media: use struct_size() helper

Prefer struct_size() over open-coded versions of idiom:

sizeof(struct-with-flex-array) + sizeof(typeof-flex-array-elements) * count

where count is the max number of items the flexible array is supposed to
contain.

Signed-off-by: Yu Liao <liaoyu15@huawei.com>
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

media: vb2: frame_vector.c: replace WARN_ONCE with a comment

The WARN_ONCE was issued also in cases that had nothing to do with VM_IO
(e.g. if the start address was just a random value and uaccess fails with
-EFAULT).

There are no reports of WARN_ONCE being issued for actual VM_IO cases, so
just drop it and instead add a note to the comment before the function.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reported-by: Yikebaer Aizezi <yikebaer61@gmail.com>

media: videobuf2: revert "get_userptr: buffers are always writable"

Commit 707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are
always writable") caused problems in a corner case (passing read-only
shmem memory as a userptr). So revert this patch.

The original problem for which that commit was originally made is
something that I could not reproduce after reverting it. So just go
back to the way it was for many years, and if problems arise in
the future, then another approach should be taken to resolve it.

This patch is based on a patch from Hirokazu.

Fixes: 707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are always writable")
Signed-off-by: Hirokazu Honda <hiroh@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

mm/frame-vector: remove FOLL_FORCE usage

FOLL_FORCE is really only for ptrace access. According to commit
707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are always
writable"), get_vaddr_frames() currently pins all pages writable as a
workaround for issues with read-only buffers.

FOLL_FORCE, however, seems to be a legacy leftover as it predates
commit 707947247e95 ("media: videobuf2-vmalloc: get_userptr: buffers are
always writable"). Let's just remove it.

Once the read-only buffer issue has been resolved, FOLL_WRITE could
again be set depending on the DMA direction.

Link: https://lkml.kernel.org/r/20221116102659.70287-17-david@redhat.com
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Tomasz Figa <tfiga@chromium.org>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails

The V4L2_MEMORY_USERPTR interface is long deprecated and shouldn't be
used (and is discouraged for any modern v4l drivers). And Seth Jenkins
points out that the fallback to VM_PFNMAP/VM_IO is fundamentally racy
and dangerous.

Note that it's not even a case that should trigger, since any normal
user pointer logic ends up just using the pin_user_pages_fast() call
that does the proper page reference counting. That's not the problem
case, only if you try to use special device mappings do you have any
issues.

Normally I'd just remove this during the merge window, but since Seth
pointed out the problem cases, we really want to know as soon as
possible if there are actually any users of this odd special case of a
legacy interface. Neither Hans nor Mauro seem to think that such
mis-uses of the old legacy interface should exist. As Mauro says:

"See, V4L2 has actually 4 streaming APIs:
- Kernel-allocated mmap (usually referred simply as just mmap);
- USERPTR mmap;
- read();
- dmabuf;

The USERPTR is one of the oldest way to use it, coming from V4L
version 1 times, and by far the least used one"

And Hans chimed in on the USERPTR interface:

"To be honest, I wouldn't mind if it goes away completely, but that's a
bit of a pipe dream right now"

but while removing this legacy interface entirely may be a pipe dream we
can at least try to remove the unlikely (and actively broken) case of
using special device mappings for USERPTR accesses.

This replaces it with a WARN_ONCE() that we can remove once we've
hopefully confirmed that no actual users exist.

NOTE! Longer term, this means that a 'struct frame_vector' only ever
contains proper page pointers, and all the games we have with converting
them to pages can go away (grep for 'frame_vector_to_pages()' and the
uses of 'vec->is_pfns'). But this is just the first step, to verify
that this code really is all dead, and do so as quickly as possible.

Reported-by: Seth Jenkins <sethjenkins@google.com>
Acked-by: Hans Verkuil <hverkuil@xs4all.nl>
Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: David Hildenbrand <david@redhat.com>
Cc: Jan Kara <jack@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

media: vb2: frame_vector.c: don't overwrite error code

get_vaddr_frames() first calls pin_user_pages_fast() and if
that fails tries follow_pfn(). But if that also fails, then
the error code from pin_user_pages_fast() is overwritten with
the error code from follow_pfn().

Specifically if pin_user_pages_fast() returns -ENOMEM, then
follow_pfn() will overwrite that with -EINVAL, which is very
confusing.

So store the error code from pin_user_pages_fast() and return
that if follow_pfn() returns -EINVAL. -EINVAL indicates that
the page is unsuitable for follow_pfn, so pin_user_pages_fast()
was the correct call to make, and that error code should be
returned instead.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

media: videobuf2: use vma_lookup() in get_vaddr_frames()

vma_lookup() finds the vma of a specific address with a cleaner interface
and is more readable.

Link: https://lkml.kernel.org/r/20210521174745.2219620-15-Liam.Howlett@Oracle.com
Signed-off-by: Liam R. Howlett <Liam.Howlett@Oracle.com>
Reviewed-by: Laurent Dufour <ldufour@linux.ibm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Davidlohr Bueso <dbueso@suse.de>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

media: fix incorrect kernel doc usages

This patch fixes the following trivial warnings w.r.t. kernel-doc usage:

drivers/media/common/videobuf2/frame_vector.c:38: warning: Excess function parameter 'gup_flags' description in 'get_vaddr_frames'
drivers/media/dvb-core/dvb_ca_en50221.c:193: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1014: warning: expecting prototype for Wake up the DVB CA thread(). Prototype was for
dvb_ca_en50221_thread_wakeup() instead
drivers/media/dvb-core/dvb_ca_en50221.c:1023: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1081: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1112: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1327: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1411: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1426: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1582: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1693: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1743: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1772: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1830: warning: wrong kernel-doc identifier on line:
drivers/media/dvb-core/dvb_ca_en50221.c:1922: warning: wrong kernel-doc identifier on line:
drivers/media/rc/img-ir/img-ir-hw.c:628: warning: expecting prototype for img_ir_decoder_compatable(). Prototype was for
img_ir_decoder_compatible() instead
drivers/media/v4l2-core/v4l2-jpeg.c:461: warning: expecting prototype for jpeg_parse_header(). Prototype was for v4l2_jpeg_parse_header()
instead
drivers/media/platform/vsp1/vsp1_dl.c:166: warning: expecting prototype for struct vsp1_cmd_pool. Prototype was for struct vsp1_dl_cmd_pool
instead
drivers/media/platform/mtk-vpu/mtk_vpu.c:28: warning: expecting prototype for is a tiny processor controlling video hardware(). Prototype
was for INIT_TIMEOUT_MS() instead
drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:73: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct
vp9_ref_buf instead
drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:85: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct
vp9_sf_ref_fb instead
drivers/media/tuners/mt2063.c:1404: warning: expecting prototype for fLO_FractionalTerm(). Prototype was for MT2063_fLO_FractionalTerm() instead
drivers/media/tuners/mt2063.c:1465: warning: expecting prototype for CalcLO2Mult(). Prototype was for MT2063_CalcLO2Mult() instead
drivers/media/usb/pwc/pwc-dec23.c:640: warning: wrong kernel-doc identifier on line:
drivers/media/platform/exynos4-is/media-dev.c:820: warning: expecting prototype for __fimc_md_create_fimc_links(). Prototype was for
__fimc_md_create_fimc_sink_links() instead
drivers/media/i2c/s5k6aa.c:426: warning: expecting prototype for s5k6aa_configure_pixel_clock(). Prototype was for
s5k6aa_configure_pixel_clocks() instead
drivers/media/i2c/imx274.c:700: warning: wrong kernel-doc identifier on line:
drivers/media/i2c/imx274.c:735: warning: wrong kernel-doc identifier on line:
drivers/media/i2c/imx274.c:983: warning: wrong kernel-doc identifier on line:

Most are missing or mistyped function names.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

media: videobuf2: Move frame_vector into media subsystem

It's the only user. This also garbage collects the CONFIG_FRAME_VECTOR
symbol from all over the tree (well just one place, somehow omap media
driver still had this in its Kconfig, despite not using it).

Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Pawel Osciak <pawel@osciak.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Tomasz Figa <tfiga@chromium.org>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: linux-mm@kvack.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-samsung-soc@vger.kernel.org
Cc: linux-media@vger.kernel.org
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201127164131.2244124-7-daniel.vetter@ffwll.ch