The UVC_DEV_DISCONNECTED flag is set when the USB device is
disconnected, and checked in the open() handler to refuse opening a
device that has been disconnected.

This is inherently racy, but the race condition is taken care of in the
V4L2 core, which also fails open() calls when the V4L2 device node has
been unregistered. As the uvcvideo USB disconnect handler unregisters
all its video device nodes, the UVC_DEV_DISCONNECTED flag doesn't serve
any purpose anymore and can be removed.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Now that videobuf2-vmalloc supports exporting buffers, add support for
the DMABUF exporter role by plugging in the videobuf2 ioctl helper.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Add support for the new VIDIOC_QUERY_EXT_CTRL ioctl. Since uvc doesn't use
the control framework, support for this ioctl isn't automatic.

This is makes v4l2-compliance happy as well.

[Added blank lines for improved readability]
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

The v4l2-compliance tool expects that if VIDIOC_CROPCAP is defined, then
VIDIOC_G_SELECTION for TGT_CROP_BOUNDS/DEFAULT is also defined (or COMPOSE
in the case of an output device).

In fact, all that a driver has to do to implement cropcap is to support
those two targets since the v4l2 core will implement cropcap and fill in
the pixelaspect to 1/1 by default.

Implementing cropcap is only needed if the pixelaspect isn't square.

So implement g_selection instead of cropcap in uvc to fix the v4l2-compliance
failure.

[Added blank lines for improved readability]
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Embed the video_device struct to simplify the error handling and in
order to (eventually) get rid of video_device_alloc/release.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Frame intervals exposed as an interval and step (so-called step-wise)
are restricted by the V4L2 API to a single enumeration entry. Return an
error when the index is not zero.
Reported-by: NAlexey Smirnoff <fling@member.fsf.org>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
[mchehab@osg.samsung.com: add a missing collon at the end of the return
 statement, in order to avoid compilation breakage]
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Based on versioncheck.
Signed-off-by: NFabian Frederick <fabf@skynet.be>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

This brings the function name in line with the V4L2 API terminology and
allows removing the duplicate queue type check.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

This brings the function name in line with the V4L2 API terminology.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

When releasing the file handle the driver calls the vb2_queue_release
which turns the stream off. There's thus no need to turn the stream off
explicitly beforehand.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

To work propertly the videobuf2 core code needs to be in charge of
stream start/stop control. Implement the start_streaming and
stop_streaming vb2 operations and move video enable/disable code to
them.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

In order to make use of the vb2 queue start/stop_streaming operations
the video and queue enable/disable operations need to be split, as the
vb2 queue will need to enable and disable video instead of the other way
around.

Also move buffer queue disable outside of uvc_video_resume() to remove
all queue disable operations out of uvc_video.c.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Simplify ioctl handling by using video_ioctl2.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Commit e93e7fd9 ("v4l2: uvcvideo: Allow
using larger buffers") reworked the buffer size sanity check at buffer
completion time to use the frame size instead of the allocated buffer
size. However, it introduced two bugs in doing so:

- it assigned the allocated buffer size to the frame_size field, instead
  of assigning the correct frame size

- it performed the assignment in the S_FMT handler, resulting in the
  frame_size field being uninitialized if the userspace application
  doesn't call S_FMT.

Fix both issues by removing the frame_size field and validating the
buffer size against the UVC video control dwMaxFrameSize.

Fixes: e93e7fd9 ("v4l2: uvcvideo: Allow using larger buffers")
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

A test in uvc_video_decode_isoc() checks whether an image has been
received from the camera completely. For this the data amount is compared
to the buffer length, which, however, doesn't have to be equal to the
image size. Switch to using formats .sizeimage field for an exact
expected image size.

[Renamed image_size to frame_size]
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

This patch enables the ioctl to create additional buffers on the
videobuf2 capture queue.

[laurent.pinchart@ideasonboard.com: Acquire privileges instead of just
checking them in VIDIOC_CREATE_BUFS implementation]
Signed-off-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: NPhilipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: NMauro Carvalho Chehab <m.chehab@samsung.com>

Maintaining the users count using an atomic variable makes sure that
access to the counter won't be racy, but doesn't serialize access to the
operations protected by the counter. This creates a race condition that
could result in the status URB being submitted multiple times.
Use a mutex to protect the users count and serialize access to the
status start and stop operations.
Reported-by: NShawn Nematbakhsh <shawnn@chromium.org>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Ming Lei reported:
IMO, there is a minor fault in the error handling path of
uvc_status_start() inside uvc_v4l2_open(), and the 'users' count should
have been decreased before usb_autopm_put_interface(). In theory, a [URB
resubmission] warning can be triggered when the device is opened just
between usb_autopm_put_interface() and atomic_dec(&stream->dev->users).
The fix is trivial.
Reported-by: NMing Lei <tom.leiming@gmail.com>
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This kind of memcpy() is error-prone. Its replacement with a struct
assignment is prefered because it's type-safe and much easier to read.
Signed-off-by: NPeter Senna Tschudin <peter.senna@gmail.com>
Signed-off-by: NEzequiel Garcia <elezegarcia@gmail.com>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The uvc_set_ctrl() calls don't write to the hardware. A failure at that
point thus leaves the device in a clean state, with no control modified.
Set the error_idx field to the count value to reflect that, as per the
V4L2 specification.
TRY_EXT_CTRLS is unchanged and the error_idx field must always be set to
the failed control index in that case.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Commit ba68c8530a263dc4de440fa10bb20a1c5b9d4ff5 (Partly revert "[media]
uvcvideo: Set error_idx properly for extended controls API failures")
missed two modifications. Clean them up.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Commit f0ed2ce8 ("[media] uvcvideo: Set error_idx properly for
extended controls API failures") causes user space to behave incorrectly
on one of my test machines (there is no sound under KDE 4.9.4 using
pulseaudio and there is a knotify4 process occupying one of the CPU
cores 100% of the time).  Reverting that commit entirely fixes the
problem for me.

However, commit f0ed2ce8 appears to do more than it follows from its
changelog, because the changelog only says about the changes related to
ctrls->error_idx, while the commit additionally changes error codes
returned by various functions in uvc_ctrl.c and uvc_v4l2.c.  It turns
out that the changes of the returned error codes confuse the user spce,
so it is sufficient to revert the part of commit f0ed2ce8 not
mentioned in its changelog to fix the problem.

[ 'ENOENT' is not a valid error return from an ioctl to begin with, and
  I don't understand how anybody ever even thought it would be.  - Linus ]
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The proper error code is -ENOTTY instead of -EINVAL.
This issue was found by the v4l2-compliance tool.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Set the capabilities field to global capabilities, and the device_caps
field to the video node capabilities.
This issue was found by the v4l2-compliance tool.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Return the default format in that case.
This issue was found by the v4l2-compliance tool.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

When one of the requested controls doesn't exist the error_idx field
must reflect that situation. For G_EXT_CTRLS and S_EXT_CTRLS, error_idx
must be set to the control count. For TRY_EXT_CTRLS, it must be set to
the index of the unexisting control.
This issue was found by the v4l2-compliance tool.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Rename all USB drivers with their own directory under
drivers/media/video into drivers/media/usb and update the
building system.
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

v4l_i2c_print_ioctl wasn't used and v4l_print_ioctl could be replaced by
v4l_printk_ioctl.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Properly validate the user-supplied index against the number of inputs.
The code used the pin local variable instead of the index by mistake.
Reported-by: NJozef Vesely <vesely@gjh.sk>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

copy_in_user() already checks for write permission, so we don't need to
do it here.  This was added in 1a5e4c86 "[media] uvcvideo: Implement
compat_ioctl32 for custom ioctls".
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Support 32-bit/64-bit compatibility for the the UVCIOC_ ioctls.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

-EINVAL is the wrong error code in that case, replace it with -ENOTTY.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a
large xmap->menu_count is passed from the userspace, the subsequent call
to kmalloc() will allocate a buffer smaller than expected.
map->menu_count and map->menu_info would later be used in a loop (e.g.
in uvc_query_v4l2_ctrl), which leads to out-of-bound access.

The patch checks the ioctl argument and returns -EINVAL for zero or too
large values in xmap->menu_count.
Signed-off-by: NHaogang Chen <haogangchen@gmail.com>
[laurent.pinchart@ideasonboard.com Prevent excessive memory consumption]
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@kernel.org
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Replace the current video buffers queue implementation with
videobuf2-vmalloc.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The UVCIOC_CTRL_ADD, UVCIOC_CTRL_MAP_OLD, UVCIOC_CTRL_GET and
UVCIOC_CTRL_SET ioctls are deprecated and were scheduled for removal for
v2.6.42. As v2.6.42 == v3.2, remove them.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Those drivers are not relying at the V4L2 core to handle the ioctl's.
So, we need to manually patch them every time a change goes to the
core.
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Acked-By: NMike Isely <isely@pobox.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

uvcvideo doesn't use vidioc_ioctl2. As the API is changing to use
a common version for all drivers, we need to expliticly fix this
driver.
Acked-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>