V4L/DVB (12438): Read buffer overflow
[safe/jmp/linux-2.6] / drivers / media / video / mt9t031.c
index 349d8e3..4207fb3 100644 (file)
@@ -76,64 +76,61 @@ struct mt9t031 {
        u16 yskip;
 };
 
-static int reg_read(struct soc_camera_device *icd, const u8 reg)
+static int reg_read(struct i2c_client *client, const u8 reg)
 {
-       struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
-       struct i2c_client *client = mt9t031->client;
        s32 data = i2c_smbus_read_word_data(client, reg);
        return data < 0 ? data : swab16(data);
 }
 
-static int reg_write(struct soc_camera_device *icd, const u8 reg,
+static int reg_write(struct i2c_client *client, const u8 reg,
                     const u16 data)
 {
-       struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
-       return i2c_smbus_write_word_data(mt9t031->client, reg, swab16(data));
+       return i2c_smbus_write_word_data(client, reg, swab16(data));
 }
 
-static int reg_set(struct soc_camera_device *icd, const u8 reg,
+static int reg_set(struct i2c_client *client, const u8 reg,
                   const u16 data)
 {
        int ret;
 
-       ret = reg_read(icd, reg);
+       ret = reg_read(client, reg);
        if (ret < 0)
                return ret;
-       return reg_write(icd, reg, ret | data);
+       return reg_write(client, reg, ret | data);
 }
 
-static int reg_clear(struct soc_camera_device *icd, const u8 reg,
+static int reg_clear(struct i2c_client *client, const u8 reg,
                     const u16 data)
 {
        int ret;
 
-       ret = reg_read(icd, reg);
+       ret = reg_read(client, reg);
        if (ret < 0)
                return ret;
-       return reg_write(icd, reg, ret & ~data);
+       return reg_write(client, reg, ret & ~data);
 }
 
-static int set_shutter(struct soc_camera_device *icd, const u32 data)
+static int set_shutter(struct i2c_client *client, const u32 data)
 {
        int ret;
 
-       ret = reg_write(icd, MT9T031_SHUTTER_WIDTH_UPPER, data >> 16);
+       ret = reg_write(client, MT9T031_SHUTTER_WIDTH_UPPER, data >> 16);
 
        if (ret >= 0)
-               ret = reg_write(icd, MT9T031_SHUTTER_WIDTH, data & 0xffff);
+               ret = reg_write(client, MT9T031_SHUTTER_WIDTH, data & 0xffff);
 
        return ret;
 }
 
-static int get_shutter(struct soc_camera_device *icd, u32 *data)
+static int get_shutter(struct i2c_client *client, u32 *data)
 {
        int ret;
 
-       ret = reg_read(icd, MT9T031_SHUTTER_WIDTH_UPPER);
+       ret = reg_read(client, MT9T031_SHUTTER_WIDTH_UPPER);
        *data = ret << 16;
 
        if (ret >= 0)
-               ret = reg_read(icd, MT9T031_SHUTTER_WIDTH);
+               ret = reg_read(client, MT9T031_SHUTTER_WIDTH);
        *data |= ret & 0xffff;
 
        return ret < 0 ? ret : 0;
@@ -141,39 +138,62 @@ static int get_shutter(struct soc_camera_device *icd, u32 *data)
 
 static int mt9t031_init(struct soc_camera_device *icd)
 {
+       struct i2c_client *client = to_i2c_client(icd->control);
+       struct soc_camera_link *icl = client->dev.platform_data;
        int ret;
 
-       /* Disable chip output, synchronous option update */
-       dev_dbg(icd->vdev->parent, "%s\n", __func__);
+       if (icl->power) {
+               ret = icl->power(&client->dev, 1);
+               if (ret < 0) {
+                       dev_err(icd->vdev->parent,
+                               "Platform failed to power-on the camera.\n");
+                       return ret;
+               }
+       }
 
-       ret = reg_write(icd, MT9T031_RESET, 1);
+       /* Disable chip output, synchronous option update */
+       ret = reg_write(client, MT9T031_RESET, 1);
        if (ret >= 0)
-               ret = reg_write(icd, MT9T031_RESET, 0);
+               ret = reg_write(client, MT9T031_RESET, 0);
        if (ret >= 0)
-               ret = reg_clear(icd, MT9T031_OUTPUT_CONTROL, 3);
+               ret = reg_clear(client, MT9T031_OUTPUT_CONTROL, 2);
+
+       if (ret < 0 && icl->power)
+               icl->power(&client->dev, 0);
 
        return ret >= 0 ? 0 : -EIO;
 }
 
 static int mt9t031_release(struct soc_camera_device *icd)
 {
+       struct i2c_client *client = to_i2c_client(icd->control);
+       struct soc_camera_link *icl = client->dev.platform_data;
+
        /* Disable the chip */
-       reg_clear(icd, MT9T031_OUTPUT_CONTROL, 3);
+       reg_clear(client, MT9T031_OUTPUT_CONTROL, 2);
+
+       if (icl->power)
+               icl->power(&client->dev, 0);
+
        return 0;
 }
 
 static int mt9t031_start_capture(struct soc_camera_device *icd)
 {
+       struct i2c_client *client = to_i2c_client(icd->control);
+
        /* Switch to master "normal" mode */
-       if (reg_set(icd, MT9T031_OUTPUT_CONTROL, 3) < 0)
+       if (reg_set(client, MT9T031_OUTPUT_CONTROL, 2) < 0)
                return -EIO;
        return 0;
 }
 
 static int mt9t031_stop_capture(struct soc_camera_device *icd)
 {
+       struct i2c_client *client = to_i2c_client(icd->control);
+
        /* Stop sensor readout */
-       if (reg_clear(icd, MT9T031_OUTPUT_CONTROL, 3) < 0)
+       if (reg_clear(client, MT9T031_OUTPUT_CONTROL, 2) < 0)
                return -EIO;
        return 0;
 }
@@ -181,14 +201,16 @@ static int mt9t031_stop_capture(struct soc_camera_device *icd)
 static int mt9t031_set_bus_param(struct soc_camera_device *icd,
                                 unsigned long flags)
 {
+       struct i2c_client *client = to_i2c_client(icd->control);
+
        /* The caller should have queried our parameters, check anyway */
        if (flags & ~MT9T031_BUS_PARAM)
                return -EINVAL;
 
        if (flags & SOCAM_PCLK_SAMPLE_FALLING)
-               reg_set(icd, MT9T031_PIXEL_CLOCK_CONTROL, 0x8000);
+               reg_clear(client, MT9T031_PIXEL_CLOCK_CONTROL, 0x8000);
        else
-               reg_clear(icd, MT9T031_PIXEL_CLOCK_CONTROL, 0x8000);
+               reg_set(client, MT9T031_PIXEL_CLOCK_CONTROL, 0x8000);
 
        return 0;
 }
@@ -201,90 +223,97 @@ static unsigned long mt9t031_query_bus_param(struct soc_camera_device *icd)
        return soc_camera_apply_sensor_flags(icl, MT9T031_BUS_PARAM);
 }
 
-static int mt9t031_set_fmt(struct soc_camera_device *icd,
-                          __u32 pixfmt, struct v4l2_rect *rect)
+/* Round up minima and round down maxima */
+static void recalculate_limits(struct soc_camera_device *icd,
+                              u16 xskip, u16 yskip)
 {
+       icd->x_min = (MT9T031_COLUMN_SKIP + xskip - 1) / xskip;
+       icd->y_min = (MT9T031_ROW_SKIP + yskip - 1) / yskip;
+       icd->width_min = (MT9T031_MIN_WIDTH + xskip - 1) / xskip;
+       icd->height_min = (MT9T031_MIN_HEIGHT + yskip - 1) / yskip;
+       icd->width_max = MT9T031_MAX_WIDTH / xskip;
+       icd->height_max = MT9T031_MAX_HEIGHT / yskip;
+}
+
+static int mt9t031_set_params(struct soc_camera_device *icd,
+                             struct v4l2_rect *rect, u16 xskip, u16 yskip)
+{
+       struct i2c_client *client = to_i2c_client(icd->control);
        struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
        int ret;
+       u16 xbin, ybin, width, height, left, top;
        const u16 hblank = MT9T031_HORIZONTAL_BLANK,
                vblank = MT9T031_VERTICAL_BLANK;
-       u16 xbin, xskip = mt9t031->xskip, ybin, yskip = mt9t031->yskip,
-               width = rect->width * xskip, height = rect->height * yskip;
 
-       if (pixfmt) {
-               /* S_FMT - use binning and skipping for scaling, recalculate */
-               /* Is this more optimal than just a division? */
-               for (xskip = 8; xskip > 1; xskip--)
-                       if (rect->width * xskip <= icd->width_max)
-                               break;
+       /* Make sure we don't exceed sensor limits */
+       if (rect->left + rect->width > icd->width_max)
+               rect->left = (icd->width_max - rect->width) / 2 + icd->x_min;
 
-               for (yskip = 8; yskip > 1; yskip--)
-                       if (rect->height * yskip <= icd->height_max)
-                               break;
+       if (rect->top + rect->height > icd->height_max)
+               rect->top = (icd->height_max - rect->height) / 2 + icd->y_min;
 
-               width = rect->width * xskip;
-               height = rect->height * yskip;
-
-               dev_dbg(&icd->dev, "xskip %u, width %u, yskip %u, height %u\n",
-                       xskip, width, yskip, height);
-       }
+       width = rect->width * xskip;
+       height = rect->height * yskip;
+       left = rect->left * xskip;
+       top = rect->top * yskip;
 
        xbin = min(xskip, (u16)3);
        ybin = min(yskip, (u16)3);
 
-       /* Make sure we don't exceed frame limits */
-       if (rect->left + width > icd->width_max)
-               rect->left = (icd->width_max - width) / 2;
-
-       if (rect->top + height > icd->height_max)
-               rect->top = (icd->height_max - height) / 2;
+       dev_dbg(&icd->dev, "xskip %u, width %u/%u, yskip %u, height %u/%u\n",
+               xskip, width, rect->width, yskip, height, rect->height);
 
-       /* Could just do roundup(rect->left, [xy]bin); but this is cheaper */
+       /* Could just do roundup(rect->left, [xy]bin * 2); but this is cheaper */
        switch (xbin) {
        case 2:
-               rect->left = (rect->left + 1) & ~1;
+               left = (left + 3) & ~3;
                break;
        case 3:
-               rect->left = roundup(rect->left, 3);
+               left = roundup(left, 6);
        }
 
        switch (ybin) {
        case 2:
-               rect->top = (rect->top + 1) & ~1;
+               top = (top + 3) & ~3;
                break;
        case 3:
-               rect->top = roundup(rect->top, 3);
+               top = roundup(top, 6);
        }
 
+       /* Disable register update, reconfigure atomically */
+       ret = reg_set(client, MT9T031_OUTPUT_CONTROL, 1);
+       if (ret < 0)
+               return ret;
+
        /* Blanking and start values - default... */
-       ret = reg_write(icd, MT9T031_HORIZONTAL_BLANKING, hblank);
+       ret = reg_write(client, MT9T031_HORIZONTAL_BLANKING, hblank);
        if (ret >= 0)
-               ret = reg_write(icd, MT9T031_VERTICAL_BLANKING, vblank);
+               ret = reg_write(client, MT9T031_VERTICAL_BLANKING, vblank);
 
-       if (pixfmt) {
+       if (yskip != mt9t031->yskip || xskip != mt9t031->xskip) {
                /* Binning, skipping */
                if (ret >= 0)
-                       ret = reg_write(icd, MT9T031_COLUMN_ADDRESS_MODE,
+                       ret = reg_write(client, MT9T031_COLUMN_ADDRESS_MODE,
                                        ((xbin - 1) << 4) | (xskip - 1));
                if (ret >= 0)
-                       ret = reg_write(icd, MT9T031_ROW_ADDRESS_MODE,
+                       ret = reg_write(client, MT9T031_ROW_ADDRESS_MODE,
                                        ((ybin - 1) << 4) | (yskip - 1));
        }
-       dev_dbg(&icd->dev, "new left %u, top %u\n", rect->left, rect->top);
+       dev_dbg(&icd->dev, "new physical left %u, top %u\n", left, top);
 
        /* The caller provides a supported format, as guaranteed by
         * icd->try_fmt_cap(), soc_camera_s_crop() and soc_camera_cropcap() */
        if (ret >= 0)
-               ret = reg_write(icd, MT9T031_COLUMN_START, rect->left);
+               ret = reg_write(client, MT9T031_COLUMN_START, left);
        if (ret >= 0)
-               ret = reg_write(icd, MT9T031_ROW_START, rect->top);
+               ret = reg_write(client, MT9T031_ROW_START, top);
        if (ret >= 0)
-               ret = reg_write(icd, MT9T031_WINDOW_WIDTH, width - 1);
+               ret = reg_write(client, MT9T031_WINDOW_WIDTH, width - 1);
        if (ret >= 0)
-               ret = reg_write(icd, MT9T031_WINDOW_HEIGHT,
+               ret = reg_write(client, MT9T031_WINDOW_HEIGHT,
                                height + icd->y_skip_top - 1);
        if (ret >= 0 && mt9t031->autoexposure) {
-               ret = set_shutter(icd, height + icd->y_skip_top + vblank);
+               ret = set_shutter(client, height + icd->y_skip_top + vblank);
                if (ret >= 0) {
                        const u32 shutter_max = MT9T031_MAX_HEIGHT + vblank;
                        const struct v4l2_queryctrl *qctrl =
@@ -297,12 +326,58 @@ static int mt9t031_set_fmt(struct soc_camera_device *icd,
                }
        }
 
-       if (!ret && pixfmt) {
+       /* Re-enable register update, commit all changes */
+       if (ret >= 0)
+               ret = reg_clear(client, MT9T031_OUTPUT_CONTROL, 1);
+
+       return ret < 0 ? ret : 0;
+}
+
+static int mt9t031_set_crop(struct soc_camera_device *icd,
+                           struct v4l2_rect *rect)
+{
+       struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
+
+       /* CROP - no change in scaling, or in limits */
+       return mt9t031_set_params(icd, rect, mt9t031->xskip, mt9t031->yskip);
+}
+
+static int mt9t031_set_fmt(struct soc_camera_device *icd,
+                          struct v4l2_format *f)
+{
+       struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
+       int ret;
+       u16 xskip, yskip;
+       struct v4l2_rect rect = {
+               .left   = icd->x_current,
+               .top    = icd->y_current,
+               .width  = f->fmt.pix.width,
+               .height = f->fmt.pix.height,
+       };
+
+       /*
+        * try_fmt has put rectangle within limits.
+        * S_FMT - use binning and skipping for scaling, recalculate
+        * limits, used for cropping
+        */
+       /* Is this more optimal than just a division? */
+       for (xskip = 8; xskip > 1; xskip--)
+               if (rect.width * xskip <= MT9T031_MAX_WIDTH)
+                       break;
+
+       for (yskip = 8; yskip > 1; yskip--)
+               if (rect.height * yskip <= MT9T031_MAX_HEIGHT)
+                       break;
+
+       recalculate_limits(icd, xskip, yskip);
+
+       ret = mt9t031_set_params(icd, &rect, xskip, yskip);
+       if (!ret) {
                mt9t031->xskip = xskip;
                mt9t031->yskip = yskip;
        }
 
-       return ret < 0 ? ret : 0;
+       return ret;
 }
 
 static int mt9t031_try_fmt(struct soc_camera_device *icd,
@@ -310,17 +385,9 @@ static int mt9t031_try_fmt(struct soc_camera_device *icd,
 {
        struct v4l2_pix_format *pix = &f->fmt.pix;
 
-       if (pix->height < icd->height_min)
-               pix->height = icd->height_min;
-       if (pix->height > icd->height_max)
-               pix->height = icd->height_max;
-       if (pix->width < icd->width_min)
-               pix->width = icd->width_min;
-       if (pix->width > icd->width_max)
-               pix->width = icd->width_max;
-
-       pix->width &= ~0x01; /* has to be even */
-       pix->height &= ~0x01; /* has to be even */
+       v4l_bound_align_image(
+               &pix->width, MT9T031_MIN_WIDTH, MT9T031_MAX_WIDTH, 1,
+               &pix->height, MT9T031_MIN_HEIGHT, MT9T031_MAX_HEIGHT, 1, 0);
 
        return 0;
 }
@@ -346,15 +413,15 @@ static int mt9t031_get_chip_id(struct soc_camera_device *icd,
 static int mt9t031_get_register(struct soc_camera_device *icd,
                                struct v4l2_dbg_register *reg)
 {
-       struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
+       struct i2c_client *client = to_i2c_client(icd->control);
 
        if (reg->match.type != V4L2_CHIP_MATCH_I2C_ADDR || reg->reg > 0xff)
                return -EINVAL;
 
-       if (reg->match.addr != mt9t031->client->addr)
+       if (reg->match.addr != client->addr)
                return -ENODEV;
 
-       reg->val = reg_read(icd, reg->reg);
+       reg->val = reg_read(client, reg->reg);
 
        if (reg->val > 0xffff)
                return -EIO;
@@ -365,15 +432,15 @@ static int mt9t031_get_register(struct soc_camera_device *icd,
 static int mt9t031_set_register(struct soc_camera_device *icd,
                                struct v4l2_dbg_register *reg)
 {
-       struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
+       struct i2c_client *client = to_i2c_client(icd->control);
 
        if (reg->match.type != V4L2_CHIP_MATCH_I2C_ADDR || reg->reg > 0xff)
                return -EINVAL;
 
-       if (reg->match.addr != mt9t031->client->addr)
+       if (reg->match.addr != client->addr)
                return -ENODEV;
 
-       if (reg_write(icd, reg->reg, reg->val) < 0)
+       if (reg_write(client, reg->reg, reg->val) < 0)
                return -EIO;
 
        return 0;
@@ -390,6 +457,14 @@ static const struct v4l2_queryctrl mt9t031_controls[] = {
                .step           = 1,
                .default_value  = 0,
        }, {
+               .id             = V4L2_CID_HFLIP,
+               .type           = V4L2_CTRL_TYPE_BOOLEAN,
+               .name           = "Flip Horizontally",
+               .minimum        = 0,
+               .maximum        = 1,
+               .step           = 1,
+               .default_value  = 0,
+       }, {
                .id             = V4L2_CID_GAIN,
                .type           = V4L2_CTRL_TYPE_INTEGER,
                .name           = "Gain",
@@ -431,6 +506,7 @@ static struct soc_camera_ops mt9t031_ops = {
        .release                = mt9t031_release,
        .start_capture          = mt9t031_start_capture,
        .stop_capture           = mt9t031_stop_capture,
+       .set_crop               = mt9t031_set_crop,
        .set_fmt                = mt9t031_set_fmt,
        .try_fmt                = mt9t031_try_fmt,
        .set_bus_param          = mt9t031_set_bus_param,
@@ -448,18 +524,19 @@ static struct soc_camera_ops mt9t031_ops = {
 
 static int mt9t031_get_control(struct soc_camera_device *icd, struct v4l2_control *ctrl)
 {
+       struct i2c_client *client = to_i2c_client(icd->control);
        struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
        int data;
 
        switch (ctrl->id) {
        case V4L2_CID_VFLIP:
-               data = reg_read(icd, MT9T031_READ_MODE_2);
+               data = reg_read(client, MT9T031_READ_MODE_2);
                if (data < 0)
                        return -EIO;
                ctrl->value = !!(data & 0x8000);
                break;
        case V4L2_CID_HFLIP:
-               data = reg_read(icd, MT9T031_READ_MODE_2);
+               data = reg_read(client, MT9T031_READ_MODE_2);
                if (data < 0)
                        return -EIO;
                ctrl->value = !!(data & 0x4000);
@@ -473,6 +550,7 @@ static int mt9t031_get_control(struct soc_camera_device *icd, struct v4l2_contro
 
 static int mt9t031_set_control(struct soc_camera_device *icd, struct v4l2_control *ctrl)
 {
+       struct i2c_client *client = to_i2c_client(icd->control);
        struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
        const struct v4l2_queryctrl *qctrl;
        int data;
@@ -485,17 +563,17 @@ static int mt9t031_set_control(struct soc_camera_device *icd, struct v4l2_contro
        switch (ctrl->id) {
        case V4L2_CID_VFLIP:
                if (ctrl->value)
-                       data = reg_set(icd, MT9T031_READ_MODE_2, 0x8000);
+                       data = reg_set(client, MT9T031_READ_MODE_2, 0x8000);
                else
-                       data = reg_clear(icd, MT9T031_READ_MODE_2, 0x8000);
+                       data = reg_clear(client, MT9T031_READ_MODE_2, 0x8000);
                if (data < 0)
                        return -EIO;
                break;
        case V4L2_CID_HFLIP:
                if (ctrl->value)
-                       data = reg_set(icd, MT9T031_READ_MODE_2, 0x4000);
+                       data = reg_set(client, MT9T031_READ_MODE_2, 0x4000);
                else
-                       data = reg_clear(icd, MT9T031_READ_MODE_2, 0x4000);
+                       data = reg_clear(client, MT9T031_READ_MODE_2, 0x4000);
                if (data < 0)
                        return -EIO;
                break;
@@ -509,26 +587,28 @@ static int mt9t031_set_control(struct soc_camera_device *icd, struct v4l2_contro
                        data = ((ctrl->value - qctrl->minimum) * 8 + range / 2) / range;
 
                        dev_dbg(&icd->dev, "Setting gain %d\n", data);
-                       data = reg_write(icd, MT9T031_GLOBAL_GAIN, data);
+                       data = reg_write(client, MT9T031_GLOBAL_GAIN, data);
                        if (data < 0)
                                return -EIO;
                } else {
-                       /* Pack it into 1.125..15 variable step, register values 9..67 */
+                       /* Pack it into 1.125..128 variable step, register values 9..0x7860 */
                        /* We assume qctrl->maximum - qctrl->default_value - 1 > 0 */
                        unsigned long range = qctrl->maximum - qctrl->default_value - 1;
+                       /* calculated gain: map 65..127 to 9..1024 step 0.125 */
                        unsigned long gain = ((ctrl->value - qctrl->default_value - 1) *
-                                              111 + range / 2) / range + 9;
+                                              1015 + range / 2) / range + 9;
 
-                       if (gain <= 32)
+                       if (gain <= 32)         /* calculated gain 9..32 -> 9..32 */
                                data = gain;
-                       else if (gain <= 64)
+                       else if (gain <= 64)    /* calculated gain 33..64 -> 0x51..0x60 */
                                data = ((gain - 32) * 16 + 16) / 32 + 80;
                        else
-                               data = ((gain - 64) * 7 + 28) / 56 + 96;
+                               /* calculated gain 65..1024 -> (1..120) << 8 + 0x60 */
+                               data = (((gain - 64 + 7) * 32) & 0xff00) | 0x60;
 
-                       dev_dbg(&icd->dev, "Setting gain from %d to %d\n",
-                                reg_read(icd, MT9T031_GLOBAL_GAIN), data);
-                       data = reg_write(icd, MT9T031_GLOBAL_GAIN, data);
+                       dev_dbg(&icd->dev, "Setting gain from 0x%x to 0x%x\n",
+                               reg_read(client, MT9T031_GLOBAL_GAIN), data);
+                       data = reg_write(client, MT9T031_GLOBAL_GAIN, data);
                        if (data < 0)
                                return -EIO;
                }
@@ -546,10 +626,10 @@ static int mt9t031_set_control(struct soc_camera_device *icd, struct v4l2_contro
                                             range / 2) / range + 1;
                        u32 old;
 
-                       get_shutter(icd, &old);
+                       get_shutter(client, &old);
                        dev_dbg(&icd->dev, "Setting shutter width from %u to %u\n",
                                old, shutter);
-                       if (set_shutter(icd, shutter) < 0)
+                       if (set_shutter(client, shutter) < 0)
                                return -EIO;
                        icd->exposure = ctrl->value;
                        mt9t031->autoexposure = 0;
@@ -559,7 +639,7 @@ static int mt9t031_set_control(struct soc_camera_device *icd, struct v4l2_contro
                if (ctrl->value) {
                        const u16 vblank = MT9T031_VERTICAL_BLANK;
                        const u32 shutter_max = MT9T031_MAX_HEIGHT + vblank;
-                       if (set_shutter(icd, icd->height +
+                       if (set_shutter(client, icd->height +
                                        icd->y_skip_top + vblank) < 0)
                                return -EIO;
                        qctrl = soc_camera_find_qctrl(icd->ops, V4L2_CID_EXPOSURE);
@@ -579,6 +659,7 @@ static int mt9t031_set_control(struct soc_camera_device *icd, struct v4l2_contro
  * this wasn't our capture interface, so, we wait for the right one */
 static int mt9t031_video_probe(struct soc_camera_device *icd)
 {
+       struct i2c_client *client = to_i2c_client(icd->control);
        struct mt9t031 *mt9t031 = container_of(icd, struct mt9t031, icd);
        s32 data;
        int ret;
@@ -590,11 +671,11 @@ static int mt9t031_video_probe(struct soc_camera_device *icd)
                return -ENODEV;
 
        /* Enable the chip */
-       data = reg_write(icd, MT9T031_CHIP_ENABLE, 1);
+       data = reg_write(client, MT9T031_CHIP_ENABLE, 1);
        dev_dbg(&icd->dev, "write: %d\n", data);
 
        /* Read out the chip version register */
-       data = reg_read(icd, MT9T031_CHIP_VERSION);
+       data = reg_read(client, MT9T031_CHIP_VERSION);
 
        switch (data) {
        case 0x1621: