specified bound 48 equals the size of the destination [-Werror=stringop-overflow=]

It seems that strlcat was intended here, and using that makes the
code correct.

Fixes: 0f314f6c ("[media] rainshadow-cec: new RainShadow Tech HDMI CEC driver")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

ir_lirc_register() currently creates its own lirc_buffer before
passing the lirc_driver to lirc_register_driver().

When a module is later unloaded, ir_lirc_unregister() gets called
which performs a call to lirc_unregister_driver() and then free():s
the lirc_buffer.

The problem is that:

a) there can still be a userspace app holding an open lirc fd
   when lirc_unregister_driver() returns; and

b) the lirc_buffer contains "wait_queue_head_t wait_poll" which
   is potentially used as long as any userspace app is still around.

The result is an oops which can be triggered quite easily by a
userspace app monitoring its lirc fd using epoll() and not closing
the fd promptly on device removal.

The minimalistic fix is to let lirc_dev create the lirc_buffer since
lirc_dev will then also free the buffer once it believes it is safe to
do so.
Signed-off-by: NDavid Härdeman <david@hardeman.nu>
Signed-off-by: NSean Young <sean@mess.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The call to input_register_device() needs to take place
before the repeat parameters are set or the input subsystem
repeat handling will be disabled (as was already noted in
the comments in that function).

Cc: stable <stable@vger.kernel.org> # v4.11
Signed-off-by: NDavid Härdeman <david@hardeman.nu>
Signed-off-by: NSean Young <sean@mess.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>