diff --git a/drivers/media/v4l2-core/Kconfig b/drivers/media/v4l2-core/Kconfig
index c57e103fed64..348559bc2468 100644
--- a/drivers/media/v4l2-core/Kconfig
+++ b/drivers/media/v4l2-core/Kconfig
@@ -73,3 +73,19 @@ config V4L2_FWNODE
 
 config V4L2_ASYNC
 	tristate
+
+# Used by drivers that need Videobuf modules
+config VIDEOBUF_GEN
+	tristate
+
+config VIDEOBUF_DMA_SG
+	tristate
+	select VIDEOBUF_GEN
+
+config VIDEOBUF_VMALLOC
+	tristate
+	select VIDEOBUF_GEN
+
+config VIDEOBUF_DMA_CONTIG
+	tristate
+	select VIDEOBUF_GEN
diff --git a/drivers/media/v4l2-core/videobuf-core.c b/drivers/media/v4l2-core/videobuf-core.c
new file mode 100644
index 000000000000..606a271bdd2d
--- /dev/null
+++ b/drivers/media/v4l2-core/videobuf-core.c
@@ -0,0 +1,1198 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * generic helper functions for handling video4linux capture buffers
+ *
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
+ *
+ * Highly based on video-buf written originally by:
+ * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
+ * (c) 2006 Ted Walther and John Sokol
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+
+#include <media/videobuf-core.h>
+#include <media/v4l2-common.h>
+
+#define MAGIC_BUFFER 0x20070728
+#define MAGIC_CHECK(is, should)						\
+	do {								\
+		if (unlikely((is) != (should))) {			\
+			printk(KERN_ERR					\
+				"magic mismatch: %x (expected %x)\n",	\
+					is, should);			\
+			BUG();						\
+		}							\
+	} while (0)
+
+static int debug;
+module_param(debug, int, 0644);
+
+MODULE_DESCRIPTION("helper module to manage video4linux buffers");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
+MODULE_LICENSE("GPL");
+
+#define dprintk(level, fmt, arg...)					\
+	do {								\
+		if (debug >= level)					\
+			printk(KERN_DEBUG "vbuf: " fmt, ## arg);	\
+	} while (0)
+
+/* --------------------------------------------------------------------- */
+
+#define CALL(q, f, arg...)						\
+	((q->int_ops->f) ? q->int_ops->f(arg) : 0)
+#define CALLPTR(q, f, arg...)						\
+	((q->int_ops->f) ? q->int_ops->f(arg) : NULL)
+
+struct videobuf_buffer *videobuf_alloc_vb(struct videobuf_queue *q)
+{
+	struct videobuf_buffer *vb;
+
+	BUG_ON(q->msize < sizeof(*vb));
+
+	if (!q->int_ops || !q->int_ops->alloc_vb) {
+		printk(KERN_ERR "No specific ops defined!\n");
+		BUG();
+	}
+
+	vb = q->int_ops->alloc_vb(q->msize);
+	if (NULL != vb) {
+		init_waitqueue_head(&vb->done);
+		vb->magic = MAGIC_BUFFER;
+	}
+
+	return vb;
+}
+EXPORT_SYMBOL_GPL(videobuf_alloc_vb);
+
+static int state_neither_active_nor_queued(struct videobuf_queue *q,
+					   struct videobuf_buffer *vb)
+{
+	unsigned long flags;
+	bool rc;
+
+	spin_lock_irqsave(q->irqlock, flags);
+	rc = vb->state != VIDEOBUF_ACTIVE && vb->state != VIDEOBUF_QUEUED;
+	spin_unlock_irqrestore(q->irqlock, flags);
+	return rc;
+};
+
+int videobuf_waiton(struct videobuf_queue *q, struct videobuf_buffer *vb,
+		int non_blocking, int intr)
+{
+	bool is_ext_locked;
+	int ret = 0;
+
+	MAGIC_CHECK(vb->magic, MAGIC_BUFFER);
+
+	if (non_blocking) {
+		if (state_neither_active_nor_queued(q, vb))
+			return 0;
+		return -EAGAIN;
+	}
+
+	is_ext_locked = q->ext_lock && mutex_is_locked(q->ext_lock);
+
+	/* Release vdev lock to prevent this wait from blocking outside access to
+	   the device. */
+	if (is_ext_locked)
+		mutex_unlock(q->ext_lock);
+	if (intr)
+		ret = wait_event_interruptible(vb->done,
+					state_neither_active_nor_queued(q, vb));
+	else
+		wait_event(vb->done, state_neither_active_nor_queued(q, vb));
+	/* Relock */
+	if (is_ext_locked)
+		mutex_lock(q->ext_lock);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(videobuf_waiton);
+
+int videobuf_iolock(struct videobuf_queue *q, struct videobuf_buffer *vb,
+		    struct v4l2_framebuffer *fbuf)
+{
+	MAGIC_CHECK(vb->magic, MAGIC_BUFFER);
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	return CALL(q, iolock, q, vb, fbuf);
+}
+EXPORT_SYMBOL_GPL(videobuf_iolock);
+
+void *videobuf_queue_to_vaddr(struct videobuf_queue *q,
+			      struct videobuf_buffer *buf)
+{
+	if (q->int_ops->vaddr)
+		return q->int_ops->vaddr(buf);
+	return NULL;
+}
+EXPORT_SYMBOL_GPL(videobuf_queue_to_vaddr);
+
+/* --------------------------------------------------------------------- */
+
+
+void videobuf_queue_core_init(struct videobuf_queue *q,
+			 const struct videobuf_queue_ops *ops,
+			 struct device *dev,
+			 spinlock_t *irqlock,
+			 enum v4l2_buf_type type,
+			 enum v4l2_field field,
+			 unsigned int msize,
+			 void *priv,
+			 struct videobuf_qtype_ops *int_ops,
+			 struct mutex *ext_lock)
+{
+	BUG_ON(!q);
+	memset(q, 0, sizeof(*q));
+	q->irqlock   = irqlock;
+	q->ext_lock  = ext_lock;
+	q->dev       = dev;
+	q->type      = type;
+	q->field     = field;
+	q->msize     = msize;
+	q->ops       = ops;
+	q->priv_data = priv;
+	q->int_ops   = int_ops;
+
+	/* All buffer operations are mandatory */
+	BUG_ON(!q->ops->buf_setup);
+	BUG_ON(!q->ops->buf_prepare);
+	BUG_ON(!q->ops->buf_queue);
+	BUG_ON(!q->ops->buf_release);
+
+	/* Lock is mandatory for queue_cancel to work */
+	BUG_ON(!irqlock);
+
+	/* Having implementations for abstract methods are mandatory */
+	BUG_ON(!q->int_ops);
+
+	mutex_init(&q->vb_lock);
+	init_waitqueue_head(&q->wait);
+	INIT_LIST_HEAD(&q->stream);
+}
+EXPORT_SYMBOL_GPL(videobuf_queue_core_init);
+
+/* Locking: Only usage in bttv unsafe find way to remove */
+int videobuf_queue_is_busy(struct videobuf_queue *q)
+{
+	int i;
+
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	if (q->streaming) {
+		dprintk(1, "busy: streaming active\n");
+		return 1;
+	}
+	if (q->reading) {
+		dprintk(1, "busy: pending read #1\n");
+		return 1;
+	}
+	if (q->read_buf) {
+		dprintk(1, "busy: pending read #2\n");
+		return 1;
+	}
+	for (i = 0; i < VIDEO_MAX_FRAME; i++) {
+		if (NULL == q->bufs[i])
+			continue;
+		if (q->bufs[i]->map) {
+			dprintk(1, "busy: buffer #%d mapped\n", i);
+			return 1;
+		}
+		if (q->bufs[i]->state == VIDEOBUF_QUEUED) {
+			dprintk(1, "busy: buffer #%d queued\n", i);
+			return 1;
+		}
+		if (q->bufs[i]->state == VIDEOBUF_ACTIVE) {
+			dprintk(1, "busy: buffer #%d active\n", i);
+			return 1;
+		}
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(videobuf_queue_is_busy);
+
+/*
+ * __videobuf_free() - free all the buffers and their control structures
+ *
+ * This function can only be called if streaming/reading is off, i.e. no buffers
+ * are under control of the driver.
+ */
+/* Locking: Caller holds q->vb_lock */
+static int __videobuf_free(struct videobuf_queue *q)
+{
+	int i;
+
+	dprintk(1, "%s\n", __func__);
+	if (!q)
+		return 0;
+
+	if (q->streaming || q->reading) {
+		dprintk(1, "Cannot free buffers when streaming or reading\n");
+		return -EBUSY;
+	}
+
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	for (i = 0; i < VIDEO_MAX_FRAME; i++)
+		if (q->bufs[i] && q->bufs[i]->map) {
+			dprintk(1, "Cannot free mmapped buffers\n");
+			return -EBUSY;
+		}
+
+	for (i = 0; i < VIDEO_MAX_FRAME; i++) {
+		if (NULL == q->bufs[i])
+			continue;
+		q->ops->buf_release(q, q->bufs[i]);
+		kfree(q->bufs[i]);
+		q->bufs[i] = NULL;
+	}
+
+	return 0;
+}
+
+/* Locking: Caller holds q->vb_lock */
+void videobuf_queue_cancel(struct videobuf_queue *q)
+{
+	unsigned long flags = 0;
+	int i;
+
+	q->streaming = 0;
+	q->reading  = 0;
+	wake_up_interruptible_sync(&q->wait);
+
+	/* remove queued buffers from list */
+	spin_lock_irqsave(q->irqlock, flags);
+	for (i = 0; i < VIDEO_MAX_FRAME; i++) {
+		if (NULL == q->bufs[i])
+			continue;
+		if (q->bufs[i]->state == VIDEOBUF_QUEUED) {
+			list_del(&q->bufs[i]->queue);
+			q->bufs[i]->state = VIDEOBUF_ERROR;
+			wake_up_all(&q->bufs[i]->done);
+		}
+	}
+	spin_unlock_irqrestore(q->irqlock, flags);
+
+	/* free all buffers + clear queue */
+	for (i = 0; i < VIDEO_MAX_FRAME; i++) {
+		if (NULL == q->bufs[i])
+			continue;
+		q->ops->buf_release(q, q->bufs[i]);
+	}
+	INIT_LIST_HEAD(&q->stream);
+}
+EXPORT_SYMBOL_GPL(videobuf_queue_cancel);
+
+/* --------------------------------------------------------------------- */
+
+/* Locking: Caller holds q->vb_lock */
+enum v4l2_field videobuf_next_field(struct videobuf_queue *q)
+{
+	enum v4l2_field field = q->field;
+
+	BUG_ON(V4L2_FIELD_ANY == field);
+
+	if (V4L2_FIELD_ALTERNATE == field) {
+		if (V4L2_FIELD_TOP == q->last) {
+			field   = V4L2_FIELD_BOTTOM;
+			q->last = V4L2_FIELD_BOTTOM;
+		} else {
+			field   = V4L2_FIELD_TOP;
+			q->last = V4L2_FIELD_TOP;
+		}
+	}
+	return field;
+}
+EXPORT_SYMBOL_GPL(videobuf_next_field);
+
+/* Locking: Caller holds q->vb_lock */
+static void videobuf_status(struct videobuf_queue *q, struct v4l2_buffer *b,
+			    struct videobuf_buffer *vb, enum v4l2_buf_type type)
+{
+	MAGIC_CHECK(vb->magic, MAGIC_BUFFER);
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	b->index    = vb->i;
+	b->type     = type;
+
+	b->memory   = vb->memory;
+	switch (b->memory) {
+	case V4L2_MEMORY_MMAP:
+		b->m.offset  = vb->boff;
+		b->length    = vb->bsize;
+		break;
+	case V4L2_MEMORY_USERPTR:
+		b->m.userptr = vb->baddr;
+		b->length    = vb->bsize;
+		break;
+	case V4L2_MEMORY_OVERLAY:
+		b->m.offset  = vb->boff;
+		break;
+	case V4L2_MEMORY_DMABUF:
+		/* DMABUF is not handled in videobuf framework */
+		break;
+	}
+
+	b->flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
+	if (vb->map)
+		b->flags |= V4L2_BUF_FLAG_MAPPED;
+
+	switch (vb->state) {
+	case VIDEOBUF_PREPARED:
+	case VIDEOBUF_QUEUED:
+	case VIDEOBUF_ACTIVE:
+		b->flags |= V4L2_BUF_FLAG_QUEUED;
+		break;
+	case VIDEOBUF_ERROR:
+		b->flags |= V4L2_BUF_FLAG_ERROR;
+		fallthrough;
+	case VIDEOBUF_DONE:
+		b->flags |= V4L2_BUF_FLAG_DONE;
+		break;
+	case VIDEOBUF_NEEDS_INIT:
+	case VIDEOBUF_IDLE:
+		/* nothing */
+		break;
+	}
+
+	b->field     = vb->field;
+	v4l2_buffer_set_timestamp(b, vb->ts);
+	b->bytesused = vb->size;
+	b->sequence  = vb->field_count >> 1;
+}
+
+int videobuf_mmap_free(struct videobuf_queue *q)
+{
+	int ret;
+	videobuf_queue_lock(q);
+	ret = __videobuf_free(q);
+	videobuf_queue_unlock(q);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(videobuf_mmap_free);
+
+/* Locking: Caller holds q->vb_lock */
+int __videobuf_mmap_setup(struct videobuf_queue *q,
+			unsigned int bcount, unsigned int bsize,
+			enum v4l2_memory memory)
+{
+	unsigned int i;
+	int err;
+
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	err = __videobuf_free(q);
+	if (0 != err)
+		return err;
+
+	/* Allocate and initialize buffers */
+	for (i = 0; i < bcount; i++) {
+		q->bufs[i] = videobuf_alloc_vb(q);
+
+		if (NULL == q->bufs[i])
+			break;
+
+		q->bufs[i]->i      = i;
+		q->bufs[i]->memory = memory;
+		q->bufs[i]->bsize  = bsize;
+		switch (memory) {
+		case V4L2_MEMORY_MMAP:
+			q->bufs[i]->boff = PAGE_ALIGN(bsize) * i;
+			break;
+		case V4L2_MEMORY_USERPTR:
+		case V4L2_MEMORY_OVERLAY:
+		case V4L2_MEMORY_DMABUF:
+			/* nothing */
+			break;
+		}
+	}
+
+	if (!i)
+		return -ENOMEM;
+
+	dprintk(1, "mmap setup: %d buffers, %d bytes each\n", i, bsize);
+
+	return i;
+}
+EXPORT_SYMBOL_GPL(__videobuf_mmap_setup);
+
+int videobuf_mmap_setup(struct videobuf_queue *q,
+			unsigned int bcount, unsigned int bsize,
+			enum v4l2_memory memory)
+{
+	int ret;
+	videobuf_queue_lock(q);
+	ret = __videobuf_mmap_setup(q, bcount, bsize, memory);
+	videobuf_queue_unlock(q);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(videobuf_mmap_setup);
+
+int videobuf_reqbufs(struct videobuf_queue *q,
+		 struct v4l2_requestbuffers *req)
+{
+	unsigned int size, count;
+	int retval;
+
+	if (req->memory != V4L2_MEMORY_MMAP     &&
+	    req->memory != V4L2_MEMORY_USERPTR  &&
+	    req->memory != V4L2_MEMORY_OVERLAY) {
+		dprintk(1, "reqbufs: memory type invalid\n");
+		return -EINVAL;
+	}
+
+	videobuf_queue_lock(q);
+	if (req->type != q->type) {
+		dprintk(1, "reqbufs: queue type invalid\n");
+		retval = -EINVAL;
+		goto done;
+	}
+
+	if (q->streaming) {
+		dprintk(1, "reqbufs: streaming already exists\n");
+		retval = -EBUSY;
+		goto done;
+	}
+	if (!list_empty(&q->stream)) {
+		dprintk(1, "reqbufs: stream running\n");
+		retval = -EBUSY;
+		goto done;
+	}
+
+	if (req->count == 0) {
+		dprintk(1, "reqbufs: count invalid (%d)\n", req->count);
+		retval = __videobuf_free(q);
+		goto done;
+	}
+
+	count = req->count;
+	if (count > VIDEO_MAX_FRAME)
+		count = VIDEO_MAX_FRAME;
+	size = 0;
+	q->ops->buf_setup(q, &count, &size);
+	dprintk(1, "reqbufs: bufs=%d, size=0x%x [%u pages total]\n",
+		count, size,
+		(unsigned int)((count * PAGE_ALIGN(size)) >> PAGE_SHIFT));
+
+	retval = __videobuf_mmap_setup(q, count, size, req->memory);
+	if (retval < 0) {
+		dprintk(1, "reqbufs: mmap setup returned %d\n", retval);
+		goto done;
+	}
+
+	req->count = retval;
+	retval = 0;
+
+ done:
+	videobuf_queue_unlock(q);
+	return retval;
+}
+EXPORT_SYMBOL_GPL(videobuf_reqbufs);
+
+int videobuf_querybuf(struct videobuf_queue *q, struct v4l2_buffer *b)
+{
+	int ret = -EINVAL;
+
+	videobuf_queue_lock(q);
+	if (unlikely(b->type != q->type)) {
+		dprintk(1, "querybuf: Wrong type.\n");
+		goto done;
+	}
+	if (unlikely(b->index >= VIDEO_MAX_FRAME)) {
+		dprintk(1, "querybuf: index out of range.\n");
+		goto done;
+	}
+	if (unlikely(NULL == q->bufs[b->index])) {
+		dprintk(1, "querybuf: buffer is null.\n");
+		goto done;
+	}
+
+	videobuf_status(q, b, q->bufs[b->index], q->type);
+
+	ret = 0;
+done:
+	videobuf_queue_unlock(q);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(videobuf_querybuf);
+
+int videobuf_qbuf(struct videobuf_queue *q, struct v4l2_buffer *b)
+{
+	struct videobuf_buffer *buf;
+	enum v4l2_field field;
+	unsigned long flags = 0;
+	int retval;
+
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	if (b->memory == V4L2_MEMORY_MMAP)
+		mmap_read_lock(current->mm);
+
+	videobuf_queue_lock(q);
+	retval = -EBUSY;
+	if (q->reading) {
+		dprintk(1, "qbuf: Reading running...\n");
+		goto done;
+	}
+	retval = -EINVAL;
+	if (b->type != q->type) {
+		dprintk(1, "qbuf: Wrong type.\n");
+		goto done;
+	}
+	if (b->index >= VIDEO_MAX_FRAME) {
+		dprintk(1, "qbuf: index out of range.\n");
+		goto done;
+	}
+	buf = q->bufs[b->index];
+	if (NULL == buf) {
+		dprintk(1, "qbuf: buffer is null.\n");
+		goto done;
+	}
+	MAGIC_CHECK(buf->magic, MAGIC_BUFFER);
+	if (buf->memory != b->memory) {
+		dprintk(1, "qbuf: memory type is wrong.\n");
+		goto done;
+	}
+	if (buf->state != VIDEOBUF_NEEDS_INIT && buf->state != VIDEOBUF_IDLE) {
+		dprintk(1, "qbuf: buffer is already queued or active.\n");
+		goto done;
+	}
+
+	switch (b->memory) {
+	case V4L2_MEMORY_MMAP:
+		if (0 == buf->baddr) {
+			dprintk(1, "qbuf: mmap requested but buffer addr is zero!\n");
+			goto done;
+		}
+		if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT
+		    || q->type == V4L2_BUF_TYPE_VBI_OUTPUT
+		    || q->type == V4L2_BUF_TYPE_SLICED_VBI_OUTPUT
+		    || q->type == V4L2_BUF_TYPE_SDR_OUTPUT) {
+			buf->size = b->bytesused;
+			buf->field = b->field;
+			buf->ts = v4l2_buffer_get_timestamp(b);
+		}
+		break;
+	case V4L2_MEMORY_USERPTR:
+		if (b->length < buf->bsize) {
+			dprintk(1, "qbuf: buffer length is not enough\n");
+			goto done;
+		}
+		if (VIDEOBUF_NEEDS_INIT != buf->state &&
+		    buf->baddr != b->m.userptr)
+			q->ops->buf_release(q, buf);
+		buf->baddr = b->m.userptr;
+		break;
+	case V4L2_MEMORY_OVERLAY:
+		buf->boff = b->m.offset;
+		break;
+	default:
+		dprintk(1, "qbuf: wrong memory type\n");
+		goto done;
+	}
+
+	dprintk(1, "qbuf: requesting next field\n");
+	field = videobuf_next_field(q);
+	retval = q->ops->buf_prepare(q, buf, field);
+	if (0 != retval) {
+		dprintk(1, "qbuf: buffer_prepare returned %d\n", retval);
+		goto done;
+	}
+
+	list_add_tail(&buf->stream, &q->stream);
+	if (q->streaming) {
+		spin_lock_irqsave(q->irqlock, flags);
+		q->ops->buf_queue(q, buf);
+		spin_unlock_irqrestore(q->irqlock, flags);
+	}
+	dprintk(1, "qbuf: succeeded\n");
+	retval = 0;
+	wake_up_interruptible_sync(&q->wait);
+
+done:
+	videobuf_queue_unlock(q);
+
+	if (b->memory == V4L2_MEMORY_MMAP)
+		mmap_read_unlock(current->mm);
+
+	return retval;
+}
+EXPORT_SYMBOL_GPL(videobuf_qbuf);
+
+/* Locking: Caller holds q->vb_lock */
+static int stream_next_buffer_check_queue(struct videobuf_queue *q, int noblock)
+{
+	int retval;
+
+checks:
+	if (!q->streaming) {
+		dprintk(1, "next_buffer: Not streaming\n");
+		retval = -EINVAL;
+		goto done;
+	}
+
+	if (list_empty(&q->stream)) {
+		if (noblock) {
+			retval = -EAGAIN;
+			dprintk(2, "next_buffer: no buffers to dequeue\n");
+			goto done;
+		} else {
+			dprintk(2, "next_buffer: waiting on buffer\n");
+
+			/* Drop lock to avoid deadlock with qbuf */
+			videobuf_queue_unlock(q);
+
+			/* Checking list_empty and streaming is safe without
+			 * locks because we goto checks to validate while
+			 * holding locks before proceeding */
+			retval = wait_event_interruptible(q->wait,
+				!list_empty(&q->stream) || !q->streaming);
+			videobuf_queue_lock(q);
+
+			if (retval)
+				goto done;
+
+			goto checks;
+		}
+	}
+
+	retval = 0;
+
+done:
+	return retval;
+}
+
+/* Locking: Caller holds q->vb_lock */
+static int stream_next_buffer(struct videobuf_queue *q,
+			struct videobuf_buffer **vb, int nonblocking)
+{
+	int retval;
+	struct videobuf_buffer *buf = NULL;
+
+	retval = stream_next_buffer_check_queue(q, nonblocking);
+	if (retval)
+		goto done;
+
+	buf = list_entry(q->stream.next, struct videobuf_buffer, stream);
+	retval = videobuf_waiton(q, buf, nonblocking, 1);
+	if (retval < 0)
+		goto done;
+
+	*vb = buf;
+done:
+	return retval;
+}
+
+int videobuf_dqbuf(struct videobuf_queue *q,
+		   struct v4l2_buffer *b, int nonblocking)
+{
+	struct videobuf_buffer *buf = NULL;
+	int retval;
+
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	memset(b, 0, sizeof(*b));
+	videobuf_queue_lock(q);
+
+	retval = stream_next_buffer(q, &buf, nonblocking);
+	if (retval < 0) {
+		dprintk(1, "dqbuf: next_buffer error: %i\n", retval);
+		goto done;
+	}
+
+	switch (buf->state) {
+	case VIDEOBUF_ERROR:
+		dprintk(1, "dqbuf: state is error\n");
+		break;
+	case VIDEOBUF_DONE:
+		dprintk(1, "dqbuf: state is done\n");
+		break;
+	default:
+		dprintk(1, "dqbuf: state invalid\n");
+		retval = -EINVAL;
+		goto done;
+	}
+	CALL(q, sync, q, buf);
+	videobuf_status(q, b, buf, q->type);
+	list_del(&buf->stream);
+	buf->state = VIDEOBUF_IDLE;
+	b->flags &= ~V4L2_BUF_FLAG_DONE;
+done:
+	videobuf_queue_unlock(q);
+	return retval;
+}
+EXPORT_SYMBOL_GPL(videobuf_dqbuf);
+
+int videobuf_streamon(struct videobuf_queue *q)
+{
+	struct videobuf_buffer *buf;
+	unsigned long flags = 0;
+	int retval;
+
+	videobuf_queue_lock(q);
+	retval = -EBUSY;
+	if (q->reading)
+		goto done;
+	retval = 0;
+	if (q->streaming)
+		goto done;
+	q->streaming = 1;
+	spin_lock_irqsave(q->irqlock, flags);
+	list_for_each_entry(buf, &q->stream, stream)
+		if (buf->state == VIDEOBUF_PREPARED)
+			q->ops->buf_queue(q, buf);
+	spin_unlock_irqrestore(q->irqlock, flags);
+
+	wake_up_interruptible_sync(&q->wait);
+done:
+	videobuf_queue_unlock(q);
+	return retval;
+}
+EXPORT_SYMBOL_GPL(videobuf_streamon);
+
+/* Locking: Caller holds q->vb_lock */
+static int __videobuf_streamoff(struct videobuf_queue *q)
+{
+	if (!q->streaming)
+		return -EINVAL;
+
+	videobuf_queue_cancel(q);
+
+	return 0;
+}
+
+int videobuf_streamoff(struct videobuf_queue *q)
+{
+	int retval;
+
+	videobuf_queue_lock(q);
+	retval = __videobuf_streamoff(q);
+	videobuf_queue_unlock(q);
+
+	return retval;
+}
+EXPORT_SYMBOL_GPL(videobuf_streamoff);
+
+/* Locking: Caller holds q->vb_lock */
+static ssize_t videobuf_read_zerocopy(struct videobuf_queue *q,
+				      char __user *data,
+				      size_t count, loff_t *ppos)
+{
+	enum v4l2_field field;
+	unsigned long flags = 0;
+	int retval;
+
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	/* setup stuff */
+	q->read_buf = videobuf_alloc_vb(q);
+	if (NULL == q->read_buf)
+		return -ENOMEM;
+
+	q->read_buf->memory = V4L2_MEMORY_USERPTR;
+	q->read_buf->baddr  = (unsigned long)data;
+	q->read_buf->bsize  = count;
+
+	field = videobuf_next_field(q);
+	retval = q->ops->buf_prepare(q, q->read_buf, field);
+	if (0 != retval)
+		goto done;
+
+	/* start capture & wait */
+	spin_lock_irqsave(q->irqlock, flags);
+	q->ops->buf_queue(q, q->read_buf);
+	spin_unlock_irqrestore(q->irqlock, flags);
+	retval = videobuf_waiton(q, q->read_buf, 0, 0);
+	if (0 == retval) {
+		CALL(q, sync, q, q->read_buf);
+		if (VIDEOBUF_ERROR == q->read_buf->state)
+			retval = -EIO;
+		else
+			retval = q->read_buf->size;
+	}
+
+done:
+	/* cleanup */
+	q->ops->buf_release(q, q->read_buf);
+	kfree(q->read_buf);
+	q->read_buf = NULL;
+	return retval;
+}
+
+static int __videobuf_copy_to_user(struct videobuf_queue *q,
+				   struct videobuf_buffer *buf,
+				   char __user *data, size_t count,
+				   int nonblocking)
+{
+	void *vaddr = CALLPTR(q, vaddr, buf);
+
+	/* copy to userspace */
+	if (count > buf->size - q->read_off)
+		count = buf->size - q->read_off;
+
+	if (copy_to_user(data, vaddr + q->read_off, count))
+		return -EFAULT;
+
+	return count;
+}
+
+static int __videobuf_copy_stream(struct videobuf_queue *q,
+				  struct videobuf_buffer *buf,
+				  char __user *data, size_t count, size_t pos,
+				  int vbihack, int nonblocking)
+{
+	unsigned int *fc = CALLPTR(q, vaddr, buf);
+
+	if (vbihack) {
+		/* dirty, undocumented hack -- pass the frame counter
+			* within the last four bytes of each vbi data block.
+			* We need that one to maintain backward compatibility
+			* to all vbi decoding software out there ... */
+		fc += (buf->size >> 2) - 1;
+		*fc = buf->field_count >> 1;
+		dprintk(1, "vbihack: %d\n", *fc);
+	}
+
+	/* copy stuff using the common method */
+	count = __videobuf_copy_to_user(q, buf, data, count, nonblocking);
+
+	if ((count == -EFAULT) && (pos == 0))
+		return -EFAULT;
+
+	return count;
+}
+
+ssize_t videobuf_read_one(struct videobuf_queue *q,
+			  char __user *data, size_t count, loff_t *ppos,
+			  int nonblocking)
+{
+	enum v4l2_field field;
+	unsigned long flags = 0;
+	unsigned size = 0, nbufs = 1;
+	int retval;
+
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	videobuf_queue_lock(q);
+
+	q->ops->buf_setup(q, &nbufs, &size);
+
+	if (NULL == q->read_buf  &&
+	    count >= size        &&
+	    !nonblocking) {
+		retval = videobuf_read_zerocopy(q, data, count, ppos);
+		if (retval >= 0  ||  retval == -EIO)
+			/* ok, all done */
+			goto done;
+		/* fallback to kernel bounce buffer on failures */
+	}
+
+	if (NULL == q->read_buf) {
+		/* need to capture a new frame */
+		retval = -ENOMEM;
+		q->read_buf = videobuf_alloc_vb(q);
+
+		dprintk(1, "video alloc=0x%p\n", q->read_buf);
+		if (NULL == q->read_buf)
+			goto done;
+		q->read_buf->memory = V4L2_MEMORY_USERPTR;
+		q->read_buf->bsize = count; /* preferred size */
+		field = videobuf_next_field(q);
+		retval = q->ops->buf_prepare(q, q->read_buf, field);
+
+		if (0 != retval) {
+			kfree(q->read_buf);
+			q->read_buf = NULL;
+			goto done;
+		}
+
+		spin_lock_irqsave(q->irqlock, flags);
+		q->ops->buf_queue(q, q->read_buf);
+		spin_unlock_irqrestore(q->irqlock, flags);
+
+		q->read_off = 0;
+	}
+
+	/* wait until capture is done */
+	retval = videobuf_waiton(q, q->read_buf, nonblocking, 1);
+	if (0 != retval)
+		goto done;
+
+	CALL(q, sync, q, q->read_buf);
+
+	if (VIDEOBUF_ERROR == q->read_buf->state) {
+		/* catch I/O errors */
+		q->ops->buf_release(q, q->read_buf);
+		kfree(q->read_buf);
+		q->read_buf = NULL;
+		retval = -EIO;
+		goto done;
+	}
+
+	/* Copy to userspace */
+	retval = __videobuf_copy_to_user(q, q->read_buf, data, count, nonblocking);
+	if (retval < 0)
+		goto done;
+
+	q->read_off += retval;
+	if (q->read_off == q->read_buf->size) {
+		/* all data copied, cleanup */
+		q->ops->buf_release(q, q->read_buf);
+		kfree(q->read_buf);
+		q->read_buf = NULL;
+	}
+
+done:
+	videobuf_queue_unlock(q);
+	return retval;
+}
+EXPORT_SYMBOL_GPL(videobuf_read_one);
+
+/* Locking: Caller holds q->vb_lock */
+static int __videobuf_read_start(struct videobuf_queue *q)
+{
+	enum v4l2_field field;
+	unsigned long flags = 0;
+	unsigned int count = 0, size = 0;
+	int err, i;
+
+	q->ops->buf_setup(q, &count, &size);
+	if (count < 2)
+		count = 2;
+	if (count > VIDEO_MAX_FRAME)
+		count = VIDEO_MAX_FRAME;
+	size = PAGE_ALIGN(size);
+
+	err = __videobuf_mmap_setup(q, count, size, V4L2_MEMORY_USERPTR);
+	if (err < 0)
+		return err;
+
+	count = err;
+
+	for (i = 0; i < count; i++) {
+		field = videobuf_next_field(q);
+		err = q->ops->buf_prepare(q, q->bufs[i], field);
+		if (err)
+			return err;
+		list_add_tail(&q->bufs[i]->stream, &q->stream);
+	}
+	spin_lock_irqsave(q->irqlock, flags);
+	for (i = 0; i < count; i++)
+		q->ops->buf_queue(q, q->bufs[i]);
+	spin_unlock_irqrestore(q->irqlock, flags);
+	q->reading = 1;
+	return 0;
+}
+
+static void __videobuf_read_stop(struct videobuf_queue *q)
+{
+	int i;
+
+	videobuf_queue_cancel(q);
+	__videobuf_free(q);
+	INIT_LIST_HEAD(&q->stream);
+	for (i = 0; i < VIDEO_MAX_FRAME; i++) {
+		if (NULL == q->bufs[i])
+			continue;
+		kfree(q->bufs[i]);
+		q->bufs[i] = NULL;
+	}
+	q->read_buf = NULL;
+}
+
+int videobuf_read_start(struct videobuf_queue *q)
+{
+	int rc;
+
+	videobuf_queue_lock(q);
+	rc = __videobuf_read_start(q);
+	videobuf_queue_unlock(q);
+
+	return rc;
+}
+EXPORT_SYMBOL_GPL(videobuf_read_start);
+
+void videobuf_read_stop(struct videobuf_queue *q)
+{
+	videobuf_queue_lock(q);
+	__videobuf_read_stop(q);
+	videobuf_queue_unlock(q);
+}
+EXPORT_SYMBOL_GPL(videobuf_read_stop);
+
+void videobuf_stop(struct videobuf_queue *q)
+{
+	videobuf_queue_lock(q);
+
+	if (q->streaming)
+		__videobuf_streamoff(q);
+
+	if (q->reading)
+		__videobuf_read_stop(q);
+
+	videobuf_queue_unlock(q);
+}
+EXPORT_SYMBOL_GPL(videobuf_stop);
+
+ssize_t videobuf_read_stream(struct videobuf_queue *q,
+			     char __user *data, size_t count, loff_t *ppos,
+			     int vbihack, int nonblocking)
+{
+	int rc, retval;
+	unsigned long flags = 0;
+
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	dprintk(2, "%s\n", __func__);
+	videobuf_queue_lock(q);
+	retval = -EBUSY;
+	if (q->streaming)
+		goto done;
+	if (!q->reading) {
+		retval = __videobuf_read_start(q);
+		if (retval < 0)
+			goto done;
+	}
+
+	retval = 0;
+	while (count > 0) {
+		/* get / wait for data */
+		if (NULL == q->read_buf) {
+			q->read_buf = list_entry(q->stream.next,
+						 struct videobuf_buffer,
+						 stream);
+			list_del(&q->read_buf->stream);
+			q->read_off = 0;
+		}
+		rc = videobuf_waiton(q, q->read_buf, nonblocking, 1);
+		if (rc < 0) {
+			if (0 == retval)
+				retval = rc;
+			break;
+		}
+
+		if (q->read_buf->state == VIDEOBUF_DONE) {
+			rc = __videobuf_copy_stream(q, q->read_buf, data + retval, count,
+					retval, vbihack, nonblocking);
+			if (rc < 0) {
+				retval = rc;
+				break;
+			}
+			retval      += rc;
+			count       -= rc;
+			q->read_off += rc;
+		} else {
+			/* some error */
+			q->read_off = q->read_buf->size;
+			if (0 == retval)
+				retval = -EIO;
+		}
+
+		/* requeue buffer when done with copying */
+		if (q->read_off == q->read_buf->size) {
+			list_add_tail(&q->read_buf->stream,
+				      &q->stream);
+			spin_lock_irqsave(q->irqlock, flags);
+			q->ops->buf_queue(q, q->read_buf);
+			spin_unlock_irqrestore(q->irqlock, flags);
+			q->read_buf = NULL;
+		}
+		if (retval < 0)
+			break;
+	}
+
+done:
+	videobuf_queue_unlock(q);
+	return retval;
+}
+EXPORT_SYMBOL_GPL(videobuf_read_stream);
+
+__poll_t videobuf_poll_stream(struct file *file,
+			      struct videobuf_queue *q,
+			      poll_table *wait)
+{
+	__poll_t req_events = poll_requested_events(wait);
+	struct videobuf_buffer *buf = NULL;
+	__poll_t rc = 0;
+
+	videobuf_queue_lock(q);
+	if (q->streaming) {
+		if (!list_empty(&q->stream))
+			buf = list_entry(q->stream.next,
+					 struct videobuf_buffer, stream);
+	} else if (req_events & (EPOLLIN | EPOLLRDNORM)) {
+		if (!q->reading)
+			__videobuf_read_start(q);
+		if (!q->reading) {
+			rc = EPOLLERR;
+		} else if (NULL == q->read_buf) {
+			q->read_buf = list_entry(q->stream.next,
+						 struct videobuf_buffer,
+						 stream);
+			list_del(&q->read_buf->stream);
+			q->read_off = 0;
+		}
+		buf = q->read_buf;
+	}
+	if (buf)
+		poll_wait(file, &buf->done, wait);
+	else
+		rc = EPOLLERR;
+
+	if (0 == rc) {
+		if (buf->state == VIDEOBUF_DONE ||
+		    buf->state == VIDEOBUF_ERROR) {
+			switch (q->type) {
+			case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+			case V4L2_BUF_TYPE_VBI_OUTPUT:
+			case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
+			case V4L2_BUF_TYPE_SDR_OUTPUT:
+				rc = EPOLLOUT | EPOLLWRNORM;
+				break;
+			default:
+				rc = EPOLLIN | EPOLLRDNORM;
+				break;
+			}
+		}
+	}
+	videobuf_queue_unlock(q);
+	return rc;
+}
+EXPORT_SYMBOL_GPL(videobuf_poll_stream);
+
+int videobuf_mmap_mapper(struct videobuf_queue *q, struct vm_area_struct *vma)
+{
+	int rc = -EINVAL;
+	int i;
+
+	MAGIC_CHECK(q->int_ops->magic, MAGIC_QTYPE_OPS);
+
+	if (!(vma->vm_flags & VM_WRITE) || !(vma->vm_flags & VM_SHARED)) {
+		dprintk(1, "mmap appl bug: PROT_WRITE and MAP_SHARED are required\n");
+		return -EINVAL;
+	}
+
+	videobuf_queue_lock(q);
+	for (i = 0; i < VIDEO_MAX_FRAME; i++) {
+		struct videobuf_buffer *buf = q->bufs[i];
+
+		if (buf && buf->memory == V4L2_MEMORY_MMAP &&
+				buf->boff == (vma->vm_pgoff << PAGE_SHIFT)) {
+			rc = CALL(q, mmap_mapper, q, buf, vma);
+			break;
+		}
+	}
+	videobuf_queue_unlock(q);
+
+	return rc;
+}
+EXPORT_SYMBOL_GPL(videobuf_mmap_mapper);
diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
new file mode 100644
index 000000000000..4c2ec7a0d804
--- /dev/null
+++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
@@ -0,0 +1,402 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * helper functions for physically contiguous capture buffers
+ *
+ * The functions support hardware lacking scatter gather support
+ * (i.e. the buffers must be linear in physical memory)
+ *
+ * Copyright (c) 2008 Magnus Damm
+ *
+ * Based on videobuf-vmalloc.c,
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/dma-mapping.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <media/videobuf-dma-contig.h>
+
+struct videobuf_dma_contig_memory {
+	u32 magic;
+	void *vaddr;
+	dma_addr_t dma_handle;
+	unsigned long size;
+};
+
+#define MAGIC_DC_MEM 0x0733ac61
+#define MAGIC_CHECK(is, should)						    \
+	if (unlikely((is) != (should)))	{				    \
+		pr_err("magic mismatch: %x expected %x\n", (is), (should)); \
+		BUG();							    \
+	}
+
+static int __videobuf_dc_alloc(struct device *dev,
+			       struct videobuf_dma_contig_memory *mem,
+			       unsigned long size)
+{
+	mem->size = size;
+	mem->vaddr = dma_alloc_coherent(dev, mem->size, &mem->dma_handle,
+					GFP_KERNEL);
+	if (!mem->vaddr) {
+		dev_err(dev, "memory alloc size %ld failed\n", mem->size);
+		return -ENOMEM;
+	}
+
+	dev_dbg(dev, "dma mapped data is at %p (%ld)\n", mem->vaddr, mem->size);
+
+	return 0;
+}
+
+static void __videobuf_dc_free(struct device *dev,
+			       struct videobuf_dma_contig_memory *mem)
+{
+	dma_free_coherent(dev, mem->size, mem->vaddr, mem->dma_handle);
+
+	mem->vaddr = NULL;
+}
+
+static void videobuf_vm_open(struct vm_area_struct *vma)
+{
+	struct videobuf_mapping *map = vma->vm_private_data;
+
+	dev_dbg(map->q->dev, "vm_open %p [count=%u,vma=%08lx-%08lx]\n",
+		map, map->count, vma->vm_start, vma->vm_end);
+
+	map->count++;
+}
+
+static void videobuf_vm_close(struct vm_area_struct *vma)
+{
+	struct videobuf_mapping *map = vma->vm_private_data;
+	struct videobuf_queue *q = map->q;
+	int i;
+
+	dev_dbg(q->dev, "vm_close %p [count=%u,vma=%08lx-%08lx]\n",
+		map, map->count, vma->vm_start, vma->vm_end);
+
+	map->count--;
+	if (0 == map->count) {
+		struct videobuf_dma_contig_memory *mem;
+
+		dev_dbg(q->dev, "munmap %p q=%p\n", map, q);
+		videobuf_queue_lock(q);
+
+		/* We need first to cancel streams, before unmapping */
+		if (q->streaming)
+			videobuf_queue_cancel(q);
+
+		for (i = 0; i < VIDEO_MAX_FRAME; i++) {
+			if (NULL == q->bufs[i])
+				continue;
+
+			if (q->bufs[i]->map != map)
+				continue;
+
+			mem = q->bufs[i]->priv;
+			if (mem) {
+				/* This callback is called only if kernel has
+				   allocated memory and this memory is mmapped.
+				   In this case, memory should be freed,
+				   in order to do memory unmap.
+				 */
+
+				MAGIC_CHECK(mem->magic, MAGIC_DC_MEM);
+
+				/* vfree is not atomic - can't be
+				   called with IRQ's disabled
+				 */
+				dev_dbg(q->dev, "buf[%d] freeing %p\n",
+					i, mem->vaddr);
+
+				__videobuf_dc_free(q->dev, mem);
+				mem->vaddr = NULL;
+			}
+
+			q->bufs[i]->map = NULL;
+			q->bufs[i]->baddr = 0;
+		}
+
+		kfree(map);
+
+		videobuf_queue_unlock(q);
+	}
+}
+
+static const struct vm_operations_struct videobuf_vm_ops = {
+	.open	= videobuf_vm_open,
+	.close	= videobuf_vm_close,
+};
+
+/**
+ * videobuf_dma_contig_user_put() - reset pointer to user space buffer
+ * @mem: per-buffer private videobuf-dma-contig data
+ *
+ * This function resets the user space pointer
+ */
+static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem)
+{
+	mem->dma_handle = 0;
+	mem->size = 0;
+}
+
+/**
+ * videobuf_dma_contig_user_get() - setup user space memory pointer
+ * @mem: per-buffer private videobuf-dma-contig data
+ * @vb: video buffer to map
+ *
+ * This function validates and sets up a pointer to user space memory.
+ * Only physically contiguous pfn-mapped memory is accepted.
+ *
+ * Returns 0 if successful.
+ */
+static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
+					struct videobuf_buffer *vb)
+{
+	unsigned long untagged_baddr = untagged_addr(vb->baddr);
+	struct mm_struct *mm = current->mm;
+	struct vm_area_struct *vma;
+	unsigned long prev_pfn, this_pfn;
+	unsigned long pages_done, user_address;
+	unsigned int offset;
+	int ret;
+
+	offset = untagged_baddr & ~PAGE_MASK;
+	mem->size = PAGE_ALIGN(vb->size + offset);
+	ret = -EINVAL;
+
+	mmap_read_lock(mm);
+
+	vma = find_vma(mm, untagged_baddr);
+	if (!vma)
+		goto out_up;
+
+	if ((untagged_baddr + mem->size) > vma->vm_end)
+		goto out_up;
+
+	pages_done = 0;
+	prev_pfn = 0; /* kill warning */
+	user_address = untagged_baddr;
+
+	while (pages_done < (mem->size >> PAGE_SHIFT)) {
+		ret = follow_pfn(vma, user_address, &this_pfn);
+		if (ret)
+			break;
+
+		if (pages_done == 0)
+			mem->dma_handle = (this_pfn << PAGE_SHIFT) + offset;
+		else if (this_pfn != (prev_pfn + 1))
+			ret = -EFAULT;
+
+		if (ret)
+			break;
+
+		prev_pfn = this_pfn;
+		user_address += PAGE_SIZE;
+		pages_done++;
+	}
+
+out_up:
+	mmap_read_unlock(current->mm);
+
+	return ret;
+}
+
+static struct videobuf_buffer *__videobuf_alloc(size_t size)
+{
+	struct videobuf_dma_contig_memory *mem;
+	struct videobuf_buffer *vb;
+
+	vb = kzalloc(size + sizeof(*mem), GFP_KERNEL);
+	if (vb) {
+		vb->priv = ((char *)vb) + size;
+		mem = vb->priv;
+		mem->magic = MAGIC_DC_MEM;
+	}
+
+	return vb;
+}
+
+static void *__videobuf_to_vaddr(struct videobuf_buffer *buf)
+{
+	struct videobuf_dma_contig_memory *mem = buf->priv;
+
+	BUG_ON(!mem);
+	MAGIC_CHECK(mem->magic, MAGIC_DC_MEM);
+
+	return mem->vaddr;
+}
+
+static int __videobuf_iolock(struct videobuf_queue *q,
+			     struct videobuf_buffer *vb,
+			     struct v4l2_framebuffer *fbuf)
+{
+	struct videobuf_dma_contig_memory *mem = vb->priv;
+
+	BUG_ON(!mem);
+	MAGIC_CHECK(mem->magic, MAGIC_DC_MEM);
+
+	switch (vb->memory) {
+	case V4L2_MEMORY_MMAP:
+		dev_dbg(q->dev, "%s memory method MMAP\n", __func__);
+
+		/* All handling should be done by __videobuf_mmap_mapper() */
+		if (!mem->vaddr) {
+			dev_err(q->dev, "memory is not allocated/mmapped.\n");
+			return -EINVAL;
+		}
+		break;
+	case V4L2_MEMORY_USERPTR:
+		dev_dbg(q->dev, "%s memory method USERPTR\n", __func__);
+
+		/* handle pointer from user space */
+		if (vb->baddr)
+			return videobuf_dma_contig_user_get(mem, vb);
+
+		/* allocate memory for the read() method */
+		if (__videobuf_dc_alloc(q->dev, mem, PAGE_ALIGN(vb->size)))
+			return -ENOMEM;
+		break;
+	case V4L2_MEMORY_OVERLAY:
+	default:
+		dev_dbg(q->dev, "%s memory method OVERLAY/unknown\n", __func__);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int __videobuf_mmap_mapper(struct videobuf_queue *q,
+				  struct videobuf_buffer *buf,
+				  struct vm_area_struct *vma)
+{
+	struct videobuf_dma_contig_memory *mem;
+	struct videobuf_mapping *map;
+	int retval;
+
+	dev_dbg(q->dev, "%s\n", __func__);
+
+	/* create mapping + update buffer list */
+	map = kzalloc(sizeof(struct videobuf_mapping), GFP_KERNEL);
+	if (!map)
+		return -ENOMEM;
+
+	buf->map = map;
+	map->q = q;
+
+	buf->baddr = vma->vm_start;
+
+	mem = buf->priv;
+	BUG_ON(!mem);
+	MAGIC_CHECK(mem->magic, MAGIC_DC_MEM);
+
+	if (__videobuf_dc_alloc(q->dev, mem, PAGE_ALIGN(buf->bsize)))
+		goto error;
+
+	/* the "vm_pgoff" is just used in v4l2 to find the
+	 * corresponding buffer data structure which is allocated
+	 * earlier and it does not mean the offset from the physical
+	 * buffer start address as usual. So set it to 0 to pass
+	 * the sanity check in dma_mmap_coherent().
+	 */
+	vma->vm_pgoff = 0;
+	retval = dma_mmap_coherent(q->dev, vma, mem->vaddr, mem->dma_handle,
+				   mem->size);
+	if (retval) {
+		dev_err(q->dev, "mmap: remap failed with error %d. ",
+			retval);
+		dma_free_coherent(q->dev, mem->size,
+				  mem->vaddr, mem->dma_handle);
+		goto error;
+	}
+
+	vma->vm_ops = &videobuf_vm_ops;
+	vm_flags_set(vma, VM_DONTEXPAND);
+	vma->vm_private_data = map;
+
+	dev_dbg(q->dev, "mmap %p: q=%p %08lx-%08lx (%lx) pgoff %08lx buf %d\n",
+		map, q, vma->vm_start, vma->vm_end,
+		(long int)buf->bsize, vma->vm_pgoff, buf->i);
+
+	videobuf_vm_open(vma);
+
+	return 0;
+
+error:
+	kfree(map);
+	return -ENOMEM;
+}
+
+static struct videobuf_qtype_ops qops = {
+	.magic		= MAGIC_QTYPE_OPS,
+	.alloc_vb	= __videobuf_alloc,
+	.iolock		= __videobuf_iolock,
+	.mmap_mapper	= __videobuf_mmap_mapper,
+	.vaddr		= __videobuf_to_vaddr,
+};
+
+void videobuf_queue_dma_contig_init(struct videobuf_queue *q,
+				    const struct videobuf_queue_ops *ops,
+				    struct device *dev,
+				    spinlock_t *irqlock,
+				    enum v4l2_buf_type type,
+				    enum v4l2_field field,
+				    unsigned int msize,
+				    void *priv,
+				    struct mutex *ext_lock)
+{
+	videobuf_queue_core_init(q, ops, dev, irqlock, type, field, msize,
+				 priv, &qops, ext_lock);
+}
+EXPORT_SYMBOL_GPL(videobuf_queue_dma_contig_init);
+
+dma_addr_t videobuf_to_dma_contig(struct videobuf_buffer *buf)
+{
+	struct videobuf_dma_contig_memory *mem = buf->priv;
+
+	BUG_ON(!mem);
+	MAGIC_CHECK(mem->magic, MAGIC_DC_MEM);
+
+	return mem->dma_handle;
+}
+EXPORT_SYMBOL_GPL(videobuf_to_dma_contig);
+
+void videobuf_dma_contig_free(struct videobuf_queue *q,
+			      struct videobuf_buffer *buf)
+{
+	struct videobuf_dma_contig_memory *mem = buf->priv;
+
+	/* mmapped memory can't be freed here, otherwise mmapped region
+	   would be released, while still needed. In this case, the memory
+	   release should happen inside videobuf_vm_close().
+	   So, it should free memory only if the memory were allocated for
+	   read() operation.
+	 */
+	if (buf->memory != V4L2_MEMORY_USERPTR)
+		return;
+
+	if (!mem)
+		return;
+
+	MAGIC_CHECK(mem->magic, MAGIC_DC_MEM);
+
+	/* handle user space pointer case */
+	if (buf->baddr) {
+		videobuf_dma_contig_user_put(mem);
+		return;
+	}
+
+	/* read() method */
+	if (mem->vaddr) {
+		__videobuf_dc_free(q->dev, mem);
+		mem->vaddr = NULL;
+	}
+}
+EXPORT_SYMBOL_GPL(videobuf_dma_contig_free);
+
+MODULE_DESCRIPTION("helper module to manage video4linux dma contig buffers");
+MODULE_AUTHOR("Magnus Damm");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
new file mode 100644
index 000000000000..405b89ea1054
--- /dev/null
+++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
@@ -0,0 +1,681 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * helper functions for SG DMA video4linux capture buffers
+ *
+ * The functions expect the hardware being able to scatter gather
+ * (i.e. the buffers are not linear in physical memory, but fragmented
+ * into PAGE_SIZE chunks).  They also assume the driver does not need
+ * to touch the video data.
+ *
+ * (c) 2007 Mauro Carvalho Chehab, <mchehab@kernel.org>
+ *
+ * Highly based on video-buf written originally by:
+ * (c) 2001,02 Gerd Knorr <kraxel@bytesex.org>
+ * (c) 2006 Mauro Carvalho Chehab, <mchehab@kernel.org>
+ * (c) 2006 Ted Walther and John Sokol
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/sched/mm.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/pgtable.h>
+
+#include <linux/dma-mapping.h>
+#include <linux/vmalloc.h>
+#include <linux/pagemap.h>
+#include <linux/scatterlist.h>
+#include <asm/page.h>
+
+#include <media/videobuf-dma-sg.h>
+
+#define MAGIC_DMABUF 0x19721112
+#define MAGIC_SG_MEM 0x17890714
+
+#define MAGIC_CHECK(is, should)						\
+	if (unlikely((is) != (should))) {				\
+		printk(KERN_ERR "magic mismatch: %x (expected %x)\n",	\
+				is, should);				\
+		BUG();							\
+	}
+
+static int debug;
+module_param(debug, int, 0644);
+
+MODULE_DESCRIPTION("helper module to manage video4linux dma sg buffers");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
+MODULE_LICENSE("GPL");
+
+#define dprintk(level, fmt, arg...)					\
+	if (debug >= level)						\
+		printk(KERN_DEBUG "vbuf-sg: " fmt , ## arg)
+
+/* --------------------------------------------------------------------- */
+
+/*
+ * Return a scatterlist for some page-aligned vmalloc()'ed memory
+ * block (NULL on errors).  Memory for the scatterlist is allocated
+ * using kmalloc.  The caller must free the memory.
+ */
+static struct scatterlist *videobuf_vmalloc_to_sg(unsigned char *virt,
+						  int nr_pages)
+{
+	struct scatterlist *sglist;
+	struct page *pg;
+	int i;
+
+	sglist = vzalloc(array_size(nr_pages, sizeof(*sglist)));
+	if (NULL == sglist)
+		return NULL;
+	sg_init_table(sglist, nr_pages);
+	for (i = 0; i < nr_pages; i++, virt += PAGE_SIZE) {
+		pg = vmalloc_to_page(virt);
+		if (NULL == pg)
+			goto err;
+		BUG_ON(PageHighMem(pg));
+		sg_set_page(&sglist[i], pg, PAGE_SIZE, 0);
+	}
+	return sglist;
+
+err:
+	vfree(sglist);
+	return NULL;
+}
+
+/*
+ * Return a scatterlist for a an array of userpages (NULL on errors).
+ * Memory for the scatterlist is allocated using kmalloc.  The caller
+ * must free the memory.
+ */
+static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
+					int nr_pages, int offset, size_t size)
+{
+	struct scatterlist *sglist;
+	int i;
+
+	if (NULL == pages[0])
+		return NULL;
+	sglist = vmalloc(array_size(nr_pages, sizeof(*sglist)));
+	if (NULL == sglist)
+		return NULL;
+	sg_init_table(sglist, nr_pages);
+
+	if (PageHighMem(pages[0]))
+		/* DMA to highmem pages might not work */
+		goto highmem;
+	sg_set_page(&sglist[0], pages[0],
+			min_t(size_t, PAGE_SIZE - offset, size), offset);
+	size -= min_t(size_t, PAGE_SIZE - offset, size);
+	for (i = 1; i < nr_pages; i++) {
+		if (NULL == pages[i])
+			goto nopage;
+		if (PageHighMem(pages[i]))
+			goto highmem;
+		sg_set_page(&sglist[i], pages[i], min_t(size_t, PAGE_SIZE, size), 0);
+		size -= min_t(size_t, PAGE_SIZE, size);
+	}
+	return sglist;
+
+nopage:
+	dprintk(2, "sgl: oops - no page\n");
+	vfree(sglist);
+	return NULL;
+
+highmem:
+	dprintk(2, "sgl: oops - highmem page\n");
+	vfree(sglist);
+	return NULL;
+}
+
+/* --------------------------------------------------------------------- */
+
+struct videobuf_dmabuf *videobuf_to_dma(struct videobuf_buffer *buf)
+{
+	struct videobuf_dma_sg_memory *mem = buf->priv;
+	BUG_ON(!mem);
+
+	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
+
+	return &mem->dma;
+}
+EXPORT_SYMBOL_GPL(videobuf_to_dma);
+
+static void videobuf_dma_init(struct videobuf_dmabuf *dma)
+{
+	memset(dma, 0, sizeof(*dma));
+	dma->magic = MAGIC_DMABUF;
+}
+
+static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
+			int direction, unsigned long data, unsigned long size)
+{
+	unsigned int gup_flags = FOLL_LONGTERM;
+	unsigned long first, last;
+	int err;
+
+	dma->direction = direction;
+	switch (dma->direction) {
+	case DMA_FROM_DEVICE:
+		gup_flags |= FOLL_WRITE;
+		break;
+	case DMA_TO_DEVICE:
+		break;
+	default:
+		BUG();
+	}
+
+	first = (data          & PAGE_MASK) >> PAGE_SHIFT;
+	last  = ((data+size-1) & PAGE_MASK) >> PAGE_SHIFT;
+	dma->offset = data & ~PAGE_MASK;
+	dma->size = size;
+	dma->nr_pages = last-first+1;
+	dma->pages = kmalloc_array(dma->nr_pages, sizeof(struct page *),
+				   GFP_KERNEL);
+	if (NULL == dma->pages)
+		return -ENOMEM;
+
+	dprintk(1, "init user [0x%lx+0x%lx => %lu pages]\n",
+		data, size, dma->nr_pages);
+
+	err = pin_user_pages(data & PAGE_MASK, dma->nr_pages, gup_flags,
+			     dma->pages);
+
+	if (err != dma->nr_pages) {
+		dma->nr_pages = (err >= 0) ? err : 0;
+		dprintk(1, "pin_user_pages: err=%d [%lu]\n", err,
+			dma->nr_pages);
+		return err < 0 ? err : -EINVAL;
+	}
+	return 0;
+}
+
+static int videobuf_dma_init_user(struct videobuf_dmabuf *dma, int direction,
+			   unsigned long data, unsigned long size)
+{
+	int ret;
+
+	mmap_read_lock(current->mm);
+	ret = videobuf_dma_init_user_locked(dma, direction, data, size);
+	mmap_read_unlock(current->mm);
+
+	return ret;
+}
+
+static int videobuf_dma_init_kernel(struct videobuf_dmabuf *dma, int direction,
+				    unsigned long nr_pages)
+{
+	int i;
+
+	dprintk(1, "init kernel [%lu pages]\n", nr_pages);
+
+	dma->direction = direction;
+	dma->vaddr_pages = kcalloc(nr_pages, sizeof(*dma->vaddr_pages),
+				   GFP_KERNEL);
+	if (!dma->vaddr_pages)
+		return -ENOMEM;
+
+	dma->dma_addr = kcalloc(nr_pages, sizeof(*dma->dma_addr), GFP_KERNEL);
+	if (!dma->dma_addr) {
+		kfree(dma->vaddr_pages);
+		return -ENOMEM;
+	}
+	for (i = 0; i < nr_pages; i++) {
+		void *addr;
+
+		addr = dma_alloc_coherent(dma->dev, PAGE_SIZE,
+					  &(dma->dma_addr[i]), GFP_KERNEL);
+		if (addr == NULL)
+			goto out_free_pages;
+
+		dma->vaddr_pages[i] = virt_to_page(addr);
+	}
+	dma->vaddr = vmap(dma->vaddr_pages, nr_pages, VM_MAP | VM_IOREMAP,
+			  PAGE_KERNEL);
+	if (NULL == dma->vaddr) {
+		dprintk(1, "vmalloc_32(%lu pages) failed\n", nr_pages);
+		goto out_free_pages;
+	}
+
+	dprintk(1, "vmalloc is at addr %p, size=%lu\n",
+		dma->vaddr, nr_pages << PAGE_SHIFT);
+
+	memset(dma->vaddr, 0, nr_pages << PAGE_SHIFT);
+	dma->nr_pages = nr_pages;
+
+	return 0;
+out_free_pages:
+	while (i > 0) {
+		void *addr;
+
+		i--;
+		addr = page_address(dma->vaddr_pages[i]);
+		dma_free_coherent(dma->dev, PAGE_SIZE, addr, dma->dma_addr[i]);
+	}
+	kfree(dma->dma_addr);
+	dma->dma_addr = NULL;
+	kfree(dma->vaddr_pages);
+	dma->vaddr_pages = NULL;
+
+	return -ENOMEM;
+
+}
+
+static int videobuf_dma_init_overlay(struct videobuf_dmabuf *dma, int direction,
+			      dma_addr_t addr, unsigned long nr_pages)
+{
+	dprintk(1, "init overlay [%lu pages @ bus 0x%lx]\n",
+		nr_pages, (unsigned long)addr);
+	dma->direction = direction;
+
+	if (0 == addr)
+		return -EINVAL;
+
+	dma->bus_addr = addr;
+	dma->nr_pages = nr_pages;
+
+	return 0;
+}
+
+static int videobuf_dma_map(struct device *dev, struct videobuf_dmabuf *dma)
+{
+	MAGIC_CHECK(dma->magic, MAGIC_DMABUF);
+	BUG_ON(0 == dma->nr_pages);
+
+	if (dma->pages) {
+		dma->sglist = videobuf_pages_to_sg(dma->pages, dma->nr_pages,
+						   dma->offset, dma->size);
+	}
+	if (dma->vaddr) {
+		dma->sglist = videobuf_vmalloc_to_sg(dma->vaddr,
+						     dma->nr_pages);
+	}
+	if (dma->bus_addr) {
+		dma->sglist = vmalloc(sizeof(*dma->sglist));
+		if (NULL != dma->sglist) {
+			dma->sglen = 1;
+			sg_dma_address(&dma->sglist[0])	= dma->bus_addr
+							& PAGE_MASK;
+			dma->sglist[0].offset = dma->bus_addr & ~PAGE_MASK;
+			sg_dma_len(&dma->sglist[0]) = dma->nr_pages * PAGE_SIZE;
+		}
+	}
+	if (NULL == dma->sglist) {
+		dprintk(1, "scatterlist is NULL\n");
+		return -ENOMEM;
+	}
+	if (!dma->bus_addr) {
+		dma->sglen = dma_map_sg(dev, dma->sglist,
+					dma->nr_pages, dma->direction);
+		if (0 == dma->sglen) {
+			printk(KERN_WARNING
+			       "%s: videobuf_map_sg failed\n", __func__);
+			vfree(dma->sglist);
+			dma->sglist = NULL;
+			dma->sglen = 0;
+			return -ENOMEM;
+		}
+	}
+
+	return 0;
+}
+
+int videobuf_dma_unmap(struct device *dev, struct videobuf_dmabuf *dma)
+{
+	MAGIC_CHECK(dma->magic, MAGIC_DMABUF);
+
+	if (!dma->sglen)
+		return 0;
+
+	dma_unmap_sg(dev, dma->sglist, dma->nr_pages, dma->direction);
+
+	vfree(dma->sglist);
+	dma->sglist = NULL;
+	dma->sglen = 0;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(videobuf_dma_unmap);
+
+int videobuf_dma_free(struct videobuf_dmabuf *dma)
+{
+	int i;
+	MAGIC_CHECK(dma->magic, MAGIC_DMABUF);
+	BUG_ON(dma->sglen);
+
+	if (dma->pages) {
+		unpin_user_pages_dirty_lock(dma->pages, dma->nr_pages,
+					    dma->direction == DMA_FROM_DEVICE);
+		kfree(dma->pages);
+		dma->pages = NULL;
+	}
+
+	if (dma->dma_addr) {
+		for (i = 0; i < dma->nr_pages; i++) {
+			void *addr;
+
+			addr = page_address(dma->vaddr_pages[i]);
+			dma_free_coherent(dma->dev, PAGE_SIZE, addr,
+					  dma->dma_addr[i]);
+		}
+		kfree(dma->dma_addr);
+		dma->dma_addr = NULL;
+		kfree(dma->vaddr_pages);
+		dma->vaddr_pages = NULL;
+		vunmap(dma->vaddr);
+		dma->vaddr = NULL;
+	}
+
+	if (dma->bus_addr)
+		dma->bus_addr = 0;
+	dma->direction = DMA_NONE;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(videobuf_dma_free);
+
+/* --------------------------------------------------------------------- */
+
+static void videobuf_vm_open(struct vm_area_struct *vma)
+{
+	struct videobuf_mapping *map = vma->vm_private_data;
+
+	dprintk(2, "vm_open %p [count=%d,vma=%08lx-%08lx]\n", map,
+		map->count, vma->vm_start, vma->vm_end);
+
+	map->count++;
+}
+
+static void videobuf_vm_close(struct vm_area_struct *vma)
+{
+	struct videobuf_mapping *map = vma->vm_private_data;
+	struct videobuf_queue *q = map->q;
+	struct videobuf_dma_sg_memory *mem;
+	int i;
+
+	dprintk(2, "vm_close %p [count=%d,vma=%08lx-%08lx]\n", map,
+		map->count, vma->vm_start, vma->vm_end);
+
+	map->count--;
+	if (0 == map->count) {
+		dprintk(1, "munmap %p q=%p\n", map, q);
+		videobuf_queue_lock(q);
+		for (i = 0; i < VIDEO_MAX_FRAME; i++) {
+			if (NULL == q->bufs[i])
+				continue;
+			mem = q->bufs[i]->priv;
+			if (!mem)
+				continue;
+
+			MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
+
+			if (q->bufs[i]->map != map)
+				continue;
+			q->bufs[i]->map   = NULL;
+			q->bufs[i]->baddr = 0;
+			q->ops->buf_release(q, q->bufs[i]);
+		}
+		videobuf_queue_unlock(q);
+		kfree(map);
+	}
+}
+
+/*
+ * Get a anonymous page for the mapping.  Make sure we can DMA to that
+ * memory location with 32bit PCI devices (i.e. don't use highmem for
+ * now ...).  Bounce buffers don't work very well for the data rates
+ * video capture has.
+ */
+static vm_fault_t videobuf_vm_fault(struct vm_fault *vmf)
+{
+	struct vm_area_struct *vma = vmf->vma;
+	struct page *page;
+
+	dprintk(3, "fault: fault @ %08lx [vma %08lx-%08lx]\n",
+		vmf->address, vma->vm_start, vma->vm_end);
+
+	page = alloc_page(GFP_USER | __GFP_DMA32);
+	if (!page)
+		return VM_FAULT_OOM;
+	clear_user_highpage(page, vmf->address);
+	vmf->page = page;
+
+	return 0;
+}
+
+static const struct vm_operations_struct videobuf_vm_ops = {
+	.open	= videobuf_vm_open,
+	.close	= videobuf_vm_close,
+	.fault	= videobuf_vm_fault,
+};
+
+/* ---------------------------------------------------------------------
+ * SG handlers for the generic methods
+ */
+
+/* Allocated area consists on 3 parts:
+	struct video_buffer
+	struct <driver>_buffer (cx88_buffer, saa7134_buf, ...)
+	struct videobuf_dma_sg_memory
+ */
+
+static struct videobuf_buffer *__videobuf_alloc_vb(size_t size)
+{
+	struct videobuf_dma_sg_memory *mem;
+	struct videobuf_buffer *vb;
+
+	vb = kzalloc(size + sizeof(*mem), GFP_KERNEL);
+	if (!vb)
+		return vb;
+
+	mem = vb->priv = ((char *)vb) + size;
+	mem->magic = MAGIC_SG_MEM;
+
+	videobuf_dma_init(&mem->dma);
+
+	dprintk(1, "%s: allocated at %p(%ld+%ld) & %p(%ld)\n",
+		__func__, vb, (long)sizeof(*vb), (long)size - sizeof(*vb),
+		mem, (long)sizeof(*mem));
+
+	return vb;
+}
+
+static void *__videobuf_to_vaddr(struct videobuf_buffer *buf)
+{
+	struct videobuf_dma_sg_memory *mem = buf->priv;
+	BUG_ON(!mem);
+
+	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
+
+	return mem->dma.vaddr;
+}
+
+static int __videobuf_iolock(struct videobuf_queue *q,
+			     struct videobuf_buffer *vb,
+			     struct v4l2_framebuffer *fbuf)
+{
+	struct videobuf_dma_sg_memory *mem = vb->priv;
+	unsigned long pages;
+	dma_addr_t bus;
+	int err;
+
+	BUG_ON(!mem);
+
+	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
+
+	if (!mem->dma.dev)
+		mem->dma.dev = q->dev;
+	else
+		WARN_ON(mem->dma.dev != q->dev);
+
+	switch (vb->memory) {
+	case V4L2_MEMORY_MMAP:
+	case V4L2_MEMORY_USERPTR:
+		if (0 == vb->baddr) {
+			/* no userspace addr -- kernel bounce buffer */
+			pages = PAGE_ALIGN(vb->size) >> PAGE_SHIFT;
+			err = videobuf_dma_init_kernel(&mem->dma,
+						       DMA_FROM_DEVICE,
+						       pages);
+			if (0 != err)
+				return err;
+		} else if (vb->memory == V4L2_MEMORY_USERPTR) {
+			/* dma directly to userspace */
+			err = videobuf_dma_init_user(&mem->dma,
+						     DMA_FROM_DEVICE,
+						     vb->baddr, vb->bsize);
+			if (0 != err)
+				return err;
+		} else {
+			/* NOTE: HACK: videobuf_iolock on V4L2_MEMORY_MMAP
+			buffers can only be called from videobuf_qbuf
+			we take current->mm->mmap_lock there, to prevent
+			locking inversion, so don't take it here */
+
+			err = videobuf_dma_init_user_locked(&mem->dma,
+						      DMA_FROM_DEVICE,
+						      vb->baddr, vb->bsize);
+			if (0 != err)
+				return err;
+		}
+		break;
+	case V4L2_MEMORY_OVERLAY:
+		if (NULL == fbuf)
+			return -EINVAL;
+		/* FIXME: need sanity checks for vb->boff */
+		/*
+		 * Using a double cast to avoid compiler warnings when
+		 * building for PAE. Compiler doesn't like direct casting
+		 * of a 32 bit ptr to 64 bit integer.
+		 */
+		bus   = (dma_addr_t)(unsigned long)fbuf->base + vb->boff;
+		pages = PAGE_ALIGN(vb->size) >> PAGE_SHIFT;
+		err = videobuf_dma_init_overlay(&mem->dma, DMA_FROM_DEVICE,
+						bus, pages);
+		if (0 != err)
+			return err;
+		break;
+	default:
+		BUG();
+	}
+	err = videobuf_dma_map(q->dev, &mem->dma);
+	if (0 != err)
+		return err;
+
+	return 0;
+}
+
+static int __videobuf_sync(struct videobuf_queue *q,
+			   struct videobuf_buffer *buf)
+{
+	struct videobuf_dma_sg_memory *mem = buf->priv;
+	BUG_ON(!mem || !mem->dma.sglen);
+
+	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
+	MAGIC_CHECK(mem->dma.magic, MAGIC_DMABUF);
+
+	dma_sync_sg_for_cpu(q->dev, mem->dma.sglist,
+			    mem->dma.nr_pages, mem->dma.direction);
+
+	return 0;
+}
+
+static int __videobuf_mmap_mapper(struct videobuf_queue *q,
+				  struct videobuf_buffer *buf,
+				  struct vm_area_struct *vma)
+{
+	struct videobuf_dma_sg_memory *mem = buf->priv;
+	struct videobuf_mapping *map;
+	unsigned int first, last, size = 0, i;
+	int retval;
+
+	retval = -EINVAL;
+
+	BUG_ON(!mem);
+	MAGIC_CHECK(mem->magic, MAGIC_SG_MEM);
+
+	/* look for first buffer to map */
+	for (first = 0; first < VIDEO_MAX_FRAME; first++) {
+		if (buf == q->bufs[first]) {
+			size = PAGE_ALIGN(q->bufs[first]->bsize);
+			break;
+		}
+	}
+
+	/* paranoia, should never happen since buf is always valid. */
+	if (!size) {
+		dprintk(1, "mmap app bug: offset invalid [offset=0x%lx]\n",
+				(vma->vm_pgoff << PAGE_SHIFT));
+		goto done;
+	}
+
+	last = first;
+
+	/* create mapping + update buffer list */
+	retval = -ENOMEM;
+	map = kmalloc(sizeof(struct videobuf_mapping), GFP_KERNEL);
+	if (NULL == map)
+		goto done;
+
+	size = 0;
+	for (i = first; i <= last; i++) {
+		if (NULL == q->bufs[i])
+			continue;
+		q->bufs[i]->map   = map;
+		q->bufs[i]->baddr = vma->vm_start + size;
+		size += PAGE_ALIGN(q->bufs[i]->bsize);
+	}
+
+	map->count    = 1;
+	map->q        = q;
+	vma->vm_ops   = &videobuf_vm_ops;
+	/* using shared anonymous pages */
+	vm_flags_mod(vma, VM_DONTEXPAND | VM_DONTDUMP, VM_IO);
+	vma->vm_private_data = map;
+	dprintk(1, "mmap %p: q=%p %08lx-%08lx pgoff %08lx bufs %d-%d\n",
+		map, q, vma->vm_start, vma->vm_end, vma->vm_pgoff, first, last);
+	retval = 0;
+
+done:
+	return retval;
+}
+
+static struct videobuf_qtype_ops sg_ops = {
+	.magic        = MAGIC_QTYPE_OPS,
+
+	.alloc_vb     = __videobuf_alloc_vb,
+	.iolock       = __videobuf_iolock,
+	.sync         = __videobuf_sync,
+	.mmap_mapper  = __videobuf_mmap_mapper,
+	.vaddr        = __videobuf_to_vaddr,
+};
+
+void *videobuf_sg_alloc(size_t size)
+{
+	struct videobuf_queue q;
+
+	/* Required to make generic handler to call __videobuf_alloc */
+	q.int_ops = &sg_ops;
+
+	q.msize = size;
+
+	return videobuf_alloc_vb(&q);
+}
+EXPORT_SYMBOL_GPL(videobuf_sg_alloc);
+
+void videobuf_queue_sg_init(struct videobuf_queue *q,
+			 const struct videobuf_queue_ops *ops,
+			 struct device *dev,
+			 spinlock_t *irqlock,
+			 enum v4l2_buf_type type,
+			 enum v4l2_field field,
+			 unsigned int msize,
+			 void *priv,
+			 struct mutex *ext_lock)
+{
+	videobuf_queue_core_init(q, ops, dev, irqlock, type, field, msize,
+				 priv, &sg_ops, ext_lock);
+}
+EXPORT_SYMBOL_GPL(videobuf_queue_sg_init);
+
diff --git a/drivers/media/v4l2-core/videobuf-vmalloc.c b/drivers/media/v4l2-core/videobuf-vmalloc.c
new file mode 100644
index 000000000000..85c7090606d6
--- /dev/null
+++ b/drivers/media/v4l2-core/videobuf-vmalloc.c
@@ -0,0 +1,326 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * helper functions for vmalloc video4linux capture buffers
+ *
+ * The functions expect the hardware being able to scatter gather
+ * (i.e. the buffers are not linear in physical memory, but fragmented
+ * into PAGE_SIZE chunks).  They also assume the driver does not need
+ * to touch the video data.
+ *
+ * (c) 2007 Mauro Carvalho Chehab <mchehab@kernel.org>
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/pgtable.h>
+
+#include <linux/pci.h>
+#include <linux/vmalloc.h>
+#include <linux/pagemap.h>
+#include <asm/page.h>
+
+#include <media/videobuf-vmalloc.h>
+
+#define MAGIC_DMABUF   0x17760309
+#define MAGIC_VMAL_MEM 0x18221223
+
+#define MAGIC_CHECK(is, should)						\
+	if (unlikely((is) != (should))) {				\
+		printk(KERN_ERR "magic mismatch: %x (expected %x)\n",	\
+				is, should);				\
+		BUG();							\
+	}
+
+static int debug;
+module_param(debug, int, 0644);
+
+MODULE_DESCRIPTION("helper module to manage video4linux vmalloc buffers");
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@kernel.org>");
+MODULE_LICENSE("GPL");
+
+#define dprintk(level, fmt, arg...)					\
+	if (debug >= level)						\
+		printk(KERN_DEBUG "vbuf-vmalloc: " fmt , ## arg)
+
+
+/***************************************************************************/
+
+static void videobuf_vm_open(struct vm_area_struct *vma)
+{
+	struct videobuf_mapping *map = vma->vm_private_data;
+
+	dprintk(2, "vm_open %p [count=%u,vma=%08lx-%08lx]\n", map,
+		map->count, vma->vm_start, vma->vm_end);
+
+	map->count++;
+}
+
+static void videobuf_vm_close(struct vm_area_struct *vma)
+{
+	struct videobuf_mapping *map = vma->vm_private_data;
+	struct videobuf_queue *q = map->q;
+	int i;
+
+	dprintk(2, "vm_close %p [count=%u,vma=%08lx-%08lx]\n", map,
+		map->count, vma->vm_start, vma->vm_end);
+
+	map->count--;
+	if (0 == map->count) {
+		struct videobuf_vmalloc_memory *mem;
+
+		dprintk(1, "munmap %p q=%p\n", map, q);
+		videobuf_queue_lock(q);
+
+		/* We need first to cancel streams, before unmapping */
+		if (q->streaming)
+			videobuf_queue_cancel(q);
+
+		for (i = 0; i < VIDEO_MAX_FRAME; i++) {
+			if (NULL == q->bufs[i])
+				continue;
+
+			if (q->bufs[i]->map != map)
+				continue;
+
+			mem = q->bufs[i]->priv;
+			if (mem) {
+				/* This callback is called only if kernel has
+				   allocated memory and this memory is mmapped.
+				   In this case, memory should be freed,
+				   in order to do memory unmap.
+				 */
+
+				MAGIC_CHECK(mem->magic, MAGIC_VMAL_MEM);
+
+				/* vfree is not atomic - can't be
+				   called with IRQ's disabled
+				 */
+				dprintk(1, "%s: buf[%d] freeing (%p)\n",
+					__func__, i, mem->vaddr);
+
+				vfree(mem->vaddr);
+				mem->vaddr = NULL;
+			}
+
+			q->bufs[i]->map   = NULL;
+			q->bufs[i]->baddr = 0;
+		}
+
+		kfree(map);
+
+		videobuf_queue_unlock(q);
+	}
+
+	return;
+}
+
+static const struct vm_operations_struct videobuf_vm_ops = {
+	.open     = videobuf_vm_open,
+	.close    = videobuf_vm_close,
+};
+
+/* ---------------------------------------------------------------------
+ * vmalloc handlers for the generic methods
+ */
+
+/* Allocated area consists on 3 parts:
+	struct video_buffer
+	struct <driver>_buffer (cx88_buffer, saa7134_buf, ...)
+	struct videobuf_dma_sg_memory
+ */
+
+static struct videobuf_buffer *__videobuf_alloc_vb(size_t size)
+{
+	struct videobuf_vmalloc_memory *mem;
+	struct videobuf_buffer *vb;
+
+	vb = kzalloc(size + sizeof(*mem), GFP_KERNEL);
+	if (!vb)
+		return vb;
+
+	mem = vb->priv = ((char *)vb) + size;
+	mem->magic = MAGIC_VMAL_MEM;
+
+	dprintk(1, "%s: allocated at %p(%ld+%ld) & %p(%ld)\n",
+		__func__, vb, (long)sizeof(*vb), (long)size - sizeof(*vb),
+		mem, (long)sizeof(*mem));
+
+	return vb;
+}
+
+static int __videobuf_iolock(struct videobuf_queue *q,
+			     struct videobuf_buffer *vb,
+			     struct v4l2_framebuffer *fbuf)
+{
+	struct videobuf_vmalloc_memory *mem = vb->priv;
+	int pages;
+
+	BUG_ON(!mem);
+
+	MAGIC_CHECK(mem->magic, MAGIC_VMAL_MEM);
+
+	switch (vb->memory) {
+	case V4L2_MEMORY_MMAP:
+		dprintk(1, "%s memory method MMAP\n", __func__);
+
+		/* All handling should be done by __videobuf_mmap_mapper() */
+		if (!mem->vaddr) {
+			printk(KERN_ERR "memory is not allocated/mmapped.\n");
+			return -EINVAL;
+		}
+		break;
+	case V4L2_MEMORY_USERPTR:
+		pages = PAGE_ALIGN(vb->size);
+
+		dprintk(1, "%s memory method USERPTR\n", __func__);
+
+		if (vb->baddr) {
+			printk(KERN_ERR "USERPTR is currently not supported\n");
+			return -EINVAL;
+		}
+
+		/* The only USERPTR currently supported is the one needed for
+		 * read() method.
+		 */
+
+		mem->vaddr = vmalloc_user(pages);
+		if (!mem->vaddr) {
+			printk(KERN_ERR "vmalloc (%d pages) failed\n", pages);
+			return -ENOMEM;
+		}
+		dprintk(1, "vmalloc is at addr %p (%d pages)\n",
+			mem->vaddr, pages);
+		break;
+	case V4L2_MEMORY_OVERLAY:
+	default:
+		dprintk(1, "%s memory method OVERLAY/unknown\n", __func__);
+
+		/* Currently, doesn't support V4L2_MEMORY_OVERLAY */
+		printk(KERN_ERR "Memory method currently unsupported.\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int __videobuf_mmap_mapper(struct videobuf_queue *q,
+				  struct videobuf_buffer *buf,
+				  struct vm_area_struct *vma)
+{
+	struct videobuf_vmalloc_memory *mem;
+	struct videobuf_mapping *map;
+	int retval, pages;
+
+	dprintk(1, "%s\n", __func__);
+
+	/* create mapping + update buffer list */
+	map = kzalloc(sizeof(struct videobuf_mapping), GFP_KERNEL);
+	if (NULL == map)
+		return -ENOMEM;
+
+	buf->map = map;
+	map->q     = q;
+
+	buf->baddr = vma->vm_start;
+
+	mem = buf->priv;
+	BUG_ON(!mem);
+	MAGIC_CHECK(mem->magic, MAGIC_VMAL_MEM);
+
+	pages = PAGE_ALIGN(vma->vm_end - vma->vm_start);
+	mem->vaddr = vmalloc_user(pages);
+	if (!mem->vaddr) {
+		printk(KERN_ERR "vmalloc (%d pages) failed\n", pages);
+		goto error;
+	}
+	dprintk(1, "vmalloc is at addr %p (%d pages)\n", mem->vaddr, pages);
+
+	/* Try to remap memory */
+	retval = remap_vmalloc_range(vma, mem->vaddr, 0);
+	if (retval < 0) {
+		printk(KERN_ERR "mmap: remap failed with error %d. ", retval);
+		vfree(mem->vaddr);
+		goto error;
+	}
+
+	vma->vm_ops          = &videobuf_vm_ops;
+	vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP);
+	vma->vm_private_data = map;
+
+	dprintk(1, "mmap %p: q=%p %08lx-%08lx (%lx) pgoff %08lx buf %d\n",
+		map, q, vma->vm_start, vma->vm_end,
+		(long int)buf->bsize,
+		vma->vm_pgoff, buf->i);
+
+	videobuf_vm_open(vma);
+
+	return 0;
+
+error:
+	mem = NULL;
+	kfree(map);
+	return -ENOMEM;
+}
+
+static struct videobuf_qtype_ops qops = {
+	.magic        = MAGIC_QTYPE_OPS,
+
+	.alloc_vb     = __videobuf_alloc_vb,
+	.iolock       = __videobuf_iolock,
+	.mmap_mapper  = __videobuf_mmap_mapper,
+	.vaddr        = videobuf_to_vmalloc,
+};
+
+void videobuf_queue_vmalloc_init(struct videobuf_queue *q,
+			 const struct videobuf_queue_ops *ops,
+			 struct device *dev,
+			 spinlock_t *irqlock,
+			 enum v4l2_buf_type type,
+			 enum v4l2_field field,
+			 unsigned int msize,
+			 void *priv,
+			 struct mutex *ext_lock)
+{
+	videobuf_queue_core_init(q, ops, dev, irqlock, type, field, msize,
+				 priv, &qops, ext_lock);
+}
+EXPORT_SYMBOL_GPL(videobuf_queue_vmalloc_init);
+
+void *videobuf_to_vmalloc(struct videobuf_buffer *buf)
+{
+	struct videobuf_vmalloc_memory *mem = buf->priv;
+	BUG_ON(!mem);
+	MAGIC_CHECK(mem->magic, MAGIC_VMAL_MEM);
+
+	return mem->vaddr;
+}
+EXPORT_SYMBOL_GPL(videobuf_to_vmalloc);
+
+void videobuf_vmalloc_free(struct videobuf_buffer *buf)
+{
+	struct videobuf_vmalloc_memory *mem = buf->priv;
+
+	/* mmapped memory can't be freed here, otherwise mmapped region
+	   would be released, while still needed. In this case, the memory
+	   release should happen inside videobuf_vm_close().
+	   So, it should free memory only if the memory were allocated for
+	   read() operation.
+	 */
+	if ((buf->memory != V4L2_MEMORY_USERPTR) || buf->baddr)
+		return;
+
+	if (!mem)
+		return;
+
+	MAGIC_CHECK(mem->magic, MAGIC_VMAL_MEM);
+
+	vfree(mem->vaddr);
+	mem->vaddr = NULL;
+
+	return;
+}
+EXPORT_SYMBOL_GPL(videobuf_vmalloc_free);
+