Otherwise ttusb2_i2c_xfer can read or write beyond the end of static and
heap buffers.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Add an explicit config option to select whether the CEC remote control
messages are to be passed on to the RC subsystem or not.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Drop the separate cec-edid.h header and merge it into cec.h.

There was really no need to have a separate header for this.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The Kconfig options for the CEC subsystem were a bit messy. In
addition there were two cec sources (cec-edid.c and cec-notifier.c)
that were outside of the media/cec directory, which was weird.

Move those sources to media/cec as well.

The cec-edid and cec-notifier functionality is now part of the cec
module and these are no longer separate modules.

Also remove the MEDIA_CEC_EDID config option and include it with the
main CEC config option (which defined CEC_EDID anyway).

Added static inlines to cec-edid.h for dummy functions when CEC_CORE
isn't defined.

CEC drivers should now depend on CEC_CORE.

CEC drivers that need the cec-notifier functionality must explicitly
select CEC_NOTIFIER.

The s5p-cec and stih-cec drivers depended on VIDEO_DEV instead of
CEC_CORE, fix that as well.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

This code copies actual_length-128 bytes from the header, which will
underflow if the received buffer is too small.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Return an error rather than memcpy()ing beyond the end of the buffer.
Internal callers use appropriate sizes, but digitv_i2c_xfer may not.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The Kconfig currently makes no reference to the snd-usb-audio
driver, which supports audio capture for this type of devices.
Just in case, let's make sure the requirement is mentioned
in the description.
Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

This patch replaces bit shifting on 1 with the BIT(x) macro.
This was done with coccinelle:
@@
constant c;
@@

-1 << c
+BIT(c)
Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Fixes "w_scan -f c" complaining with

  This dvb driver is *buggy*: the symbol rate limits are undefined - please
  report to linuxtv.org)
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Acked-by: Abylay Ospan <aospan@netup.ru>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Adding support for SRGGB8 is as simple as adding a new entry at
struct em28xx_fmt.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

CbYCrY has been identified by looking into the tvp5150 driver and the
saa7115 datasheet.
YUV formats have been verified with em2765 + ov2640 (VAD Laplace webcam).
RGB8 formats have been verified with em2710/em2820 + mt9v011 (Silvercrest
webcam 1.3mpix).
I also did some cross-checking with these two camera devices and 0x08-0x0b
are at least 16 bits per pixel formats on em2710/em2820, too, and
0x0c-0x0f are at least 8 bits per pixel formats on em2765, too.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

With an unknown sensor, norm_maxw() and norm_maxh() return 0 as max.
height and width values, which causes a devide by zero in size_to_scale().
Of course we could use speculative default values for unknown sensors,
but the chance that the device works at this resolution without any
driver/setup is very low and therefore not worth the efforts.
Instead, just don't treat the device as camera.
A message will then be printed to the log that the device isn't supported.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

With MEDIA_SUBDRV_AUTOSELECT enabled in the kernel config, the em28xx
driver currently does't select some used subdrivers.
Fix this by adding the missing auto-selections to the Kconfig file.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The v4l2 dummy clock has been added with commit fc5d0f8a
("V4L2: em28xx: register a V4L2 clock source") to be able to use the ov2640
soc_camera driver.
Since commit 46796cfc ("ov2640: use standard clk and enable it") it is
no longer required.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Use i2c_smbus_read_word_data() instead of i2c_master_send() and
i2c_master_recv() for reading the ID of Micorn sensors.

i2c_smbus_read_word_data() assumes that byes are in little-endian,
so, it uses:
	data->word = msgbuf1[0] | (msgbuf1[1] << 8);

However, Micron datasheet describes the ID as if they were read
in big-endian. So, we need to change the byte order in order to
match the ID number as described on their datasheets.
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

It started with a sporadic message in syslog: "CAM tried to send a
buffer larger than the ecount size" This message is not the fault
itself, but a consecutive fault, after a read error from the CAM. This
happens only on several CAMs, several hardware, and of course sporadic.

It is a consecutive fault, if the last read from the CAM did fail. I
guess this will not happen on all CAMs, but at least it did on mine.
There was a write error to the CAM and during the re-initialization
procedure, the CAM finished the last read, although it got a RS.

The write error to the CAM happened because a race condition between HC
write, checking DA and FR.

This patch added an additional check for DA(RE), just after checking FR.
It is important to read the CAMs status register again, to give the CAM
the necessary time for a proper reaction to HC. Please note the
description within the source code (patch below).

[mchehab@s-opensource.com: make checkpatch happy]
Signed-off-by: Jasmin jessich <jasmin@anw.at>
Tested-by: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

When fe_ops.read_status is called and no channel is tuned (yet), the
subsequent calls to get_lock_status() causes the kernel log to be filled
with

    drxk: Error -22 on get_lock_status

which either means a NULL pointer was passed for the p_lock_status var,
or neither QAM nor OFDM/DVBT operation mode are active. Instead of
filling the kernel log in the latter case, print out a message to the debug
level and return 0 (this isn't used in the calling drxk_get_stats() anyway).
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Submitters of device tree binding documentation may forget to CC
the subsystem maintainer if this is missing.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Some functions like kmalloc/kzalloc return NULL on failure.
When NULL represents failure, !x is commonly used.

This was done using Coccinelle:
@@
expression *e;
identifier l1;
@@

e = \(kmalloc\|kzalloc\|kcalloc\|devm_kzalloc\)(...);
...
- e == NULL
+ !e
Signed-off-by: simran singhal <singhalsimran0@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The refcount field was added to the struct but it was not
properly documented.

Document it.

[mchehab@s-opensource.com: fix a merge conflict]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Update the CSI-2 bus documentation to tell that the LP-11 mode is not
mandatory as there are transmitters that cannot be explicitly set to LP-11
mode. Instead, say that this what the transmitter drivers shall do if
possible.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Add new usbid eb1a:5051 for the Ion Video 2 PC MKII, Startech svid2usb23
and Raygo R12-41373.
Signed-off-by: Alexandre-Xavier Labonté-Lamoureux <alexandrexavier@live.ca>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

'usb_free_urb(urb)' is a no-op, because urb is known to be NULL.

It is likelly that releasing resources allocated by
'tm6000_alloc_urb_buffers()' just a few lines above is expected here.

This has been spotted by the following coccinelle script:
@@
expression ret, x, e;
identifier f;
@@

*   if (x == NULL)
    {
     ... when != x = e;
(
*    f(<+...x...+>);
|
*    ret = f(<+...x...+>);
)
     ...
    }
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The driver doesn't have a struct of_device_id table but supported devices
are registered via Device Trees. This is working on the assumption that a
I2C device registered via OF will always match a legacy I2C device ID and
that the MODALIAS reported will always be of the form i2c:<device>.

But this could change in the future so the correct approach is to have an
OF device ID table if the devices are registered via OF.
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Remove dead code. The following line of code is never reached:
return SAA_OK;

Addresses-Coverity-ID: 114283
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Reviewed-by: Peter Senna Tschudin <peter.senna@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Remove unnecessary variable 'loop'.
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Reviewed-by: Peter Senna Tschudin <peter.senna@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The I2C core always reports a MODALIAS of the form i2c:<foo> even if the
device was registered via OF, this means that exporting the OF device ID
table device aliases in the module is not needed. But in order to change
how the core reports modaliases to user-space, it's better to export it.

Before this patch:

$ modinfo drivers/media/i2c/et8ek8/et8ek8.ko | grep alias
alias:          i2c:et8ek8

After this patch:

$ modinfo drivers/media/i2c/et8ek8/et8ek8.ko | grep alias
alias:          i2c:et8ek8
alias:          of:N*T*Ctoshiba,et8ek8C*
alias:          of:N*T*Ctoshiba,et8ek8
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Declare stv0299_config structures as const as they are only passed as
an argument to the function dvb_attach. dvb_attach
calls its first argument on the rest of its arguments. The first
argument of dvb_attach in the changed cases is stv0299_attach and
the parameter of this function to which the object references are passed
is of type const. So, stv0299_config structures having this property
can be made const.

First line shows the file size before patching and second one shows size
after patching.

   text	   data	    bss	    dec	    hex	filename
   9572	    926	     40	  10538	   292a media/pci/dm1105/dm1105.o
   9636	    862	     40	  10538	   292a media/pci/dm1105/dm1105.o

  15133	   5408	      0	  20541	   503d	media/pci/ttpci/budget-av.o
  15389	   5152	      0	  20541	   503d media/pci/ttpci/budget-av.o

  15703	   2326	     36	  18065	   4691	media/pci/ttpci/budget-ci.o
  15767	   2262	     36	  18065	   4691 media/pci/ttpci/budget-ci.o

  10555	   1918	      4	  12477	   30bd	drivers/media/pci/ttpci/budget.o
  10683	   1822	      4	  12509	   30dd	drivers/media/pci/ttpci/budget.o
Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Declare mb86a16_config structure as const as it is either passed as
an argument to the function dvb_attach or is dereferenced. dvb_attach
calls its first argument on the rest of its arguments. The first argument
of dvb_attach in the changed case is mb86a16_attach and the parameter of
this function to which the object reference is passed is of type
const. So, mb86a16_config structures having this property can be made
const.
Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Declare mb86a16_config structure as const as it is only passed as
an argument to the function dvb_attach. dvb_attach calls its first
argument on the rest of its arguments. The first argument of
dvb_attach in the changed case is mb86a16_attach and the parameter of
this function to which the object reference is passed is of type
const. So, mb86a16_config structures having this property can be made
const.
Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Declare nxt200x_config structures as const as they are only passed as
an argument to the function dvb_attach. dvb_attach calls its first
argument on the rest of its arguments. The first argument of
dvb_attach in the changed cases is nxt200x_attach and the parameter of
this function to which the object references are passed is of type
const. So, nxt200x_config structures having this property can be made
const.

File size before:
   text	   data	    bss	    dec	    hex	filename
  21320	   3776	     16	  25112	   6218	saa7134/saa7134-dvb.o

File size after:
   text	   data	    bss	    dec	    hex	filename
  21384	   3744	     16	  25144	   6238	saa7134/saa7134-dvb.o
Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Declare nxt200x_config structure as const as it is only passed as
an argument to the function dvb_attach. dvb_attach calls its first
argument on the rest of its arguments. The first argument of
dvb_attach in the changed case is nxt200x_attach and the parameter of
this function to which the object reference is passed is of type
const. So, nxt200x_config structures having this property can be made
const.

File size before:
   text	   data	    bss	    dec	    hex	filename
   7566	    568	      0	   8134	   1fc6	common/b2c2/flexcop-fe-tuner.o

File size after:
   text	   data	    bss	    dec	    hex	filename
   7582	    536	      0	   8118	   1fb6	common/b2c2/flexcop-fe-tuner.o
Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

dvb-usb-dibusb-mc-common is licensed under GPLv2, and if we don't say
so then it won't even load since it needs a GPL-only symbol.

Fixes: e91455a1 ("[media] dvb-usb: split out common parts of dibusb")
Reported-by: Dominique Dumont <dod@debian.org>
Cc: stable@vger.kernel.org # 4.9+
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

There is an exit path where rx is kfree'd on put_ir_rx and then
a jump to label out_put_xx will again kfree it with another
call to put_ir_rx.  Fix this by adding a new label that avoids
this 2nd call to put_ir_rx for this specific case.

Detected with CoverityScan, CID#145119 ("Use after free")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

To enable eventual removal of pr_warning

This makes pr_warn use consistent for drivers/media

Prior to this patch, there was 1 use of pr_warning and
310 uses of pr_warn in drivers/media
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

First version of the Virtual Media Controller.
Add a simple version of the core of the driver, the capture and
sensor nodes in the topology, generating a grey image in a hardcoded
format.
Signed-off-by: Helen Koike <helen.koike@collabora.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
[hans.verkuil@cisco.com: fix small typo in Kconfig]
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The OV5647 sensor from Omnivision supports up to 2592x1944 @ 15 fps, RAW 8
and RAW 10 output formats, and MIPI CSI-2 interface.

The driver adds support for 640x480 RAW 8.
Signed-off-by: Ramiro Oliveira <roliveir@synopsys.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Create device tree bindings documentation.
Signed-off-by: Ramiro Oliveira <roliveir@synopsys.com>
Acked-by: Rob Herring <robh@kernel.org>
Reviewed-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The ov5645 sensor from Omnivision supports up to 2592x1944
and CSI2 interface.

The driver adds support for the following modes:
- 1280x960
- 1920x1080
- 2592x1944

Output format is packed 8bit UYVY.
Signed-off-by: Todor Tomov <todor.tomov@linaro.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Add the document for ov5645 device tree binding.
Signed-off-by: Todor Tomov <todor.tomov@linaro.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>