media: imx-pxp: add support for i.MX7D

The i.MX7D needs a different data path configuration than the i.MX6ULL.
Configure the data path as close as possible to the data path on the
i.MX6ULL.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-pxp: make data_path_ctrl0 platform dependent

Unfortunately, the PXP_HW_VERSION register reports the PXP on the i.MX7D
and on the i.MX6ULL as version 3.0, although the PXP versions on these
SoCs have significant differences.

Use the compatible to configure the ctrl0 register as required dependent
on the platform.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-pxp: disable LUT block

The LUT block is always configured in bypass mode.

Take it entirely out of the pipeline by disabling it and routing the
data path around the LUT.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-pxp: explicitly disable unused blocks

Various multiplexers in the pipeline are not used with the currently
configured data path. Disable all unused multiplexers by selecting the
"no output" (3) option.

The datasheet doesn't explicitly require this, but the PXP has been seen
to hang after processing a few hundreds of frames otherwise.

As at it, add documentation for the multiplexers that are actually
relevant for the data path.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-pxp: extract helper function to setup data path

The driver must configure the data path through the Pixel Pipeline.

Currently, the driver is using a fixed setup, but once there are
different pipeline configurations, it is helpful to have a dedicated
function for determining the register value for the data path.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-pxp: detect PXP version

Different versions of the Pixel Pipeline have different blocks and their
routing may be different. Read the PXP_HW_VERSION register to determine
the version of the PXP and print it to the log for debugging purposes.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dt-bindings: media: fsl-pxp: convert to yaml

Convert the bindings of the Freescale Pixel Pipeline to YAML.

The conversion drops the previously listed compatibles for several SoCs.
It is unclear, if the PXP on these SoCs is compatible to any of the PXPs
on the existing SoCs and would allow to reuse the already defined
compatibles. The missing compatibles should be brought back when the
support for the PXP on these SoCs is added.

Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-mipi-csis: Implement .init_cfg() using .set_fmt()

The .set_fmt() handler is responsible for adjusting the requested format
based on the device limitations. Implement .init_cfg() as a wrapper of
.set_fmt(), to ensure that the initial configuration always matches the
rules implemented in .set_fmt(), should they ever change.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mn-beacon
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-mipi-csis: Use V4L2 subdev active state

Use the V4L2 subdev active state API to store the active format. This
simplifies the driver not only by dropping the mipi_csis_device csis_fmt
and format_mbus fields, but it also allows dropping the device lock,
replaced with the state lock.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mn-beacon
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-mipi-csis: Pass format explicitly to internal functions

To prepare for usage of the subdev active state that will replace the
csis_fmt and format_mbus fields stored in the mipi_csis_device
structure, pass the format explicitly to the functions called when
starting streaming to avoid accessing those two fields. Not functional
change intended.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mn-beacon
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-mipi-csis: Don't take lock in runtime PM handlers

The runtime PM handlers don't need manual locking as

- they are serialized by the runtime PM core
- they can't race with other functions taking the same lock, as they
  don't access any data protect by that lock

Drop the locking.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mn-beacon
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx-mipi-csis: Rename error labels with 'err_' prefix

It is customary to prefix error labels with 'err_' to make their purpose
clearer. Do so in the probe function.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mn-beacon
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx: imx7-media-csi: Use V4L2 subdev active state

Use the V4L2 subdev active state API to store the active format. This
simplifies the driver not only by dropping the state stored in the
imx7_csi structure, but also by replacing the manual lock with the state
lock.

The is_streaming field is now protected by the active state lock, either
explicitly in .s_stream(), where the active state is locked manually, or
implicitly in .set_fmt(), which is called with the state locked.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mm-beacon-kit
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx: imx7-media-csi: Zero format struct before calling .get_fmt()

The v4l2_subdev_format structure passed to the .get_fmt() subdev
operation in imx7_csi_video_validate_fmt() isn't zeroed, which can cause
undefined behaviour. Fix it.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mm-beacon-kit
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx: imx7-media-csi: Cleanup errors in imx7_csi_async_register()

It's good practice for functions to perform error cleanup internally
when they fail, in order to not leave the device in a half-initialized
state. Move the async notifier cleanup from the probe error path to the
imx7_csi_async_register(), and drop the v4l2_async_nf_unregister() call
as there is no error path after the async notifier gets registered.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mm-beacon-kit
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx: imx7-media-csi: Drop unneeded pad checks

The subdev core guarantees that the .set_fmt() operation is always
called with a valid pad. Drop the unneeded pad checks.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mm-beacon-kit
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx: imx7-media-csi: Drop unneeded src_sd check

The .s_stream() and .link_validate() operations can't be called with a
NULL src_sd, as subdev nodes are not registered before the async
notifier completes. Remove the unneeded checks.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mm-beacon-kit
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx: imx7-media-csi: Drop unneeded check when starting streaming

The .s_stream() operation is guaranteed not to be called to start/stop
an already started/stopped subdev. Remove the unneeded check.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mm-beacon-kit
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx: imx7-media-csi: Simplify imx7_csi_video_init_format()

The imx7_csi_video_init_format() function instantiates a
v4l2_subdev_format on the stack, to only use the .format field of that
structure. Replace it with a v4l2_mbus_framefmt instance.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mm-beacon-kit
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx: imx7-media-csi: Drop imx7_csi.cc field

The imx7_csi.cc field is set but never used. Drop it.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Adam Ford <aford173@gmail.com> #imx8mm-beacon-kit
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Tested-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: saa7134: Use video_unregister_device for radio_dev

The radio device doesn't use vb2, thus calling vb2_video_unregister_device()
which results in the following warning being printed on module unload.

WARNING: CPU: 1 PID: 215963 at drivers/media/common/videobuf2/videobuf2-v4l2.c:1236 vb2_video_unregister_device+0xc6/0xe0 [videobuf2_v4l2]

Fixes: 11788d9b7e91 ("media: media/pci: use vb2_video_unregister_device()")
Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: imx: imx-media-fim: Replace macro icap_enabled() with function

Replace the macro icap_enabled() with a static function to comply
with Linux coding style standards.

Signed-off-by: Brent Pappas <bpappas@pappasbrent.com>
Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: meson: vdec: remove redundant if statement

Checking if sess->fmt_out->pixfmt is V4L2_PIX_FMT_VP9 was already done as a
condition to enter the if statement where this additional check is made.

Signed-off-by: Benjamin Roszak <benjamin545@gmail.com>
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: usb: siano: Fix use after free bugs caused by do_submit_urb

There are UAF bugs caused by do_submit_urb(). One of the KASan reports
is shown below:

[   36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890
[   36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49
[   36.408316]
[   36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8
[   36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584
[   36.416157] Workqueue:  0x0 (events)
[   36.417654] Call Trace:
[   36.418546]  <TASK>
[   36.419320]  dump_stack_lvl+0x96/0xd0
[   36.420522]  print_address_description+0x75/0x350
[   36.421992]  print_report+0x11b/0x250
[   36.423174]  ? _raw_spin_lock_irqsave+0x87/0xd0
[   36.424806]  ? __virt_addr_valid+0xcf/0x170
[   36.426069]  ? worker_thread+0x4a2/0x890
[   36.427355]  kasan_report+0x131/0x160
[   36.428556]  ? worker_thread+0x4a2/0x890
[   36.430053]  worker_thread+0x4a2/0x890
[   36.431297]  ? worker_clr_flags+0x90/0x90
[   36.432479]  kthread+0x166/0x190
[   36.433493]  ? kthread_blkcg+0x50/0x50
[   36.434669]  ret_from_fork+0x22/0x30
[   36.435923]  </TASK>
[   36.436684]
[   36.437215] Allocated by task 24:
[   36.438289]  kasan_set_track+0x50/0x80
[   36.439436]  __kasan_kmalloc+0x89/0xa0
[   36.440566]  smsusb_probe+0x374/0xc90
[   36.441920]  usb_probe_interface+0x2d1/0x4c0
[   36.443253]  really_probe+0x1d5/0x580
[   36.444539]  __driver_probe_device+0xe3/0x130
[   36.446085]  driver_probe_device+0x49/0x220
[   36.447423]  __device_attach_driver+0x19e/0x1b0
[   36.448931]  bus_for_each_drv+0xcb/0x110
[   36.450217]  __device_attach+0x132/0x1f0
[   36.451470]  bus_probe_device+0x59/0xf0
[   36.452563]  device_add+0x4ec/0x7b0
[   36.453830]  usb_set_configuration+0xc63/0xe10
[   36.455230]  usb_generic_driver_probe+0x3b/0x80
[   36.456166] printk: console [ttyGS0] disabled
[   36.456569]  usb_probe_device+0x90/0x110
[   36.459523]  really_probe+0x1d5/0x580
[   36.461027]  __driver_probe_device+0xe3/0x130
[   36.462465]  driver_probe_device+0x49/0x220
[   36.463847]  __device_attach_driver+0x19e/0x1b0
[   36.465229]  bus_for_each_drv+0xcb/0x110
[   36.466466]  __device_attach+0x132/0x1f0
[   36.467799]  bus_probe_device+0x59/0xf0
[   36.469010]  device_add+0x4ec/0x7b0
[   36.470125]  usb_new_device+0x863/0xa00
[   36.471374]  hub_event+0x18c7/0x2220
[   36.472746]  process_one_work+0x34c/0x5b0
[   36.474041]  worker_thread+0x4b7/0x890
[   36.475216]  kthread+0x166/0x190
[   36.476267]  ret_from_fork+0x22/0x30
[   36.477447]
[   36.478160] Freed by task 24:
[   36.479239]  kasan_set_track+0x50/0x80
[   36.480512]  kasan_save_free_info+0x2b/0x40
[   36.481808]  ____kasan_slab_free+0x122/0x1a0
[   36.483173]  __kmem_cache_free+0xc4/0x200
[   36.484563]  smsusb_term_device+0xcd/0xf0
[   36.485896]  smsusb_probe+0xc85/0xc90
[   36.486976]  usb_probe_interface+0x2d1/0x4c0
[   36.488303]  really_probe+0x1d5/0x580
[   36.489498]  __driver_probe_device+0xe3/0x130
[   36.491140]  driver_probe_device+0x49/0x220
[   36.492475]  __device_attach_driver+0x19e/0x1b0
[   36.493988]  bus_for_each_drv+0xcb/0x110
[   36.495171]  __device_attach+0x132/0x1f0
[   36.496617]  bus_probe_device+0x59/0xf0
[   36.497875]  device_add+0x4ec/0x7b0
[   36.498972]  usb_set_configuration+0xc63/0xe10
[   36.500264]  usb_generic_driver_probe+0x3b/0x80
[   36.501740]  usb_probe_device+0x90/0x110
[   36.503084]  really_probe+0x1d5/0x580
[   36.504241]  __driver_probe_device+0xe3/0x130
[   36.505548]  driver_probe_device+0x49/0x220
[   36.506766]  __device_attach_driver+0x19e/0x1b0
[   36.508368]  bus_for_each_drv+0xcb/0x110
[   36.509646]  __device_attach+0x132/0x1f0
[   36.510911]  bus_probe_device+0x59/0xf0
[   36.512103]  device_add+0x4ec/0x7b0
[   36.513215]  usb_new_device+0x863/0xa00
[   36.514736]  hub_event+0x18c7/0x2220
[   36.516130]  process_one_work+0x34c/0x5b0
[   36.517396]  worker_thread+0x4b7/0x890
[   36.518591]  kthread+0x166/0x190
[   36.519599]  ret_from_fork+0x22/0x30
[   36.520851]
[   36.521405] Last potentially related work creation:
[   36.523143]  kasan_save_stack+0x3f/0x60
[   36.524275]  kasan_record_aux_stack_noalloc+0x9d/0xb0
[   36.525831]  insert_work+0x25/0x130
[   36.527039]  __queue_work+0x4d4/0x620
[   36.528236]  queue_work_on+0x72/0xb0
[   36.529344]  __usb_hcd_giveback_urb+0x13f/0x1b0
[   36.530819]  dummy_timer+0x350/0x1a40
[   36.532149]  call_timer_fn+0x2c/0x190
[   36.533567]  expire_timers+0x69/0x1f0
[   36.534736]  __run_timers+0x289/0x2d0
[   36.535841]  run_timer_softirq+0x2d/0x60
[   36.537110]  __do_softirq+0x116/0x380
[   36.538377]
[   36.538950] Second to last potentially related work creation:
[   36.540855]  kasan_save_stack+0x3f/0x60
[   36.542084]  kasan_record_aux_stack_noalloc+0x9d/0xb0
[   36.543592]  insert_work+0x25/0x130
[   36.544891]  __queue_work+0x4d4/0x620
[   36.546168]  queue_work_on+0x72/0xb0
[   36.547328]  __usb_hcd_giveback_urb+0x13f/0x1b0
[   36.548805]  dummy_timer+0x350/0x1a40
[   36.550116]  call_timer_fn+0x2c/0x190
[   36.551570]  expire_timers+0x69/0x1f0
[   36.552762]  __run_timers+0x289/0x2d0
[   36.553916]  run_timer_softirq+0x2d/0x60
[   36.555118]  __do_softirq+0x116/0x380
[   36.556239]
[   36.556807] The buggy address belongs to the object at ffff888005960000
[   36.556807]  which belongs to the cache kmalloc-4k of size 4096
[   36.560652] The buggy address is located 232 bytes inside of
[   36.560652]  4096-byte region [ffff888005960000, ffff888005961000)
[   36.564791]
[   36.565355] The buggy address belongs to the physical page:
[   36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00
[   36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0
[   36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1)
[   36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000
[   36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
[   36.580175] page dumped because: kasan: bad access detected
[   36.581994]
[   36.582548] Memory state around the buggy address:
[   36.583983]  ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   36.586240]  ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   36.591071]                                                           ^
[   36.593295]  ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   36.595705]  ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   36.598026] ==================================================================
[   36.600224] Disabling lock debugging due to kernel taint
[   36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I
[   36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G    B              6.2.0-rc3-15798-8
[   36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584
[   36.615026] Workqueue: events do_submit_urb
[   36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0
[   36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5
[   36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046
[   36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7
[   36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0
[   36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f
[   36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020
[   36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001
[   36.636438] FS:  0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
[   36.639092] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0
[   36.643411] Call Trace:
[   36.644215]  <TASK>
[   36.644902]  smscore_getbuffer+0x3e/0x1e0
[   36.646147]  do_submit_urb+0x4f/0x190
[   36.647449]  process_one_work+0x34c/0x5b0
[   36.648777]  worker_thread+0x4b7/0x890
[   36.649984]  ? worker_clr_flags+0x90/0x90
[   36.651166]  kthread+0x166/0x190
[   36.652151]  ? kthread_blkcg+0x50/0x50
[   36.653547]  ret_from_fork+0x22/0x30
[   36.655051]  </TASK>
[   36.655733] Modules linked in:
[   36.656787] ---[ end trace 0000000000000000 ]---
[   36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0
[   36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5
[   36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046
[   36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7
[   36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0
[   36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f
[   36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020
[   36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001
[   36.679184] FS:  0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
[   36.681655] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0
[   36.685733] Kernel panic - not syncing: Fatal exception
[   36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff)
[   36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]---

When the siano device is plugged in, it may call the following functions
to initialize the device.

smsusb_probe()-->smsusb_init_device()-->smscore_start_device().

When smscore_start_device() gets failed, the function smsusb_term_device()
will be called and smsusb_device_t will be deallocated. Although we use
usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests
and wait for them to finish, the worker threads that are scheduled by
smsusb_onresponse() may be still running. As a result, the UAF bugs
could happen.

We add cancel_work_sync() in smsusb_stop_streaming() in order that the
worker threads could finish before the smsusb_device_t is deallocated.

Fixes: dd47fbd40e6e ("[media] smsusb: don't sleep while atomic")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb-frontends: mb86a16.c: always use the same error path

If the message length was wrong, the dprintk() after the 'err' label
was bypassed. Fix that, and fix a smatch warning at the same time:

mb86a16.c:1514 mb86a16_send_diseqc_msg() warn: missing unwind goto?

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: i2c: ov7670: 0 instead of -EINVAL was returned

If the media bus is unsupported, then return -EINVAL. Instead it
returned 'ret' which happened to be 0.

This fixes a smatch warning:

ov7670.c:1843 ov7670_parse_dt() warn: missing error code? 'ret'

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 01b8444828fc ("media: v4l2: i2c: ov7670: Implement OF mbus configuration")
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: ti: davinci: vpbe_display.c: return 0 instead of 'ret'.

Since 'ret' is known to be 0, just return '0'. This fixes a smatch warning:

vpbe_display.c:1152 vpbe_display_open() warn: missing error code? 'err'

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: mediatek: vcodec/venc: return 0 instead of 'ret'.

Since 'ret' is known to be 0, just return '0'. This fixes a smatch warning:

venc_h264_if.c:568 h264_encode_frame() warn: missing error code? 'ret'

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Andrew-CT Chen <andrew-ct.chen@mediatek.com>
Cc: Yunfei Dong <yunfei.dong@mediatek.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: mediatek: mdp3: replace return by goto for proper unwind

An error was returned at one point without going through the
goto label for proper unwinding.

This fixes a smatch warning:

mtk-mdp3-comp.c:1005 mdp_comp_config() warn: missing unwind goto?

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Moudy Ho <moudy.ho@mediatek.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb-frontends: drx39xyj: replace return with goto for proper unwind

In three places there was a return instead of a goto to the unwind
code.

This fixes three smatch warnings:

drxj.c:9542 ctrl_get_qam_sig_quality() warn: missing unwind goto?
drxj.c:10919 ctrl_set_standard() warn: missing unwind goto?
drxj.c:11466 drxj_open() warn: missing unwind goto?

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: marvell: change return to goto for proper unwind

The probe function used 'goto out' everywhere, except in one
place where it returned an error. That too should be a 'goto out'.

This fixes a smatch warning:

mmp-driver.c:257 mmpcam_probe() warn: missing unwind goto?

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb-frontends: cxd2880: return 0 instead of 'ret'.

Since 'ret' is known to be 0, just return '0'. This fixes 10 smatch warnings:

cxd2880_tnrdmd_dvbt.c:836 cxd2880_tnrdmd_dvbt_check_demod_lock() warn: missing error code? 'ret'
cxd2880_tnrdmd_dvbt.c:841 cxd2880_tnrdmd_dvbt_check_demod_lock() warn: missing error code? 'ret'
cxd2880_tnrdmd_dvbt.c:896 cxd2880_tnrdmd_dvbt_check_ts_lock() warn: missing error code? 'ret'
cxd2880_tnrdmd_dvbt.c:901 cxd2880_tnrdmd_dvbt_check_ts_lock() warn: missing error code? 'ret'
cxd2880_tnrdmd_dvbt.c:904 cxd2880_tnrdmd_dvbt_check_ts_lock() warn: missing error code? 'ret'
cxd2880_tnrdmd_dvbt2.c:1027 cxd2880_tnrdmd_dvbt2_check_demod_lock() warn: missing error code? 'ret'
cxd2880_tnrdmd_dvbt2.c:1032 cxd2880_tnrdmd_dvbt2_check_demod_lock() warn: missing error code? 'ret'
cxd2880_tnrdmd_dvbt2.c:1087 cxd2880_tnrdmd_dvbt2_check_ts_lock() warn: missing error code? 'ret'
cxd2880_tnrdmd_dvbt2.c:1092 cxd2880_tnrdmd_dvbt2_check_ts_lock() warn: missing error code? 'ret'
cxd2880_tnrdmd_dvbt2.c:1095 cxd2880_tnrdmd_dvbt2_check_ts_lock() warn: missing error code? 'ret'

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Yasunari Takiguchi <Yasunari.Takiguchi@sony.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: usb: dvb-usb-v2: af9015.c: return 0 instead of 'ret'.

Since 'ret' is known to be 0, just return '0'. This fixes two smatch warnings:

af9015.c:1168 af9015_rc_query() warn: missing error code? 'ret'
af9015.c:1177 af9015_rc_query() warn: missing error code? 'ret'

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dvb-frontends: cxd2880: return 0 instead of 'ret'.

Since 'ret' is known to be 0, just return '0'. This fixes two smatch warnings:

cxd2880_tnrdmd.c:2165 cxd2880_tnrdmd_check_internal_cpu_status() warn: missing error code? 'ret'
cxd2880_tnrdmd.c:2169 cxd2880_tnrdmd_check_internal_cpu_status() warn: missing error code? 'ret'

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Yasunari Takiguchi <Yasunari.Takiguchi@sony.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: i2c: s5c73m3: return 0 instead of 'ret'.

Since 'ret' is known to be 0, just return '0'. This fixes a smatch warning:

s5c73m3-core.c:439 __s5c73m3_s_stream() warn: missing error code? 'ret'

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: davinci/vpif.c: drop unnecessary cast

DEFINE_RES_IRQ_NAMED already casts to (struct resource), so no
need to do it again.

This fixes a sparse warning:

vpif.c:483:20: warning: cast to non-scalar

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: visl: make visl_qops static

This struct can be static. This fixes a sparse warning:

visl-video.c:690:22: warning: symbol 'visl_qops' was not declared. Should it be static?

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: Daniel Almeida <daniel.almeida@collabora.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: pci: sh_css: Inline single invocation of macro STATS_ENABLED()

Inline the single invocation of the macro STATS_ENABLED().
The macro abstraction is not necessary because the logic behind it is only
used once.

Link: https://lore.kernel.org/r/20230120171408.16099-1-bpappas@pappasbrent.com
Signed-off-by: Brent Pappas <bpappas@pappasbrent.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: pci: hive_isp_css_common: host: vmem: Replace SUBWORD macros with functions

Replace the macros SUBWORD() and INV_SUBWORD() with functions to comply
with Linux coding style standards.

Link: https://lore.kernel.org/r/20230120182625.23227-1-bpappas@pappasbrent.com
Signed-off-by: Brent Pappas <bpappas@pappasbrent.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: pci: Replace bytes macros with functions

Replace the function-like macros FPNTBL_BYTES(), SCTBL_BYTES(), and
MORPH_PLANE_BYTES() with functions to comply with Linux coding style
standards.
Replace multiplication with calls to array_size() and array3_size()
to prevent accidental arithmetic overflow.

Link: https://lore.kernel.org/r/20230118160739.26059-1-bpappas@pappasbrent.com
Signed-off-by: Brent Pappas <bpappas@pappasbrent.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2722: Power on sensor from set_fmt() callback

Depending on which order userspace makes various v4l2 calls, the sensor
might still be powered down when set_fmt is called.

What should really happen here is delay the writing of the mode-related
registers till streaming is started, but for now use the same quick fix
as the atomisp_ov2680 / atomisp_gc0310 code and call power_up() from
set_fmt() in combination with keeping track of the power-state to avoid
doing the power-up sequence twice.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2722: Don't take the input_lock for try_fmt calls.

On ov2722_set_fmt() calls with format->which == V4L2_SUBDEV_FORMAT_TRY,
ov2722_set_fmt() does not talk to the sensor, so there is no need to
lock the dev->input_lock mutex in this case.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2722: Fix GPIO1 polarity

The comment claims the PWDN pin is active when pulled down in other words,
it is /power-down so it needs to be driven high to get the sensor
powered-up (not powered down) and flag is 1 when powering-up the sensor
so the ! is wrong, drop it.

This also matches with the schematics which I have which shows GPIO1 also
enables a 3.3v line to the sensor-module which controls the privacy-LED
and indeed before this patch the privacy LED was inverted from what it
should be (and the sensor did not work).

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2722: Call atomisp_gmin_remove_subdev() on probe failure

Call atomisp_gmin_remove_subdev() on probe failure to properly free
the GPIOs and other resources acquired by the gmin_camera_platform_data()
call earlier.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Switch over to ACPI powermanagement

The DSDT of all Windows BYT / CHT devices which I have seen has proper
ACPI powermagement for the clk and regulators used by the sensors.

So there is no need for the whole custom atomisp_gmin custom code to
disable the ACPI pm and directly poke at the PMIC for this.

Replace all the atomisp_gmin usage with using the new
atomisp_register_sensor_no_gmin() / atomisp_unregister_subdev()
helpers which allow registering a sensor with the atomisp code
without using any of the atomisp_gmin power-management code.

Note eventually these calls should be replaced by the standard
v4l2_async_register_subdev_sensor() mechanism.

But this first requires a bunch of work to the atomisp main code
to make it set the necessary fwnodes up, similar to how
drivers/media/pci/intel/ipu3/cio2-bridge.c does this.

This has been tested on:
-Trekstor Surftab duo W1 10.1, CHT, AXP288 PMIC, 2x ov2680 sensor
-Asus T101HA, CHT, TI PMIC, 1x ov2680 sensor
-MPMAN Converter 9, BYT, AXP288 PMIC, ov2680 back, gc0310 front sensor

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Use devm_kzalloc() for sensor data struct

Use devm_kzalloc() to allocate the sensor data struct. It is always free-ed
as the last step of probe-error-exit or remove, so it can be devm-managed.

This will make unwinding things easier when support is added to the ov2680
code to use standard GPIO APIs instead of the custom atomisp_gmin code.

This also allows dropping the out_free label and use direct return
on errors.

This may seem like a functional change since the out_free label also
did a v4l2_device_unregister_subdev() but at the 2 changed returns
the device is not registered yet, so that always is a no-op and can
be dropped.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Add dev local variable to probe()

Add a dev local variable to probe(), to allow shortening
&client->dev in various places, including further patches
in this series.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: s/dev/sensor/

Using dev as name for variables pointing to struct ov2680_device is a bit
unfortunate choice.

All the recently added / rewritten code is already using sensor for this,
replace the remaining usages of "struct ov2680_device *dev" with
"struct ov2680_device *sensor".

Note the power_up()/power_down() related functions are not changed as
these will be removed in one of the next patches.

No functional changes.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Add runtime-pm support

Add runtime-pm support. This is a preparation patch for letting
ACPI deal with the regulators and clocks instead of the DIY code
in atomisp_gmin_platform.c.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Delay power-on till streaming is started

Move the setting of the mode to stream on, this also allows
delaying power-on till streaming is started.

And drop the deprecated s_power callback since this now no long
is necessary.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Cleanup includes

Remove unused includes and sort the remaining ones alphabetically.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Consistently indent define values

Use the same indentation level for all #define values.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Drop MAX_FMTS define

The ov2680 only supports a single format, there is no need to
use a define for this.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Remove unused data-types and defines from ov2680.h

Remove a bunch of unused data-types and defines from ov2680.h.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Fix frame_size list

3 fixes for the framesize list:

1. Drop modes < 640x480, these are made by significant cropping,
   leading to such a small remainig field-of-view that they are
   not really usable

2. 1616x1082 is presumably intended to be 1600x1080 + 16 pixels
   padding in both dimensions, but the height is wrong.
   Change this to 1616x1096.

3. The 800x600 mode is missing the 16 pixels padding and
   720x592 is missing 16 pixels padding in its width and
   the 720x576 base mode is a mode with non square pixels,
   while the sensor has square pixels.
   Replace both with 768x576 + 16 pixels padding -> 784x592

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Drop struct ov2680_resolution / ov2680_res_preview

Drop struct ov2680_resolution and the ov2680_res_preview[] array,
this is now only used in ov2680_enum_frame_size() and only
the width + height are used there.

Replace this with a new struct v4l2_frmsize_discrete ov2680_frame_sizes[]
array.

No functional changes.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Drop v4l2_find_nearest_size() call from set_fmt()

Since we now calculate timings baded on the desired width and height,
any width and height are valid as long as they don't exceed the sensor's
dimensions.

Drop the v4l2_find_nearest_size() call and instead clamp the requested
width and height.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Fix ov2680_enum_frame_interval()

Fix and simplify ov2680_enum_frame_interval(), the index is not
an index into ov2680_res_preview[], so using N_PREVIEW is wrong.

Instead it is an index indexing the different framerates for
the resolution specified in fie->width, fie->height.

Since the ov2680 code only supports a single fixed 30 fps,
index must always be 0 and we don't need to check the other
fie input values.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Drop unused res member from struct ov2680_device

The res member of struct ov2680_device isn't read anywhere anymore,
drop it.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Use defines for fps, lines-per-frame and skip-frames

The fps, lines-per-frame and skip-frames values are the same for all
resolutions, use defines for these.

The ov2680_res_preview[] incorrectly sets fps to 60 for some low-res
modes, this is incorrect with the current fixed (resolution independent)
lines-per-frame value.

Note this not drop the now no longer used fps, lines-per-frame and
skip-frames struct ov2680_resolution members. The entire struct is going
away in the next patches so that would just cause unnecessary changes.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Make setting the modes algorithm based

Instead of using a long fixed register settings list for each resolution,
calculate the register settings based on the requested width + height.

This will allow future enhancements like adding hblank and vblank controls
and adding selection support.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Fix window settings and enable window for all resolutions

By default the ov2680 automatically sets the window to match the outputsize
and automatically adjusts it to keep the bayer pattern stable when enabling
hflip/vflip.

This does not work for the 1616x1216 mode because there is no room to
adjust the window there. To make flipping work in the 1616 wide modes the
register lists for those modes set bit 0 of 0x5708 (manual_win_en) to 1 and
ov2680_set_bayer_order() updates the bayer-order on the pad to match.

But ov2680_set_bayer_order() is always called, so when enabling flipping
on modes with a width of less then 1616 now results in the wrong bayer
order being reported on the pad since the sensor is auto-adjusting
the window in this case.

Specify the correct (== output-size) window-size in all resolutions
register-list and always set the manual_win_en bit, so that the bayer order
is changed on hflip/vflip enable on all resolutions.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Add test pattern control

Add a test pattern control. This is a 1:1 copy of the test pattern
control in the main drivers/media/i2c/ov2680.c driver.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Add exposure and gain controls

Add exposure and gain controls. This allows controlling
the exposure and gain through standard v4l2 IOCTLs.

Note the register defines for the exposure and gain registers
are renamed to match the datasheet.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Drop custom ATOMISP_IOC_S_EXPOSURE support

Exposure and gain control should use standard v4l2 controls,
not a custom ioctl.

The next patch in this series will re-add support as standard controls,
this is split into 2 patches for easier reviewing.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Rework flip ctrls

Rework the flip ctrls to be more like those of mainline (non staging)
drivers.

This is modelled after the main ov2680 and ov5693 drivers. This also
introduces __ov2680_get_pad_format() to make the ov2680 code more compliant
with the mainline v4l2-subdev APIs.

Note the OV2680_FLIP_REG and OV2680_MIRROR_REG defines are renamed to
OV2680_REG_FORMAT1 and OV2680_REG_FORMAT2 to match the datasheet.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: ov2680: Use the new ov_16bit_addr_reg_helpers.h

Use the new ov_16bit_addr_reg_helpers.h instead of duplicating
the ovxxxx sensor I2C register access helpers found in many different
sensor drivers.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: core: add ov_16bit_addr_reg_helpers.h

The following drivers under drivers/media/i2c: ov08x40.c, ov13858.c,
ov13b10.c, ov2680.c, ov2685.c, ov2740.c, ov4689.c, ov5670.c,
ov5675.c, ov5695.c, ov8856.c, ov9282.c and ov9734.c,

as well as various "atomisp" sensor drivers in drivers/staging, *all*
use register access helpers with the following function prototypes:

int ovxxxx_read_reg(struct ovxxxx_dev *sensor, u16 reg,
                    unsigned int len, u32 *val);

int ovxxxx_write_reg(struct ovxxxx_dev *sensor, u16 reg,
                     unsigned int len, u32 val);

To read/write registers on Omnivision OVxxxx image sensors wich expect
a 16 bit register address in big-endian format and which have 1-3 byte
wide registers, in big-endian format (for the higher width registers).

Add a new ov_16bit_addr_reg_helpers.h header file with static inline
versions of these register access helpers, so that this code duplication
can be removed.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Properly initialize function field of media-entity links

Don't use MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN to initialize the function field
of various media-entity links.

This fixes the following warnings showing up in dmesg:

 atomisp-isp2 0000:00:03.0: Entity type for entity ATOM ISP CSI2-port0 was not initialized!
 atomisp-isp2 0000:00:03.0: Entity type for entity ATOM ISP CSI2-port1 was not initialized!
 atomisp-isp2 0000:00:03.0: Entity type for entity ATOM ISP CSI2-port2 was not initialized!
 atomisp-isp2 0000:00:03.0: Entity type for entity tpg_subdev was not initialized!
 atomisp-isp2 0000:00:03.0: Entity type for entity ATOMISP_SUBDEV_0 was not initialized!
 atomisp-isp2 0000:00:03.0: Entity type for entity ATOMISP_SUBDEV_1 was not initialized!

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove csi2_link_setup()

Looking at csi2_link_setup(), this function can never work,
it does a switch-case like this:

 switch (local->index | is_media_entity_v4l2_subdev(remote->entity))

with cases like this:

 case ATOMISP_SUBDEV_PAD_SOURCE | MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN

where ATOMISP_SUBDEV_PAD_SOURCE matches an index (0-1) and
MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN is 0x00020000, but
is_media_entity_v4l2_subdev(remote->entity) does not return
MEDIA_ENT_F_* values, it return a bool, so 0 or 1 which means
that non of the cases can ever match the input value.

Looking at the rest of the function all it ever does (if it
would actually hit one of the cases) is set the atomisp_mipi_csi2_device
struct's output member.

And checking the rest of the atomisp code that member is never
read. Also userspace does not actually setup media-controller
links when using the atomisp /dev/video$ nodes since all the links
are fixed. So csi2_link_setup() never runs.

Remove the unnecessary and broken csi2_link_setup() function
and also remove the unused atomisp_mipi_csi2_device struct's
output member.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove isp_subdev_link_setup()

Looking at isp_subdev_link_setup(), this function can never work,
it does a switch-case like this:

 switch (local->index | is_media_entity_v4l2_subdev(remote->entity))

with cases like this:

 case ATOMISP_SUBDEV_PAD_SINK | MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN

where ATOMISP_SUBDEV_PAD_SINK matches an index (0-4) and
MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN is 0x00020000, but
is_media_entity_v4l2_subdev(remote->entity) does not return
MEDIA_ENT_F_* values, it return a bool, so 0 or 1 which means
that non of the cases can ever match the input value.

Looking at the rest of the function all it ever does (if it
would actually hit one of the cases) is set the atomisp_sub_device
struct's input member.

And checking the rest of the atomisp code that member is never
read. Also userspace does not actually setup media-controller
links when using the atomisp /dev/video$ nodes since all the links
are fixed. So isp_subdev_link_setup() never runs.

Remove the unnecessary and broken isp_subdev_link_setup() function
and also remove the unused atomisp_sub_device struct's input member.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Put sensor ACPI devices in D3 before disable ACPI power-resources

The device core will call ACPI to turn the device (i2c_client) for a sensor
on / put it in D0 before calling its probe() method.

This takes a reference on all of the ACPI power-resources belonging to
the device. Since the atomisp_gmin_platform code disables ACPI
power-resource management and does its own pm, this reference never gets
released.

This is a problem for ACPI power-resources which are shared with other
devices since those now never get turned off again (nor back on again).

Explicitly put the device in D3 before disabling the ACPI power-resource
management.

Note that atomisp_register_i2c_module() runs near the end of the sensor
driver's probe() function, after the driver is done with probing the hw.
So the power-resouces (the same resources as directly controlled by
the atomisp platform code) getting turned off (a second time, as they are
already off) is not a problem.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Stop overriding padding w/h to 12 on BYT

atomisp_set_fmt() first does:

v4l2_fill_mbus_format(&vformat.format, ...);
        vformat.format.height += padding_h;
        vformat.format.width += padding_w;

        ret = v4l2_subdev_call(isp->inputs[asd->input_curr].camera, pad,
                               set_fmt, NULL, &vformat);
        if (ret)
                return ret;

f->fmt.pix.width = vformat.format.width - padding_w;
f->fmt.pix.height = vformat.format.height - padding_h;

this happens with the original padding w/h = 16 values and then later
on it calls:

                ret = atomisp_set_fmt_to_snr(vdev, &s_fmt,
                                             f->fmt.pix.pixelformat, padding_w,
                                             padding_h, dvs_env_w, dvs_env_h);

Which repeats the above structure. If at that point padding w/h are
changed to 12 then it will now request a different output-size of
the sensor driver.

The sensor drivers so far have actually been ignoring this since they use
v4l2_find_nearest_size() on a fixed resolution list and the nearest
resolution will be the one from the earlier calls where padding w/h
was 16.

But there really is no reason for sensor drivers to use a fixed
resolution list. They make lower resolutions using cropping so they
can make any resolution as long as width/height are even numbers.

Dropping the fixed-resolution list limit from sensors on BYT results
in trying to start streaming failing because the resolution set to
the sensor now no longer matches with the resolution used during
the initial part of the configuration done by atomisp_set_fmt().

Drop the BYT specific overriding of the padding_w/h to 12, so that
the padding in the first and second s_fmt calls made to the sensor
matches, to fix stream start failing when the fixed resolution list
is dropped.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Drop ffmt local var from atomisp_set_fmt()

ffmt is a local variable pointing to a substruct of another local
variable which really just makes the code harder to read / follow,
so drop it.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Add atomisp_register_sensor_no_gmin() helper

The DSDT of all Windows BYT / CHT devices which I have seen has proper
ACPI powermagement for the clk and regulators used by the sensors.

So there is no need for the whole custom atomisp_gmin custom code to
disable the ACPI pm and directly poke at the PMIC for this.

Add new atomisp_register_sensor_no_gmin() + atomisp_unregister_subdev()
helpers which allow registering a sensor with the atomisp code without
using any of the atomisp_gmin power-management code.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove atomisp_gmin_find_subdev()

atomisp_gmin_find_subdev() can be used to lookup a subdev
given its i2c-adapter + i2c-client-address.

But the only caller of it reads this from the intel_v4l2_subdev_table
struct and that same struct already contains a pointer to the v4l2_subdev.

So this function is not necessary, drop it and modify its only caller
to directly take the subdev from the intel_v4l2_subdev_table struct.

Also drop struct intel_v4l2_subdev_i2c_board_info since that now no
longer is used.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Allow sensor drivers without a s_power callback

The s_power callback for v4l2-subdevs has been deprecated, allow sensor
drivers without a s_power callback to work by ignoring the -ENOIOCTLCMD
return value.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Do not turn off sensor when the atomisp-sub-dev does not own it

The atomisp driver creates 8 /dev/video# device nodes. 4 nodes (preview /
video / viewfinder / capture) for each of 2 possible streams aka
atomisp-sub-device-s (asd-s).

Both streams start with asd->input_curr set to 0 (to the first sensor),
opening + releasing a file-handle on one of the nodes of an asd,
while streaming from the other asd causes the sensor to get turned off,
leading to the stream failing.

The atomisp-code already tracks which asd "owns" a specific sensor,
use this to only turn the sensor off if it is owned by the asd.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove unnecessary memset(foo, 0, sizeof(foo)) calls

The memory for all of struct atomisp_video_pipe is kzalloc()-ed in
atomisp_subdev_init() so there is no need to memset parts of
struct atomisp_video_pipe to 0.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Drop atomisp_init_pipe()

atomisp_init_pipe() does 3 things:

1. Init a bunch of list-heads / locks
2. Init the vb_queue for the videodev (aka pipe)
3. zero the per-frame parameters related variables of the pipe

1. and 2. really should not be done at file-open time, but once at probe.
Currently the code is getting away with doing this on every videodev-open
because only 1 open is allowed at a time.

1. is already done at probe time by atomisp_init_subdev_pipe(), move 2. to
atomisp_init_subdev_pipe() so that it is also done once at probe.

As for 3. The per-frame parameters can only be set from a qbuf ioctl,
which can only happen after a reqbufs ioctl and atomisp_buf_cleanup
already zeros the per-frame parameters when the buffers are released,
so 3. is not necessary at all.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove deferred firmware loading support

Make atomisp behave like any other drivers and have it load the firmware
at probe time (as it was already doing by default).

The deferred firmware loading support needlessly complicates the
v4l2_file_operations.open callback (atomisp_open()), getting in
the way of allowing multiple opens like a normal v4l2 device would.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove no longer used binning info from sensor resolution info

Remove the no longer used bin_factor_x, bin_factor_y and bin_mode members
from the resolution info inside various atomisp camera sensor drivers.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove V4L2_CID_BIN_FACTOR_HORZ/_VERT

The bin-factor-x and bin-factor-y ctrls are only used internally to
get a single value to pass to atomisp_css_input_set_binning_factor(),
which is supposed to tune the lens-shading correction for the binning
factor. But all sensor drivers return either 0 or 1 for this,
with 0 meaning unset and 1 meaning no-binning. Even though some modes
do actually do binning ...

Also note that the removed atomisp_get_sensor_bin_factor() would fall
back to 0 if either the x and y factor differ or if the ctrls are not
implemented (not all sensor drivers implement them).

Simply always pass 0 to atomisp_css_input_set_binning_factor().

This is part of a patch-series which tries to remove atomisp specific /
custom code from the sensor drivers, with as end goal to make the atomisp
drivers regular camera sensor drivers.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove custom ATOMISP_IOC_G_SENSOR_MODE_DATA ioctl

This ioctl returns a number of fixed sensor parameters +
a number of mode-specific parameters.

With libcamera these fixed parameters are instead stored in a table
with sensor-name to parameters mappings (camera_sensor_properties.cpp);
and the variable parameters can be derived from the set fmt.

So this custom ioctl is not necessary; and it currently has no users.

Remove the ioctl and all the sensor drivers xxxx_get_intg_factor()
helpers which return this info.

This is part of a patch-series which tries to remove atomisp specific /
custom code from the sensor drivers, with as end goal to make the atomisp
drivers regular camera sensor drivers.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove custom ATOMISP_IOC_ISP_MAKERNOTE ioctl

This ioctl simply returns a couple of fixed sensor parameters.

With libcamera these fixed parameters are instead stored in a table
with sensor-name to parameters mappings (camera_sensor_properties.cpp),
so this custom ioctl is not necessary; and it currently has no users.

Remove the ioctl and also remove the custom v4l2-ctrls underpinning
the ioctl.

This is part of a patch-series which tries to remove atomisp specific /
custom code from the sensor drivers, with as end goal to make the atomisp
drivers regular camera sensor drivers.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove useless msleep(10) before power-on on BYT

On BYT on poweron/runtime-resume the code is doing:

1. Do nothing
2. msleep(10)
3. Start actual poweron sequence

Since the runtime resume can happen at any moment, waiting 10ms
after it does not really make any sense.

According to both the comment and to:
https://github.com/intel/ProductionKernelQuilts/blob/master/uefi/cht-m1stable/patches/cam-0341-atomisp-WA-sleep-10ms-when-power-up-ISP-on-byt.patch

Which is the patch which originally added this this was added
as a workaround for a single test failing on a single model
tablet/laptop. So lets just drop this.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove non working doorbell check from punit_ddr_dvfs_enable()

punit_ddr_dvfs_enable() is only used on CHT devices and there dmesg
gets filled with: "DDR DVFS, door bell is not cleared within 3ms"
messages, so clearly the doorbell checking is not working.

This check was added by:
https://github.com/intel/ProductionKernelQuilts/blob/master/uefi/cht-m1stable/patches/cam-0340-atomisp-add-door-bell-for-ddr-dvfs-on-cht.patch

Which commit message says: "PUNIT interface added to check Req_ACK
of freq status". This suggests that the doorbell mechanism may only
be available with certain PUNIT fw versions and it seems that
many CHT devices do not have this fw version; that or the doorbell
mechanism is not working for other reasons.

Revert cam-0340-atomisp-add-door-bell-for-ddr-dvfs-on-cht.patch,
replacing the doorbell check with a msleep(20) this fixes dmesg
getting filled with error messages.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Silence "isys dma store at addr, val" debug messages

These are clearly debug messages, printing these all the time is not
useful.

Silence these by simply removing them altogether.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Move power-management over to a custom pm-domain

The atomisp does not use standard PCI power-management through the
PCI config space. Instead this driver directly tells the P-Unit to
disable the ISP over the IOSF. The standard PCI subsystem pm_ops will
try to access the config space before (resume) / after (suspend) this
driver has turned the ISP on / off, resulting in the following errors:

 Unable to change power state from D0 to D3hot, device inaccessible
 Unable to change power state from D3cold to D0, device inaccessible

Getting logged into dmesg a whole bunch of time during boot as well as
every time the camera is used.

To avoid these errors use a custom pm_domain instead of standard driver
pm-callbacks so that all the PCI subsys suspend / resume handling is
skipped and call pci_save_state() / pci_restore_state() ourselves.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Remove atomisp_sw_contex struct

Remove the atomisp_sw_contex struct, it has only 1 member: running_freq,
instead store running_freq directly.

While at it also change running_freq from an int to an unsigned int,
all values stored in it are unsigned and it is compared to the also
unsigned new_freq variable.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Fix regulator registers on BYT devices with CRC PMIC

The Crystal Cove PMIC used on some BYT/CHT devices has different revisions
when paired with Bay Trail (BYT) vs Cherry Trail (CHT) SoCs.

The current hardcoded values are only valid for CHT devices, change
the code so that it uses the correct register values on both BYT and CHT.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Check buffer index is in range inside atomisp_qbuf_wrapper()

Check buffer index is in range inside atomisp_qbuf_wrapper() before
using it do index pipe->frame_request_config_id[].

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Fix WARN() when the vb2 start_streaming callback fails

The videobuf2-core expects buffers to be put back in the queued state
when the vb2 start_streaming callback fails. But the atomisp
atomisp_flush_video_pipe() would unconditionally return them to the core
in an error state.

This triggers the following warning in the videobuf2-core:

drivers/media/common/videobuf2/videobuf2-core.c:1652:
/*
 * If done_list is not empty, then start_streaming() didn't call
 * vb2_buffer_done(vb, VB2_BUF_STATE_QUEUED) but STATE_ERROR or
 * STATE_DONE.
 */
WARN_ON(!list_empty(&q->done_list));

Fix this by adding a state argument to atomisp_flush_video_pipe() and use
VB2_BUF_STATE_QUEUED as state when atomisp_start_streaming() fails.

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Only set default_run_mode on first open of a stream/asd

Calling v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode) when
the stream is already active (through another /dev/video# node) causes
the stream to stop.

Move the call to set the default run-mode so that it is only done
on the first open of one of the 4 /dev/video# nodes of one of
the 2 streams (atomisp-sub-devices / asd-s).

Fixes: 2c45e343c581 ("media: atomisp: set per-device's default mode")
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: Propagate set_fmt() errors in queue_setup()

If set_fmt() fails make queue_setup() actually return the error instead of
returning 0.

This fixes the following oops on set_fmt() failures:

[ 1060.378662] ------------[ cut here ]------------
[ 1060.378805] WARNING: CPU: 0 PID: 2080 at drivers/media/common/videobuf2/videobuf2-core.c:840 vb2_core_reqbufs+0x3f7/0x430 [videobuf2_common]
...
[ 1060.381414] RIP: 0010:vb2_core_reqbufs+0x3f7/0x430 [videobuf2_common]
...
[ 1060.382066]  vb2_ioctl_reqbufs+0x9d/0xe0 [videobuf2_v4l2]
[ 1060.382181]  __video_do_ioctl+0x18e/0x3c0 [videodev]

Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: use vb2_start_streaming_called()

Don't touch q->start_streaming_called directly, use the
vb2_start_streaming_called() function instead.

Link: https://lore.kernel.org/r/bc6c24ec-72ea-64a1-9061-311cc7339827@xs4all.nl
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: atomisp: fix videobuf2 Kconfig depenendency

The recent conversion missed the Kconfig bit, so it can now
end up in a link error on randconfig builds:

ld.lld: error: undefined symbol: vb2_vmalloc_memops
>>> referenced by atomisp_fops.c
>>>               drivers/staging/media/atomisp/pci/atomisp_fops.o:(atomisp_open) in archive vmlinux.a

Link: https://lore.kernel.org/r/20230104082212.3770415-1-arnd@kernel.org
Fixes: cb48ae89be3b ("media: atomisp: Convert to videobuf2")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Tested-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()

When the ene device is detaching, function ene_remove() will
be called. But there is no function to cancel tx_sim_timer
in ene_remove(), the timer handler ene_tx_irqsim() could race
with ene_remove(). As a result, the UAF bugs could happen,
the process is shown below.

    (cleanup routine)          |        (timer routine)
                               | mod_timer(&dev->tx_sim_timer, ..)
ene_remove()                   | (wait a time)
                               | ene_tx_irqsim()
                               |   dev->hw_lock //USE
                               |   ene_tx_sample(dev) //USE

Fix by adding del_timer_sync(&dev->tx_sim_timer) in ene_remove(),
The tx_sim_timer could stop before ene device is deallocated.

What's more, The rc_unregister_device() and del_timer_sync()
should be called first in ene_remove() and the deallocated
functions such as free_irq(), release_region() and so on
should be called behind them. Because the rc_unregister_device()
is well synchronized. Otherwise, race conditions may happen. The
situations that may lead to race conditions are shown below.

Firstly, the rx receiver is disabled with ene_rx_disable()
before rc_unregister_device() in ene_remove(), which means it
can be enabled again if a process opens /dev/lirc0 between
ene_rx_disable() and rc_unregister_device().

Secondly, the irqaction descriptor is freed by free_irq()
before the rc device is unregistered, which means irqaction
descriptor may be accessed again after it is deallocated.

Thirdly, the timer can call ene_tx_sample() that can write
to the io ports, which means the io ports could be accessed
again after they are deallocated by release_region().

Therefore, the rc_unregister_device() and del_timer_sync()
should be called first in ene_remove().

Suggested by: Sean Young <sean@mess.org>

Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: rc: gpio-ir-recv: add remove function

In case runtime PM is enabled, do runtime PM clean up to remove
cpu latency qos request, otherwise driver removal may have below
kernel dump:

[   19.463299] Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000048
[   19.472161] Mem abort info:
[   19.474985]   ESR = 0x0000000096000004
[   19.478754]   EC = 0x25: DABT (current EL), IL = 32 bits
[   19.484081]   SET = 0, FnV = 0
[   19.487149]   EA = 0, S1PTW = 0
[   19.490361]   FSC = 0x04: level 0 translation fault
[   19.495256] Data abort info:
[   19.498149]   ISV = 0, ISS = 0x00000004
[   19.501997]   CM = 0, WnR = 0
[   19.504977] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000049f81000
[   19.511432] [0000000000000048] pgd=0000000000000000,
p4d=0000000000000000
[   19.518245] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[   19.524520] Modules linked in: gpio_ir_recv(+) rc_core [last
unloaded: rc_core]
[   19.531845] CPU: 0 PID: 445 Comm: insmod Not tainted
6.2.0-rc1-00028-g2c397a46d47c #72
[   19.531854] Hardware name: FSL i.MX8MM EVK board (DT)
[   19.531859] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS
BTYPE=--)
[   19.551777] pc : cpu_latency_qos_remove_request+0x20/0x110
[   19.557277] lr : gpio_ir_recv_runtime_suspend+0x18/0x30
[gpio_ir_recv]
[   19.557294] sp : ffff800008ce3740
[   19.557297] x29: ffff800008ce3740 x28: 0000000000000000 x27:
ffff800008ce3d50
[   19.574270] x26: ffffc7e3e9cea100 x25: 00000000000f4240 x24:
ffffc7e3f9ef0e30
[   19.574284] x23: 0000000000000000 x22: ffff0061803820f4 x21:
0000000000000008
[   19.574296] x20: ffffc7e3fa75df30 x19: 0000000000000020 x18:
ffffffffffffffff
[   19.588570] x17: 0000000000000000 x16: ffffc7e3f9efab70 x15:
ffffffffffffffff
[   19.595712] x14: ffff800008ce37b8 x13: ffff800008ce37aa x12:
0000000000000001
[   19.602853] x11: 0000000000000001 x10: ffffcbe3ec0dff87 x9 :
0000000000000008
[   19.609991] x8 : 0101010101010101 x7 : 0000000000000000 x6 :
000000000f0bfe9f
[   19.624261] x5 : 00ffffffffffffff x4 : 0025ab8e00000000 x3 :
ffff006180382010
[   19.631405] x2 : ffffc7e3e9ce8030 x1 : ffffc7e3fc3eb810 x0 :
0000000000000020
[   19.638548] Call trace:
[   19.640995]  cpu_latency_qos_remove_request+0x20/0x110
[   19.646142]  gpio_ir_recv_runtime_suspend+0x18/0x30 [gpio_ir_recv]
[   19.652339]  pm_generic_runtime_suspend+0x2c/0x44
[   19.657055]  __rpm_callback+0x48/0x1dc
[   19.660807]  rpm_callback+0x6c/0x80
[   19.664301]  rpm_suspend+0x10c/0x640
[   19.667880]  rpm_idle+0x250/0x2d0
[   19.671198]  update_autosuspend+0x38/0xe0
[   19.675213]  pm_runtime_set_autosuspend_delay+0x40/0x60
[   19.680442]  gpio_ir_recv_probe+0x1b4/0x21c [gpio_ir_recv]
[   19.685941]  platform_probe+0x68/0xc0
[   19.689610]  really_probe+0xc0/0x3dc
[   19.693189]  __driver_probe_device+0x7c/0x190
[   19.697550]  driver_probe_device+0x3c/0x110
[   19.701739]  __driver_attach+0xf4/0x200
[   19.705578]  bus_for_each_dev+0x70/0xd0
[   19.709417]  driver_attach+0x24/0x30
[   19.712998]  bus_add_driver+0x17c/0x240
[   19.716834]  driver_register+0x78/0x130
[   19.720676]  __platform_driver_register+0x28/0x34
[   19.725386]  gpio_ir_recv_driver_init+0x20/0x1000 [gpio_ir_recv]
[   19.731404]  do_one_initcall+0x44/0x2ac
[   19.735243]  do_init_module+0x48/0x1d0
[   19.739003]  load_module+0x19fc/0x2034
[   19.742759]  __do_sys_finit_module+0xac/0x12c
[   19.747124]  __arm64_sys_finit_module+0x20/0x30
[   19.751664]  invoke_syscall+0x48/0x114
[   19.755420]  el0_svc_common.constprop.0+0xcc/0xec
[   19.760132]  do_el0_svc+0x38/0xb0
[   19.763456]  el0_svc+0x2c/0x84
[   19.766516]  el0t_64_sync_handler+0xf4/0x120
[   19.770789]  el0t_64_sync+0x190/0x194
[   19.774460] Code: 910003fd a90153f3 aa0003f3 91204021 (f9401400)
[   19.780556] ---[ end trace 0000000000000000 ]---

Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

media: dt-bindings: st,stih-cec: convert to DT schema

Convert ST STIH4xx HDMI CEC bindings to DT schema.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>