As reported by Laurent, when a DVB frontend need to register
two drivers (e. g. a tuner and a demod), if the second driver
fails to register (for example because it was not compiled),
the error handling logic frees the frontend by calling
dvb_frontend_detach(). That used to work fine, but changeset
1f862a68 ("[media] dvb_frontend: move kref to struct dvb_frontend")
added a kref at struct dvb_frontend. So, now, instead of just
freeing the data, the error handling do a kref_put().

That works fine only after dvb_register_frontend() succeeds.

While it would be possible to add a helper function that
would be initializing earlier the kref, that would require
changing every single DVB frontend on non-trivial ways, and
would make frontends different than other drivers.

So, instead of doing that, let's focus on the real issue:
only call kref_put() after kref_init(). That's easy to
check, as, when the dvb frontend is successfuly registered,
it will allocate its own private struct. So, if such
struct is allocated, it means that it is safe to use
kref_put(). If not, then nobody is using yet the frontend,
and it is safe to just deallocate it.

Fixes: 1f862a68 ("[media] dvb_frontend: move kref to struct dvb_frontend")
Reported-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

If NO_DMA=y:

    warning: (TOUCHSCREEN_SUR40 && VIDEO_TW68 && VIDEO_CX23885 && VIDEO_CX25821 && VIDEO_CX88 && VIDEO_SAA7134 && VIDEO_COBALT && VIDEO_QCOM_CAMSS) selects VIDEOBUF2_DMA_SG which has unmet direct dependencies (MEDIA_SUPPORT && HAS_DMA)

and

    ERROR: "bad_dma_ops" [drivers/media/v4l2-core/videobuf2-dma-sg.ko] undefined!
    ERROR: "bad_dma_ops" [drivers/media/platform/qcom/camss-8x16/qcom-camss.ko] undefined!

VIDEO_QCOM_CAMSS selects VIDEOBUF2_DMA_SG, which bypasses its dependency
on HAS_DMA.  Make VIDEO_QCOM_CAMSS depend on HAS_DMA to fix this.

Fixes: f5c07494 ("media: camss: Enable building")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>

Running CEC 1.4 compliance test we get the following error on test
11.1.6.2: "ERROR: The DUT did not broadcast a
<Report Physical Address> message to the unregistered device."

Fix this by letting GIVE_PHYSICAL_ADDR message respond to unregistered
device. Also, GIVE_DEVICE_VENDOR_ID and GIVE_FEATURES fall in the
same category so, respond also to these messages.

With this fix we pass CEC 1.4 official compliance.
Signed-off-by: Jose Abreu <joabreu@synopsys.com>
Cc: Joao Pinto <jpinto@synopsys.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: <stable@vger.kernel.org>      # for v4.10 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The s5p-cec driver returned CEC_TX_STATUS_ERROR for the NACK condition.

Some digging into the datasheet uncovered the S5P_CEC_TX_STAT1 register where
bit 0 indicates if the transmit was nacked or not.

Use this to return the correct CEC_TX_STATUS_NACK status to userspace.

This was the only driver that couldn't tell a NACK from another error, and
that was very unusual. And a potential problem for applications as well.

Tested with my Odroid-U3.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: <stable@vger.kernel.org>      # for v4.12 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The ret variable can be returned uninitialized in the
imx_media_create_pad_vdev_lists() function is imxmd->num_vdevs is zero.
Fix it.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The function vfe_set_selection is local to the source and does
not need to be in global scope, so make it static.

Cleans up sparse warning:
warning: symbol 'vfe_set_selection' was not declared. Should it be static?
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Todor Tomov <todor.tomov@linaro.org>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Add missing init_list_head for the registered buffer list.
Absence of the init could lead to a unhandled kernel paging
request as below, when streamon/streamoff are called in row.

[338046.571321] Unable to handle kernel paging request at virtual address fffffffffffffe00
[338046.574849] pgd = ffff800034820000
[338046.582381] [fffffffffffffe00] *pgd=00000000b60f5003[338046.582545]
, *pud=00000000b1f31003
, *pmd=0000000000000000[338046.592082]
[338046.597754] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[338046.601671] Modules linked in: venus_enc venus_dec venus_core
usb_f_ecm g_ether usb_f_rndis u_ether libcomposite ipt_MASQUERADE
nf_nat_masquerade_ipv4 arc4 wcn36xx mac80211 btqcomsmd btqca iptable_nat
nf_co]
[338046.662408] CPU: 0 PID: 5433 Comm: irq/160-venus Tainted: G        W
4.9.39+ #232
[338046.668024] Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC
(DT)
[338046.675268] task: ffff80003541cb00 task.stack: ffff800026e20000
[338046.682097] PC is at venus_helper_release_buf_ref+0x28/0x88
[venus_core]
[338046.688282] LR is at vdec_event_notify+0xe8/0x150 [venus_dec]
[338046.695029] pc : [<ffff000000af6c48>] lr : [<ffff000000a6fc60>]
pstate: a0000145
[338046.701256] sp : ffff800026e23bc0
[338046.708494] x29: ffff800026e23bc0 x28: 0000000000000000
[338046.718853] x27: ffff000000afd4f8 x26: ffff800031faa700
[338046.729253] x25: ffff000000afd790 x24: ffff800031faa618
[338046.739664] x23: ffff800003e18138 x22: ffff800002fc9810
[338046.750109] x21: ffff800026e23c28 x20: 0000000000000001
[338046.760592] x19: ffff80002a13b800 x18: 0000000000000010
[338046.771099] x17: 0000ffffa3d01600 x16: ffff000008100428
[338046.781654] x15: 0000000000000006 x14: ffff000089045ba7
[338046.792250] x13: ffff000009045bb6 x12: 00000000004f37c8
[338046.802894] x11: 0000000000267211 x10: 0000000000000000
[338046.813574] x9 : 0000000000032000 x8 : 00000000dc400000
[338046.824274] x7 : 0000000000000000 x6 : ffff800031faa728
[338046.835005] x5 : ffff80002a13b850 x4 : 0000000000000000
[338046.845793] x3 : fffffffffffffdf8 x2 : 0000000000000000
[338046.856602] x1 : 0000000000000003 x0 : ffff80002a13b800
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Since commit 29d2fef8 ("usb: catch attempts to submit urbs
with a vmalloc'd transfer buffer"), the AverMedia AverTV DVB-T
USB 2.0 (a800) fails to probe.

Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

We get a link error when V4L2_FLASH_LED_CLASS=m and AS3645A is built-in:

drivers/leds/leds-as3645a.o: In function `as3645a_v4l2_setup':
leds-as3645a.c:(.text+0x258): undefined reference to `v4l2_flash_init'
leds-as3645a.c:(.text+0x284): undefined reference to `v4l2_flash_indicator_init'
leds-as3645a.c:(.text+0x2a4): undefined reference to `v4l2_flash_release'
drivers/leds/leds-as3645a.o: In function `as3645a_remove':
leds-as3645a.c:(.text+0x784): undefined reference to `v4l2_flash_release'

This adds the same Kconfig dependency that the other V4L2 flash
drivers in drivers/leds use, to avoid that broken configuration.

Fixes: a56ba8fb ("media: leds: as3645a: Add LED flash class driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Those two ioctls were never used within the Kernel. Still, there
used to have compat32 code there (and an if #0 block at the core).

Get rid of them.

Fixes: 286fe1ca ("media: dmx.h: get rid of DMX_GET_CAPS")
Fixes: 13adefbe ("media: dmx.h: get rid of DMX_SET_SOURCE")
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

This reverts commit d2180e0c.

The commit was flawed in that if the device_node pointers are different,
then in fact a different device is present and the device node could be
different in ways other than full_name.

As Frank Rowand explained:

"When an overlay (1) is removed, all uses and references to the nodes and
properties in that overlay are no longer valid.  Any driver that uses any
information from the overlay _must_ stop using any data from the overlay.
Any driver that is bound to a new node in the overlay _must_ unbind.  Any
driver that became bound to a pre-existing node that was modified by the
overlay (became bound after the overlay was applied) _must_ adjust itself
to account for any changes to that node when the overlay is removed.  One
way to do this is to unbind when notified that the overlay is about to
be removed, then to re-bind after the overlay is completely removed.

If an overlay (2) is subsequently applied, a node with the same
full_name as from overlay (1) may exist.  There is no guarantee
that overlay (1) and overlay (2) are the same overlay, even if
that node has the same full_name in both cases."

Also, there's not sufficient overlay support in mainline to actually
remove and re-apply an overlay to hit this condition as overlays can
only be applied from in kernel APIs.

Fixes: d2180e0c ("[media] v4l: async: make v4l2 coexist with devicetree nodes in a dt overlay")

Cc: Javier Martinez Canillas <javier@osg.samsung.com>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Frank Rowand <frowand.list@gmail.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Acked-by: Javi Merino <javi.merino@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The calloc function returns either a null pointer or a pointer to the
allocated space. Add the second case that is missed.

Fixes: da22013f ("atomisp: remove indirection from sh_css_malloc")
Signed-off-by: Sergei A. Trusov <sergei.a.trusov@ya.ru>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

This reverts commit 5be2b76a.

Only when the lirc device is freed, should we drop our reference to
rc_dev, else we the rc_dev is freed to early. If userspace has
a file descriptor open during unplug, it goes bang.

==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10
Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609

-snip-
 mutex_lock_nested+0x1b/0x20
 ? mutex_lock_nested+0x1b/0x20
 rc_close.part.6+0x20/0x60 [rc_core]
 rc_close+0x13/0x20 [rc_core]
 lirc_dev_fop_close+0x62/0xd0 [lirc_dev]
 __fput+0x236/0x410
 ? fput+0xb0/0xb0
 ? do_raw_spin_trylock+0x110/0x110
 ? set_rq_offline.part.70+0xa0/0xa0
 ____fput+0xe/0x10
 task_work_run+0x116/0x180
 ? task_work_cancel+0x170/0x170
 ? _raw_spin_unlock+0x27/0x40
 ? switch_task_namespaces+0x5f/0x90
 do_exit+0x68b/0xe80

Cc: stable@vger.kernel.org # For Kernel 4.13
Fixes: 5be2b76a ("[media] lirc_dev: remove superfluous get/put_device() calls")
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Avoid this warning:
	/devel/v4l/docs/Documentation/media/v4l-drivers/qcom_camss.rst:: WARNING: document isn't included in any toctree
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Adjust dvb ca.h, dmx.h and frontend.h in order to make
checkpatch happier. Now, it only complains about the typedefs,
and those are there just to provide backward userspace
compatibility.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

There's a chapter for the legacy APIs. Move the frontend DVBv3
API to it, and update the chapter's introduction accordingly.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Adjust the table to be better displayed on PDF output.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

There appears to be an issue in using \small in certain cases on Sphinx
1.4 and 1.5. Other format documents don't use \small either, remove it
from here as well.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>

[mchehab@s-opensource.com: kept tabularcolumns - readjusted - and
 add a few blank lines for it to display better]
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Right now, Sphinx unconditionally creates a blank page with
just "Contents:" on it, on PDF output. While this makes sense
for html, it doesn't o PDF, as LaTeX does what's required
automatically.

Fix it.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

On several tables, the color sample location table preamble is
written as:
	Color Sample Location..
Instead of:
	Color Sample Location:

I suspect that the repetition of such pattern was due to some
copy-and-paste (or perhaps some error during DocBook conversion).

Anyway, fix it.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

While doing a visual inspection with Sphinx 1.5, I noticed that
one of the columns was smaller than the text written there.

As this is the only thing I noticed with Sphinx 1.5, I suspect
that this was also a problem with Sphinx 1.4. Yet, I opted to
touch it in a way that wouldn't cause backward issues.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

On all vivid parameters, there's an space after the parameter,
except for "DV Timings Signal Mode". That makes this single one
to be written in bold, and, at PDF output, at the same line as
its description.

Use the same convention as the other parameters, in order to
adjust its output.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

It doesn't make any sense having a driver programming's chapter
at the uAPI book, as this is related to kernel API. Also,
we now have such kAPI book where V4L2 driver programming is covered.

So, get rid of this left-over.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

There's an important note there, but it is not using the
ReST markup. So, it doesn't get any visual highlight on
the output.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Most tables there don't fit on 80 columns. Some are very big.

While those tables are actually generated via scripts, every
time a new board is added, the entire table could be reformatted.
>From the diffstat PoV, that's bad, as it is hard to see what
happened.

One such example is at changeset 4868f6e1fce6 ("media:
em28xx-cardlist.rst: update to reflect last changes"):

The USB ID for "Plextor ConvertX PX-AV100U" was added to card
number 9, with caused the entire table to be reformatted.

So, instead, use flat-tables. While here, fix PDF output,
by adding tablecolumns to the tables that need it.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

There were some new board additions. Update the cardlist
accordingly.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The tables there don't quite fit on PDF output.

Adjust it by adding a tabularcolumns macro.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The "Table of Contents" of a PDF file is generated only once,
at the beginning fo the output. It doesn't produce it on
each part.

So, don't output this text on each part of the document.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Several tables at this media book chapter have issues
when PDF is produced. Adjust them.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Some cells are too small to fit the text written to it.

Increase it. No text changes.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

A literal box provides a better visual when pdf and html output
is generated for things like the output of a sysfs devnode.
It alsod matches other conventions used within the media book.

So, use it.

While here, use literals for protocol names.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Commit 70b074df ("media: fix pdf build with Spinx 1.6") caused
a regression at Sphinx 1.4 PDF build: although it produces a full
document in batch mode, it returns errors on interactive mode:

	[63]
	Runaway argument?
	{\relax
	! Paragraph ended before \multicolumn was complete.
	<to be read again>
	                   \par
	l.7703 \hline\end{tabulary}

The error seems to be due to some bug at Sphinx PDF output:
when multicolumns is used, it doesn't accept an empty string.

Just removing the :cpan:`1` and replacing by two empty
columns fix the issue.

Fixes: 70b074df ("media: fix pdf build with Spinx 1.6")
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

On tests with Spinx 1.4, some tables are still writing text
outside cells. Adjust those tables.

PS.: As this was revisited several times, I suspect that this
will only be fully fixed if we add tabularcolumns to all tables
at the V4L2 part of the book.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The Tuner Audio Matrix table is broken: the first row has 7
columns instead of 6, causing it to be parsed wrong and displayed
very badly on PDF output.

Fix it and adjust the table to look nice at PDF output
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

In the past, V4L2 versions were 0.x.y, but that changed years
ago. Since Kernel 3.1, however, the numbering schema was changed
to match the Kernel version.

However, the presented example still uses the old numerating
schema, with is a misleading information.

So, update it to the new schema.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Several ioctls are missing descriptions for the third argument
of the ioctl() command. They should have a description, as
otherwise the output won't be ok, and will sound like something
is missing.

So, add them.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

Usually, CA messages are sent/received via reading/writing at
the CA device node. However, two drivers (dst_ca and firedtv-ci)
also implement it via ioctls.

Apparently, on both cases, the net result is the same.

Anyway, let's document it.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The av7110 driver uses CA_SET_DESCR to store the descrambler
control words at the CA descrambler slots.

Document it.

Thanks-to: Honza Petrouš <jpetrous@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

As we did with frontend.h, ca.h and dmx.h, move the struct
definition to net.h.

That should help to keep it updated, as more stuff gets
added there.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

The DVB term can either refer to the subsystem or to a delivery
system. Avoid it in the first case at the kernel-doc markups.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>