summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-01-31media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevsHans Verkuil
If the device is of type VFL_TYPE_SUBDEV then vdev->ioctl_ops is NULL so the 'if (!ops->vidioc_query_ext_ctrl)' check would crash. Add a test for !ops to the condition. All sub-devices that have controls will use the control framework, so they do not have an equivalent to ops->vidioc_query_ext_ctrl. Returning false if ops is NULL is the correct thing to do here. Fixes: b8c601e8af ("v4l2-compat-ioctl32.c: fix ctrl_is_pointer") Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logicDaniel Mentz
The 32-bit compat v4l2 ioctl handling is implemented based on its 64-bit equivalent. It converts 32-bit data structures into its 64-bit equivalents and needs to provide the data to the 64-bit ioctl in user space memory which is commonly allocated using compat_alloc_user_space(). However, due to how that function is implemented, it can only be called a single time for every syscall invocation. Supposedly to avoid this limitation, the existing code uses a mix of memory from the kernel stack and memory allocated through compat_alloc_user_space(). Under normal circumstances, this would not work, because the 64-bit ioctl expects all pointers to point to user space memory. As a workaround, set_fs(KERNEL_DS) is called to temporarily disable this extra safety check and allow kernel pointers. However, this might introduce a security vulnerability: The result of the 32-bit to 64-bit conversion is writeable by user space because the output buffer has been allocated via compat_alloc_user_space(). A malicious user space process could then manipulate pointers inside this output buffer, and due to the previous set_fs(KERNEL_DS) call, functions like get_user() or put_user() no longer prevent kernel memory access. The new approach is to pre-calculate the total amount of user space memory that is needed, allocate it using compat_alloc_user_space() and then divide up the allocated memory to accommodate all data structures that need to be converted. An alternative approach would have been to retain the union type karg that they allocated on the kernel stack in do_video_ioctl(), copy all data from user space into karg and then back to user space. However, we decided against this approach because it does not align with other compat syscall implementations. Instead, we tried to replicate the get_user/put_user pairs as found in other places in the kernel: if (get_user(clipcount, &up->clipcount) || put_user(clipcount, &kp->clipcount)) return -EFAULT; Notes from hans.verkuil@cisco.com: This patch was taken from: https://github.com/LineageOS/android_kernel_samsung_apq8084/commit/97b733953c06e4f0398ade18850f0817778255f7 Clearly nobody could be bothered to upstream this patch or at minimum tell us :-( We only heard about this a week ago. This patch was rebased and cleaned up. Compared to the original I also swapped the order of the convert_in_user arguments so that they matched copy_in_user. It was hard to review otherwise. I also replaced the ALLOC_USER_SPACE/ALLOC_AND_GET by a normal function. Fixes: 6b5a9492ca ("v4l: introduce string control support.") Signed-off-by: Daniel Mentz <danielmentz@google.com> Co-developed-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: don't copy back the result for certain errorsHans Verkuil
Some ioctls need to copy back the result even if the ioctl returned an error. However, don't do this for the error code -ENOTTY. It makes no sense in that cases. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer typeHans Verkuil
There is nothing wrong with using an unknown buffer type. So stop spamming the kernel log whenever this happens. The kernel will just return -EINVAL to signal this. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32Hans Verkuil
put_v4l2_window32() didn't copy back the clip list to userspace. Drivers can update the clip rectangles, so this should be done. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: fix ctrl_is_pointerHans Verkuil
ctrl_is_pointer just hardcoded two known string controls, but that caused problems when using e.g. custom controls that use a pointer for the payload. Reimplement this function: it now finds the v4l2_ctrl (if the driver uses the control framework) or it calls vidioc_query_ext_ctrl (if the driver implements that directly). In both cases it can now check if the control is a pointer control or not. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32Hans Verkuil
The struct v4l2_plane32 should set m.userptr as well. The same happens in v4l2_buffer32 and v4l2-compliance tests for this. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: avoid sizeof(type)Hans Verkuil
Instead of doing sizeof(struct foo) use sizeof(*up). There even were cases where 4 * sizeof(__u32) was used instead of sizeof(kp->reserved), which is very dangerous when the size of the reserved array changes. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32Hans Verkuil
These helper functions do not really help. Move the code to the __get/put_v4l2_format32 functions. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: fix the indentationHans Verkuil
The indentation of this source is all over the place. Fix this. This patch only changes whitespace. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUFHans Verkuil
The result of the VIDIOC_PREPARE_BUF ioctl was never copied back to userspace since it was missing in the switch. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-ioctl.c: don't copy back the result for -ENOTTYHans Verkuil
If the ioctl returned -ENOTTY, then don't bother copying back the result as there is no point. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: v4l2-ioctl.c: use check_fmt for enum/g/s/try_fmtHans Verkuil
Don't duplicate the buffer type checks in enum/g/s/try_fmt. The check_fmt function does that already. It is hard to keep the checks in sync for all these functions and in fact the check for VBI was wrong in the _fmt functions as it allowed SDR types as well. This caused a v4l2-compliance failure for /dev/swradio0 using vivid. This simplifies the code and keeps the check in one place and fixes the SDR/VBI bug. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-30media: vivid: fix module load error when enabling fb and no_error_inj=1Hans Verkuil
If the framebuffer is enabled and error injection is disabled, then creating the controls for the video output device would fail with an error. This is because the Clear Framebuffer control uses the 'vivid control class' and that control class isn't added if error injection is disabled. In addition, this control was added to e.g. vbi devices as well, which makes no sense. Move this control to its own control handler and handle it correctly. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: <stable@vger.kernel.org> # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-29media: dvb_demux: improve debug messagesMauro Carvalho Chehab
Do some cleanup of debug messages, making them cleaner and easier to be used to analyze what's going on. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2018-01-29media: dvb_demux: Better handle discontinuity errorsMauro Carvalho Chehab
When a packet discontinuity happens, it is not just the payload that was lost. The headers are lost too. So, the max size is not 184 but, instead 188. Also, while printing warnings, make a distinction between MPEG-TS indicated discontinuity and detected one. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2018-01-29media: cxusb, dib0700: ignore XC2028_I2C_FLUSHMauro Carvalho Chehab
The XC2028_I2C_FLUSH only needs to be implemented on a few devices. Others can safely ignore it. That prevents filling the dmesg with lots of messages like: dib0700: stk7700ph_xc3028_callback: unknown command 2, arg 0 Cc: stable@vger.kernel.org Fixes: 4d37ece757a8 ("[media] tuner/xc2028: Add I2C flush callback") Reported-by: Enrico Mioso <mrkiko.rs@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2018-01-29media: ts2020: avoid integer overflows on 32 bit machinesMauro Carvalho Chehab
Before this patch, when compiled for arm32, the signal strength were reported as: Lock (0x1f) Signal= 4294908.66dBm C/N= 12.79dB Because of a 32 bit integer overflow. After it, it is properly reported as: Lock (0x1f) Signal= -58.64dBm C/N= 12.79dB Cc: stable@vger.kernel.org Fixes: 0f91c9d6bab9 ("[media] TS2020: Calculate tuner gain correctly") Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: i2c: ov7740: use gpio/consumer.h instead of gpio.hArnd Bergmann
When built on a platform without gpiolib support, we run into a couple of compile errors in ov7740, including: drivers/media/i2c/ov7740.c: In function 'ov7740_set_power': drivers/media/i2c/ov7740.c:307:4: error: implicit declaration of function 'gpiod_direction_output'; did you mean 'gpio_direction_output'? [-Werror=implicit-function-declaration] gpiod_direction_output(ov7740->pwdn_gpio, 0); drivers/media/i2c/ov7740.c:914:4: error: 'GPIOD_OUT_HIGH' undeclared (first use in this function); did you mean 'GPIOF_INIT_HIGH'? Changing it to use the correct header file solves the problem. Fixes: 39c5c4471b8d ("media: i2c: Add the ov7740 image sensor driver") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: entity: Add a nop variant of media_entity_cleanupSakari Ailus
Add nop variant of media_entity_cleanup. This allows calling media_entity_cleanup whether or not Media controller is enabled, simplifying driver code. Also drop #ifdefs on a few drivers around media_entity_cleanup(). Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: ov5640: fix spurious streamon failuresHugues Fruchet
Time to time, stream on is failing with a strange positive error. Error code is returned erroneously by ov5640_set_ctrl_exposure() due to ov5640_get_vts() return value wrongly treated as error. Fix this by forcing ret to 0 after ov5640_get_vts() success call, in order that ret is set to success for rest of code sequence. Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_initYong Zhi
With "pages" initialized to vb length + 1 pages, the condition check if(!pages--) will break at one more page than intended, this can result in out-of-bound access to b->lop[i][j] when setting the last dummy page. Fixes: c7cbef1fdb54 ("media: intel-ipu3: cio2: fix a crash with out-of-bounds access") Signed-off-by: Yong Zhi <yong.zhi@intel.com> Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: intel-ipu3: cio2: mark more PM functions as __maybe_unusedArnd Bergmann
My earlier patch missed two functions, these must be __maybe_unused as well: drivers/media/pci/intel/ipu3/ipu3-cio2.c:1867:12: error: 'cio2_runtime_resume' defined but not used [-Werror=unused-function] drivers/media/pci/intel/ipu3/ipu3-cio2.c:1849:12: error: 'cio2_runtime_suspend' defined but not used [-Werror=unused-function] Fixes: 2086dd35705f ("media: intel-ipu3: cio2: mark PM functions as __maybe_unused") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: drivers/media/common/videobuf2: rename from videobufHans Verkuil
This directory contains the videobuf2 framework, so name the directory accordingly. The name 'videobuf' typically refers to the old and deprecated videobuf version 1 framework so that was confusing. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: cobalt: select CONFIG_SND_PCMArnd Bergmann
The cobalt sound driver has a dependency on ALSA, but not on the PCM helper code, so this can lead to an extremely rare link error in randconfig builds: ERROR: "snd_pcm_period_elapsed" [drivers/media/pci/cobalt/cobalt.ko] undefined! ERROR: "_snd_pcm_stream_lock_irqsave" [drivers/media/pci/cobalt/cobalt.ko] undefined! ERROR: "snd_pcm_hw_constraint_integer" [drivers/media/pci/cobalt/cobalt.ko] undefined! ERROR: "snd_pcm_set_ops" [drivers/media/pci/cobalt/cobalt.ko] undefined! ERROR: "snd_pcm_stream_unlock_irqrestore" [drivers/media/pci/cobalt/cobalt.ko] undefined! ERROR: "snd_pcm_lib_ioctl" [drivers/media/pci/cobalt/cobalt.ko] undefined! ERROR: "snd_pcm_new" [drivers/media/pci/cobalt/cobalt.ko] undefined! The other audio drivers select 'SND_PCM' for this, so let's do the same. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: staging: tegra-vde: select DMA_SHARED_BUFFERArnd Bergmann
Without CONFIG_DMA_SHARED_BUFFER we run into a link error for the dma_buf_* APIs: ERROR: "dma_buf_map_attachment" [drivers/staging/media/tegra-vde/tegra-vde.ko] undefined! ERROR: "dma_buf_attach" [drivers/staging/media/tegra-vde/tegra-vde.ko] undefined! ERROR: "dma_buf_get" [drivers/staging/media/tegra-vde/tegra-vde.ko] undefined! ERROR: "dma_buf_put" [drivers/staging/media/tegra-vde/tegra-vde.ko] undefined! ERROR: "dma_buf_detach" [drivers/staging/media/tegra-vde/tegra-vde.ko] undefined! ERROR: "dma_buf_unmap_attachment" [drivers/staging/media/tegra-vde/tegra-vde.ko] undefined! Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Dmitry Osipenko <digetx@gmail.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: dt-bindings/media/cec-gpio.txt: mention the CEC/HPD max voltagesHans Verkuil
Mention the maximum voltages of the CEC and HPD lines. Since in the example these lines are connected to a Raspberry Pi and the Rpi GPIO lines are 3.3V it is a good idea to warn against directly connecting the HPD to the Raspberry Pi's GPIO line. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Reviewed-by: Rob Herring <robh@kernel.org> Cc: <stable@vger.kernel.org> # for v4.15 Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: dw9714: annotate a __be16 integer valueMauro Carvalho Chehab
As warned: drivers/media/i2c/dw9714.c: warning: incorrect type in initializer (different base types): => 64:19 Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: dw9714: Remove client field in driver's structSakari Ailus
The client field in driver's struct is redundant. Remove it. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Tested-by: Rajmohan Mani <rajmohan.mani@intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: dw9714: Call pm_runtime_idle() at the end of probe()Sakari Ailus
Call pm_runtime_idle() at the end of the driver's probe() function to enable the device to reach low power state once probe() finishes. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Tested-by: Rajmohan Mani <rajmohan.mani@intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: rc: do not remove first bit if leader pulse is presentSean Young
The rc5 protocol does not have a leading pulse or space, but we encode the first bit using a single leading pulse. For other protocols, the leading pulse or space does not represent any bit. So, don't remove the first bit if a leading pulse is present. Cc: Antti Seppälä <a.seppala@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: rc: clean up leader pulse/space for manchester encodingSean Young
The IR rc6 encoder sends the header using manchester encoding using 0 bits, which causes the following: UBSAN: Undefined behaviour in drivers/media/rc/rc-ir-raw.c:247:6 shift exponent 4294967295 is too large for 64-bit type 'long long unsigned int' So, allow the leader code to send a pulse and space and remove the unused pulse_space_start field. Cc: Antti Seppälä <a.seppala@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: lirc: lirc mode ioctls deal with current modeSean Young
The ioctl change the current mode or return the current mode; they do not tell you which modes are possible (use the lirc features ioctl for that). Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: lirc: lirc daemon fails to detect raw IR deviceSean Young
Since commit 9b6192589be7 ("media: lirc: implement scancode sending"), and commit de142c324106 ("media: lirc: implement reading scancode") the lirc features ioctl for raw IR devices advertises two modes for sending and receiving. The lirc daemon now fails to detect a raw IR device, both for transmit and receive. To fix this, do not advertise the scancode mode in the lirc features for raw IR devices (however do keep it for scancode devices). The mode can still be used via the LIRC_SET_{REC,SEND}_MODE ioctl. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: lirc: add module alias for lirc_devSean Young
Since commit a60d64b15c20 ("media: lirc: lirc interface should not be a raw decoder"), there is no lirc_dev module any more. On Ubuntu 16.10, the /etc/init.d/lirc startup script attempts to load the lirc_dev module. Since this module does not exist any more, this script fails. Add an alias so the correct module is loaded. Fixes: a60d64b15c20 ("media: lirc: lirc interface should not be a raw decoder") Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-23media: lirc: don't kfree the uninitialized pointer txbufColin Ian King
The current error exit path if ir_raw_encode_scancode fails is via the label out_kfree which kfree's an uninitialized pointer txbuf. Fix this by exiting via a new exit path that does not kfree txbuf. Also exit via this new exit path for a failed allocation of txbuf to avoid a redundant kfree on a NULL pointer (to save a bunch of CPU cycles). Detected by: CoverityScan, CID#1463070 ("Uninitialized pointer read") Fixes: f81a8158d4fb ("media: lirc: release lock before sleep") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: ov5640: add support of RGB565 and YUYV formatsHugues Fruchet
Add RGB565 (LE & BE) and YUV422 YUYV format in addition to existing YUV422 UYVY format. Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: ov5640: add support of DVP parallel interfaceHugues Fruchet
Add support of DVP parallel mode in addition of existing MIPI CSI mode. The choice between two modes and configuration is made through device tree. Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: dt-bindings: ov5640: refine CSI-2 and add parallel interfaceHugues Fruchet
Refine CSI-2 endpoint documentation and add bindings for DVP parallel interface support. Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: ov5640: check chip idHugues Fruchet
Verify that chip identifier is correct when probing. Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: ov5640: switch to gpiod_set_value_cansleep()Hugues Fruchet
Switch gpiod_set_value to gpiod_set_value_cansleep to avoid warnings when powering sensor. Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: mt9m111: add V4L2_CID_TEST_PATTERN controlAkinobu Mita
The mt9m111 has the test pattern generator features. This makes use of it through V4L2_CID_TEST_PATTERN control. Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: mt9m111: document missing required clocks propertyAkinobu Mita
The mt9m111 driver requires clocks property for the master clock to the sensor, but there is no description for that. This adds it. Cc: Rob Herring <robh@kernel.org> Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: mt9m111: add media controller supportAkinobu Mita
Create a source pad and set the media controller type to the sensor. Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: mt9m111: create subdevice device nodeAkinobu Mita
Set the V4L2_SUBDEV_FL_HAS_DEVNODE flag for the subdevice so that the subdevice device node is created. Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: i2c: Add the ov7740 image sensor driverWenyou Yang
The ov7740 (color) image sensor is a high performance VGA CMOS image snesor, which supports for output formats: RAW RGB and YUV and image sizes: VGA, and QVGA, CIF and any size smaller. Signed-off-by: Songjun Wu <songjun.wu@microchip.com> Signed-off-by: Wenyou Yang <wenyou.yang@microchip.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: ov7740: Document device tree bindingsWenyou Yang
Add the device tree binding documentation for the ov7740 sensor driver. Signed-off-by: Wenyou Yang <wenyou.yang@microchip.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: imx274: Silence uninitialized variable warningDan Carpenter
Smatch complains that "err" can be uninitialized if we have a zero size write. The flow analysis is a little complicated so I'm not sure if that's possible or not, but it's harmless to set this to zero and it makes the code easier to read. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: intel-ipu3: cio2: fix for wrong vb2buf state warningsYong Zhi
cio2 driver should release buffer with QUEUED state when start_stream op failed, wrong buffer state will cause vb2 core throw a warning. Signed-off-by: Yong Zhi <yong.zhi@intel.com> Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2018-01-05media: intel-ipu3: cio2: fix a crash with out-of-bounds accessYong Zhi
When dmabuf is used for BLOB type frame, the frame buffers allocated by gralloc will hold more pages than the valid frame data due to height alignment. In this case, the page numbers in sg list could exceed the FBPT upper limit value - max_lops(8)*1024 to cause crash. Limit the LOP access to the valid data length to avoid FBPT sub-entries overflow. Signed-off-by: Yong Zhi <yong.zhi@intel.com> Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>