Fix a regression caused by commit 2bc46b3a ("[media] media/pci:
convert drivers to use the new vb2_queue dev field").

Three places where q->dev should be set were missed, causing
a WARN.

Fixes: 2bc46b3a ("[media] media/pci: convert drivers to use the new vb2_queue dev field").
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Reported-by: NMarton Balint <cus@passwd.hu>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

When resuming from suspend-to-RAM on r8a7795/salvator-x:

    dpm_run_callback(): pm_genpd_resume_noirq+0x0/0x90 returns 1
    PM: Device fe940000.fdp1 failed to resume noirq: error 1
    dpm_run_callback(): pm_genpd_resume_noirq+0x0/0x90 returns 1
    PM: Device fe944000.fdp1 failed to resume noirq: error 1
    dpm_run_callback(): pm_genpd_resume_noirq+0x0/0x90 returns 1
    PM: Device fe948000.fdp1 failed to resume noirq: error 1

According to its documentation, rcar_fcp_enable() returns 0 on success
or a negative error code if an error occurs.  Hence
fdp1_pm_runtime_resume() and vsp1_pm_runtime_resume() forward its return
value to their callers.

However, rcar_fcp_enable() forwards the return value of
pm_runtime_get_sync(), which can actually be 1 on success, leading to
the resume failure above.

To fix this, consider only negative values returned by
pm_runtime_get_sync() to be failures.

Fixes: 7b49235e ("[media] v4l: Add Renesas R-Car FCP driver")
Signed-off-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch remove field and function that unused anymore
Signed-off-by: NTiffany Lin <tiffany.lin@mediatek.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch :
1. remove field and function that unused anymore
2. add support V4L2_MPEG_VIDEO_H264_LEVEL_4_2
Signed-off-by: NTiffany Lin <tiffany.lin@mediatek.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch change default H264 profile from V4L2_MPEG_VIDEO_H264_PROFILE_MAIN
to V4L2_MPEG_VIDEO_H264_PROFILE_HIGH
Signed-off-by: NTiffany Lin <tiffany.lin@mediatek.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch add copying timestamp and timecode from src buffer to dst buffer
Signed-off-by: NTiffany Lin <tiffany.lin@mediatek.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The original code add extra 32 line to visible_height.
It is incorrect, 32 line should be add to coded_height.
The purpose is that user space could calcuate real buffer size needed by using
coded_width * coded_height.
But this method will make v4l2-compliance test fail, since g_fmt != s_fmt(g_fmt)
So remove extend visible_height or coded_height, user space should just
use sizeimage to get real buffer size needed
Signed-off-by: NTiffany Lin <tiffany.lin@mediatek.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch fix that mtk_vcodec_venc_release should be called after v4l2_m2m_ctx_release
Signed-off-by: NTiffany Lin <tiffany.lin@mediatek.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch remove unused header and define from haeder files
Signed-off-by: NTiffany Lin <tiffany.lin@mediatek.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The cec_get_edid_spa_location() function did not verify that the IEEE
identifier in the Vendor Specific Data Block matched the HDMI-LLC
identifier. This could result in the wrong VSDB block being returned.

For example, for HDMI 2.0 EDIDs there is also a HDMI Forum VSDB.

So check the IEEE identifier as well.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This fixes this kbuild test robot error:

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   329f4152
commit: c1023ba7 [media] drivers/media/platform/Kconfig: fix VIDEO_MEDIATEK_VCODEC dependency
config: m32r-allyesconfig (attached as .config)
compiler: m32r-linux-gcc (GCC) 4.9.0
reproduce:
        wget https://git.kernel.org/cgit/linux/kernel/git/wfg/lkp-tests.git/plain/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        git checkout c1023ba7
        # save the attached .config to linux build tree
        make.cross ARCH=m32r

All errors (new ones prefixed by >>):

   drivers/media/v4l2-core/videobuf2-dma-contig.c: In function 'vb2_dc_get_userptr':
>> >> drivers/media/v4l2-core/videobuf2-dma-contig.c:486:2: error: implicit declaration of function 'dma_get_cache_alignment' [-Werror=implicit-function-declaration]
     unsigned long dma_align = dma_get_cache_alignment();
     ^
   cc1: some warnings being treated as errors

This driver depends on HAS_DMA for dma_get_cache_alignment().
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The addition of jump label support in dynamic_debug caused an unexpected
warning in exactly one file in the kernel:

  drivers/media/dvb-frontends/cxd2841er.c: In function 'cxd2841er_tune_tc':
  include/linux/dynamic_debug.h:134:3: error: 'carrier_offset' may be used uninitialized in this function [-Werror=maybe-uninitialized]
     __dynamic_dev_dbg(&descriptor, dev, fmt, \
     ^~~~~~~~~~~~~~~~~
  drivers/media/dvb-frontends/cxd2841er.c:3177:11: note: 'carrier_offset' was declared here
    int ret, carrier_offset;
             ^~~~~~~~~~~~~~

The problem seems to be that the compiler gets confused by the extra
conditionals in static_branch_unlikely, to the point where it can no
longer keep track of which branches have already been taken, and it
doesn't realize that this variable is now always initialized when it
gets used.

I have done lots of randconfig kernel builds and could not find any
other file with this behavior, so I assume it's a rare enough glitch
that we don't need to change the jump label support but instead just
work around the warning in the driver.

To achieve that, I'm moving the check for the return value into the
switch() statement, which is an obvious transformation, but is enough to
un-confuse the compiler here.  The resulting code is not as nice to
read, but at least we retain the behavior of warning if it gets changed
to actually access an uninitialized carrier offset value in the future.

Link: http://lkml.kernel.org/r/20160713204342.1221511-1-arnd@arndb.deSigned-off-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NAbylay Ospan <aospan@netup.ru>
Cc: Sergey Kozlov <serjk@netup.ru>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Jason Baron <jbaron@akamai.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The dma-mapping core and the implementations do not change the DMA
attributes passed by pointer.  Thus the pointer can point to const data.
However the attributes do not have to be a bitfield.  Instead unsigned
long will do fine:

1. This is just simpler.  Both in terms of reading the code and setting
   attributes.  Instead of initializing local attributes on the stack
   and passing pointer to it to dma_set_attr(), just set the bits.

2. It brings safeness and checking for const correctness because the
   attributes are passed by value.

Semantic patches for this change (at least most of them):

    virtual patch
    virtual context

    @r@
    identifier f, attrs;

    @@
    f(...,
    - struct dma_attrs *attrs
    + unsigned long attrs
    , ...)
    {
    ...
    }

    @@
    identifier r.f;
    @@
    f(...,
    - NULL
    + 0
     )

and

    // Options: --all-includes
    virtual patch
    virtual context

    @r@
    identifier f, attrs;
    type t;

    @@
    t f(..., struct dma_attrs *attrs);

    @@
    identifier r.f;
    @@
    f(...,
    - NULL
    + 0
     )

Link: http://lkml.kernel.org/r/1468399300-5399-2-git-send-email-k.kozlowski@samsung.comSigned-off-by: NKrzysztof Kozlowski <k.kozlowski@samsung.com>
Acked-by: NVineet Gupta <vgupta@synopsys.com>
Acked-by: NRobin Murphy <robin.murphy@arm.com>
Acked-by: NHans-Christian Noren Egtvedt <egtvedt@samfundet.no>
Acked-by: Mark Salter <msalter@redhat.com> [c6x]
Acked-by: Jesper Nilsson <jesper.nilsson@axis.com> [cris]
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> [drm]
Reviewed-by: NBart Van Assche <bart.vanassche@sandisk.com>
Acked-by: Joerg Roedel <jroedel@suse.de> [iommu]
Acked-by: Fabien Dessenne <fabien.dessenne@st.com> [bdisp]
Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com> [vb2-core]
Acked-by: David Vrabel <david.vrabel@citrix.com> [xen]
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> [xen swiotlb]
Acked-by: Joerg Roedel <jroedel@suse.de> [iommu]
Acked-by: Richard Kuo <rkuo@codeaurora.org> [hexagon]
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> [m68k]
Acked-by: Gerald Schaefer <gerald.schaefer@de.ibm.com> [s390]
Acked-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Acked-by: Hans-Christian Noren Egtvedt <egtvedt@samfundet.no> [avr32]
Acked-by: Vineet Gupta <vgupta@synopsys.com> [arc]
Acked-by: Robin Murphy <robin.murphy@arm.com> [arm64 and dma-iommu]
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The local variable dma_attrs is set but never read.

Link: http://lkml.kernel.org/r/1468399300-5399-1-git-send-email-k.kozlowski@samsung.comSigned-off-by: NKrzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

vivid shouldn't process the CEC_MSG_SET_STREAM_PATH message: this will confuse
userspace follower code because it isn't aware of the state change of becoming
an active source.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Access to the interrupt page registers has been broken since at least
commit 3999e5d0 ("[media] adv7180: Do implicit register paging").
That commit forgot to add the interrupt page number to the register
defines.
Signed-off-by: NSteve Longerbeam <steve_longerbeam@mentor.com>
Tested-by: NTim Harvey <tharvey@gateworks.com>
Acked-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

When allocating memory to hold the device dma parameters in
vb2_dma_contig_set_max_seg_size(), the requested size is by mistake only
the size of a pointer. Request the correct size instead.

Fixes: 3f033969 ("media: vb2-dma-contig: add helper for setting dma max seg size")
Signed-off-by: NVincent Stehlé <vincent.stehle@laposte.net>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The xfer_func, ycbcr_enc and quantization fields should also be copied from
output to capture format.

Since this driver serves as example code it is important that this is handled
correctly.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The adv7511 will automatically fill in the VIC code in the AVI InfoFrame
based on the timings of the incoming pixelport signals.

However, to have this work correctly it needs to specify the fps
value in a register. After doing this the proper VIC code is filled in.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Some extra escape codes are needed to avoid Sphinx to not
identify the tags.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Better document a note on this header.

While here, better format dvb_ringbuffer_pkt_read_user()
to adjust it to CodingStyle.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add documentation for v4l2-dev.h, and put it at v4l2-framework.rst,
where struct video_device is currently documented.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This header were poorly documented, and weren't using the
kernel-doc format. Document everything but the macros using
the right format.

While here, also fix the other comments to match the
Linux CodingStyle.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fix all remaining media warnings with ReST that are fixable
without changing at the Sphinx code.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Just pass the transmitted CEC message to all CEC adapters.
This implements the Monitor All mode for vivid.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

On mips and parisc:

    drivers/bluetooth/btwilink.c: In function 'ti_st_open':
    drivers/bluetooth/btwilink.c:174:21: warning: overflow in implicit constant conversion [-Woverflow]
       hst->reg_status = -EINPROGRESS;

    drivers/nfc/nfcwilink.c: In function 'nfcwilink_open':
    drivers/nfc/nfcwilink.c:396:31: warning: overflow in implicit constant conversion [-Woverflow]
      drv->st_register_cb_status = -EINPROGRESS;

There are actually two issues:
  1. Whether "char" is signed or unsigned depends on the architecture.
     As the completion callback data is used to pass a (negative) error
     code, it should always be signed.
  2. EINPROGRESS is 150 on mips, 245 on parisc.
     Hence -EINPROGRESS doesn't fit in a signed 8-bit number.

Change the callback status from "char" to "int" to fix these.
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Acked-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
Acked-by: NSamuel Ortiz <sameo@linux.intel.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

The conversion from DocBook required some fixes:

- Now, the C files with the exported symbols also need to be
  added. So, all headers need to be included twice: one to
  get the structs/enums/.. and another one for the functions;

- Notes should use the ReST tag, as kernel-doc doesn't
  recognizes it anymore;

- Identation needs to be fixed, as ReST uses it to identify
  when a format "tag" ends.

- Fix the cross-references at the media controller description.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Move the contents of the media section at
DocBooks/DocBook/device-drivers.tmpl to a new ReST book.

For now, the contents is kept as-is. Next patches will fix
the warnings and add cross-references that were removed due to
the conversion.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Now driver returns correct values for DVB-C:
 SNR (in dB)

[mchehab@s-opensource.com: fix a new function to be static]
Signed-off-by: NAbylay Ospan <aospan@netup.ru>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

now driver returns correct values for DVB-C:
 BER (post_bit_count and post_bit_error values)
 UCB (count of uncorrected errors)
also, some code cleanup was done - checkpatch.pl now is happy
Signed-off-by: NAbylay Ospan <aospan@netup.ru>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

DVB-C should use cxd2841er_read_agc_gain_c() to get the gain. The same
function is used for all DVB-C annex delivery systems.
Signed-off-by: NAbylay Ospan <aospan@netup.ru>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

The scale for ISDB-T was wrong too: it was inverted, and
on a relative scale.

Use a linear interpolation to make it look better.
The formula was empirically determined, using 3 frequencies
(175 MHz, 410 MHz and 800 MHz), measuring from -50dBm to
-12dBm in steps of 0.5dB.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Instead of using a relative frequency range, calibrate it to
show the results in dB. The callibration was done getting
samples with a signal generated from -50dBm to -12dBm,
incremented in steps of 0.5 dB, using 3 frequencies:
175 MHz, 410 MHz and 800 MHz. The modulated signal was
using QAM64, and it was used a linear interpolation of all
the results.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Currently, there's no stats for DVB-C. Let's at least return
signal strength. The scale is different than on DVB-T, so let's
use a relative scale, for now.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

What userspace expects is to receive both bit_error and bit_count
counters. So, instead of doing the division at the Kernel,
return the counters for userspace to handle it the way it
wants.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fix a memory leak on probe error of the airspy usb device driver.

The problem is triggered when more than 64 usb devices register with
v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.

The memory leak is caused by the probe function of the airspy driver
mishandeling errors and not freeing the corresponding control structures
when an error occours registering the device to v4l2 core.

A badusb device can emulate 64 of these devices, and then through
continual emulated connect/disconnect of the 65th device, cause the
kernel to run out of RAM and crash the kernel, thus causing a local DOS
vulnerability.

Fixes CVE-2016-5400
Signed-off-by: NJames Patrick-Evans <james@jmp-e.com>
Reviewed-by: NKees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org # 3.17+
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Appling the mask 0x0f to the immediate return of the call to
mb86a20s_readreg will always result in a positive value, meaning that the
check of ret < 0 will never work.  Instead, check for a -ve return value
first, and then mask val with 0x0f.

Kudos to Mauro Carvalho Chehab for spotting the mistake in my original fix.
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This patch addresses CVE-2016-5400, a local DOS vulnerability caused by
a memory leak in the airspy usb device driver.

The vulnerability is triggered when more than 64 usb devices register
with v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.A badusb device can
emulate 64 of these devices then through continual emulated
connect/disconnect of the 65th device, cause the kernel to run out of
RAM and crash the kernel.

The vulnerability exists in kernel versions from 3.17 to current 4.7.

The memory leak is caused by the probe function of the airspy driver
mishandeling errors and not freeing the corresponding control structures
when an error occours registering the device to v4l2 core.
Signed-off-by: NJames Patrick-Evans <james@jmp-e.com>
Cc: stable@vger.kernel.org # Up to Kernel 3.17
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fix typo in vivid that caused all HDMI outputs to have the same
physical address.
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

When calculate OUTPUT buffer size in vidioc_try_fmt, it will
add more size hw need in each plane.
But in mtk_vcodec_enc_set_default_params, it do not add
same size in each plane.
This makes v4l2-compliance test fail.
This patch fix the issue.
Signed-off-by: NTiffany Lin <tiffany.lin@mediatek.com>
Signed-off-by: NHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>