Setting sev->fh to NULL causes problems for the del op added in the next
patch of this series, since this op needs a way to get to its own data
structures, and typically this will be done by using container_of on an
embedded v4l2_fh struct.

The reason the original code is setting sev->fh to NULL is to signal
to users of the event framework that the unsubscription has happened,
but since their is no shared lock between the event framework and users
of it, this is inherently racy, and it also turns out to be unnecessary
as long as both the event framework and the user of the framework do their
own locking properly and the user guarantees that it holds no references
to the subcribed_event structure after its del operation has been called.

This is best explained by looking at the only code currently checking for
sev->fh being set to NULL on unsubscribe, which is the v4l2-ctrls.c send_event
function. Here is the relevant code from v4l2-ctrls: send_event():

	if (sev->fh && (sev->fh != fh ||
			(sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK)))
		v4l2_event_queue_fh(sev->fh, &ev);

Now lets say that v4l2_event_unsubscribe and v4l2-ctrls: send_event() race
on the same sev, then the following could happens:

1) send_event checks sev->fh, finds it is not NULL
<thread switch>
2) v4l2_event_unsubscribe sets sev->fh NULL
3) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
   as the thread calling send_event holds the ctrl_lock
<thread switch>
4) send_event calls v4l2_event_queue_fh(sev->fh, &ev) which not is equivalent
   to calling: v4l2_event_queue_fh(NULL, &ev)
5) oops, NULL pointer deref.

Now again without setting sev->fh to NULL in v4l2_event_unsubscribe and
without the (now senseless since always true) sev->fh != NULL check in

1) send_event is about to call v4l2_event_queue_fh(sev->fh, &ev)
<thread switch>
2) v4l2_event_unsubscribe removes sev->list from the fh->subscribed list
<thread switch>
3) send_event calls v4l2_event_queue_fh(sev->fh, &ev)
4) v4l2_event_queue_fh blocks on the fh_lock spinlock
<thread switch>
5) v4l2_event_unsubscribe unlocks the fh_lock spinlock
6) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
   as the thread calling send_event holds the ctrl_lock
<thread switch>
8) v4l2_event_queue_fh takes the fh_lock
7) v4l2_event_queue_fh calls v4l2_event_subscribed, does not find it since
   sev->list has been removed from fh->subscribed already -> does nothing
9) v4l2_event_queue_fh releases the fh_lock
10) the caller of send_event releases the ctrl lock (mutex)
<thread switch>
11) v4l2_ctrls del_event takes the ctrl lock
12) v4l2_ctrls del_event removes sev->node from the ev_subs list
13) v4l2_ctrls del_event releases the ctrl lock
14) v4l2_event_unsubscribe frees the sev, to which no references are being
    held anymore
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The kev pointers inside the pending events queue (the available queue) of the
fh point to data inside the sev, unsubscribing frees the sev, thus making these
pointers point to freed memory!

This patch fixes these dangling pointers in the available queue by removing
all matching pending events on unsubscription.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Add a maintainer for s5p-mfc driver.
Signed-off-by: NJeongtae Park <jtp.park@samsung.com>
Acked-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Acked-by: NKamil Debski <k.debski@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

MFC uses the multi-plane API, but it reported single-plane
when querying capabilities.
Signed-off-by: NKamil Debski <k.debski@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Queued list was not reset on REQBUFS(0) call. This caused to enqueue a
freed buffer to the driver.
Reported-by: NAngela Wan <angela.j.wan@gmail.com>
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

v4l2_planes[plane].length field was not initialized for userptr buffers.
This patch fixes this issue.
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
CC: Pawel Osciak <pawel@osciak.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

__buffer_in_use() might be called for empty/uninitialized buffer in the
following scenario: REQBUF(n, USER_PTR), QUERYBUF(). This patch fixes
kernel ops in such case.
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
CC: Pawel Osciak <pawel@osciak.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

fix build warning:
	variable ‘ret’ set but not used in function ‘mxl111sf_i2c_readagain’
Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

mxl111sf_idac_config was incorrectly returning val instead of ret
Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Currently it is also being checked for non BITMAP type menu controls,
breaking the logitech LED control menu added by uvcdynctrl, as well as
potentially breaking the powerline frequency menu.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

If the said config optio is not set, the compiler will spill out many
warnings about statements with no effect, such as:

Casting the zero to void will cure the warning.
Signed-off-by: NTimo Kokkonen <kaapeli@itanic.dy.fi>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Support for single ITE 9135 device.

Only single devices have been tested.  Dual ITE 9135 devices
should work, but have not been tested.

TODOs
support for ver 2 chip
config for other tuner types.
rework of firmware file.
Signed-off-by: NMalcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Hi,

This is a little patch to support Terratec G1 (based on Terratec Grabby).

It works perfectly on my pc (Ubuntu 11.04 / Kernel 2.6.38).

Best regards,
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

If "i" is 2 then when we call cx25821_video_mux() we'd end up going
past the end of the cx25821_boards[dev->board]->input[].

The INPUT() macro obfuscates what's going on in that function so it's
a bit hard to follow.  And as Mauro points out the hard coded 2 is
not very helpful.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The Kconfig symbol RADIO_TEA5764_XTAL is unused. The code does use a
RADIO_TEA5764_XTAL macro, but does that rather peculiar. But there seems
to be a way to keep both. (The easiest way out would be to rip out both
the Kconfig symbol and the macro.)

Note there's also a module parameter 'use_xtal' to influence all this.
Signed-off-by: NPaul Bolle <pebolle@tiscali.nl>
Acked-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NVaibhav Hiremath <hvaibhav@ti.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The crop rectangle takes the preview engine internal cropping
requirements into account. The smallest allowable margins are 14 columns
and 8 rows when reading from memory, and 18 columns and 8 rows when
processing data on the fly from the CCDC.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The macros that define the minimum/maximum input and output sizes are
defined in seperate files and have no consistent naming. In preparation
for preview engine cropping support, move them all to isppreview.c and
rename them to PREV_{MIN|MAX}_{IN|OUT}_{WIDTH|HEIGHT}*.

Remove unused and/or unneeded local variables that store the maximum
output width.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The horizontal averager isn't used and will get in the way when
implementing cropping support on the input pad. Remove it, it can be
added back later if needed.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Set the media_device::hw_revision field to the ISP revision number.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NSakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Trivial arithmetics clean up.
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Make sure all modules init functions clean up after themselves in case
of error.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Reported-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Mutexes must be destroyed with mutex_destroy(). Add missing calls in the
modules cleanup handlers.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Group all init/cleanup functions together to make the code more
readable.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The media_entity_cleanup() function belong to the module cleanup
handlers, not the entity registration handlers. Move it there.

Create a omap3isp_video_cleanup() function to cleanup the video node
entity, and call it from the module cleanup handlers.

Rename omap3isp_stat_free() to omap3isp_stat_cleanup().
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This patch renames the MFC firmware binary to avoid SoC name in it.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Acked-by: NKamil Debski <k.debski@samsung.com>
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

no mmu system needs get_unmapped_area file operations to do mmap
Signed-off-by: NScott Jiang <scott.jiang.linux@gmail.com>
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This driver exposes preview mode operation of the S5K6AAFX sensor with
embedded SoC ISP. The native capture (snapshot) operation mode is not
supported.
Following controls are available:
 manual/auto exposure and gain, power line frequency (anti-flicker),
 saturation, sharpness, brightness, contrast, white balance temperature,
 color effects, horizontal/vertical image flip, frame interval,
 auto white balance.
RGB component gains are currently exposed through private controls.
Reviewed-by: NSakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

V4L2_CID_POWER_LINE_FREQUENCY control allows applications to instruct
a driver what is the power line frequency so an appropriate filter
can be used by the device to cancel flicker by compensating the light
intensity ripple. Currently in the menu we have entries for 50 Hz and
60 Hz and for entirely disabling the anti-flicker filter.
However some devices are capable of automatically detecting the
frequency, so add V4L2_CID_POWER_LINE_FREQUENCY_AUTO entry for them.
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

* with no "retrun ret;" at the end, there is no need to initialize ret
  any longer,
* consequently use conditional expressions, not if...else constructs,
  throughout ov6650_s_ctrl(),
* v4l2_ctrl_new_std_menu() max value of V4L2_EXPOSURE_MANUAL instead of
  equivalent 1 looks more clear.

Created on top of "Converting soc_camera to the control framework"
series.
Signed-off-by: NJanusz Krzysztofik <jkrzyszt@tis.icnet.pl>
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This patch adds the ability to get arbitrary resolutions with a width
up to 2592 and a height up to 720 pixels instead of the standard 1280x720
only.
Signed-off-by: NBastian Hecht <hechtb@gmail.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Most users of the <media/soc_mediabus.h> header only need pixel code
definitions, which are now located in the generic <linux/v4l2-mediabus.h>
header. Switch over to reduce soc-camera dependencies.
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The most important change in this patch is direct linking to struct
soc_camera_link via the client->dev.platform_data pointer. This makes most
of the soc-camera client drivers also usable outside of the soc-camera
framework. After this change all what is needed for these drivers to
function are inclusions of soc-camera headers for some convenience macros,
suitably configured platform data, which is anyway always required, and
loaded soc-camera core module for library functions. If desired, these
library functions can be made generic in the future and moved to a more
neutral location.

The only two client drivers, that still depend on soc-camera are:

mt9t031: it uses struct video_device for its PM. Since no hardware is
available, alternative methods cannot be tested.

ov6650: it uses struct soc_camera_device to pass its sense data back to
the bridge driver. A generic v4l2-subdevice approach should be developed
to perform this.
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

VIDIOC_G_STD can return the current TV-norm to the user in one of two ways:
if an .vidioc_g_std() ioctl operation is provided by the driver, it is
called, otherwise the value ot the .current_norm field of struct
video_device is returned. Since subdevice drivers currently have no access
to struct video_device objects, the only way to provide this information to
the user is by implementing a .g_std() method.
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Currently only very few drivers actually use video_device nodes, embedded
in struct v4l2_subdev. Allocate these nodes dynamically for those drivers
to save memory for the rest.
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Tested-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

If the sh_mobile_csi2 driver didn't attach to a client, normally, because
the respective device connects to the SoC over the parallel CEU interface
and doesn't use the CSI-2 controller, it also shouldn't call
pm_runtime_put() on attempted disconnect.
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Using the internally cached pixel code, instead of the one, provided by
the soc-camera, removes one more use of struct soc_camera_device in these
drivers. Also remove the no longer needed soc_camera_from_i2c() inline
function.
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>