]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.19-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 11 Nov 2018 16:24:49 +0000 (08:24 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 11 Nov 2018 16:24:49 +0000 (08:24 -0800)
added patches:
drm-mediatek-fix-of-sibling-node-lookup.patch
media-adv7604-when-the-edid-is-cleared-unconfigure-cec-as-well.patch
media-adv7842-when-the-edid-is-cleared-unconfigure-cec-as-well.patch
media-cec-add-new-tx-rx-status-bits-to-detect-aborts-timeouts.patch
media-cec-fix-the-signal-free-time-calculation.patch
media-cec-forgot-to-cancel-delayed-work.patch
media-em28xx-fix-handler-for-vidioc_s_input.patch
media-em28xx-fix-input-name-for-terratec-av-350.patch
media-em28xx-make-v4l2-compliance-happier-by-starting-sequence-on-zero.patch
media-em28xx-use-a-default-format-if-try_fmt-fails.patch
media-hdmi.h-rename-adobe_rgb-to-oprgb-and-adobe_ycc-to-opycc.patch
media-media-colorspaces-.rst-rename-adobergb-to-oprgb.patch
media-replace-adobergb-by-oprgb.patch
media-tvp5150-avoid-going-past-array-on-v4l2_querymenu.patch
xen-blkfront-fix-kernel-panic-with-negotiate_mq-error-path.patch
xen-fix-xen_qlock_wait.patch
xen-remove-size-limit-of-privcmd-buf-mapping-interface.patch

18 files changed:
queue-4.19/drm-mediatek-fix-of-sibling-node-lookup.patch [new file with mode: 0644]
queue-4.19/media-adv7604-when-the-edid-is-cleared-unconfigure-cec-as-well.patch [new file with mode: 0644]
queue-4.19/media-adv7842-when-the-edid-is-cleared-unconfigure-cec-as-well.patch [new file with mode: 0644]
queue-4.19/media-cec-add-new-tx-rx-status-bits-to-detect-aborts-timeouts.patch [new file with mode: 0644]
queue-4.19/media-cec-fix-the-signal-free-time-calculation.patch [new file with mode: 0644]
queue-4.19/media-cec-forgot-to-cancel-delayed-work.patch [new file with mode: 0644]
queue-4.19/media-em28xx-fix-handler-for-vidioc_s_input.patch [new file with mode: 0644]
queue-4.19/media-em28xx-fix-input-name-for-terratec-av-350.patch [new file with mode: 0644]
queue-4.19/media-em28xx-make-v4l2-compliance-happier-by-starting-sequence-on-zero.patch [new file with mode: 0644]
queue-4.19/media-em28xx-use-a-default-format-if-try_fmt-fails.patch [new file with mode: 0644]
queue-4.19/media-hdmi.h-rename-adobe_rgb-to-oprgb-and-adobe_ycc-to-opycc.patch [new file with mode: 0644]
queue-4.19/media-media-colorspaces-.rst-rename-adobergb-to-oprgb.patch [new file with mode: 0644]
queue-4.19/media-replace-adobergb-by-oprgb.patch [new file with mode: 0644]
queue-4.19/media-tvp5150-avoid-going-past-array-on-v4l2_querymenu.patch [new file with mode: 0644]
queue-4.19/series
queue-4.19/xen-blkfront-fix-kernel-panic-with-negotiate_mq-error-path.patch [new file with mode: 0644]
queue-4.19/xen-fix-xen_qlock_wait.patch [new file with mode: 0644]
queue-4.19/xen-remove-size-limit-of-privcmd-buf-mapping-interface.patch [new file with mode: 0644]

diff --git a/queue-4.19/drm-mediatek-fix-of-sibling-node-lookup.patch b/queue-4.19/drm-mediatek-fix-of-sibling-node-lookup.patch
new file mode 100644 (file)
index 0000000..8396cc2
--- /dev/null
@@ -0,0 +1,57 @@
+From ceff2f4dcd44abf35864d9a99f85ac619e89a01d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:46 +0200
+Subject: drm/mediatek: fix OF sibling-node lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ceff2f4dcd44abf35864d9a99f85ac619e89a01d upstream.
+
+Use the new of_get_compatible_child() helper to lookup the sibling
+instead of using of_find_compatible_node(), which searches the entire
+tree from a given start node and thus can return an unrelated (i.e.
+non-sibling) node.
+
+This also addresses a potential use-after-free (e.g. after probe
+deferral) as the tree-wide helper drops a reference to its first
+argument (i.e. the parent device node).
+
+While at it, also fix the related cec-node reference leak.
+
+Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support")
+Cc: stable <stable@vger.kernel.org>     # 4.8
+Cc: Junzhi Zhao <junzhi.zhao@mediatek.com>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: CK Hu <ck.hu@mediatek.com>
+Cc: David Airlie <airlied@linux.ie>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1446,8 +1446,7 @@ static int mtk_hdmi_dt_parse_pdata(struc
+       }
+       /* The CEC module handles HDMI hotplug detection */
+-      cec_np = of_find_compatible_node(np->parent, NULL,
+-                                       "mediatek,mt8173-cec");
++      cec_np = of_get_compatible_child(np->parent, "mediatek,mt8173-cec");
+       if (!cec_np) {
+               dev_err(dev, "Failed to find CEC node\n");
+               return -EINVAL;
+@@ -1457,8 +1456,10 @@ static int mtk_hdmi_dt_parse_pdata(struc
+       if (!cec_pdev) {
+               dev_err(hdmi->dev, "Waiting for CEC device %pOF\n",
+                       cec_np);
++              of_node_put(cec_np);
+               return -EPROBE_DEFER;
+       }
++      of_node_put(cec_np);
+       hdmi->cec_dev = &cec_pdev->dev;
+       /*
diff --git a/queue-4.19/media-adv7604-when-the-edid-is-cleared-unconfigure-cec-as-well.patch b/queue-4.19/media-adv7604-when-the-edid-is-cleared-unconfigure-cec-as-well.patch
new file mode 100644 (file)
index 0000000..beee171
--- /dev/null
@@ -0,0 +1,35 @@
+From e7da89926f6dc6cf855f5ffdf79ef99a1b115ca7 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Thu, 4 Oct 2018 03:57:06 -0400
+Subject: media: adv7604: when the EDID is cleared, unconfigure CEC as well
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+commit e7da89926f6dc6cf855f5ffdf79ef99a1b115ca7 upstream.
+
+When there is no EDID the CEC adapter should be unconfigured as
+well. So call cec_phys_addr_invalidate() when this happens.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: <stable@vger.kernel.org>      # for v4.18 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/adv7604.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2284,8 +2284,10 @@ static int adv76xx_set_edid(struct v4l2_
+               state->aspect_ratio.numerator = 16;
+               state->aspect_ratio.denominator = 9;
+-              if (!state->edid.present)
++              if (!state->edid.present) {
+                       state->edid.blocks = 0;
++                      cec_phys_addr_invalidate(state->cec_adap);
++              }
+               v4l2_dbg(2, debug, sd, "%s: clear EDID pad %d, edid.present = 0x%x\n",
+                               __func__, edid->pad, state->edid.present);
diff --git a/queue-4.19/media-adv7842-when-the-edid-is-cleared-unconfigure-cec-as-well.patch b/queue-4.19/media-adv7842-when-the-edid-is-cleared-unconfigure-cec-as-well.patch
new file mode 100644 (file)
index 0000000..be9e38c
--- /dev/null
@@ -0,0 +1,35 @@
+From ab83203e181015b099720aff43ffabc1812e0fb3 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Thu, 4 Oct 2018 03:58:34 -0400
+Subject: media: adv7842: when the EDID is cleared, unconfigure CEC as well
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+commit ab83203e181015b099720aff43ffabc1812e0fb3 upstream.
+
+When there is no EDID the CEC adapter should be unconfigured as
+well. So call cec_phys_addr_invalidate() when this happens.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: <stable@vger.kernel.org>      # for v4.18 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/adv7842.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -786,8 +786,10 @@ static int edid_write_hdmi_segment(struc
+       /* Disable I2C access to internal EDID ram from HDMI DDC ports */
+       rep_write_and_or(sd, 0x77, 0xf3, 0x00);
+-      if (!state->hdmi_edid.present)
++      if (!state->hdmi_edid.present) {
++              cec_phys_addr_invalidate(state->cec_adap);
+               return 0;
++      }
+       pa = cec_get_edid_phys_addr(edid, 256, &spa_loc);
+       err = cec_phys_addr_validate(pa, &pa, NULL);
diff --git a/queue-4.19/media-cec-add-new-tx-rx-status-bits-to-detect-aborts-timeouts.patch b/queue-4.19/media-cec-add-new-tx-rx-status-bits-to-detect-aborts-timeouts.patch
new file mode 100644 (file)
index 0000000..9493fe5
--- /dev/null
@@ -0,0 +1,239 @@
+From 7ec2b3b941a666a942859684281b5f6460a0c234 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Thu, 4 Oct 2018 03:28:21 -0400
+Subject: media: cec: add new tx/rx status bits to detect aborts/timeouts
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+commit 7ec2b3b941a666a942859684281b5f6460a0c234 upstream.
+
+If the HDMI cable is disconnected or the CEC adapter is manually
+unconfigured, then all pending transmits and wait-for-replies are
+aborted. Signal this with new status bits (CEC_RX/TX_STATUS_ABORTED).
+
+If due to (usually) a driver bug a transmit never ends (i.e. the
+transmit_done was never called by the driver), then when this times
+out the message is marked with CEC_TX_STATUS_TIMEOUT.
+
+This should not happen and is an indication of a driver bug.
+
+Without a separate status bit for this it was impossible to detect
+this from userspace.
+
+The 'transmit timed out' kernel message is now a warning, so this
+should be more prominent in the kernel log as well.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: <stable@vger.kernel.org>      # for v4.18 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/media/uapi/cec/cec-ioc-receive.rst |   25 +++++++-
+ drivers/media/cec/cec-adap.c                     |   68 ++++++-----------------
+ include/uapi/linux/cec.h                         |    3 +
+ 3 files changed, 45 insertions(+), 51 deletions(-)
+
+--- a/Documentation/media/uapi/cec/cec-ioc-receive.rst
++++ b/Documentation/media/uapi/cec/cec-ioc-receive.rst
+@@ -16,10 +16,10 @@ CEC_RECEIVE, CEC_TRANSMIT - Receive or t
+ Synopsis
+ ========
+-.. c:function:: int ioctl( int fd, CEC_RECEIVE, struct cec_msg *argp )
++.. c:function:: int ioctl( int fd, CEC_RECEIVE, struct cec_msg \*argp )
+     :name: CEC_RECEIVE
+-.. c:function:: int ioctl( int fd, CEC_TRANSMIT, struct cec_msg *argp )
++.. c:function:: int ioctl( int fd, CEC_TRANSMIT, struct cec_msg \*argp )
+     :name: CEC_TRANSMIT
+ Arguments
+@@ -272,6 +272,19 @@ View On' messages from initiator 0xf ('U
+       - The transmit failed after one or more retries. This status bit is
+       mutually exclusive with :ref:`CEC_TX_STATUS_OK <CEC-TX-STATUS-OK>`.
+       Other bits can still be set to explain which failures were seen.
++    * .. _`CEC-TX-STATUS-ABORTED`:
++
++      - ``CEC_TX_STATUS_ABORTED``
++      - 0x40
++      - The transmit was aborted due to an HDMI disconnect, or the adapter
++        was unconfigured, or a transmit was interrupted, or the driver
++      returned an error when attempting to start a transmit.
++    * .. _`CEC-TX-STATUS-TIMEOUT`:
++
++      - ``CEC_TX_STATUS_TIMEOUT``
++      - 0x80
++      - The transmit timed out. This should not normally happen and this
++      indicates a driver problem.
+ .. tabularcolumns:: |p{5.6cm}|p{0.9cm}|p{11.0cm}|
+@@ -300,6 +313,14 @@ View On' messages from initiator 0xf ('U
+       - The message was received successfully but the reply was
+       ``CEC_MSG_FEATURE_ABORT``. This status is only set if this message
+       was the reply to an earlier transmitted message.
++    * .. _`CEC-RX-STATUS-ABORTED`:
++
++      - ``CEC_RX_STATUS_ABORTED``
++      - 0x08
++      - The wait for a reply to an earlier transmitted message was aborted
++        because the HDMI cable was disconnected, the adapter was unconfigured
++      or the :ref:`CEC_TRANSMIT <CEC_RECEIVE>` that waited for a
++      reply was interrupted.
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -341,7 +341,7 @@ static void cec_data_completed(struct ce
+  *
+  * This function is called with adap->lock held.
+  */
+-static void cec_data_cancel(struct cec_data *data)
++static void cec_data_cancel(struct cec_data *data, u8 tx_status)
+ {
+       /*
+        * It's either the current transmit, or it is a pending
+@@ -356,13 +356,11 @@ static void cec_data_cancel(struct cec_d
+       }
+       if (data->msg.tx_status & CEC_TX_STATUS_OK) {
+-              /* Mark the canceled RX as a timeout */
+               data->msg.rx_ts = ktime_get_ns();
+-              data->msg.rx_status = CEC_RX_STATUS_TIMEOUT;
++              data->msg.rx_status = CEC_RX_STATUS_ABORTED;
+       } else {
+-              /* Mark the canceled TX as an error */
+               data->msg.tx_ts = ktime_get_ns();
+-              data->msg.tx_status |= CEC_TX_STATUS_ERROR |
++              data->msg.tx_status |= tx_status |
+                                      CEC_TX_STATUS_MAX_RETRIES;
+               data->msg.tx_error_cnt++;
+               data->attempts = 0;
+@@ -390,15 +388,15 @@ static void cec_flush(struct cec_adapter
+       while (!list_empty(&adap->transmit_queue)) {
+               data = list_first_entry(&adap->transmit_queue,
+                                       struct cec_data, list);
+-              cec_data_cancel(data);
++              cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+       }
+       if (adap->transmitting)
+-              cec_data_cancel(adap->transmitting);
++              cec_data_cancel(adap->transmitting, CEC_TX_STATUS_ABORTED);
+       /* Cancel the pending timeout work. */
+       list_for_each_entry_safe(data, n, &adap->wait_queue, list) {
+               if (cancel_delayed_work(&data->work))
+-                      cec_data_cancel(data);
++                      cec_data_cancel(data, CEC_TX_STATUS_OK);
+               /*
+                * If cancel_delayed_work returned false, then
+                * the cec_wait_timeout function is running,
+@@ -474,12 +472,13 @@ int cec_thread_func(void *_adap)
+                        * so much traffic on the bus that the adapter was
+                        * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s).
+                        */
+-                      dprintk(1, "%s: message %*ph timed out\n", __func__,
++                      pr_warn("cec-%s: message %*ph timed out\n", adap->name,
+                               adap->transmitting->msg.len,
+                               adap->transmitting->msg.msg);
+                       adap->tx_timeouts++;
+                       /* Just give up on this. */
+-                      cec_data_cancel(adap->transmitting);
++                      cec_data_cancel(adap->transmitting,
++                                      CEC_TX_STATUS_TIMEOUT);
+                       goto unlock;
+               }
+@@ -530,7 +529,7 @@ int cec_thread_func(void *_adap)
+               /* Tell the adapter to transmit, cancel on error */
+               if (adap->ops->adap_transmit(adap, data->attempts,
+                                            signal_free_time, &data->msg))
+-                      cec_data_cancel(data);
++                      cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+ unlock:
+               mutex_unlock(&adap->lock);
+@@ -702,8 +701,6 @@ int cec_transmit_msg_fh(struct cec_adapt
+ {
+       struct cec_data *data;
+       u8 last_initiator = 0xff;
+-      unsigned int timeout;
+-      int res = 0;
+       msg->rx_ts = 0;
+       msg->tx_ts = 0;
+@@ -846,47 +843,20 @@ int cec_transmit_msg_fh(struct cec_adapt
+               return 0;
+       /*
+-       * If we don't get a completion before this time something is really
+-       * wrong and we time out.
+-       */
+-      timeout = CEC_XFER_TIMEOUT_MS;
+-      /* Add the requested timeout if we have to wait for a reply as well */
+-      if (msg->timeout)
+-              timeout += msg->timeout;
+-
+-      /*
+        * Release the lock and wait, retake the lock afterwards.
+        */
+       mutex_unlock(&adap->lock);
+-      res = wait_for_completion_killable_timeout(&data->c,
+-                                                 msecs_to_jiffies(timeout));
++      wait_for_completion_killable(&data->c);
+       mutex_lock(&adap->lock);
+-      if (data->completed) {
+-              /* The transmit completed (possibly with an error) */
+-              *msg = data->msg;
+-              kfree(data);
+-              return 0;
+-      }
+-      /*
+-       * The wait for completion timed out or was interrupted, so mark this
+-       * as non-blocking and disconnect from the filehandle since it is
+-       * still 'in flight'. When it finally completes it will just drop the
+-       * result silently.
+-       */
+-      data->blocking = false;
+-      if (data->fh)
+-              list_del(&data->xfer_list);
+-      data->fh = NULL;
+-
+-      if (res == 0) { /* timed out */
+-              /* Check if the reply or the transmit failed */
+-              if (msg->timeout && (msg->tx_status & CEC_TX_STATUS_OK))
+-                      msg->rx_status = CEC_RX_STATUS_TIMEOUT;
+-              else
+-                      msg->tx_status = CEC_TX_STATUS_MAX_RETRIES;
+-      }
+-      return res > 0 ? 0 : res;
++      /* Cancel the transmit if it was interrupted */
++      if (!data->completed)
++              cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
++
++      /* The transmit completed (possibly with an error) */
++      *msg = data->msg;
++      kfree(data);
++      return 0;
+ }
+ /* Helper function to be used by drivers and this framework. */
+--- a/include/uapi/linux/cec.h
++++ b/include/uapi/linux/cec.h
+@@ -152,10 +152,13 @@ static inline void cec_msg_set_reply_to(
+ #define CEC_TX_STATUS_LOW_DRIVE               (1 << 3)
+ #define CEC_TX_STATUS_ERROR           (1 << 4)
+ #define CEC_TX_STATUS_MAX_RETRIES     (1 << 5)
++#define CEC_TX_STATUS_ABORTED         (1 << 6)
++#define CEC_TX_STATUS_TIMEOUT         (1 << 7)
+ #define CEC_RX_STATUS_OK              (1 << 0)
+ #define CEC_RX_STATUS_TIMEOUT         (1 << 1)
+ #define CEC_RX_STATUS_FEATURE_ABORT   (1 << 2)
++#define CEC_RX_STATUS_ABORTED         (1 << 3)
+ static inline int cec_msg_status_is_ok(const struct cec_msg *msg)
+ {
diff --git a/queue-4.19/media-cec-fix-the-signal-free-time-calculation.patch b/queue-4.19/media-cec-fix-the-signal-free-time-calculation.patch
new file mode 100644 (file)
index 0000000..d523353
--- /dev/null
@@ -0,0 +1,113 @@
+From 7d867a1b765e2b70815fec4964d7822a976ed349 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Fri, 5 Oct 2018 08:00:21 -0400
+Subject: media: cec: fix the Signal Free Time calculation
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+commit 7d867a1b765e2b70815fec4964d7822a976ed349 upstream.
+
+The calculation of the Signal Free Time in the framework was not
+correct. If a message was received, then the next transmit should be
+considered a New Initiator and use a shorter SFT value.
+
+This was not done with the result that if both sides where continually
+sending messages, they both could use the same SFT value and one side
+could deny the other side access to the bus.
+
+Note that this fix does not take the corner case into account where
+a receive is in progress when you call adap_transmit.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: <stable@vger.kernel.org>      # for v4.18 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/cec/cec-adap.c |   26 +++++++-------------------
+ include/media/cec.h          |    2 +-
+ 2 files changed, 8 insertions(+), 20 deletions(-)
+
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -513,9 +513,11 @@ int cec_thread_func(void *_adap)
+               if (data->attempts) {
+                       /* should be >= 3 data bit periods for a retry */
+                       signal_free_time = CEC_SIGNAL_FREE_TIME_RETRY;
+-              } else if (data->new_initiator) {
++              } else if (adap->last_initiator !=
++                         cec_msg_initiator(&data->msg)) {
+                       /* should be >= 5 data bit periods for new initiator */
+                       signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
++                      adap->last_initiator = cec_msg_initiator(&data->msg);
+               } else {
+                       /*
+                        * should be >= 7 data bit periods for sending another
+@@ -700,7 +702,6 @@ int cec_transmit_msg_fh(struct cec_adapt
+                       struct cec_fh *fh, bool block)
+ {
+       struct cec_data *data;
+-      u8 last_initiator = 0xff;
+       msg->rx_ts = 0;
+       msg->tx_ts = 0;
+@@ -810,23 +811,6 @@ int cec_transmit_msg_fh(struct cec_adapt
+       data->adap = adap;
+       data->blocking = block;
+-      /*
+-       * Determine if this message follows a message from the same
+-       * initiator. Needed to determine the free signal time later on.
+-       */
+-      if (msg->len > 1) {
+-              if (!(list_empty(&adap->transmit_queue))) {
+-                      const struct cec_data *last;
+-
+-                      last = list_last_entry(&adap->transmit_queue,
+-                                             const struct cec_data, list);
+-                      last_initiator = cec_msg_initiator(&last->msg);
+-              } else if (adap->transmitting) {
+-                      last_initiator =
+-                              cec_msg_initiator(&adap->transmitting->msg);
+-              }
+-      }
+-      data->new_initiator = last_initiator != cec_msg_initiator(msg);
+       init_completion(&data->c);
+       INIT_DELAYED_WORK(&data->work, cec_wait_timeout);
+@@ -1014,6 +998,8 @@ void cec_received_msg_ts(struct cec_adap
+       mutex_lock(&adap->lock);
+       dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg);
++      adap->last_initiator = 0xff;
++
+       /* Check if this message was for us (directed or broadcast). */
+       if (!cec_msg_is_broadcast(msg))
+               valid_la = cec_has_log_addr(adap, msg_dest);
+@@ -1476,6 +1462,8 @@ void __cec_s_phys_addr(struct cec_adapte
+       }
+       mutex_lock(&adap->devnode.lock);
++      adap->last_initiator = 0xff;
++
+       if ((adap->needs_hpd || list_empty(&adap->devnode.fhs)) &&
+           adap->ops->adap_enable(adap, true)) {
+               mutex_unlock(&adap->devnode.lock);
+--- a/include/media/cec.h
++++ b/include/media/cec.h
+@@ -63,7 +63,6 @@ struct cec_data {
+       struct delayed_work work;
+       struct completion c;
+       u8 attempts;
+-      bool new_initiator;
+       bool blocking;
+       bool completed;
+ };
+@@ -174,6 +173,7 @@ struct cec_adapter {
+       bool is_configuring;
+       bool is_configured;
+       bool cec_pin_is_high;
++      u8 last_initiator;
+       u32 monitor_all_cnt;
+       u32 monitor_pin_cnt;
+       u32 follower_cnt;
diff --git a/queue-4.19/media-cec-forgot-to-cancel-delayed-work.patch b/queue-4.19/media-cec-forgot-to-cancel-delayed-work.patch
new file mode 100644 (file)
index 0000000..5c7c4a5
--- /dev/null
@@ -0,0 +1,41 @@
+From 490d84f6d73c12f4204241cff8651eed60aae914 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Mon, 15 Oct 2018 06:14:22 -0400
+Subject: media: cec: forgot to cancel delayed work
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 490d84f6d73c12f4204241cff8651eed60aae914 upstream.
+
+If the wait for completion was interrupted, then make sure to cancel
+any delayed work.
+
+This can only happen if a transmit is waiting for a reply, and you press
+Ctrl-C or reboot/poweroff or something like that which interrupts the
+thread waiting for the reply and then proceeds to delete the CEC message.
+
+Since the delayed work wasn't canceled, once it would trigger it referred
+to stale data and resulted in a kernel oops.
+
+Fixes: 7ec2b3b941a6 ("cec: add new tx/rx status bits to detect aborts/timeouts")
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: <stable@vger.kernel.org>      # for v4.18 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/cec/cec-adap.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -831,6 +831,8 @@ int cec_transmit_msg_fh(struct cec_adapt
+        */
+       mutex_unlock(&adap->lock);
+       wait_for_completion_killable(&data->c);
++      if (!data->completed)
++              cancel_delayed_work_sync(&data->work);
+       mutex_lock(&adap->lock);
+       /* Cancel the transmit if it was interrupted */
diff --git a/queue-4.19/media-em28xx-fix-handler-for-vidioc_s_input.patch b/queue-4.19/media-em28xx-fix-handler-for-vidioc_s_input.patch
new file mode 100644 (file)
index 0000000..0d9c060
--- /dev/null
@@ -0,0 +1,253 @@
+From 258c430456ba5f0005043762e14fc3be35983aaf Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Fri, 14 Sep 2018 13:13:15 -0400
+Subject: media: em28xx: fix handler for vidioc_s_input()
+
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+
+commit 258c430456ba5f0005043762e14fc3be35983aaf upstream.
+
+The a->index is not the name of the internal amux entry,
+but, instead a value from zero to the maximum number
+of audio inputs.
+
+As the actual available inputs depend on each board, build
+it dynamically.
+
+This is broken for a really long time. On a quick check,
+since at least commit 195a4ef627e1 ("V4L/DVB (6585): Convert
+em28xx to video_ioctl2") this was not implemented right.
+
+Fixes: 195a4ef627e1 ("V4L/DVB (6585): Convert em28xx to video_ioctl2")
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-cards.c |   29 ++++++++++
+ drivers/media/usb/em28xx/em28xx-video.c |   86 ++++++++++++++++++++++++++++----
+ drivers/media/usb/em28xx/em28xx.h       |    8 ++
+ 3 files changed, 113 insertions(+), 10 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -3039,6 +3039,9 @@ static int em28xx_hint_board(struct em28
+ static void em28xx_card_setup(struct em28xx *dev)
+ {
++      int i, j, idx;
++      bool duplicate_entry;
++
+       /*
+        * If the device can be a webcam, seek for a sensor.
+        * If sensor is not found, then it isn't a webcam.
+@@ -3195,6 +3198,32 @@ static void em28xx_card_setup(struct em2
+       /* Allow override tuner type by a module parameter */
+       if (tuner >= 0)
+               dev->tuner_type = tuner;
++
++      /*
++       * Dynamically generate a list of valid audio inputs for this
++       * specific board, mapping them via enum em28xx_amux.
++       */
++
++      idx = 0;
++      for (i = 0; i < MAX_EM28XX_INPUT; i++) {
++              if (!INPUT(i)->type)
++                      continue;
++
++              /* Skip already mapped audio inputs */
++              duplicate_entry = false;
++              for (j = 0; j < idx; j++) {
++                      if (INPUT(i)->amux == dev->amux_map[j]) {
++                              duplicate_entry = true;
++                              break;
++                      }
++              }
++              if (duplicate_entry)
++                      continue;
++
++              dev->amux_map[idx++] = INPUT(i)->amux;
++      }
++      for (; idx < MAX_EM28XX_INPUT; idx++)
++              dev->amux_map[idx] = EM28XX_AMUX_UNUSED;
+ }
+ void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1668,6 +1668,7 @@ static int vidioc_enum_input(struct file
+ {
+       struct em28xx *dev = video_drvdata(file);
+       unsigned int       n;
++      int j;
+       n = i->index;
+       if (n >= MAX_EM28XX_INPUT)
+@@ -1687,6 +1688,12 @@ static int vidioc_enum_input(struct file
+       if (dev->is_webcam)
+               i->capabilities = 0;
++      /* Dynamically generates an audioset bitmask */
++      i->audioset = 0;
++      for (j = 0; j < MAX_EM28XX_INPUT; j++)
++              if (dev->amux_map[j] != EM28XX_AMUX_UNUSED)
++                      i->audioset |= 1 << j;
++
+       return 0;
+ }
+@@ -1712,11 +1719,24 @@ static int vidioc_s_input(struct file *f
+       return 0;
+ }
+-static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
+-{
+-      struct em28xx *dev = video_drvdata(file);
++static int em28xx_fill_audio_input(struct em28xx *dev,
++                                 const char *s,
++                                 struct v4l2_audio *a,
++                                 unsigned int index)
++{
++      unsigned int idx = dev->amux_map[index];
++
++      /*
++       * With msp3400, almost all mappings use the default (amux = 0).
++       * The only one may use a different value is WinTV USB2, where it
++       * can also be SCART1 input.
++       * As it is very doubtful that we would see new boards with msp3400,
++       * let's just reuse the existing switch.
++       */
++      if (dev->has_msp34xx && idx != EM28XX_AMUX_UNUSED)
++              idx = EM28XX_AMUX_LINE_IN;
+-      switch (a->index) {
++      switch (idx) {
+       case EM28XX_AMUX_VIDEO:
+               strcpy(a->name, "Television");
+               break;
+@@ -1741,32 +1761,79 @@ static int vidioc_g_audio(struct file *f
+       case EM28XX_AMUX_PCM_OUT:
+               strcpy(a->name, "PCM");
+               break;
++      case EM28XX_AMUX_UNUSED:
+       default:
+               return -EINVAL;
+       }
+-
+-      a->index = dev->ctl_ainput;
++      a->index = index;
+       a->capability = V4L2_AUDCAP_STEREO;
++      em28xx_videodbg("%s: audio input index %d is '%s'\n",
++                      s, a->index, a->name);
++
+       return 0;
+ }
++static int vidioc_enumaudio(struct file *file, void *fh, struct v4l2_audio *a)
++{
++      struct em28xx *dev = video_drvdata(file);
++
++      if (a->index >= MAX_EM28XX_INPUT)
++              return -EINVAL;
++
++      return em28xx_fill_audio_input(dev, __func__, a, a->index);
++}
++
++static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
++{
++      struct em28xx *dev = video_drvdata(file);
++      int i;
++
++      for (i = 0; i < MAX_EM28XX_INPUT; i++)
++              if (dev->ctl_ainput == dev->amux_map[i])
++                      return em28xx_fill_audio_input(dev, __func__, a, i);
++
++      /* Should never happen! */
++      return -EINVAL;
++}
++
+ static int vidioc_s_audio(struct file *file, void *priv,
+                         const struct v4l2_audio *a)
+ {
+       struct em28xx *dev = video_drvdata(file);
++      int idx, i;
+       if (a->index >= MAX_EM28XX_INPUT)
+               return -EINVAL;
+-      if (!INPUT(a->index)->type)
++
++      idx = dev->amux_map[a->index];
++
++      if (idx == EM28XX_AMUX_UNUSED)
++              return -EINVAL;
++
++      dev->ctl_ainput = idx;
++
++      /*
++       * FIXME: This is wrong, as different inputs at em28xx_cards
++       * may have different audio outputs. So, the right thing
++       * to do is to implement VIDIOC_G_AUDOUT/VIDIOC_S_AUDOUT.
++       * With the current board definitions, this would work fine,
++       * as, currently, all boards fit.
++       */
++      for (i = 0; i < MAX_EM28XX_INPUT; i++)
++              if (idx == dev->amux_map[i])
++                      break;
++      if (i == MAX_EM28XX_INPUT)
+               return -EINVAL;
+-      dev->ctl_ainput = INPUT(a->index)->amux;
+-      dev->ctl_aoutput = INPUT(a->index)->aout;
++      dev->ctl_aoutput = INPUT(i)->aout;
+       if (!dev->ctl_aoutput)
+               dev->ctl_aoutput = EM28XX_AOUT_MASTER;
++      em28xx_videodbg("%s: set audio input to %d\n", __func__,
++                      dev->ctl_ainput);
++
+       return 0;
+ }
+@@ -2304,6 +2371,7 @@ static const struct v4l2_ioctl_ops video
+       .vidioc_try_fmt_vbi_cap     = vidioc_g_fmt_vbi_cap,
+       .vidioc_s_fmt_vbi_cap       = vidioc_g_fmt_vbi_cap,
+       .vidioc_enum_framesizes     = vidioc_enum_framesizes,
++      .vidioc_enumaudio           = vidioc_enumaudio,
+       .vidioc_g_audio             = vidioc_g_audio,
+       .vidioc_s_audio             = vidioc_s_audio,
+--- a/drivers/media/usb/em28xx/em28xx.h
++++ b/drivers/media/usb/em28xx/em28xx.h
+@@ -335,6 +335,9 @@ enum em28xx_usb_audio_type {
+ /**
+  * em28xx_amux - describes the type of audio input used by em28xx
+  *
++ * @EM28XX_AMUX_UNUSED:
++ *    Used only on em28xx dev->map field, in order to mark an entry
++ *    as unused.
+  * @EM28XX_AMUX_VIDEO:
+  *    On devices without AC97, this is the only value that it is currently
+  *    allowed.
+@@ -369,7 +372,8 @@ enum em28xx_usb_audio_type {
+  * same time, via the alsa mux.
+  */
+ enum em28xx_amux {
+-      EM28XX_AMUX_VIDEO,
++      EM28XX_AMUX_UNUSED = -1,
++      EM28XX_AMUX_VIDEO = 0,
+       EM28XX_AMUX_LINE_IN,
+       /* Some less-common mixer setups */
+@@ -692,6 +696,8 @@ struct em28xx {
+       unsigned int ctl_input; // selected input
+       unsigned int ctl_ainput;// selected audio input
+       unsigned int ctl_aoutput;// selected audio output
++      enum em28xx_amux amux_map[MAX_EM28XX_INPUT];
++
+       int mute;
+       int volume;
diff --git a/queue-4.19/media-em28xx-fix-input-name-for-terratec-av-350.patch b/queue-4.19/media-em28xx-fix-input-name-for-terratec-av-350.patch
new file mode 100644 (file)
index 0000000..0d78fdf
--- /dev/null
@@ -0,0 +1,39 @@
+From 15644bfa195bd166d0a5ed76ae2d587f719c3dac Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Fri, 14 Sep 2018 00:20:21 -0400
+Subject: media: em28xx: fix input name for Terratec AV 350
+
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+
+commit 15644bfa195bd166d0a5ed76ae2d587f719c3dac upstream.
+
+Instead of using a register value, use an AMUX name, as otherwise
+VIDIOC_G_AUDIO would fail.
+
+Cc: stable@vger.kernel.org
+Fixes: 766ed64de554 ("V4L/DVB (11827): Add support for Terratec Grabster AV350")
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-cards.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -2141,13 +2141,13 @@ const struct em28xx_board em28xx_boards[
+               .input           = { {
+                       .type     = EM28XX_VMUX_COMPOSITE,
+                       .vmux     = TVP5150_COMPOSITE1,
+-                      .amux     = EM28XX_AUDIO_SRC_LINE,
++                      .amux     = EM28XX_AMUX_LINE_IN,
+                       .gpio     = terratec_av350_unmute_gpio,
+               }, {
+                       .type     = EM28XX_VMUX_SVIDEO,
+                       .vmux     = TVP5150_SVIDEO,
+-                      .amux     = EM28XX_AUDIO_SRC_LINE,
++                      .amux     = EM28XX_AMUX_LINE_IN,
+                       .gpio     = terratec_av350_unmute_gpio,
+               } },
+       },
diff --git a/queue-4.19/media-em28xx-make-v4l2-compliance-happier-by-starting-sequence-on-zero.patch b/queue-4.19/media-em28xx-make-v4l2-compliance-happier-by-starting-sequence-on-zero.patch
new file mode 100644 (file)
index 0000000..69c16c9
--- /dev/null
@@ -0,0 +1,41 @@
+From afeaade90db4c5dab93f326d9582be1d5954a198 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Thu, 13 Sep 2018 22:46:29 -0400
+Subject: media: em28xx: make v4l2-compliance happier by starting sequence on zero
+
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+
+commit afeaade90db4c5dab93f326d9582be1d5954a198 upstream.
+
+The v4l2-compliance tool complains if a video doesn't start
+with a zero sequence number.
+
+While this shouldn't cause any real problem for apps, let's
+make it happier, in order to better check the v4l2-compliance
+differences before and after patchsets.
+
+This is actually an old issue. It is there since at least its
+videobuf2 conversion, e. g. changeset 3829fadc461 ("[media]
+em28xx: convert to videobuf2"), if VB1 wouldn't suffer from
+the same issue.
+
+Cc: stable@vger.kernel.org
+Fixes: d3829fadc461 ("[media] em28xx: convert to videobuf2")
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-video.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1093,6 +1093,8 @@ int em28xx_start_analog_streaming(struct
+       em28xx_videodbg("%s\n", __func__);
++      dev->v4l2->field_count = 0;
++
+       /*
+        * Make sure streaming is not already in progress for this type
+        * of filehandle (e.g. video, vbi)
diff --git a/queue-4.19/media-em28xx-use-a-default-format-if-try_fmt-fails.patch b/queue-4.19/media-em28xx-use-a-default-format-if-try_fmt-fails.patch
new file mode 100644 (file)
index 0000000..bfc40b0
--- /dev/null
@@ -0,0 +1,40 @@
+From f823ce2a1202d47110a7ef86b65839f0be8adc38 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Thu, 13 Sep 2018 23:22:40 -0400
+Subject: media: em28xx: use a default format if TRY_FMT fails
+
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+
+commit f823ce2a1202d47110a7ef86b65839f0be8adc38 upstream.
+
+Follow the V4L2 spec, as warned by v4l2-compliance:
+
+       warn: v4l2-test-formats.cpp(732): TRY_FMT cannot handle an invalid pixelformat.
+       warn: v4l2-test-formats.cpp(733): This may or may not be a problem. For more information see:
+
+warn: v4l2-test-formats.cpp(734): http://www.mail-archive.com/linux-media@vger.kernel.org/msg56550.html
+
+Cc: stable@vger.kernel.org
+Fixes: bddcf63313c6 ("V4L/DVB (9927): em28xx: use a more standard way to specify video formats")
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-video.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1471,9 +1471,9 @@ static int vidioc_try_fmt_vid_cap(struct
+       fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+       if (!fmt) {
+-              em28xx_videodbg("Fourcc format (%08x) invalid.\n",
+-                              f->fmt.pix.pixelformat);
+-              return -EINVAL;
++              fmt = &format[0];
++              em28xx_videodbg("Fourcc format (%08x) invalid. Using default (%08x).\n",
++                              f->fmt.pix.pixelformat, fmt->fourcc);
+       }
+       if (dev->board.is_em2800) {
diff --git a/queue-4.19/media-hdmi.h-rename-adobe_rgb-to-oprgb-and-adobe_ycc-to-opycc.patch b/queue-4.19/media-hdmi.h-rename-adobe_rgb-to-oprgb-and-adobe_ycc-to-opycc.patch
new file mode 100644 (file)
index 0000000..fe461b2
--- /dev/null
@@ -0,0 +1,88 @@
+From 463659a08d7999d5461fa45b35b17686189a70ca Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hansverk@cisco.com>
+Date: Thu, 13 Sep 2018 07:47:29 -0400
+Subject: media: hdmi.h: rename ADOBE_RGB to OPRGB and ADOBE_YCC to OPYCC
+
+From: Hans Verkuil <hansverk@cisco.com>
+
+commit 463659a08d7999d5461fa45b35b17686189a70ca upstream.
+
+These names have been renamed in the CTA-861 standard due to trademark
+issues. Replace them here as well so they are in sync with the standard.
+
+Signed-off-by: Hans Verkuil <hansverk@cisco.com>
+Cc: stable@vger.kernel.org
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/adv7511.c               |    4 ++--
+ drivers/media/v4l2-core/v4l2-dv-timings.c |    4 ++--
+ drivers/video/hdmi.c                      |    8 ++++----
+ include/linux/hdmi.h                      |    4 ++--
+ 4 files changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/media/i2c/adv7511.c
++++ b/drivers/media/i2c/adv7511.c
+@@ -1357,8 +1357,8 @@ static int adv7511_set_fmt(struct v4l2_s
+       switch (format->format.colorspace) {
+       case V4L2_COLORSPACE_OPRGB:
+               c = HDMI_COLORIMETRY_EXTENDED;
+-              ec = y ? HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601 :
+-                       HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB;
++              ec = y ? HDMI_EXTENDED_COLORIMETRY_OPYCC_601 :
++                       HDMI_EXTENDED_COLORIMETRY_OPRGB;
+               break;
+       case V4L2_COLORSPACE_SMPTE170M:
+               c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE;
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -837,7 +837,7 @@ v4l2_hdmi_rx_colorimetry(const struct hd
+               switch (avi->colorimetry) {
+               case HDMI_COLORIMETRY_EXTENDED:
+                       switch (avi->extended_colorimetry) {
+-                      case HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB:
++                      case HDMI_EXTENDED_COLORIMETRY_OPRGB:
+                               c.colorspace = V4L2_COLORSPACE_OPRGB;
+                               c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+                               break;
+@@ -908,7 +908,7 @@ v4l2_hdmi_rx_colorimetry(const struct hd
+                               c.ycbcr_enc = V4L2_YCBCR_ENC_601;
+                               c.xfer_func = V4L2_XFER_FUNC_SRGB;
+                               break;
+-                      case HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601:
++                      case HDMI_EXTENDED_COLORIMETRY_OPYCC_601:
+                               c.colorspace = V4L2_COLORSPACE_OPRGB;
+                               c.ycbcr_enc = V4L2_YCBCR_ENC_601;
+                               c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+--- a/drivers/video/hdmi.c
++++ b/drivers/video/hdmi.c
+@@ -592,10 +592,10 @@ hdmi_extended_colorimetry_get_name(enum
+               return "xvYCC 709";
+       case HDMI_EXTENDED_COLORIMETRY_S_YCC_601:
+               return "sYCC 601";
+-      case HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601:
+-              return "Adobe YCC 601";
+-      case HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB:
+-              return "Adobe RGB";
++      case HDMI_EXTENDED_COLORIMETRY_OPYCC_601:
++              return "opYCC 601";
++      case HDMI_EXTENDED_COLORIMETRY_OPRGB:
++              return "opRGB";
+       case HDMI_EXTENDED_COLORIMETRY_BT2020_CONST_LUM:
+               return "BT.2020 Constant Luminance";
+       case HDMI_EXTENDED_COLORIMETRY_BT2020:
+--- a/include/linux/hdmi.h
++++ b/include/linux/hdmi.h
+@@ -101,8 +101,8 @@ enum hdmi_extended_colorimetry {
+       HDMI_EXTENDED_COLORIMETRY_XV_YCC_601,
+       HDMI_EXTENDED_COLORIMETRY_XV_YCC_709,
+       HDMI_EXTENDED_COLORIMETRY_S_YCC_601,
+-      HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601,
+-      HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB,
++      HDMI_EXTENDED_COLORIMETRY_OPYCC_601,
++      HDMI_EXTENDED_COLORIMETRY_OPRGB,
+       /* The following EC values are only defined in CEA-861-F. */
+       HDMI_EXTENDED_COLORIMETRY_BT2020_CONST_LUM,
diff --git a/queue-4.19/media-media-colorspaces-.rst-rename-adobergb-to-oprgb.patch b/queue-4.19/media-media-colorspaces-.rst-rename-adobergb-to-oprgb.patch
new file mode 100644 (file)
index 0000000..04d6c18
--- /dev/null
@@ -0,0 +1,99 @@
+From a58c37978cf02f6d35d05ee4e9288cb8455f1401 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hansverk@cisco.com>
+Date: Thu, 13 Sep 2018 07:47:28 -0400
+Subject: media: media colorspaces*.rst: rename AdobeRGB to opRGB
+
+From: Hans Verkuil <hansverk@cisco.com>
+
+commit a58c37978cf02f6d35d05ee4e9288cb8455f1401 upstream.
+
+Drop all Adobe references and use the official opRGB standard
+instead.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: stable@vger.kernel.org
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/media/uapi/v4l/biblio.rst              |   10 ----------
+ Documentation/media/uapi/v4l/colorspaces-defs.rst    |    8 ++++----
+ Documentation/media/uapi/v4l/colorspaces-details.rst |   13 ++++++-------
+ 3 files changed, 10 insertions(+), 21 deletions(-)
+
+--- a/Documentation/media/uapi/v4l/biblio.rst
++++ b/Documentation/media/uapi/v4l/biblio.rst
+@@ -226,16 +226,6 @@ xvYCC
+ :author:    International Electrotechnical Commission (http://www.iec.ch)
+-.. _adobergb:
+-
+-AdobeRGB
+-========
+-
+-
+-:title:     Adobe© RGB (1998) Color Image Encoding Version 2005-05
+-
+-:author:    Adobe Systems Incorporated (http://www.adobe.com)
+-
+ .. _oprgb:
+ opRGB
+--- a/Documentation/media/uapi/v4l/colorspaces-defs.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-defs.rst
+@@ -51,8 +51,8 @@ whole range, 0-255, dividing the angular
+       - See :ref:`col-rec709`.
+     * - ``V4L2_COLORSPACE_SRGB``
+       - See :ref:`col-srgb`.
+-    * - ``V4L2_COLORSPACE_ADOBERGB``
+-      - See :ref:`col-adobergb`.
++    * - ``V4L2_COLORSPACE_OPRGB``
++      - See :ref:`col-oprgb`.
+     * - ``V4L2_COLORSPACE_BT2020``
+       - See :ref:`col-bt2020`.
+     * - ``V4L2_COLORSPACE_DCI_P3``
+@@ -90,8 +90,8 @@ whole range, 0-255, dividing the angular
+       - Use the Rec. 709 transfer function.
+     * - ``V4L2_XFER_FUNC_SRGB``
+       - Use the sRGB transfer function.
+-    * - ``V4L2_XFER_FUNC_ADOBERGB``
+-      - Use the AdobeRGB transfer function.
++    * - ``V4L2_XFER_FUNC_OPRGB``
++      - Use the opRGB transfer function.
+     * - ``V4L2_XFER_FUNC_SMPTE240M``
+       - Use the SMPTE 240M transfer function.
+     * - ``V4L2_XFER_FUNC_NONE``
+--- a/Documentation/media/uapi/v4l/colorspaces-details.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-details.rst
+@@ -290,15 +290,14 @@ Y' is clamped to the range [0…1] and C
+ 170M/BT.601. The Y'CbCr quantization is limited range.
+-.. _col-adobergb:
++.. _col-oprgb:
+-Colorspace Adobe RGB (V4L2_COLORSPACE_ADOBERGB)
++Colorspace opRGB (V4L2_COLORSPACE_OPRGB)
+ ===============================================
+-The :ref:`adobergb` standard defines the colorspace used by computer
+-graphics that use the AdobeRGB colorspace. This is also known as the
+-:ref:`oprgb` standard. The default transfer function is
+-``V4L2_XFER_FUNC_ADOBERGB``. The default Y'CbCr encoding is
++The :ref:`oprgb` standard defines the colorspace used by computer
++graphics that use the opRGB colorspace. The default transfer function is
++``V4L2_XFER_FUNC_OPRGB``. The default Y'CbCr encoding is
+ ``V4L2_YCBCR_ENC_601``. The default Y'CbCr quantization is limited
+ range.
+@@ -312,7 +311,7 @@ The chromaticities of the primary colors
+ .. tabularcolumns:: |p{4.4cm}|p{4.4cm}|p{8.7cm}|
+-.. flat-table:: Adobe RGB Chromaticities
++.. flat-table:: opRGB Chromaticities
+     :header-rows:  1
+     :stub-columns: 0
+     :widths:       1 1 2
diff --git a/queue-4.19/media-replace-adobergb-by-oprgb.patch b/queue-4.19/media-replace-adobergb-by-oprgb.patch
new file mode 100644 (file)
index 0000000..694c30d
--- /dev/null
@@ -0,0 +1,613 @@
+From db0340182444612bcadb98bdec22f651aa42266c Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Fri, 14 Sep 2018 04:58:03 -0400
+Subject: media: replace ADOBERGB by OPRGB
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit db0340182444612bcadb98bdec22f651aa42266c upstream.
+
+The CTA-861 standards have been updated to refer to opRGB instead
+of AdobeRGB. The official standard is in fact named opRGB, so
+switch to that.
+
+The two old defines referring to ADOBERGB in the public API are
+put under #ifndef __KERNEL__ and a comment mentions that they are
+deprecated.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: stable@vger.kernel.org
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/media/videodev2.h.rst.exceptions  |    6 
+ drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c |  262 ++++++++++++------------
+ drivers/media/i2c/adv7511.c                     |    2 
+ drivers/media/i2c/adv7604.c                     |    2 
+ drivers/media/i2c/tc358743.c                    |    4 
+ drivers/media/platform/vivid/vivid-core.h       |    2 
+ drivers/media/platform/vivid/vivid-ctrls.c      |    6 
+ drivers/media/platform/vivid/vivid-vid-out.c    |    2 
+ drivers/media/v4l2-core/v4l2-dv-timings.c       |    8 
+ include/uapi/linux/videodev2.h                  |   23 +-
+ 10 files changed, 165 insertions(+), 152 deletions(-)
+
+--- a/Documentation/media/videodev2.h.rst.exceptions
++++ b/Documentation/media/videodev2.h.rst.exceptions
+@@ -56,7 +56,8 @@ replace symbol V4L2_MEMORY_USERPTR :c:ty
+ # Documented enum v4l2_colorspace
+ replace symbol V4L2_COLORSPACE_470_SYSTEM_BG :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_470_SYSTEM_M :c:type:`v4l2_colorspace`
+-replace symbol V4L2_COLORSPACE_ADOBERGB :c:type:`v4l2_colorspace`
++replace symbol V4L2_COLORSPACE_OPRGB :c:type:`v4l2_colorspace`
++replace define V4L2_COLORSPACE_ADOBERGB :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_BT2020 :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_DCI_P3 :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_DEFAULT :c:type:`v4l2_colorspace`
+@@ -69,7 +70,8 @@ replace symbol V4L2_COLORSPACE_SRGB :c:t
+ # Documented enum v4l2_xfer_func
+ replace symbol V4L2_XFER_FUNC_709 :c:type:`v4l2_xfer_func`
+-replace symbol V4L2_XFER_FUNC_ADOBERGB :c:type:`v4l2_xfer_func`
++replace symbol V4L2_XFER_FUNC_OPRGB :c:type:`v4l2_xfer_func`
++replace define V4L2_XFER_FUNC_ADOBERGB :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_DCI_P3 :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_DEFAULT :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_NONE :c:type:`v4l2_xfer_func`
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
+@@ -602,14 +602,14 @@ const struct tpg_rbg_color16 tpg_csc_col
+       [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][5] = { 3138, 657, 810 },
+       [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][6] = { 731, 680, 3048 },
+       [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+-      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+-      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][1] = { 3046, 3054, 886 },
+-      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][2] = { 0, 3058, 3031 },
+-      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][3] = { 360, 3079, 877 },
+-      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][4] = { 3103, 587, 3027 },
+-      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][5] = { 3116, 723, 861 },
+-      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][6] = { 789, 744, 3025 },
+-      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][1] = { 3046, 3054, 886 },
++      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][2] = { 0, 3058, 3031 },
++      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][3] = { 360, 3079, 877 },
++      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][4] = { 3103, 587, 3027 },
++      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][5] = { 3116, 723, 861 },
++      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][6] = { 789, 744, 3025 },
++      [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+       [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+       [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2941, 2950, 546 },
+       [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][2] = { 0, 2954, 2924 },
+@@ -658,14 +658,14 @@ const struct tpg_rbg_color16 tpg_csc_col
+       [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][5] = { 3138, 657, 810 },
+       [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][6] = { 731, 680, 3048 },
+       [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+-      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+-      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][1] = { 3046, 3054, 886 },
+-      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][2] = { 0, 3058, 3031 },
+-      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][3] = { 360, 3079, 877 },
+-      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][4] = { 3103, 587, 3027 },
+-      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][5] = { 3116, 723, 861 },
+-      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][6] = { 789, 744, 3025 },
+-      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][1] = { 3046, 3054, 886 },
++      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][2] = { 0, 3058, 3031 },
++      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][3] = { 360, 3079, 877 },
++      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][4] = { 3103, 587, 3027 },
++      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][5] = { 3116, 723, 861 },
++      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][6] = { 789, 744, 3025 },
++      [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+       [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+       [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2941, 2950, 546 },
+       [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][2] = { 0, 2954, 2924 },
+@@ -714,14 +714,14 @@ const struct tpg_rbg_color16 tpg_csc_col
+       [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][5] = { 3056, 800, 800 },
+       [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3056 },
+       [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+-      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+-      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 851 },
+-      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][2] = { 851, 3033, 3033 },
+-      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][3] = { 851, 3033, 851 },
+-      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][4] = { 3033, 851, 3033 },
+-      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][5] = { 3033, 851, 851 },
+-      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3033 },
+-      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 851 },
++      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][2] = { 851, 3033, 3033 },
++      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][3] = { 851, 3033, 851 },
++      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][4] = { 3033, 851, 3033 },
++      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][5] = { 3033, 851, 851 },
++      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3033 },
++      [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+       [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+       [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 507 },
+       [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][2] = { 507, 2926, 2926 },
+@@ -770,14 +770,14 @@ const struct tpg_rbg_color16 tpg_csc_col
+       [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][5] = { 2599, 901, 909 },
+       [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][6] = { 991, 0, 2966 },
+       [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+-      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+-      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][1] = { 2989, 3120, 1180 },
+-      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][2] = { 1913, 3011, 3009 },
+-      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][3] = { 1836, 3099, 1105 },
+-      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][4] = { 2627, 413, 2966 },
+-      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][5] = { 2576, 943, 951 },
+-      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][6] = { 1026, 0, 2942 },
+-      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][1] = { 2989, 3120, 1180 },
++      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][2] = { 1913, 3011, 3009 },
++      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][3] = { 1836, 3099, 1105 },
++      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][4] = { 2627, 413, 2966 },
++      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][5] = { 2576, 943, 951 },
++      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][6] = { 1026, 0, 2942 },
++      [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+       [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+       [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2879, 3022, 874 },
+       [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][2] = { 1688, 2903, 2901 },
+@@ -826,14 +826,14 @@ const struct tpg_rbg_color16 tpg_csc_col
+       [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][5] = { 3001, 800, 799 },
+       [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3071 },
+       [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 799 },
+-      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+-      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 776 },
+-      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][2] = { 1068, 3033, 3033 },
+-      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][3] = { 1068, 3033, 776 },
+-      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][4] = { 2977, 851, 3048 },
+-      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][5] = { 2977, 851, 851 },
+-      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3048 },
+-      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 776 },
++      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][2] = { 1068, 3033, 3033 },
++      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][3] = { 1068, 3033, 776 },
++      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][4] = { 2977, 851, 3048 },
++      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][5] = { 2977, 851, 851 },
++      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3048 },
++      [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+       [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+       [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 423 },
+       [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][2] = { 749, 2926, 2926 },
+@@ -882,14 +882,14 @@ const struct tpg_rbg_color16 tpg_csc_col
+       [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][5] = { 3056, 800, 800 },
+       [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3056 },
+       [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+-      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+-      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 851 },
+-      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][2] = { 851, 3033, 3033 },
+-      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][3] = { 851, 3033, 851 },
+-      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][4] = { 3033, 851, 3033 },
+-      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][5] = { 3033, 851, 851 },
+-      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3033 },
+-      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 851 },
++      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][2] = { 851, 3033, 3033 },
++      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][3] = { 851, 3033, 851 },
++      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][4] = { 3033, 851, 3033 },
++      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][5] = { 3033, 851, 851 },
++      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3033 },
++      [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+       [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+       [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 507 },
+       [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 507, 2926, 2926 },
+@@ -922,62 +922,62 @@ const struct tpg_rbg_color16 tpg_csc_col
+       [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1812, 886, 886 },
+       [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1812 },
+       [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][1] = { 2939, 2939, 781 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][2] = { 1622, 2939, 2939 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][3] = { 1622, 2939, 781 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][4] = { 2502, 547, 2881 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][5] = { 2502, 547, 547 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][6] = { 547, 547, 2881 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][7] = { 547, 547, 547 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][0] = { 3056, 3056, 3056 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][1] = { 3056, 3056, 1031 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][2] = { 1838, 3056, 3056 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][3] = { 1838, 3056, 1031 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][4] = { 2657, 800, 3002 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][5] = { 2657, 800, 800 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3002 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 1063 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][2] = { 1828, 3033, 3033 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][3] = { 1828, 3033, 1063 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][4] = { 2633, 851, 2979 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][5] = { 2633, 851, 851 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 2979 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 744 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 1594, 2926, 2926 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][3] = { 1594, 2926, 744 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][4] = { 2484, 507, 2867 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][5] = { 2484, 507, 507 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][6] = { 507, 507, 2867 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][7] = { 507, 507, 507 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][0] = { 2125, 2125, 2125 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][1] = { 2125, 2125, 212 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][2] = { 698, 2125, 2125 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][3] = { 698, 2125, 212 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][4] = { 1557, 130, 2043 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][5] = { 1557, 130, 130 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][6] = { 130, 130, 2043 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][7] = { 130, 130, 130 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][0] = { 3175, 3175, 3175 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][1] = { 3175, 3175, 1308 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][2] = { 2069, 3175, 3175 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][3] = { 2069, 3175, 1308 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][4] = { 2816, 1084, 3127 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][5] = { 2816, 1084, 1084 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][6] = { 1084, 1084, 3127 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][7] = { 1084, 1084, 1084 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][0] = { 1812, 1812, 1812 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][1] = { 1812, 1812, 1022 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][2] = { 1402, 1812, 1812 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][3] = { 1402, 1812, 1022 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][4] = { 1692, 886, 1797 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1692, 886, 886 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1797 },
+-      [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][1] = { 2939, 2939, 781 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][2] = { 1622, 2939, 2939 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][3] = { 1622, 2939, 781 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][4] = { 2502, 547, 2881 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][5] = { 2502, 547, 547 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][6] = { 547, 547, 2881 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][7] = { 547, 547, 547 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][0] = { 3056, 3056, 3056 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][1] = { 3056, 3056, 1031 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][2] = { 1838, 3056, 3056 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][3] = { 1838, 3056, 1031 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][4] = { 2657, 800, 3002 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][5] = { 2657, 800, 800 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3002 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 1063 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][2] = { 1828, 3033, 3033 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][3] = { 1828, 3033, 1063 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][4] = { 2633, 851, 2979 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][5] = { 2633, 851, 851 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 2979 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 744 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 1594, 2926, 2926 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][3] = { 1594, 2926, 744 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][4] = { 2484, 507, 2867 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][5] = { 2484, 507, 507 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][6] = { 507, 507, 2867 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][7] = { 507, 507, 507 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][0] = { 2125, 2125, 2125 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][1] = { 2125, 2125, 212 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][2] = { 698, 2125, 2125 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][3] = { 698, 2125, 212 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][4] = { 1557, 130, 2043 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][5] = { 1557, 130, 130 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][6] = { 130, 130, 2043 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][7] = { 130, 130, 130 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][0] = { 3175, 3175, 3175 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][1] = { 3175, 3175, 1308 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][2] = { 2069, 3175, 3175 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][3] = { 2069, 3175, 1308 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][4] = { 2816, 1084, 3127 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][5] = { 2816, 1084, 1084 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][6] = { 1084, 1084, 3127 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][7] = { 1084, 1084, 1084 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][0] = { 1812, 1812, 1812 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][1] = { 1812, 1812, 1022 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][2] = { 1402, 1812, 1812 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][3] = { 1402, 1812, 1022 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][4] = { 1692, 886, 1797 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1692, 886, 886 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1797 },
++      [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
+       [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
+       [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][1] = { 2877, 2923, 1058 },
+       [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][2] = { 1837, 2840, 2916 },
+@@ -994,14 +994,14 @@ const struct tpg_rbg_color16 tpg_csc_col
+       [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][5] = { 2517, 1159, 900 },
+       [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][6] = { 1042, 870, 2917 },
+       [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+-      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+-      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][1] = { 2976, 3018, 1315 },
+-      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][2] = { 2024, 2942, 3011 },
+-      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][3] = { 1930, 2926, 1256 },
+-      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][4] = { 2563, 1227, 2916 },
+-      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][5] = { 2494, 1183, 943 },
+-      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][6] = { 1073, 916, 2894 },
+-      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][1] = { 2976, 3018, 1315 },
++      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][2] = { 2024, 2942, 3011 },
++      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][3] = { 1930, 2926, 1256 },
++      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][4] = { 2563, 1227, 2916 },
++      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][5] = { 2494, 1183, 943 },
++      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][6] = { 1073, 916, 2894 },
++      [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+       [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+       [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][1] = { 2864, 2910, 1024 },
+       [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][2] = { 1811, 2826, 2903 },
+@@ -1050,14 +1050,14 @@ const struct tpg_rbg_color16 tpg_csc_col
+       [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][5] = { 2880, 998, 902 },
+       [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][6] = { 816, 823, 2940 },
+       [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 799 },
+-      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+-      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][1] = { 3029, 3028, 1255 },
+-      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][2] = { 1406, 2988, 3011 },
+-      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][3] = { 1398, 2983, 1190 },
+-      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][4] = { 2860, 1050, 2939 },
+-      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][5] = { 2857, 1033, 945 },
+-      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][6] = { 866, 873, 2916 },
+-      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][1] = { 3029, 3028, 1255 },
++      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][2] = { 1406, 2988, 3011 },
++      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][3] = { 1398, 2983, 1190 },
++      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][4] = { 2860, 1050, 2939 },
++      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][5] = { 2857, 1033, 945 },
++      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][6] = { 866, 873, 2916 },
++      [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+       [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+       [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][1] = { 2923, 2921, 957 },
+       [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][2] = { 1125, 2877, 2902 },
+@@ -1128,7 +1128,7 @@ static const double rec709_to_240m[3][3]
+       { 0.0016327, 0.0044133, 0.9939540 },
+ };
+-static const double rec709_to_adobergb[3][3] = {
++static const double rec709_to_oprgb[3][3] = {
+       { 0.7151627, 0.2848373, -0.0000000 },
+       { 0.0000000, 1.0000000, 0.0000000 },
+       { -0.0000000, 0.0411705, 0.9588295 },
+@@ -1195,7 +1195,7 @@ static double transfer_rec709_to_rgb(dou
+       return (v < 0.081) ? v / 4.5 : pow((v + 0.099) / 1.099, 1.0 / 0.45);
+ }
+-static double transfer_rgb_to_adobergb(double v)
++static double transfer_rgb_to_oprgb(double v)
+ {
+       return pow(v, 1.0 / 2.19921875);
+ }
+@@ -1251,8 +1251,8 @@ static void csc(enum v4l2_colorspace col
+       case V4L2_COLORSPACE_470_SYSTEM_M:
+               mult_matrix(r, g, b, rec709_to_ntsc1953);
+               break;
+-      case V4L2_COLORSPACE_ADOBERGB:
+-              mult_matrix(r, g, b, rec709_to_adobergb);
++      case V4L2_COLORSPACE_OPRGB:
++              mult_matrix(r, g, b, rec709_to_oprgb);
+               break;
+       case V4L2_COLORSPACE_BT2020:
+               mult_matrix(r, g, b, rec709_to_bt2020);
+@@ -1284,10 +1284,10 @@ static void csc(enum v4l2_colorspace col
+               *g = transfer_rgb_to_srgb(*g);
+               *b = transfer_rgb_to_srgb(*b);
+               break;
+-      case V4L2_XFER_FUNC_ADOBERGB:
+-              *r = transfer_rgb_to_adobergb(*r);
+-              *g = transfer_rgb_to_adobergb(*g);
+-              *b = transfer_rgb_to_adobergb(*b);
++      case V4L2_XFER_FUNC_OPRGB:
++              *r = transfer_rgb_to_oprgb(*r);
++              *g = transfer_rgb_to_oprgb(*g);
++              *b = transfer_rgb_to_oprgb(*b);
+               break;
+       case V4L2_XFER_FUNC_DCI_P3:
+               *r = transfer_rgb_to_dcip3(*r);
+@@ -1321,7 +1321,7 @@ int main(int argc, char **argv)
+               V4L2_COLORSPACE_470_SYSTEM_BG,
+               0,
+               V4L2_COLORSPACE_SRGB,
+-              V4L2_COLORSPACE_ADOBERGB,
++              V4L2_COLORSPACE_OPRGB,
+               V4L2_COLORSPACE_BT2020,
+               0,
+               V4L2_COLORSPACE_DCI_P3,
+@@ -1336,7 +1336,7 @@ int main(int argc, char **argv)
+               "V4L2_COLORSPACE_470_SYSTEM_BG",
+               "",
+               "V4L2_COLORSPACE_SRGB",
+-              "V4L2_COLORSPACE_ADOBERGB",
++              "V4L2_COLORSPACE_OPRGB",
+               "V4L2_COLORSPACE_BT2020",
+               "",
+               "V4L2_COLORSPACE_DCI_P3",
+@@ -1345,7 +1345,7 @@ int main(int argc, char **argv)
+               "",
+               "V4L2_XFER_FUNC_709",
+               "V4L2_XFER_FUNC_SRGB",
+-              "V4L2_XFER_FUNC_ADOBERGB",
++              "V4L2_XFER_FUNC_OPRGB",
+               "V4L2_XFER_FUNC_SMPTE240M",
+               "V4L2_XFER_FUNC_NONE",
+               "V4L2_XFER_FUNC_DCI_P3",
+--- a/drivers/media/i2c/adv7511.c
++++ b/drivers/media/i2c/adv7511.c
+@@ -1355,7 +1355,7 @@ static int adv7511_set_fmt(struct v4l2_s
+       state->xfer_func = format->format.xfer_func;
+       switch (format->format.colorspace) {
+-      case V4L2_COLORSPACE_ADOBERGB:
++      case V4L2_COLORSPACE_OPRGB:
+               c = HDMI_COLORIMETRY_EXTENDED;
+               ec = y ? HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601 :
+                        HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB;
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2476,7 +2476,7 @@ static int adv76xx_log_status(struct v4l
+               "YCbCr Bt.601 (16-235)", "YCbCr Bt.709 (16-235)",
+               "xvYCC Bt.601", "xvYCC Bt.709",
+               "YCbCr Bt.601 (0-255)", "YCbCr Bt.709 (0-255)",
+-              "sYCC", "Adobe YCC 601", "AdobeRGB", "invalid", "invalid",
++              "sYCC", "opYCC 601", "opRGB", "invalid", "invalid",
+               "invalid", "invalid", "invalid"
+       };
+       static const char * const rgb_quantization_range_txt[] = {
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1243,9 +1243,9 @@ static int tc358743_log_status(struct v4
+       u8 vi_status3 =  i2c_rd8(sd, VI_STATUS3);
+       const int deep_color_mode[4] = { 8, 10, 12, 16 };
+       static const char * const input_color_space[] = {
+-              "RGB", "YCbCr 601", "Adobe RGB", "YCbCr 709", "NA (4)",
++              "RGB", "YCbCr 601", "opRGB", "YCbCr 709", "NA (4)",
+               "xvYCC 601", "NA(6)", "xvYCC 709", "NA(8)", "sYCC601",
+-              "NA(10)", "NA(11)", "NA(12)", "Adobe YCC 601"};
++              "NA(10)", "NA(11)", "NA(12)", "opYCC 601"};
+       v4l2_info(sd, "-----Chip status-----\n");
+       v4l2_info(sd, "Chip ID: 0x%02x\n",
+--- a/drivers/media/platform/vivid/vivid-core.h
++++ b/drivers/media/platform/vivid/vivid-core.h
+@@ -111,7 +111,7 @@ enum vivid_colorspace {
+       VIVID_CS_170M,
+       VIVID_CS_709,
+       VIVID_CS_SRGB,
+-      VIVID_CS_ADOBERGB,
++      VIVID_CS_OPRGB,
+       VIVID_CS_2020,
+       VIVID_CS_DCI_P3,
+       VIVID_CS_240M,
+--- a/drivers/media/platform/vivid/vivid-ctrls.c
++++ b/drivers/media/platform/vivid/vivid-ctrls.c
+@@ -348,7 +348,7 @@ static int vivid_vid_cap_s_ctrl(struct v
+               V4L2_COLORSPACE_SMPTE170M,
+               V4L2_COLORSPACE_REC709,
+               V4L2_COLORSPACE_SRGB,
+-              V4L2_COLORSPACE_ADOBERGB,
++              V4L2_COLORSPACE_OPRGB,
+               V4L2_COLORSPACE_BT2020,
+               V4L2_COLORSPACE_DCI_P3,
+               V4L2_COLORSPACE_SMPTE240M,
+@@ -729,7 +729,7 @@ static const char * const vivid_ctrl_col
+       "SMPTE 170M",
+       "Rec. 709",
+       "sRGB",
+-      "AdobeRGB",
++      "opRGB",
+       "BT.2020",
+       "DCI-P3",
+       "SMPTE 240M",
+@@ -752,7 +752,7 @@ static const char * const vivid_ctrl_xfe
+       "Default",
+       "Rec. 709",
+       "sRGB",
+-      "AdobeRGB",
++      "opRGB",
+       "SMPTE 240M",
+       "None",
+       "DCI-P3",
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -413,7 +413,7 @@ int vivid_try_fmt_vid_out(struct file *f
+               mp->colorspace = V4L2_COLORSPACE_SMPTE170M;
+       } else if (mp->colorspace != V4L2_COLORSPACE_SMPTE170M &&
+                  mp->colorspace != V4L2_COLORSPACE_REC709 &&
+-                 mp->colorspace != V4L2_COLORSPACE_ADOBERGB &&
++                 mp->colorspace != V4L2_COLORSPACE_OPRGB &&
+                  mp->colorspace != V4L2_COLORSPACE_BT2020 &&
+                  mp->colorspace != V4L2_COLORSPACE_SRGB) {
+               mp->colorspace = V4L2_COLORSPACE_REC709;
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -838,8 +838,8 @@ v4l2_hdmi_rx_colorimetry(const struct hd
+               case HDMI_COLORIMETRY_EXTENDED:
+                       switch (avi->extended_colorimetry) {
+                       case HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB:
+-                              c.colorspace = V4L2_COLORSPACE_ADOBERGB;
+-                              c.xfer_func = V4L2_XFER_FUNC_ADOBERGB;
++                              c.colorspace = V4L2_COLORSPACE_OPRGB;
++                              c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+                               break;
+                       case HDMI_EXTENDED_COLORIMETRY_BT2020:
+                               c.colorspace = V4L2_COLORSPACE_BT2020;
+@@ -909,9 +909,9 @@ v4l2_hdmi_rx_colorimetry(const struct hd
+                               c.xfer_func = V4L2_XFER_FUNC_SRGB;
+                               break;
+                       case HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601:
+-                              c.colorspace = V4L2_COLORSPACE_ADOBERGB;
++                              c.colorspace = V4L2_COLORSPACE_OPRGB;
+                               c.ycbcr_enc = V4L2_YCBCR_ENC_601;
+-                              c.xfer_func = V4L2_XFER_FUNC_ADOBERGB;
++                              c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+                               break;
+                       case HDMI_EXTENDED_COLORIMETRY_BT2020:
+                               c.colorspace = V4L2_COLORSPACE_BT2020;
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -225,8 +225,8 @@ enum v4l2_colorspace {
+       /* For RGB colorspaces such as produces by most webcams. */
+       V4L2_COLORSPACE_SRGB          = 8,
+-      /* AdobeRGB colorspace */
+-      V4L2_COLORSPACE_ADOBERGB      = 9,
++      /* opRGB colorspace */
++      V4L2_COLORSPACE_OPRGB         = 9,
+       /* BT.2020 colorspace, used for UHDTV. */
+       V4L2_COLORSPACE_BT2020        = 10,
+@@ -258,7 +258,7 @@ enum v4l2_xfer_func {
+        *
+        * V4L2_COLORSPACE_SRGB, V4L2_COLORSPACE_JPEG: V4L2_XFER_FUNC_SRGB
+        *
+-       * V4L2_COLORSPACE_ADOBERGB: V4L2_XFER_FUNC_ADOBERGB
++       * V4L2_COLORSPACE_OPRGB: V4L2_XFER_FUNC_OPRGB
+        *
+        * V4L2_COLORSPACE_SMPTE240M: V4L2_XFER_FUNC_SMPTE240M
+        *
+@@ -269,7 +269,7 @@ enum v4l2_xfer_func {
+       V4L2_XFER_FUNC_DEFAULT     = 0,
+       V4L2_XFER_FUNC_709         = 1,
+       V4L2_XFER_FUNC_SRGB        = 2,
+-      V4L2_XFER_FUNC_ADOBERGB    = 3,
++      V4L2_XFER_FUNC_OPRGB       = 3,
+       V4L2_XFER_FUNC_SMPTE240M   = 4,
+       V4L2_XFER_FUNC_NONE        = 5,
+       V4L2_XFER_FUNC_DCI_P3      = 6,
+@@ -281,7 +281,7 @@ enum v4l2_xfer_func {
+  * This depends on the colorspace.
+  */
+ #define V4L2_MAP_XFER_FUNC_DEFAULT(colsp) \
+-      ((colsp) == V4L2_COLORSPACE_ADOBERGB ? V4L2_XFER_FUNC_ADOBERGB : \
++      ((colsp) == V4L2_COLORSPACE_OPRGB ? V4L2_XFER_FUNC_OPRGB : \
+        ((colsp) == V4L2_COLORSPACE_SMPTE240M ? V4L2_XFER_FUNC_SMPTE240M : \
+         ((colsp) == V4L2_COLORSPACE_DCI_P3 ? V4L2_XFER_FUNC_DCI_P3 : \
+          ((colsp) == V4L2_COLORSPACE_RAW ? V4L2_XFER_FUNC_NONE : \
+@@ -295,7 +295,7 @@ enum v4l2_ycbcr_encoding {
+        *
+        * V4L2_COLORSPACE_SMPTE170M, V4L2_COLORSPACE_470_SYSTEM_M,
+        * V4L2_COLORSPACE_470_SYSTEM_BG, V4L2_COLORSPACE_SRGB,
+-       * V4L2_COLORSPACE_ADOBERGB and V4L2_COLORSPACE_JPEG: V4L2_YCBCR_ENC_601
++       * V4L2_COLORSPACE_OPRGB and V4L2_COLORSPACE_JPEG: V4L2_YCBCR_ENC_601
+        *
+        * V4L2_COLORSPACE_REC709 and V4L2_COLORSPACE_DCI_P3: V4L2_YCBCR_ENC_709
+        *
+@@ -382,6 +382,17 @@ enum v4l2_quantization {
+        (((is_rgb_or_hsv) || (colsp) == V4L2_COLORSPACE_JPEG) ? \
+        V4L2_QUANTIZATION_FULL_RANGE : V4L2_QUANTIZATION_LIM_RANGE))
++/*
++ * Deprecated names for opRGB colorspace (IEC 61966-2-5)
++ *
++ * WARNING: Please don't use these deprecated defines in your code, as
++ * there is a chance we have to remove them in the future.
++ */
++#ifndef __KERNEL__
++#define V4L2_COLORSPACE_ADOBERGB V4L2_COLORSPACE_OPRGB
++#define V4L2_XFER_FUNC_ADOBERGB  V4L2_XFER_FUNC_OPRGB
++#endif
++
+ enum v4l2_priority {
+       V4L2_PRIORITY_UNSET       = 0,  /* not initialized */
+       V4L2_PRIORITY_BACKGROUND  = 1,
diff --git a/queue-4.19/media-tvp5150-avoid-going-past-array-on-v4l2_querymenu.patch b/queue-4.19/media-tvp5150-avoid-going-past-array-on-v4l2_querymenu.patch
new file mode 100644 (file)
index 0000000..1fba047
--- /dev/null
@@ -0,0 +1,80 @@
+From 5c4c4505b716cb782ad7263091edc466c4d1fbd4 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Thu, 13 Sep 2018 16:49:51 -0400
+Subject: media: tvp5150: avoid going past array on v4l2_querymenu()
+
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+
+commit 5c4c4505b716cb782ad7263091edc466c4d1fbd4 upstream.
+
+The parameters of v4l2_ctrl_new_std_menu_items() are tricky: instead of
+the number of possible values, it requires the number of the maximum
+value. In other words, the ARRAY_SIZE() value should be decremented,
+otherwise it will go past the array bounds, as warned by KASAN:
+
+[  279.839688] BUG: KASAN: global-out-of-bounds in v4l2_querymenu+0x10d/0x180 [videodev]
+[  279.839709] Read of size 8 at addr ffffffffc10a4cb0 by task v4l2-compliance/16676
+
+[  279.839736] CPU: 1 PID: 16676 Comm: v4l2-compliance Not tainted 4.18.0-rc2+ #120
+[  279.839741] Hardware name:  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
+[  279.839743] Call Trace:
+[  279.839758]  dump_stack+0x71/0xab
+[  279.839807]  ? v4l2_querymenu+0x10d/0x180 [videodev]
+[  279.839817]  print_address_description+0x1c9/0x270
+[  279.839863]  ? v4l2_querymenu+0x10d/0x180 [videodev]
+[  279.839871]  kasan_report+0x237/0x360
+[  279.839918]  v4l2_querymenu+0x10d/0x180 [videodev]
+[  279.839964]  __video_do_ioctl+0x2c8/0x590 [videodev]
+[  279.840011]  ? copy_overflow+0x20/0x20 [videodev]
+[  279.840020]  ? avc_ss_reset+0xa0/0xa0
+[  279.840028]  ? check_stack_object+0x21/0x60
+[  279.840036]  ? __check_object_size+0xe7/0x240
+[  279.840080]  video_usercopy+0xed/0x730 [videodev]
+[  279.840123]  ? copy_overflow+0x20/0x20 [videodev]
+[  279.840167]  ? v4l_enumstd+0x40/0x40 [videodev]
+[  279.840177]  ? __handle_mm_fault+0x9f9/0x1ba0
+[  279.840186]  ? __pmd_alloc+0x2c0/0x2c0
+[  279.840193]  ? __vfs_write+0xb6/0x350
+[  279.840200]  ? kernel_read+0xa0/0xa0
+[  279.840244]  ? video_usercopy+0x730/0x730 [videodev]
+[  279.840284]  v4l2_ioctl+0xa1/0xb0 [videodev]
+[  279.840295]  do_vfs_ioctl+0x117/0x8a0
+[  279.840303]  ? selinux_file_ioctl+0x211/0x2f0
+[  279.840313]  ? ioctl_preallocate+0x120/0x120
+[  279.840319]  ? selinux_capable+0x20/0x20
+[  279.840332]  ksys_ioctl+0x70/0x80
+[  279.840342]  __x64_sys_ioctl+0x3d/0x50
+[  279.840351]  do_syscall_64+0x6d/0x1c0
+[  279.840361]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[  279.840367] RIP: 0033:0x7fdfb46275d7
+[  279.840369] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
+[  279.840474] RSP: 002b:00007ffee1179038 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+[  279.840483] RAX: ffffffffffffffda RBX: 00007ffee1179180 RCX: 00007fdfb46275d7
+[  279.840488] RDX: 00007ffee11790c0 RSI: 00000000c02c5625 RDI: 0000000000000003
+[  279.840493] RBP: 0000000000000002 R08: 0000000000000020 R09: 00000000009f0902
+[  279.840497] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffee117a5a0
+[  279.840501] R13: 00007ffee11790c0 R14: 0000000000000002 R15: 0000000000000000
+
+[  279.840515] The buggy address belongs to the variable:
+[  279.840535]  tvp5150_test_patterns+0x10/0xffffffffffffe360 [tvp5150]
+
+Fixes: c43875f66140 ("[media] tvp5150: replace MEDIA_ENT_F_CONN_TEST by a control")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/tvp5150.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -1534,7 +1534,7 @@ static int tvp5150_probe(struct i2c_clie
+                       27000000, 1, 27000000);
+       v4l2_ctrl_new_std_menu_items(&core->hdl, &tvp5150_ctrl_ops,
+                                    V4L2_CID_TEST_PATTERN,
+-                                   ARRAY_SIZE(tvp5150_test_patterns),
++                                   ARRAY_SIZE(tvp5150_test_patterns) - 1,
+                                    0, 0, tvp5150_test_patterns);
+       sd->ctrl_handler = &core->hdl;
+       if (core->hdl.error) {
index 0e72d092df84cb8c6671f59f02427736e54ae4c2..996f1d7e3424af9296ebf2391dcd3a944cc13752 100644 (file)
@@ -298,3 +298,20 @@ kgdboc-passing-ekgdboc-to-command-line-causes-panic.patch
 remoteproc-qcom-q6v5-propagate-eprobe_defer.patch
 media-cec-make-cec_get_edid_spa_location-an-inline-function.patch
 media-cec-integrate-cec_validate_phys_addr-in-cec-api.c.patch
+xen-fix-xen_qlock_wait.patch
+xen-remove-size-limit-of-privcmd-buf-mapping-interface.patch
+xen-blkfront-fix-kernel-panic-with-negotiate_mq-error-path.patch
+media-cec-add-new-tx-rx-status-bits-to-detect-aborts-timeouts.patch
+media-cec-fix-the-signal-free-time-calculation.patch
+media-cec-forgot-to-cancel-delayed-work.patch
+media-em28xx-use-a-default-format-if-try_fmt-fails.patch
+media-tvp5150-avoid-going-past-array-on-v4l2_querymenu.patch
+media-em28xx-fix-input-name-for-terratec-av-350.patch
+media-em28xx-make-v4l2-compliance-happier-by-starting-sequence-on-zero.patch
+media-em28xx-fix-handler-for-vidioc_s_input.patch
+media-adv7604-when-the-edid-is-cleared-unconfigure-cec-as-well.patch
+media-adv7842-when-the-edid-is-cleared-unconfigure-cec-as-well.patch
+drm-mediatek-fix-of-sibling-node-lookup.patch
+media-media-colorspaces-.rst-rename-adobergb-to-oprgb.patch
+media-replace-adobergb-by-oprgb.patch
+media-hdmi.h-rename-adobe_rgb-to-oprgb-and-adobe_ycc-to-opycc.patch
diff --git a/queue-4.19/xen-blkfront-fix-kernel-panic-with-negotiate_mq-error-path.patch b/queue-4.19/xen-blkfront-fix-kernel-panic-with-negotiate_mq-error-path.patch
new file mode 100644 (file)
index 0000000..09688e7
--- /dev/null
@@ -0,0 +1,50 @@
+From 6cc4a0863c9709c512280c64e698d68443ac8053 Mon Sep 17 00:00:00 2001
+From: Manjunath Patil <manjunath.b.patil@oracle.com>
+Date: Tue, 30 Oct 2018 09:49:21 -0700
+Subject: xen-blkfront: fix kernel panic with negotiate_mq error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Manjunath Patil <manjunath.b.patil@oracle.com>
+
+commit 6cc4a0863c9709c512280c64e698d68443ac8053 upstream.
+
+info->nr_rings isn't adjusted in case of ENOMEM error from
+negotiate_mq(). This leads to kernel panic in error path.
+
+Typical call stack involving panic -
+ #8 page_fault at ffffffff8175936f
+    [exception RIP: blkif_free_ring+33]
+    RIP: ffffffffa0149491  RSP: ffff8804f7673c08  RFLAGS: 00010292
+ ...
+ #9 blkif_free at ffffffffa0149aaa [xen_blkfront]
+ #10 talk_to_blkback at ffffffffa014c8cd [xen_blkfront]
+ #11 blkback_changed at ffffffffa014ea8b [xen_blkfront]
+ #12 xenbus_otherend_changed at ffffffff81424670
+ #13 backend_changed at ffffffff81426dc3
+ #14 xenwatch_thread at ffffffff81422f29
+ #15 kthread at ffffffff810abe6a
+ #16 ret_from_fork at ffffffff81754078
+
+Cc: stable@vger.kernel.org
+Fixes: 7ed8ce1c5fc7 ("xen-blkfront: move negotiate_mq to cover all cases of new VBDs")
+Signed-off-by: Manjunath Patil <manjunath.b.patil@oracle.com>
+Acked-by: Roger Pau MonnĂ© <roger.pau@citrix.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/xen-blkfront.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1919,6 +1919,7 @@ static int negotiate_mq(struct blkfront_
+                             GFP_KERNEL);
+       if (!info->rinfo) {
+               xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
++              info->nr_rings = 0;
+               return -ENOMEM;
+       }
diff --git a/queue-4.19/xen-fix-xen_qlock_wait.patch b/queue-4.19/xen-fix-xen_qlock_wait.patch
new file mode 100644 (file)
index 0000000..be9fad6
--- /dev/null
@@ -0,0 +1,82 @@
+From d3132b3860f6cf35ff7609a76bbcdbb814bd027c Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Thu, 8 Nov 2018 08:35:06 +0100
+Subject: xen: fix xen_qlock_wait()
+
+From: Juergen Gross <jgross@suse.com>
+
+commit d3132b3860f6cf35ff7609a76bbcdbb814bd027c upstream.
+
+Commit a856531951dc80 ("xen: make xen_qlock_wait() nestable")
+introduced a regression for Xen guests running fully virtualized
+(HVM or PVH mode). The Xen hypervisor wouldn't return from the poll
+hypercall with interrupts disabled in case of an interrupt (for PV
+guests it does).
+
+So instead of disabling interrupts in xen_qlock_wait() use a nesting
+counter to avoid calling xen_clear_irq_pending() in case
+xen_qlock_wait() is nested.
+
+Fixes: a856531951dc80 ("xen: make xen_qlock_wait() nestable")
+Cc: stable@vger.kernel.org
+Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Tested-by: Sander Eikelenboom <linux@eikelenboom.it>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/xen/spinlock.c |   14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -9,6 +9,7 @@
+ #include <linux/log2.h>
+ #include <linux/gfp.h>
+ #include <linux/slab.h>
++#include <linux/atomic.h>
+ #include <asm/paravirt.h>
+ #include <asm/qspinlock.h>
+@@ -21,6 +22,7 @@
+ static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
+ static DEFINE_PER_CPU(char *, irq_name);
++static DEFINE_PER_CPU(atomic_t, xen_qlock_wait_nest);
+ static bool xen_pvspin = true;
+ static void xen_qlock_kick(int cpu)
+@@ -39,25 +41,25 @@ static void xen_qlock_kick(int cpu)
+  */
+ static void xen_qlock_wait(u8 *byte, u8 val)
+ {
+-      unsigned long flags;
+       int irq = __this_cpu_read(lock_kicker_irq);
++      atomic_t *nest_cnt = this_cpu_ptr(&xen_qlock_wait_nest);
+       /* If kicker interrupts not initialized yet, just spin */
+       if (irq == -1 || in_nmi())
+               return;
+-      /* Guard against reentry. */
+-      local_irq_save(flags);
++      /* Detect reentry. */
++      atomic_inc(nest_cnt);
+-      /* If irq pending already clear it. */
+-      if (xen_test_irq_pending(irq)) {
++      /* If irq pending already and no nested call clear it. */
++      if (atomic_read(nest_cnt) == 1 && xen_test_irq_pending(irq)) {
+               xen_clear_irq_pending(irq);
+       } else if (READ_ONCE(*byte) == val) {
+               /* Block until irq becomes pending (or a spurious wakeup) */
+               xen_poll_irq(irq);
+       }
+-      local_irq_restore(flags);
++      atomic_dec(nest_cnt);
+ }
+ static irqreturn_t dummy_handler(int irq, void *dev_id)
diff --git a/queue-4.19/xen-remove-size-limit-of-privcmd-buf-mapping-interface.patch b/queue-4.19/xen-remove-size-limit-of-privcmd-buf-mapping-interface.patch
new file mode 100644 (file)
index 0000000..db73226
--- /dev/null
@@ -0,0 +1,100 @@
+From 3941552aec1e04d63999988a057ae09a1c56ebeb Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Thu, 1 Nov 2018 13:33:07 +0100
+Subject: xen: remove size limit of privcmd-buf mapping interface
+
+From: Juergen Gross <jgross@suse.com>
+
+commit 3941552aec1e04d63999988a057ae09a1c56ebeb upstream.
+
+Currently the size of hypercall buffers allocated via
+/dev/xen/hypercall is limited to a default of 64 memory pages. For live
+migration of guests this might be too small as the page dirty bitmask
+needs to be sized according to the size of the guest. This means
+migrating a 8GB sized guest is already exhausting the default buffer
+size for the dirty bitmap.
+
+There is no sensible way to set a sane limit, so just remove it
+completely. The device node's usage is limited to root anyway, so there
+is no additional DOS scenario added by allowing unlimited buffers.
+
+While at it make the error path for the -ENOMEM case a little bit
+cleaner by setting n_pages to the number of successfully allocated
+pages instead of the target size.
+
+Fixes: c51b3c639e01f2 ("xen: add new hypercall buffer mapping device")
+Cc: <stable@vger.kernel.org> #4.18
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/privcmd-buf.c |   22 ++++------------------
+ 1 file changed, 4 insertions(+), 18 deletions(-)
+
+--- a/drivers/xen/privcmd-buf.c
++++ b/drivers/xen/privcmd-buf.c
+@@ -21,15 +21,9 @@
+ MODULE_LICENSE("GPL");
+-static unsigned int limit = 64;
+-module_param(limit, uint, 0644);
+-MODULE_PARM_DESC(limit, "Maximum number of pages that may be allocated by "
+-                      "the privcmd-buf device per open file");
+-
+ struct privcmd_buf_private {
+       struct mutex lock;
+       struct list_head list;
+-      unsigned int allocated;
+ };
+ struct privcmd_buf_vma_private {
+@@ -60,13 +54,10 @@ static void privcmd_buf_vmapriv_free(str
+ {
+       unsigned int i;
+-      vma_priv->file_priv->allocated -= vma_priv->n_pages;
+-
+       list_del(&vma_priv->list);
+       for (i = 0; i < vma_priv->n_pages; i++)
+-              if (vma_priv->pages[i])
+-                      __free_page(vma_priv->pages[i]);
++              __free_page(vma_priv->pages[i]);
+       kfree(vma_priv);
+ }
+@@ -146,8 +137,7 @@ static int privcmd_buf_mmap(struct file
+       unsigned int i;
+       int ret = 0;
+-      if (!(vma->vm_flags & VM_SHARED) || count > limit ||
+-          file_priv->allocated + count > limit)
++      if (!(vma->vm_flags & VM_SHARED))
+               return -EINVAL;
+       vma_priv = kzalloc(sizeof(*vma_priv) + count * sizeof(void *),
+@@ -155,19 +145,15 @@ static int privcmd_buf_mmap(struct file
+       if (!vma_priv)
+               return -ENOMEM;
+-      vma_priv->n_pages = count;
+-      count = 0;
+-      for (i = 0; i < vma_priv->n_pages; i++) {
++      for (i = 0; i < count; i++) {
+               vma_priv->pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO);
+               if (!vma_priv->pages[i])
+                       break;
+-              count++;
++              vma_priv->n_pages++;
+       }
+       mutex_lock(&file_priv->lock);
+-      file_priv->allocated += count;
+-
+       vma_priv->file_priv = file_priv;
+       vma_priv->users = 1;