Commit Graph

601775 Commits

Author SHA1 Message Date
Ezequiel Garcia
11a1697404 [media] tw686x: Add support for DMA contiguous interlaced frame mode
Now that the driver has the infrastructure to support more
DMA modes, let's add the DMA contiguous interlaced frame mode.

In this mode, the DMA P and B buffers are programmed with
the user-provided buffers. When a P (or B) frame is ready,
a new buffer is dequeued into P (or B).

In addition to interlaced fields, the device can also be
programmed to deliver alternate fields. Only interlaced
mode is supported for now.

Tested-by: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-28 07:48:28 -03:00
Ezequiel Garcia
f8afaa8dbc [media] tw686x: Introduce an interface to support multiple DMA modes
Let's set the corner stone to support all the DMA modes
available on this device.

For stability reasons, the driver is currently setting DMA frame
mode, and using single DMA buffers to get the P and B buffers.
Each frame is then memcpy'ed into the user buffer.

However, other platforms might be interested in avoiding this
memcpy, or in taking advantage of the chip's DMA scatter-gather
capabilities.

To achieve this, this commit introduces a "dma_mode" module parameter,
and a tw686x_dma_ops struct. This will allow to define functions to
alloc/free DMA buffers, and to return the frames to userspace.

The memcpy-based method described above is named as dma_mode="memcpy".
Current alloc/free functions are renamed as tw686x_memcpy_xxx,
and are now used through a memcpy_dma_ops.

Tested-by: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-28 07:47:40 -03:00
Mauro Carvalho Chehab
068adc457f bdisp: move the V/H filter spec to bdisp-hw.c
Those structs are used only at bdisp-hw, so they shouldn't be
there in a header file that it is used elsewhere.

This fixes the following Gcc 6.1 warnings:

In file included from drivers/media/platform/sti/bdisp/bdisp-debug.c:11:0:
drivers/media/platform/sti/bdisp/bdisp-filter.h:207:65: warning: ‘bdisp_v_spec’ defined but not used [-Wunused-const-variable=]
 static const struct __maybe_unused bdisp_filter_v_spec bdisp_v_spec[] = {
                                                                 ^~~~~~~~~
In file included from drivers/media/platform/sti/bdisp/bdisp-debug.c:11:0:
drivers/media/platform/sti/bdisp/bdisp-filter.h:23:65: warning: ‘bdisp_h_spec’ defined but not used [-Wunused-const-variable=]
 static const struct __maybe_unused bdisp_filter_h_spec bdisp_h_spec[] = {
                                                                 ^~~~~~~~~

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 12:27:51 -03:00
Mauro Carvalho Chehab
60eb9579c1 adv7842: comment out a table useful for debug
Gcc 6.1 warns about an unused table:

drivers/media/i2c/adv7842.c:2400:27: warning: 'prim_mode_txt' defined but not used [-Wunused-const-variable=]
 static const char * const prim_mode_txt[] = {
                           ^~~~~~~~~~~~~

That seems to be useful for debug, and likely were used before.
While we could simply remove, let's comment it out, for now.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 12:17:27 -03:00
Mauro Carvalho Chehab
5776fbec90 em28xx-dvb: remove some left over
Gcc 6.1 warns about an unused table:

drivers/media/usb/em28xx/em28xx-dvb.c:907:38: warning: 'pctv_461e_m88ds3103_config' defined but not used [-Wunused-const-variable=]
 static const struct m88ds3103_config pctv_461e_m88ds3103_config = {
                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~

That's a left over of patch 76b91be3d3 ('em28xx: PCTV 461e use I2C
client for demod and SEC').

Remove the dead code.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 12:12:54 -03:00
Mauro Carvalho Chehab
ba4cd399c5 vivid: remove some unused vars
Gcc 6.1 warns about some unused vars. Remove them:
drivers/media/platform/vivid/vivid-vid-cap.c:40:2: warning: 'tpf_default' defined but not used [-Wunused-const-variable=]
  tpf_default = {.numerator = 1,  .denominator = 30};
  ^~~~~~~~~~~
drivers/media/platform/vivid/vivid-sdr-cap.c:54:27: warning: 'NUM_FORMATS' defined but not used [-Wunused-const-variable=]
 static const unsigned int NUM_FORMATS = ARRAY_SIZE(formats);
                           ^~~~~~~~~~~

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 12:09:49 -03:00
Mauro Carvalho Chehab
40bcfdac96 zr36016: remove some unused tables
Gcc 6.1 warns about some unused tables:

drivers/media/pci/zoran/zr36016.c:251:18: warning: 'zr016_yoff' defined but not used [-Wunused-const-variable=]
 static const int zr016_yoff[] = { 8, 9, 7 };
                  ^~~~~~~~~~
drivers/media/pci/zoran/zr36016.c:250:18: warning: 'zr016_xoff' defined but not used [-Wunused-const-variable=]
 static const int zr016_xoff[] = { 20, 20, 20 };
                  ^~~~~~~~~~

Those tables aren't used anywere. So, remove them.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 12:02:11 -03:00
Mauro Carvalho Chehab
29025f69bb r820t: comment out two ancillary tables
As Gcc6.1 warned, those tables are currently unused:
	drivers/media/tuners/r820t.c:349:18: warning: 'r820t_mixer_gain_steps' defined but not used [-Wunused-const-variable=]
	 static const int r820t_mixer_gain_steps[]  = {
	                  ^~~~~~~~~~~~~~~~~~~~~~
	drivers/media/tuners/r820t.c:345:18: warning: 'r820t_lna_gain_steps' defined but not used [-Wunused-const-variable=]
	 static const int r820t_lna_gain_steps[]  = {
	                  ^~~~~~~~~~~~~~~~~~~~

They're actually used only by a routine that it is currently
commented out. So, move those tables to be together with such
code and comment them out.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 12:00:02 -03:00
Mauro Carvalho Chehab
cf47faca25 dib0090: comment out the unused tables
Those tables are currently unused, so comment them out:

drivers/media/dvb-frontends/dib0090.c:852:18: warning: 'rf_ramp_pwm_sband' defined but not used [-Wunused-const-variable=]
 static const u16 rf_ramp_pwm_sband[] = {
                  ^~~~~~~~~~~~~~~~~
drivers/media/dvb-frontends/dib0090.c:800:18: warning: 'bb_ramp_pwm_boost' defined but not used [-Wunused-const-variable=]
 static const u16 bb_ramp_pwm_boost[] = {
                  ^~~~~~~~~~~~~~~~~

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 11:23:59 -03:00
Mauro Carvalho Chehab
01d7d436c6 drxj: comment out the unused nicam_presc_table_val table
Avoid this warning:

drivers/media/dvb-frontends/drx39xyj/drxj.c:1243:18: warning: 'nicam_presc_table_val' defined but not used [-Wunused-const-variable=]
 static const u16 nicam_presc_table_val[43] = {
                  ^~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 11:10:16 -03:00
Mauro Carvalho Chehab
114e877a8f cx25821-alsa: shutup a Gcc 6.1 warning
The PCI device ID table is only used if compiled with modules
support. When compiled with modules disabled, this is now
producing this bogus warning:

drivers/media/pci/cx25821/cx25821-alsa.c:696:35: warning: 'cx25821_audio_pci_tbl' defined but not used [-Wunused-const-variable=]
 static const struct pci_device_id cx25821_audio_pci_tbl[] = {
                                   ^~~~~~~~~~~~~~~~~~~~~

Fix it by annotating that the function may not be used.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 09:46:54 -03:00
Mauro Carvalho Chehab
123818ee8c m5602_ov7660: move skeletons to the .c file
The header file has some private static structures that
are used only by the C file. Move those structures to the C file,
in order to shut up gcc 6.1 warnings.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 09:37:43 -03:00
Mauro Carvalho Chehab
804c7812ef m5602_po1030: move skeletons to the .c file
The header file has some private static structures that
are used only by the C file. Move those structures to the C file,
in order to shut up gcc 6.1 warnings.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 09:36:43 -03:00
Mauro Carvalho Chehab
1ab9e60001 m5602_s5k83a: move skeletons to the .c file
The header file has some private static structures that
are used only by the C file. Move those structures to the C file,
in order to shut up gcc 6.1 warnings.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 09:35:43 -03:00
Mauro Carvalho Chehab
14ccffa3c1 m5602_ov9650: move skeletons to the .c file
The header file has some private static structures that
are used only by the C file. Move those structures to the C file,
in order to shut up gcc 6.1 warnings.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 09:35:35 -03:00
Mauro Carvalho Chehab
349e4dc59a m5602_mt9m111: move skeletons to the .c file
The header file has some private static structures that
are used only by the C file. Move those structures to the C file,
in order to shut up gcc 6.1 warnings.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 09:35:24 -03:00
Mauro Carvalho Chehab
0eed95b249 m5602_s5k4aa: move skeletons to the .c file
The mc5602_s5k4aa.h has some private static structures that
are used only by the C file. Move those structures to the C file,
in order to shut up gcc 6.1 warnings.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 09:35:21 -03:00
Mauro Carvalho Chehab
511ebc093c m5602_core: move skeletons to the .c file
The mc5602_brigde.h is included at m5602 submodules. This
causes Gcc 6.1 to complain:

drivers/media/usb/gspca/m5602/m5602_bridge.h:124:28: warning: 'sensor_urb_skeleton' defined but not used [-Wunused-const-variable=]
 static const unsigned char sensor_urb_skeleton[] = {
                            ^~~~~~~~~~~~~~~~~~~
drivers/media/usb/gspca/m5602/m5602_bridge.h:119:28: warning: 'bridge_urb_skeleton' defined but not used [-Wunused-const-variable=]
 static const unsigned char bridge_urb_skeleton[] = {
                           ^~~~~~~~~~~~~~~~~~~

Let's shut up gcc 6.1 warnings by moving those data structures
to the core, as they're used only there.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 09:35:15 -03:00
Mauro Carvalho Chehab
318de7911f cx18: use macros instead of static const vars
Gcc 6.1 now complains about unused vars:

drivers/media/pci/cx18/cx18-driver.h:497:18: warning: 'vbi_hblank_samples_50Hz' defined but not used [-Wunused-const-variable=]
 static const u32 vbi_hblank_samples_50Hz = 284; /* 4 byte EAV + 280 anc/fill */
                  ^~~~~~~~~~~~~~~~~~~~~~~
drivers/media/pci/cx18/cx18-driver.h:496:18: warning: 'vbi_hblank_samples_60Hz' defined but not used [-Wunused-const-variable=]
 static const u32 vbi_hblank_samples_60Hz = 272; /* 4 byte EAV + 268 anc/fill */
                  ^~~~~~~~~~~~~~~~~~~~~~~
In file included from drivers/media/pci/cx18/cx18-cards.c:25:0:
drivers/media/pci/cx18/cx18-driver.h:497:18: warning: 'vbi_hblank_samples_50Hz' defined but not used [-Wunused-const-variable=]
 static const u32 vbi_hblank_samples_50Hz = 284; /* 4 byte EAV + 280 anc/fill */
                  ^~~~~~~~~~~~~~~~~~~~~~~
drivers/media/pci/cx18/cx18-driver.h:496:18: warning: 'vbi_hblank_samples_60Hz' defined but not used [-Wunused-const-variable=]
 static const u32 vbi_hblank_samples_60Hz = 272; /* 4 byte EAV + 268 anc/fill */
                  ^~~~~~~~~~~~~~~~~~~~~~~
drivers/media/pci/cx18/cx18-driver.h:495:18: warning: 'vbi_active_samples' defined but not used [-Wunused-const-variable=]
 static const u32 vbi_active_samples = 1444; /* 4 byte SAV + 720 Y + 720 U/V */
                  ^~~~~~~~~~~~~~~~~~

In this specific case, this is somewhat intentional, as those
values are actually used in parts of the driver. The code assumes
that gcc optimizer it and not actually create any var, but convert
it to immediate access at the routines.

Yet, as we want to shut up gcc warnings, let's use #define, with
is the standard way to store values that will use assembler's
immediate access code.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 08:50:24 -03:00
Mauro Carvalho Chehab
21ed20340a exynos4-is: remove some unused vars
Gcc 6.1 warns about some unused vars and functions. Remove them:

drivers/media/platform/exynos4-is/mipi-csis.c:665:46: warning: 's5pcsis_sd_internal_ops' defined but not used [-Wunused-const-variable=]
 static const struct v4l2_subdev_internal_ops s5pcsis_sd_internal_ops = {
                                              ^~~~~~~~~~~~~~~~~~~~~~~

drivers/media/platform/exynos4-is/mipi-csis.c:652:12: warning: 's5pcsis_open' defined but not used [-Wunused-function]
 static int s5pcsis_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
            ^~~~~~~~~~~~

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 08:36:13 -03:00
Mauro Carvalho Chehab
d69bb093a7 usbvision: remove some unused vars
Gcc 6.1 warns about some unused vars. Remove them:

drivers/media/usb/usbvision/usbvision-core.c:94:18: warning: 'min_imgheight' defined but not used [-Wunused-const-variable=]
 static const int min_imgheight = MIN_FRAME_HEIGHT;
                  ^~~~~~~~~~~~~
drivers/media/usb/usbvision/usbvision-core.c:93:18: warning: 'min_imgwidth' defined but not used [-Wunused-const-variable=]
 static const int min_imgwidth = MIN_FRAME_WIDTH;
                  ^~~~~~~~~~~~
drivers/media/usb/usbvision/usbvision-core.c:92:18: warning: 'max_imgheight' defined but not used [-Wunused-const-variable=]
 static const int max_imgheight = MAX_FRAME_HEIGHT;
                  ^~~~~~~~~~~~~
drivers/media/usb/usbvision/usbvision-core.c:91:18: warning: 'max_imgwidth' defined but not used [-Wunused-const-variable=]
 static const int max_imgwidth = MAX_FRAME_WIDTH;
                  ^~~~~~~~~~~~

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-24 08:30:15 -03:00
Mauro Carvalho Chehab
0db5c79989 [media] media-devnode.h: Fix documentation
Two parameters were documented with a wrong name, and a struct
device pointer description was missing.

That caused the following warnings, when building documentation:

include/media/media-devnode.h:102: warning: No description found for parameter 'media_dev'
include/media/media-devnode.h:126: warning: No description found for parameter 'mdev'
include/media/media-devnode.h:126: warning: Excess function parameter 'media_dev' description in 'media_devnode_register'

Rename the description, to match the function parameter and fix
Documentation.

No funcional changes.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-16 08:14:56 -03:00
Mauro Carvalho Chehab
66fa120036 [media] rcar-vin: get rid of an unused var
drivers/media/platform/rcar-vin/rcar-core.c: In function 'rvin_graph_notify_complete':
drivers/media/platform/rcar-vin/rcar-core.c:65:22: warning: variable 'sd' set but not used [-Wunused-but-set-variable]
  struct v4l2_subdev *sd;
                      ^

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-16 07:45:46 -03:00
Niklas Söderlund
f00add9655 [media] rcar-vin: add Renesas R-Car VIN driver
A V4L2 driver for Renesas R-Car VIN driver that do not depend on
soc_camera. The driver is heavily based on its predecessor and aims to
replace it.

Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-16 07:42:32 -03:00
Sakari Ailus
83934b75c3 [media] videobuf2-v4l2: Verify planes array in buffer dequeueing
When a buffer is being dequeued using VIDIOC_DQBUF IOCTL, the exact buffer
which will be dequeued is not known until the buffer has been removed from
the queue. The number of planes is specific to a buffer, not to the queue.

This does lead to the situation where multi-plane buffers may be requested
and queued with n planes, but VIDIOC_DQBUF IOCTL may be passed an argument
struct with fewer planes.

__fill_v4l2_buffer() however uses the number of planes from the dequeued
videobuf2 buffer, overwriting kernel memory (the m.planes array allocated
in video_usercopy() in v4l2-ioctl.c)  if the user provided fewer
planes than the dequeued buffer had. Oops!

Fixes: b0e0e1f83d ("[media] media: videobuf2: Prepare to divide videobuf2")

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: stable@vger.kernel.org # for v4.4 and later
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-16 07:35:02 -03:00
Sakari Ailus
126f402984 [media] vb2: core: Skip planes array verification if pb is NULL
An earlier patch fixing an input validation issue introduced another
issue: vb2_core_dqbuf() is called with pb argument value NULL in some
cases, causing a NULL pointer dereference. Fix this by skipping the
verification as there's nothing to verify.

Fixes: e7e0c3e265 ("[media] videobuf2-core: Check user space planes array in dqbuf")

Signed-off-by: David R <david@unsolicited.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: stable@vger.kernel.org # for v4.4 and later
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-16 07:34:25 -03:00
Shuah Khan
6f0dd24a08 [media] media: fix media devnode ioctl/syscall and unregister race
Media devnode open/ioctl could be in progress when media device unregister
is initiated. System calls and ioctls check media device registered status
at the beginning, however, there is a window where unregister could be in
progress without changing the media devnode status to unregistered.

process 1				process 2
fd = open(/dev/media0)
media_devnode_is_registered()
	(returns true here)

					media_device_unregister()
						(unregister is in progress
						and devnode isn't
						unregistered yet)
					...
ioctl(fd, ...)
__media_ioctl()
media_devnode_is_registered()
	(returns true here)
					...
					media_devnode_unregister()
					...
					(driver releases the media device
					memory)

media_device_ioctl()
	(By this point
	devnode->media_dev does not
	point to allocated memory.
	use-after free in in mutex_lock_nested)

BUG: KASAN: use-after-free in mutex_lock_nested+0x79c/0x800 at addr
ffff8801ebe914f0

Fix it by clearing register bit when unregister starts to avoid the race.

process 1                               process 2
fd = open(/dev/media0)
media_devnode_is_registered()
        (could return true here)

                                        media_device_unregister()
                                                (clear the register bit,
						 then start unregister.)
                                        ...
ioctl(fd, ...)
__media_ioctl()
media_devnode_is_registered()
        (return false here, ioctl
	 returns I/O error, and
	 will not access media
	 device memory)
                                        ...
                                        media_devnode_unregister()
                                        ...
                                        (driver releases the media device
					 memory)

Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reported-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Tested-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-15 17:59:28 -03:00
Shuah Khan
5b28dde51d [media] media: fix use-after-free in cdev_put() when app exits after driver unbind
When driver unbinds while media_ioctl is in progress, cdev_put() fails with
when app exits after driver unbinds.

Add devnode struct device kobj as the cdev parent kobject. cdev_add() gets
a reference to it and releases it in cdev_del() ensuring that the devnode
is not deallocated as long as the application has the device file open.

media_devnode_register() initializes the struct device kobj before calling
cdev_add(). media_devnode_unregister() does cdev_del() and then deletes the
device. devnode is released when the last reference to the struct device is
gone.

This problem is found on uvcvideo, em28xx, and au0828 drivers and fix has
been tested on all three.

kernel: [  193.599736] BUG: KASAN: use-after-free in cdev_put+0x4e/0x50
kernel: [  193.599745] Read of size 8 by task media_device_te/1851
kernel: [  193.599792] INFO: Allocated in __media_device_register+0x54
kernel: [  193.599951] INFO: Freed in media_devnode_release+0xa4/0xc0

kernel: [  193.601083] Call Trace:
kernel: [  193.601093]  [<ffffffff81aecac3>] dump_stack+0x67/0x94
kernel: [  193.601102]  [<ffffffff815359b2>] print_trailer+0x112/0x1a0
kernel: [  193.601111]  [<ffffffff8153b5e4>] object_err+0x34/0x40
kernel: [  193.601119]  [<ffffffff8153d9d4>] kasan_report_error+0x224/0x530
kernel: [  193.601128]  [<ffffffff814a2c3d>] ? kzfree+0x2d/0x40
kernel: [  193.601137]  [<ffffffff81539d72>] ? kfree+0x1d2/0x1f0
kernel: [  193.601154]  [<ffffffff8157ca7e>] ? cdev_put+0x4e/0x50
kernel: [  193.601162]  [<ffffffff8157ca7e>] cdev_put+0x4e/0x50
kernel: [  193.601170]  [<ffffffff815767eb>] __fput+0x52b/0x6c0
kernel: [  193.601179]  [<ffffffff8117743a>] ? switch_task_namespaces+0x2a
kernel: [  193.601188]  [<ffffffff815769ee>] ____fput+0xe/0x10
kernel: [  193.601196]  [<ffffffff81170023>] task_work_run+0x133/0x1f0
kernel: [  193.601204]  [<ffffffff8117746e>] ? switch_task_namespaces+0x5e
kernel: [  193.601213]  [<ffffffff8111b50c>] do_exit+0x72c/0x2c20
kernel: [  193.601224]  [<ffffffff8111ade0>] ? release_task+0x1250/0x1250
-
-
-
kernel: [  193.601360]  [<ffffffff81003587>] ? exit_to_usermode_loop+0xe7
kernel: [  193.601368]  [<ffffffff810035c0>] exit_to_usermode_loop+0x120
kernel: [  193.601376]  [<ffffffff810061da>] syscall_return_slowpath+0x16a
kernel: [  193.601386]  [<ffffffff82848b33>] entry_SYSCALL_64_fastpath+0xa6

Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Tested-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-15 17:58:06 -03:00
Mauro Carvalho Chehab
a087ce704b [media] media-device: dynamically allocate struct media_devnode
struct media_devnode is currently embedded at struct media_device.

While this works fine during normal usage, it leads to a race
condition during devnode unregister. the problem is that drivers
assume that, after calling media_device_unregister(), the struct
that contains media_device can be freed. This is not true, as it
can't be freed until userspace closes all opened /dev/media devnodes.

In other words, if the media devnode is still open, and media_device
gets freed, any call to an ioctl will make the core to try to access
struct media_device, with will cause an use-after-free and even GPF.

Fix this by dynamically allocating the struct media_devnode and only
freeing it when it is safe.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-15 17:57:24 -03:00
Mauro Carvalho Chehab
163f1e93e9 [media] media-devnode: fix namespace mess
Along all media controller code, "mdev" is used to represent
a pointer to struct media_device, and "devnode" for a pointer
to struct media_devnode.

However, inside media-devnode.[ch], "mdev" is used to represent
a pointer to struct media_devnode.

This is very confusing and may lead to development errors.

So, let's change all occurrences at media-devnode.[ch] to
also use "devnode" for such pointers.

This patch doesn't make any functional changes.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-15 17:56:06 -03:00
Mauro Carvalho Chehab
dc19ed1571
Update my main e-mails at the Kernel tree
For the third time in three years, I'm changing my e-mail at
Samsung. That's bad, as it may stop communications with me for
a while. So, this time, I'll also the mchehab@kernel.org e-mail,
as it remains stable since ever.

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-06-14 14:55:18 -03:00
Colin Ian King
cac1c639bc [media] m88rs2000: initialize status to zero
status is not initialized so it can contain garbage. The
check for status containing the FE_HAS_LOCK bit may randomly pass
or fail if the read of register 0x8c fails to set status after 25
read attempts.  Fix this by initializing status to 0.

Issue found with CoverityScan, CID#986738

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-10 08:41:36 -03:00
Dan Carpenter
e44c153b30 [media] em28xx-i2c: rt_mutex_trylock() returns zero on failure
The code is checking for negative returns but it should be checking for
zero.

Fixes: aab3125c43 ('[media] em28xx: add support for registering multiple i2c buses')

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-10 08:29:40 -03:00
Zhaoxiu Zeng
917d11a4e0 [media] mt2063: use lib gcd
This patch removes the local MT2063_gcd function, uses lib gcd instead

Signed-off-by: Zhaoxiu Zeng <zhaoxiu.zeng@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-09 15:58:32 -03:00
Martin Blumenstingl
d10f89cc36 [media] rtl2832: add support for slave ts pid filter
The rtl2832 demod has 2 sets of PID filters. This patch enables
the filter support when using a slave demod.

Signed-off-by: Benjamin Larsson <benjamin@southpole.se>
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-09 08:48:46 -03:00
Antti Palosaari
2b987ea78b [media] af9035: fix logging
Remove __func__ and KBUILD_MODNAME from logging formatters and pass
USB interface device instead, so logging can be done correctly.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-09 08:47:48 -03:00
Alessandro Radicati
1882f59f93 [media] af9035: fix for MXL5007T devices with I2C read issues
The MXL5007T tuner will lock-up on some devices after an I2C read
transaction.  This patch works around this issue by inhibiting such
operations and emulating a 0x00 response. The workaround is only
applied to USB devices known to exhibit this flaw.

Signed-off-by: Alessandro Radicati <alessandro@radicati.net>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-09 08:46:00 -03:00
Alessandro Radicati
57f1c05338 [media] af9035: I2C combined write + read transaction fix
This patch will modify the af9035 driver to use the register address
fields of the I2C read command for the combined write/read transaction
case.  Without this change, the firmware issues just a I2C read
transaction without the preceding write transaction to select the
register.

Signed-off-by: Alessandro Radicati <alessandro@radicati.net>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-09 08:44:54 -03:00
Marek Szyprowski
9f5a802b1d [media] of: reserved_mem: restore old behavior when no region is defined
Change return value back to -ENODEV when no region is defined for given
device. This restores old behavior of this function, as some drivers rely
on such error code.

Fixes: 59ce403972 ("of: reserved_mem: add support for using more than
       one region for given device")

Reported-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Reviewed-by: Liviu Dudau <Liviu.Dudau@arm.com>
Acked-by: Rob Herring <robh@kernel.org>
Reviewed-by: Sumit Semwal <sumit.semwal@linaro.org>
2016-06-09 06:55:15 -03:00
Max Kellermann
bd3df3c53e [media] drivers/media/dvb-core/en50221: move code to dvb_ca_private_free()
Prepare for postponing the call until all file handles have been
closed.

[mchehab@osg.samsung.com: make checkpatch happy]
Signed-off-by: Max Kellermann <max@duempel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 17:14:43 -03:00
Olli Salonen
212fa08126 [media] ds3000: return error if invalid symbol rate is set
Return -EINVAL if ds3000_set_frontend is called with invalid parameters.

v1 of the patch series got incorrect subject lines.

Signed-off-by: Olli Salonen <olli.salonen@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 17:10:04 -03:00
Fengguang Wu
155af08b15 [media] fix semicolon.cocci warnings
drivers/media/dvb-frontends/helene.c:750:2-3: Unneeded semicolon

 Remove unneeded semicolon.

Generated by: scripts/coccinelle/misc/semicolon.cocci

CC: Abylay Ospan <aospan@netup.ru>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 16:56:55 -03:00
Martin Blumenstingl
1f846620e7 [media] rtl28xxu: sort the config symbols which are auto-selected
No functional changes.

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 15:50:40 -03:00
Martin Blumenstingl
d287a4ef92 [media] rtl28xxu: auto-select more DVB-frontends and tuners
This adds the missing auto-select bits for DVB-frontends and tuners
(if MEDIA_SUBDRV_AUTOSELECT is enabled) which are used by the various
rtl28xxu devices.
The driver itself probes for three more tuners, but it's not actually
using any of them:
- MEDIA_TUNER_MT2063
- MEDIA_TUNER_MT2266
- MEDIA_TUNER_MXL5007T

Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 15:49:52 -03:00
Antti Palosaari
94d0eaa419 [media] mn88472: move out of staging to media
Move mn88472 DVB-T/T2/C demod driver out of staging to media.

v2: Fix build error reported by kbuild test robot:
drivers/staging/media/mn88472/Makefile: No such file or directory

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 15:46:47 -03:00
Antti Palosaari
8d1f38fcb7 [media] mn88472: finalize driver
Finalize driver in order to move out of staging.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 15:41:58 -03:00
Julia Lawall
eb7e61b62d [media] mn88472: fix typo
firmare -> firmware

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 15:40:05 -03:00
Antti Palosaari
734fd634a6 [media] rtl28xxu: increase failed I2C msg repeat count to 3
1 and 2 wasn't enough for mn88472 chip on Astrometa device,
so increase it to 3.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 15:39:46 -03:00
Julia Lawall
c5ee19c866 [media] mn88473: fix typo
firmare -> firmware

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 15:39:01 -03:00
Antti Palosaari
37cf9b2d5b [media] mn88473: fix error path on probe()
Latest, 3rd, regmap instance should be freed on error case.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 15:38:44 -03:00