If buffers were prepared or queued and the buffers were released without
starting the queue, the finish mem op (corresponding to the prepare mem
op) was never called to the buffers.

Before commit a136f59c there was no need to do this as in such a case
the prepare mem op had not been called yet. Address the problem by
explicitly calling finish mem op when the queue is stopped if the buffer
is in either prepared or queued state.

Fixes: a136f59c ("[media] vb2: Move buffer cache synchronisation to prepare from queue")

Cc: stable@vger.kernel.org # for v4.13 and up
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Tested-by: NDevin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The vivid driver has two custom controls that change the behavior of RDS.
Depending on the control setting the V4L2_CAP_READWRITE capability is toggled.
However, after an earlier commit the capability was no longer set correctly.
This is now fixed.

Fixes: 9765a32c ("vivid: set device_caps in video_device")
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Currently an out of range dev->nr is detected by just reporting the
issue and later on an out-of-bounds read on array card occurs because
of this. Fix this by checking the upper range of dev->nr with the size
of array card (removes the hard coded size), move this check earlier
and also exit with the error -ENOSYS to avoid the later out-of-bounds
array read.

Detected by CoverityScan, CID#711191 ("Out-of-bounds-read")

Fixes: commit 02b20b0b ("V4L/DVB (12730): Add conexant cx25821 driver")
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
[hans.verkuil@cisco.com: %ld -> %zd]
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

A recent change to the media_entity_to_video_device() macro breaks some
use-cases for the macro due to a symbol collision. Before the change
this worked:

    vdev = media_entity_to_video_device(link->sink->entity);

While after the change it results in a compiler error "error: 'struct
video_device' has no member named 'link'; did you mean 'lock'?". While
the following still works after the change.

    struct media_entity *entity = link->sink->entity;
    vdev = media_entity_to_video_device(entity);

Fix the collision by renaming the macro argument to '__entity'.

Fixes: 69b925c5 ("media: v4l2-dev.h: add kernel-doc to two macros")
Signed-off-by: NNiklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Given the following definitions from s2255drv.c

 #define LINE_SZ_4CIFS_NTSC      640
 #define LINE_SZ_2CIFS_NTSC      640
 #define LINE_SZ_1CIFS_NTSC      320

and

 #define LINE_SZ_4CIFS_PAL       704
 #define LINE_SZ_2CIFS_PAL       704
 #define LINE_SZ_1CIFS_PAL       352

f->fmt.pix.width possible values can be reduced to
LINE_SZ_4CIFS_NTSC or LINE_SZ_1CIFS_NTSC.

This patch removes unneeded if else blocks in vidioc_try_fmt_vid_cap
function.

This issue was detected by using the Coccinelle software.
Signed-off-by: NChristopher Díaz Riveros <chrisadr@gentoo.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fix inconsistent IS_ERR and PTR_ERR in vdic_get_ipu_resources.
The proper pointer to be passed as argument is ch.

This issue was detected with the help of Coccinelle.

Fixes: 0b2e9e79 ("media: staging/imx: remove confusing IS_ERR_OR_NULL usage")
Signed-off-by: NGustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: NSteve Longerbeam <steve_longerbeam@mentor.com>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Assign true or false to boolean variables instead of an integer value.

This issue was detected with the help of Coccinelle.
Signed-off-by: NGustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The link was showing both VIDIOC_QBUF, VIDIOC_DQBUF while it should show
only VIDIOC_QBUF in this case.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.com>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fix to return error code -ENODEV from the dma_request_slave_channel()
error handling case instead of 0, as done elsewhere in this function.
rc can be overwrite to 0 by dmaengine_slave_config() in the for loop.
Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: NRamesh Shanmugasundaram <Ramesh.shanmugasundaram@bp.renesas.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add support for a new USB ID in this driver.
Signed-off-by: NIan Douglas Scott <ian@iandouglasscott.com>
[hans.verkuil@cisco.com: add commit message]
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Replace GPL license statement with SPDX GPL-2.0 license identifier.
Signed-off-by: NShuah Khan <shuahkh@osg.samsung.com>
Reviewed-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Currently the driver signals the source change event only in case of
a midstream resolution change, however the initial format detection
is also defined as a source change by the V4L2 codec API specification.
Fix this by signaling the event after the initial header is parsed as
well.
Signed-off-by: NTomasz Figa <tfiga@chromium.org>
Reviewed-by: NWu-Cheng Li <wuchengli@chromium.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Quoting the original report:

It looks like there is a double-free vulnerability in Linux usbtv driver
on an error path of usbtv_probe function. When audio registration fails,
usbtv_video_free function ends up freeing usbtv data structure, which
gets freed the second time under usbtv_video_fail label.

usbtv_audio_fail:

        usbtv_video_free(usbtv); =>

           v4l2_device_put(&usbtv->v4l2_dev);

              => v4l2_device_put

                  => kref_put

                      => v4l2_device_release

  => usbtv_release (CALLBACK)

                             => kfree(usbtv) (1st time)

usbtv_video_fail:

        usb_set_intfdata(intf, NULL);

        usb_put_dev(usbtv->udev);

        kfree(usbtv); (2nd time)

So, as we have refcounting, use it
Reported-by: NYavuz, Tuba <tuba@ece.ufl.edu>
Signed-off-by: NOliver Neukum <oneukum@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

gcc-8 reports

drivers/media/media-device.c: In function 'media_device_get_topology':
./include/linux/string.h:245:9: warning: '__builtin_strncpy' specified
bound 64 equals destination size [-Wstringop-truncation]

We need to use strlcpy() to make sure the dest string is nul-terminated.
Signed-off-by: NXiongfeng Wang <xiongfeng.wang@linaro.org>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

While the h.264 standard only allows up to 16 reference frames, the CODA
firmware needs two more buffers: one to hold the currently decoded frame
and one for the display frame. Adding the framebuffer needed by the
driver for VDOA operation brings the total to a maximum of 19 internal
framebuffers.
Lift the current maximum of 17 internal framebuffers to allow playback
of high profile streams that require more than 14 reference frames.
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

After the move of videobuf2 into the common directory, selecting the
au0828 driver with CONFIG_V4L2 disabled started causing a link failure,
as we now attempt to build videobuf2 but it still requires v4l2:

ERROR: "v4l2_event_pending" [drivers/media/common/videobuf/videobuf2-v4l2.ko] undefined!
ERROR: "v4l2_fh_release" [drivers/media/common/videobuf/videobuf2-v4l2.ko] undefined!
ERROR: "video_devdata" [drivers/media/common/videobuf/videobuf2-v4l2.ko] undefined!
ERROR: "__tracepoint_vb2_buf_done" [drivers/media/common/videobuf/videobuf2-core.ko] undefined!
ERROR: "__tracepoint_vb2_dqbuf" [drivers/media/common/videobuf/videobuf2-core.ko] undefined!
ERROR: "v4l_vb2q_enable_media_source" [drivers/media/common/videobuf/videobuf2-core.ko] undefined!

We want to be able to build the core au0828 support without V4L2,
so this makes the 'select' conditional on V4L2, and refines the
dependencies in VIDEO_AU0828_V4L2 so it can only be enabled in
the exact conditions that have VIDEOBUF2_VMALLOC reachable.

Fixes: 03fbdb2f ("media: move videobuf2 to drivers/media/common")
Fixes: 05439b1a ("[media] media: au0828 - convert to use videobuf2")
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fixes the following sparse warning:

drivers/media/platform/atmel/atmel-isc.c:338:19: warning:
 symbol 'fmt_configs_list' was not declared. Should it be static?
Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
Acked-by: NWenyou Yang <wenyou.yang@microchip.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Allow building this driver for other platforms under COMPILE_TEST.
Suggested-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Acked-by: NSteve Longerbeam <steve_longerbeam@mentor.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add support for the CodaHx4 VPU used on i.MX51.

Decoding h.264, MPEG-4, and MPEG-2 video works, as well as encoding
h.264. MPEG-4 encoding is not enabled, it currently produces visual
artifacts.
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Reviewed-by: NFabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
[hans.verkuil@cisco.com: fix (bogus) sparse warning about uninited me_bits]
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add a compatible for the CodaHx4 VPU used on i.MX51.
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Reviewed-by: NRob Herring <robh@kernel.org>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add SPDX identifiers to files under stm32 directory
Signed-off-by: NBenjamin Gaignard <benjamin.gaignard@st.com>
Acked-by: NPhilippe Ombredanne <pombredanne@nexb.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

3 warning regressions:
  + drivers/media/i2c/ov13858.c: warning: cast to restricted __be32:  => 1093:16
  + drivers/media/i2c/ov13858.c: warning: incorrect type in assignment (different base types):  => 1111:13
  + drivers/media/i2c/ov13858.c: warning: incorrect type in initializer (different base types):  => 1071:27
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

After a framerate update through s_frame_interval(), the new
framerate was not taken into account when streaming,
but was taken into account on next session.
This was due to sensor->current_mode not updated accordingly to new
framerate setting in ov5640_s_frame_interval().
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fix module_param(virtual_channel) permissions.
This problem was detected by checkpatch:
$ scripts/checkpatch.pl -f drivers/media/i2c/ov5640.c
ERROR: Use 4 digit octal (0777) not decimal permissions
+module_param(virtual_channel, int, 0);

Also add an error trace in case of virtual_channel not in
the valid range of values.
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Reviewed-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Various typo & style fixes either detected by code
review or checkpatch.
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add an error trace in ov5640_read_reg() in case of i2c_transfer()
failure.
Uniformize error traces using dev_err instead v4l2_err.
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add YUV422 encoded JPEG support.
Signed-off-by: NHugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

ov7670 driver supports two optional properties supplied through platform
data, but currently does not support any standard video interface
property.

Add support through OF parsing for 2 generic properties (vsync and hsync
polarities) and for one custom property already supported through
platform data to suppress pixel clock output during horizontal
blanking.

While at there, check return value of register writes in set_fmt
function and rationalize spacings.

Signal polarities and pixel clock blanking verified through scope and
image capture.
Signed-off-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Describe newly introduced OF properties for ov7670 image sensor.
The driver supports two standard properties to configure synchronism
signals polarities and one custom property already supported as
platform data options to suppress pixel clock during horizontal
blankings.

Re-phrase child nodes description while at there.
Signed-off-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Reviewed-by: NRob Herring <robh@kernel.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Cast fi->interval.numerator to u64 in order to avoid a potential integer
overflow. This variable is being used in a context that expects an
expression of type u64.

Addresses-Coverity-ID: 1324146 ("Unintentional integer overflow")
[Sakari Ailus: use do_div() to make this work on 32-bit systems]
Signed-off-by: NGustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The ov9650 driver currently only supports legacy platform data probe.
This change adds device tree probing.

There has been an attempt to add device tree support for ov9650 driver
by Hugues Fruchet as a part of the patchset that adds support of OV9655
camera (http://www.spinics.net/lists/linux-media/msg117903.html), but
it wasn't merged into mainline because creating a separate driver for
OV9655 is preferred.

This is very similar to Hugues's patch, but not supporting new device.

Cc: Jacopo Mondi <jacopo@jmondi.org>
Cc: H. Nikolaus Schaller <hns@goldelico.com>
Cc: Hugues Fruchet <hugues.fruchet@st.com>
Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Rob Herring <robh@kernel.org>
Reviewed-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Reviewed-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Now the ov9650 driver supports device tree probing.  So this adds a
device tree binding documentation.

Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Jacopo Mondi <jacopo@jmondi.org>
Cc: H. Nikolaus Schaller <hns@goldelico.com>
Cc: Hugues Fruchet <hugues.fruchet@st.com>
Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Reviewed-by: NRob Herring <robh@kernel.org>
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Reviewed-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This adds an entry to the MAINTAINERS file for ov9650 driver.  The
following persons are added in this entry.

* Sakari as a person who looks after media sensor driver patches
* Sylwester as a module author
* Myself as a person who has the hardware and can test the patches

Cc: Jacopo Mondi <jacopo@jmondi.org>
Cc: H. Nikolaus Schaller <hns@goldelico.com>
Cc: Hugues Fruchet <hugues.fruchet@st.com>
Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Rob Herring <robh@kernel.org>
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Reviewed-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Acked-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Assign true or false to boolean variables instead of an integer value.

This issue was detected with the help of Coccinelle.
Signed-off-by: NGustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Previously, the sensor, with default settings, was outputting SOF without
data. This results in frame sync error on the receiver side.

Now, configure the sensor to output SOF with MIPI data for all frames. This
avoids possible null first frame on the bus.
Signed-off-by: NChiranjeevi Rapolu <chiranjeevi.rapolu@intel.com>
Signed-off-by: NTianshu Qiu <tian.shu.qiu@intel.com>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Assign ret in the default case for s_ctrl callback. This can't happen but
still may result in compiler warnings.
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch adds driver for Omnivision's ov2685 sensor.
Though the ov2685 can output yuv data, this driver only
supports the raw bayer format, including the following features:
  - output 1600x1200 at 30fps
  - test patterns
  - manual exposure/gain control
  - vblank and hblank
  - media controller
  - runtime pm

[Sakari Ailus: trivial: ov5695_of_match -> ov2685_of_match]
Signed-off-by: NShunqian Zheng <zhengsq@rock-chips.com>
Reviewed-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add device tree binding documentation for the OV2685 sensor.
Signed-off-by: NShunqian Zheng <zhengsq@rock-chips.com>
Reviewed-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch adds driver for Omnivision's ov5695 sensor,
the driver supports following features:
 - supported resolutions
   + 2592x1944 at 30fps
   + 1920x1080 at 30fps
   + 1296x972 at 60fps
   + 1280x720 at 30fps
   + 640x480 at 120fps
 - test patterns
 - manual exposure/gain(analog and digital) control
 - vblank and hblank
 - media controller
 - runtime pm
Signed-off-by: NShunqian Zheng <zhengsq@rock-chips.com>
Reviewed-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add device tree binding documentation for the OV5695 sensor.
Signed-off-by: NShunqian Zheng <zhengsq@rock-chips.com>
Reviewed-by: NJacopo Mondi <jacopo+renesas@jmondi.org>
Signed-off-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>