Commit Graph

24487 Commits

Author SHA1 Message Date
Arnd Bergmann
d74ce54885 media: v4l: omap_vout: vrfb: include linux/slab.h
Without this header, we get a build error in some configurations:

drivers/media/platform/omap/omap_vout_vrfb.c: In function 'omap_vout_setup_vrfb_bufs':
drivers/media/platform/omap/omap_vout_vrfb.c:143:26: error: implicit declaration of function 'kzalloc'; did you mean 'vzalloc'? [-Werror=implicit-function-declaration]

Fixes: 6a1560ecaa ("media: v4l: omap_vout: vrfb: Convert to dmaengine")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:32:06 -04:00
Hugues Fruchet
457a1a7ac0 media: ov9655: fix missing mutex_destroy()
Fix missing mutex_destroy() when probe fails and
when driver is removed.

Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:31:47 -04:00
Hugues Fruchet
0a7a13452b media: ov9650: fix coding style
Fix a bunch of coding style issues detected
by checkpatch --strict.

Signed-off-by: Hugues Fruchet <hugues.fruchet@st.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:30:53 -04:00
Philipp Zabel
1a48e10282 media: stm32-dcmi: explicitly request exclusive reset control
Commit a53e35db70 ("reset: Ensure drivers are explicit when requesting
reset lines") started to transition the reset control request API calls
to explicitly state whether the driver needs exclusive or shared reset
control behavior. Convert all drivers requesting exclusive resets to the
explicit API call so the temporary transition helpers can be removed.

No functional changes.

Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@st.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:27:06 -04:00
Tiffany Lin
e706b9ed69 media: mtk-vcodec: fix vp9 decode error
Fix The camera has a blurry screen phenomenon when
we video chat with apprtc using vp9 codec

Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com>
Reviewed-by: Wu-Cheng Li <wuchengli@chromium.org>
Tested-by: Wu-Cheng Li <wuchengli@chromium.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:26:48 -04:00
Fabio Estevam
1fc86ad052 media: ov7670: Check the return value from clk_prepare_enable()
clk_prepare_enable() may fail, so we should better check its return value
and propagate it in the case of error.

Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:24:58 -04:00
Fabio Estevam
011dfab805 media: ov7670: Return the real error code
When devm_clk_get() fails the real error code should be propagated,
instead of always returning -EPROBE_DEFER.

Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:24:33 -04:00
Hans Verkuil
eada47597b media: v4l2-tpg-core.c: fix typo in bt2020_full matrix
My eye fell on this wrong coefficient in the bt2020_full matrix.
The bt2020 matrix (limited range) is OK.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:20:20 -04:00
Hans Verkuil
6c2c188f35 media: drop use of MEDIA_API_VERSION
Set media_version to LINUX_VERSION_CODE, just as we did for
driver_version.

Nobody ever rememebers to update the version number, but
LINUX_VERSION_CODE will always be updated.

Move the MEDIA_API_VERSION define to the ifndef __KERNEL__ section of the
media.h header. That way kernelspace can't accidentally start to use
it again.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:03:15 -04:00
Hans Verkuil
2bd8682375 media: media-device: remove driver_version
Since the driver_version field in struct media_device is no longer
used, just remove it.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:02:22 -04:00
Hans Verkuil
71269bf607 media: uvc: don't set driver_version
This field will be removed as it is not needed anymore.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:01:17 -04:00
Hans Verkuil
4b3b11048d media: s3c-camif: don't set driver_version
This field will be removed as it is not needed anymore.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:00:26 -04:00
Hans Verkuil
4c7089ee66 media: media-device: set driver_version directly
Don't use driver_version from struct media_device, just return
LINUX_VERSION_CODE as the other media subsystems do.

The driver_version field in struct media_device will be removed
in the following patches.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-08 06:00:07 -04:00
Mauro Carvalho Chehab
1d54267b23 Linux 4.13-rc4
-----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJZh8YYAAoJEHm+PkMAQRiG46QIAKOBbLlOY38zIJwDfJs6ydvH
 eFLryznS7RM2w0Gw1RyVAyWS43QS9RUNGDMa4UOb9AvurBHYpK29t1uq6LejQ/hn
 2Uvxuq95qEVVYzN1OA3WzLKUa35g3qRM9rTYFz7xGMRp2Ldk/aPRi/PVJLhSO3YQ
 HFRLsfNMWTkSR4imuxm7NS+cYMcqWbDbanvW5IwQ+RFRPo8Ac1PbFpGUdVtar6+O
 Fm3GLBsRB3dijJwYyWQKeDvtLr608i50by4yS7EIAqbUSfoDpJEyTL57oTCRok7P
 5ZycGpK4bXWF0OpBWpKgrFO5tB7xfzUDa3TmNhS3Q8ep4KLHNXwM3V6p8Y+YZco=
 =FId5
 -----END PGP SIGNATURE-----

Merge tag 'v4.13-rc4' into patchwork

Linux 4.13-rc4

* tag 'v4.13-rc4': (863 commits)
  Linux 4.13-rc4
  Fix compat_sys_sigpending breakage
  ext4: fix copy paste error in ext4_swap_extents()
  ext4: fix overflow caused by missing cast in ext4_resize_fs()
  ext4, project: expand inode extra size if possible
  ext4: cleanup ext4_expand_extra_isize_ea()
  ext4: restructure ext4_expand_extra_isize
  ext4: fix forgetten xattr lock protection in ext4_expand_extra_isize
  ext4: make xattr inode reads faster
  ext4: inplace xattr block update fails to deduplicate blocks
  ext4: remove unused mode parameter
  ext4: fix warning about stack corruption
  ext4: fix dir_nlink behaviour
  ext4: silence array overflow warning
  ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
  platform/x86: intel-vbtn: match power button on press rather than release
  ext4: release discard bio after sending discard commands
  sparc64: Fix exception handling in UltraSPARC-III memcpy.
  arm64: avoid overflow in VA_START and PAGE_OFFSET
  arm64: Fix potential race with hardware DBM in ptep_set_access_flags()
  ...
2017-08-08 05:38:41 -04:00
Philipp Zabel
9e6b1dae37 media: coda: explicitly request exclusive reset control
Commit a53e35db70 ("reset: Ensure drivers are explicit when requesting
reset lines") started to transition the reset control request API calls
to explicitly state whether the driver needs exclusive or shared reset
control behavior. Convert all drivers requesting exclusive resets to the
explicit API call so the temporary transition helpers can be removed.

No functional changes.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 13:37:17 -04:00
Philipp Zabel
87a420c8f6 media: coda: disable BWB only while decoding on CODA 960
Disabling the BWB works around hangups observed while decoding. Since no
issues have been observed while encoding, and disabling BWB also reduces
encoding performance, reenable it for encoding.

Fixes: 89ed025d5c ("[media] coda: disable BWB for all codecs on CODA 960")

Reported-by: Ian Arkver <ian.arkver.dev@gmail.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Tested-by: Ian Arkver <ian.arkver.dev@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 13:32:11 -04:00
Fabio Estevam
d9ba7bd98a media: ov5640: Remove unneeded gpiod NULL check
The gpiod API checks for NULL descriptors, so there is no need to
duplicate the check in the driver.

Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:41:57 -04:00
Laurent Pinchart
c8dbe3181b media: v4l: omap3isp: Get the parallel bus type from DT
The OMAP3 ISP supports both external and embedded BT.656 synchronization
for parallel buses. It currently gets the bus type information from the
source subdev through the .g_mbus_config() operation, but should instead
get it from DT as that's the authoritative source of bus configuration
information.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:41:33 -04:00
Sakari Ailus
52740975f3 media: v4l2-flash: Flash ops aren't mandatory
None of the flash operations are mandatory and therefore there should be
no need for the flash ops structure either. Accept NULL.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:41:07 -04:00
Sakari Ailus
85f7ff9702 media: v4l2-flash: Use led_classdev instead of led_classdev_flash for indicator
The V4L2 flash class initialisation expects struct led_classdev_flash that
describes an indicator but only uses struct led_classdev which is a field
iled_cdev in the struct. Use struct iled_cdev only.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:40:28 -04:00
Sakari Ailus
06f8152027 media: v4l2-fwnode: link_frequency is an optional property
v4l2_fwnode_endpoint_alloc_parse() is intended as a replacement for
v4l2_fwnode_endpoint_parse(). It parses the "link-frequency" property and
if the property isn't found, it returns an error. However,
"link-frequency" is an optional property and if it does not exist is not
an error. Instead, the number of link frequencies is simply zero in that
case.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:39:55 -04:00
Arvind Yadav
26d051e301 media: exynos4-is: fimc-is-i2c: constify dev_pm_ops structures
dev_pm_ops are not supposed to change at runtime. All functions
working with dev_pm_ops provided by <linux/device.h> work with
const dev_pm_ops. So mark the non-const structs as const.

File size before:
   text	   data	    bss	    dec	    hex	filename
   1195	    376	      0	   1571	    623	fimc-is-i2c.o

File size After adding 'const':
   text	   data	    bss	    dec	    hex	filename
   1403	    176	      0	   1579	    62b	fimc-is-i2c.o

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:37:57 -04:00
Gustavo A. R. Silva
281643a2ad media: s5k5baf: remove unnecessary static in s5k5baf_get_selection()
Remove unnecessary static on local variable rtype. Such variable
is initialized before being used, on every execution path throughout
the function. The static has no benefit and, removing it reduces
the code size.

This issue was detected using Coccinelle and the following semantic patch:

@bad exists@
position p;
identifier x;
type T;
@@

static T x@p;
...
x = <+...x...+>

@@
identifier x;
expression e;
type T;
position p != bad.p;
@@

-static
 T x@p;
 ... when != x
     when strict
?x = e;

In the following log you can see the difference in the code size. Also,
there is a significant difference in the bss segment. This log is the
output of the size command, before and after the code change:

before:
   text    data     bss     dec     hex filename
  27765    5656     320   33741    83cd drivers/media/i2c/s5k5baf.o

after:
   text    data     bss     dec     hex filename
  27733    5600     256   33589    8335 drivers/media/i2c/s5k5baf.o

Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:37:30 -04:00
henryhsu
80cdacaa5c media: s5p-jpeg: Add stream error handling for Exynos5420
On Exynos5420, the STREAM_STAT bit raised on the JPGINTST register means
there is a syntax error or an unrecoverable error on compressed file
when ERR_INT_EN is set to 1.

Fix this case and report BUF_STATE_ERROR to videobuf2.

Signed-off-by: Henry-Ruey Hsu <henryhsu@chromium.org>
Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Acked-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:36:50 -04:00
henryhsu
1c84e7f9d5 media: s5p-jpeg: Add support for resolution change event
This patch adds support for resolution change event to notify clients so
they can prepare correct output buffer. When resolution change happened,
G_FMT for CAPTURE should return old resolution and format before CAPTURE
queues streamoff.

This event is used in the Chromium browser project by the V4L2 JPEG
Decode Accelerator (V4L2JDA) to allocate output buffer.

Signed-off-by: Henry-Ruey Hsu <henryhsu@chromium.org>
Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Acked-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:36:08 -04:00
Tony K Nadackal
accf9b2c1f media: s5p-jpeg: Decode 4:1:1 chroma subsampling format
This patch adds support for decoding 4:1:1 chroma subsampling in the
JPEG header parsing function.

Signed-off-by: Tony K Nadackal <tony.kn@samsung.com>
Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Acked-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:31:51 -04:00
Thierry Escande
c8d36a8035 media: s5p-jpeg: Split s5p_jpeg_parse_hdr()
This patch moves the subsampling value decoding read from the JPEG
header into its own function. This new function is called
s5p_jpeg_subsampling_decode() and returns true if it successfully
decodes the subsampling value, false otherwise.

Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Acked-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:31:10 -04:00
Thierry Escande
14a2de14dc media: s5p-jpeg: Don't use temporary structure in s5p_jpeg_buf_queue
If s5p_jpeg_parse_hdr() fails to parse the JPEG header, the passed
s5p_jpeg_q_data structure is not modified so there is no need to use a
temporary structure and the field-by-field copy can be avoided.

Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Acked-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:30:29 -04:00
Thierry Escande
fe8a57b618 media: s5p-jpeg: Handle parsing error in s5p_jpeg_parse_hdr()
This patch modifies the s5p_jpeg_parse_hdr() function so it only
modifies the passed s5p_jpeg_q_data structure if the jpeg header parsing
is successful.

Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Acked-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:30:04 -04:00
Tony K Nadackal
fa3cb90bdf media: s5p-jpeg: Correct WARN_ON statement for checking subsampling
Correct the WARN_ON statement for subsampling based on the
JPEG hardware version.

Signed-off-by: Tony K Nadackal <tony.kn@samsung.com>
Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Acked-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:29:24 -04:00
Tony K Nadackal
5ea3bf28ed media: s5p-jpeg: Call jpeg_bound_align_image after qbuf
When queuing an OUTPUT buffer for decoder, s5p_jpeg_parse_hdr()
function parses the input jpeg file and takes the width and height
parameters from its header. These new width/height values will be used
for the calculation of stride. HX_JPEG Hardware needs the width and
height values aligned on a 16 bits boundary. This width/height alignment
is handled in the s5p_jpeg_s_fmt_vid_cap() function during the S_FMT
ioctl call.

But if user space calls the QBUF of OUTPUT buffer after the S_FMT of
CAPTURE buffer, these aligned values will be replaced by the values in
jpeg header. If the width/height values of jpeg are not aligned, the
decoder output will be corrupted. So in this patch we call
jpeg_bound_align_image() to align the width/height values of Capture
buffer in s5p_jpeg_buf_queue().

Signed-off-by: Tony K Nadackal <tony.kn@samsung.com>
Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Acked-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 08:28:52 -04:00
Prabhakar Lad
b25db38392 media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS
drop VPFE_CMD_S_CCDC_RAW_PARAMS ioctl from dm355/dm644x following reasons:

- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t
  numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is
  described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user
  the user input over the kernel settings, and then compare them
  for inequality.
- We then go on to use an address provided by user space as both the
  __user pointer for input and pass it through phys_to_virt to come up
  with a kernel pointer to copy the data to. This looks like a trivially
  exploitable root hole.

Signed-off-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 06:14:33 -04:00
Prabhakar Lad
da05d52d2f media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
this patch makes sure VPFE_CMD_S_CCDC_RAW_PARAMS ioctl no longer works
for vpfe_capture driver with a minimal patch suitable for backporting.

- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t
  numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is
  described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user
  the user input over the kernel settings, and then compare them
  for inequality.
- We then go on to use an address provided by user space as both the
  __user pointer for input and pass it through phys_to_virt to come up
  with a kernel pointer to copy the data to. This looks like a trivially
  exploitable root hole.

Due to these reasons we make sure this ioctl now returns -EINVAL and backport
this patch as far as possible.

Fixes: 5f15fbb68f ("V4L/DVB (12251): v4l: dm644x ccdc module for vpfe capture driver")

Signed-off-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Cc: <stable@vger.kernel.org>      # for v3.7 and up
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 06:14:33 -04:00
Stanimir Varbanov
377a22d3ca media: venus: don't abuse dma_alloc for non-DMA allocations
In venus_boot(), we pass a pointer to a phys_addr_t
into dmam_alloc_coherent, which the compiler warns about:

platform/qcom/venus/firmware.c: In function 'venus_boot':
platform/qcom/venus/firmware.c:63:49: error: passing argument 3 of 'dmam_alloc_coherent' from incompatible pointer type [-Werror=incompatible-pointer-types]

To avoid the error refactor venus_boot function by discard
dma_alloc_coherent invocation because we don't want to map the
memory for the device.  Something more, the usage of
DMA mapping API is actually wrong and the current
implementation relies on several bugs in DMA mapping code.
When these bugs are fixed that will break firmware loading,
so fix this now to avoid future troubles.

The meaning of venus_boot is to copy the content of the
firmware buffer into reserved (and memblock removed)
block of memory and pass that physical address to the
trusted zone for authentication and mapping through iommu
form the secure world. After iommu mapping is done the iova
is passed as ane entry point to the remote processor.

After this change memory-region property is parsed manually
and the physical address is memremap to CPU, call mdt_load to
load firmware segments into proper places and unmap
reserved memory.

Fixes: af2c3834c8 ("[media] media: venus: adding core part and helper functions")

Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 06:14:32 -04:00
Rob Clark
3e7caae5f2 media: venus: hfi: fix error handling in hfi_sys_init_done()
Not entirely sure what triggers it, but with venus build as kernel
module and in initrd, we hit this crash:

  Unable to handle kernel paging request at virtual address ffff80003c039000
  pgd = ffff00000a14f000
  [ffff80003c039000] *pgd=00000000bd9f7003, *pud=00000000bd9f6003, *pmd=00000000bd9f0003, *pte=0000000000000000
  Internal error: Oops: 96000007 [#1] SMP
  Modules linked in: qcom_wcnss_pil(E+) crc32_ce(E) qcom_common(E) venus_core(E+) remoteproc(E) snd_soc_msm8916_digital(E) virtio_ring(E) cdc_ether(E) snd_soc_lpass_apq8016(E) snd_soc_lpass_cpu(E) snd_soc_apq8016_sbc(E) snd_soc_lpass_platform(E) v4l2_mem2mem(E) virtio(E) snd_soc_core(E) ac97_bus(E) snd_pcm_dmaengine(E) snd_seq(E) leds_gpio(E) videobuf2_v4l2(E) videobuf2_core(E) snd_seq_device(E) snd_pcm(E) videodev(E) media(E) nvmem_qfprom(E) msm(E) snd_timer(E) snd(E) soundcore(E) spi_qup(E) mdt_loader(E) qcom_tsens(E) qcom_spmi_temp_alarm(E) nvmem_core(E) msm_rng(E) uas(E) usb_storage(E) dm9601(E) usbnet(E) mii(E) mmc_block(E) adv7511(E) drm_kms_helper(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) fb_sys_fops(E) qcom_spmi_vadc(E) qcom_vadc_common(PE) industrialio(E) pinctrl_spmi_mpp(E)
   pinctrl_spmi_gpio(E) rtc_pm8xxx(E) clk_smd_rpm(E) sdhci_msm(E) sdhci_pltfm(E) qcom_smd_regulator(E) drm(E) smd_rpm(E) qcom_spmi_pmic(E) regmap_spmi(E) ci_hdrc_msm(E) ci_hdrc(E) usb3503(E) extcon_usb_gpio(E) phy_msm_usb(E) udc_core(E) qcom_hwspinlock(E) extcon_core(E) ehci_msm(E) i2c_qup(E) sdhci(E) mmc_core(E) spmi_pmic_arb(E) spmi(E) qcom_smd(E) smsm(E) rpmsg_core(E) smp2p(E) smem(E) hwspinlock_core(E) gpio_keys(E)
  CPU: 2 PID: 551 Comm: irq/150-venus Tainted: P            E   4.12.0+ #1625
  Hardware name: qualcomm dragonboard410c/dragonboard410c, BIOS 2017.07-rc2-00144-ga97bdbdf72-dirty 07/08/2017
  task: ffff800037338000 task.stack: ffff800038e00000
  PC is at hfi_sys_init_done+0x64/0x140 [venus_core]
  LR is at hfi_process_msg_packet+0xcc/0x1e8 [venus_core]
  pc : [<ffff00000118b384>] lr : [<ffff00000118c11c>] pstate: 20400145
  sp : ffff800038e03c60
  x29: ffff800038e03c60 x28: 0000000000000000
  x27: 00000000000df018 x26: ffff00000118f4d0
  x25: 0000000000020003 x24: ffff80003a8d3010
  x23: ffff00000118f760 x22: ffff800037b40028
  x21: ffff8000382981f0 x20: ffff800037b40028
  x19: ffff80003c039000 x18: 0000000000000020
  x17: 0000000000000000 x16: ffff800037338000
  x15: ffffffffffffffff x14: 0000001000000014
  x13: 0000000100001007 x12: 0000000100000020
  x11: 0000100e00000000 x10: 0000000000000001
  x9 : 0000000200000000 x8 : 0000001400000001
  x7 : 0000000000001010 x6 : 0000000000000148
  x5 : 0000000000001009 x4 : ffff80003c039000
  x3 : 00000000cd770abb x2 : 0000000000000042
  x1 : 0000000000000788 x0 : 0000000000000002
  Process irq/150-venus (pid: 551, stack limit = 0xffff800038e00000)
  Call trace:
  [<ffff00000118b384>] hfi_sys_init_done+0x64/0x140 [venus_core]
  [<ffff00000118c11c>] hfi_process_msg_packet+0xcc/0x1e8 [venus_core]
  [<ffff00000118a2b4>] venus_isr_thread+0x1b4/0x208 [venus_core]
  [<ffff00000118e750>] hfi_isr_thread+0x28/0x38 [venus_core]
  [<ffff000008161550>] irq_thread_fn+0x30/0x70
  [<ffff0000081617fc>] irq_thread+0x14c/0x1c8
  [<ffff000008105e68>] kthread+0x138/0x140
  [<ffff000008083590>] ret_from_fork+0x10/0x40
  Code: 52820125 52820207 7a431820 54000249 (b9400263)
  ---[ end trace c963460f20a984b6 ]---

The problem is that in the error case, we've incremented the data ptr
but not decremented rem_bytes, and keep reading (presumably garbage)
until eventually we go beyond the end of the buffer.

Instead, on first error, we should probably just bail out.  Other
option is to increment read_bytes by sizeof(u32) before the switch,
rather than only accounting for the ptype header in the non-error
case.  Note that in this case it is HFI_ERR_SYS_INVALID_PARAMETER,
ie. an unrecognized/unsupported parameter, so interpreting the next
word as a property type would be bogus.  The other error cases are
due to truncated buffer, so there isn't likely to be anything valid
to interpret in the remainder of the buffer.  So just bailing seems
like a reasonable solution.

Signed-off-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 06:14:32 -04:00
Arnd Bergmann
b8f9bdc151 media: venus: fix compile-test build on non-qcom ARM platform
If QCOM_MDT_LOADER is enabled, but ARCH_QCOM is not, we run into
a build error:

ERROR: "qcom_mdt_load" [drivers/media/platform/qcom/venus/venus-core.ko] undefined!
ERROR: "qcom_mdt_get_size" [drivers/media/platform/qcom/venus/venus-core.ko] undefined!

This changes the 'select' statement again, so we only try to enable
those symbols when the drivers will actually get built, and explicitly
test for QCOM_MDT_LOADER to be enabled before calling into it.

Fixes: 76724b30f2 ("[media] media: venus: enable building with COMPILE_TEST")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 06:14:31 -04:00
Arnd Bergmann
eb918f915f media: venus: mark PM functions as __maybe_unused
Without PM support, gcc warns about two unused functions:

platform/qcom/venus/core.c:146:13: error: 'venus_clks_disable' defined but not used [-Werror=unused-function]
platform/qcom/venus/core.c:126:12: error: 'venus_clks_enable' defined but not used [-Werror=unused-function]

The problem as usual are incorrect #ifdefs, so the easiest fix
is to do away with the #ifdef completely and mark the suspend/resume
handlers as __maybe_unused, which they are.

Fixes: af2c3834c8 ("[media] media: venus: adding core part and helper functions")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 06:14:31 -04:00
Hans Verkuil
fc1ff45a07 media: cec-notifier: small improvements
Allow calling cec_notifier_set_phys_addr and
cec_notifier_set_phys_addr_from_edid with a NULL notifier, in which
case these functions do nothing.

Add a cec_notifier_phys_addr_invalidate helper function (the notifier
equivalent of cec_phys_addr_invalidate).

These changes simplify drm CEC driver support.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 05:46:44 -04:00
Hans Verkuil
9b7c0c476f media: pulse8-cec: persistent_config should be off by default
The persistent_config option is used to make the CEC settings persistent by using
the eeprom inside the device to store this information. This was on by default, which
caused confusion since this device now behaves differently from other CEC devices
which all come up unconfigured.

Another reason for doing this now is that I hope a more standard way of selecting
persistent configuration will be created in the future. And for that to work all
CEC drivers should behave the same and come up unconfigured by default.

None of the open source CEC applications are using this CEC framework at the moment
so change this behavior before it is too late.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: <stable@vger.kernel.org>      # for v4.10 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 05:46:43 -04:00
Hans Verkuil
bd34ca8758 media: cec: cec_transmit_attempt_done: ignore CEC_TX_STATUS_MAX_RETRIES
The switch in cec_transmit_attempt_done() should ignore the
CEC_TX_STATUS_MAX_RETRIES status bit.

Calling this function with e.g. CEC_TX_STATUS_NACK | CEC_TX_STATUS_MAX_RETRIES
is perfectly legal and should not trigger the WARN(1).

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 05:46:43 -04:00
Sean Young
9f5039ba44 media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds
Since commit e8f4818895 ("[media] lirc: advertise
LIRC_CAN_GET_REC_RESOLUTION and improve") lircd uses the ioctl
LIRC_GET_REC_RESOLUTION to determine the shortest pulse or space that
the hardware can detect. This breaks decoding in lirc because lircd
expects the answer in microseconds, but nanoseconds is returned.

Cc: <stable@vger.kernel.org> # v2.6.36+
Reported-by: Derek <user.vdr@gmail.com>
Tested-by: Derek <user.vdr@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 05:46:42 -04:00
Javier Martinez Canillas
bf183e0fed media: vimc: set id_table for platform drivers
The vimc platform drivers define a platform device ID table but these
are not set to the .id_table field in the platform driver structure.

So the platform device ID table is only used to fill the aliases in
the module but are not used for matching (works because the platform
subsystem fallbacks to the driver's name if no .id_table is set).

But this also means that the platform device ID table isn't used if
the driver is built-in, which leads to the following build warning:

This causes the following build warnings when the driver is built-in:

drivers/media/platform/vimc//vimc-capture.c:528:40: warning: ‘vimc_cap_driver_ids’ defined but not used [-Wunused-const-variable=]
 static const struct platform_device_id vimc_cap_driver_ids[] = {
                                        ^~~~~~~~~~~~~~~~~~~
drivers/media/platform/vimc//vimc-debayer.c:588:40: warning: ‘vimc_deb_driver_ids’ defined but not used [-Wunused-const-variable=]
 static const struct platform_device_id vimc_deb_driver_ids[] = {
                                        ^~~~~~~~~~~~~~~~~~~
drivers/media/platform/vimc//vimc-scaler.c:442:40: warning: ‘vimc_sca_driver_ids’ defined but not used [-Wunused-const-variable=]
 static const struct platform_device_id vimc_sca_driver_ids[] = {
                                        ^~~~~~~~~~~~~~~~~~~
drivers/media/platform/vimc//vimc-sensor.c:376:40: warning: ‘vimc_sen_driver_ids’ defined but not used [-Wunused-const-variable=]
 static const struct platform_device_id vimc_sen_driver_ids[] = {
                                        ^~~~~~~~~~~~~~~~~~~

Reported-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Suggested-by: Sakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Helen Koike <helen.koike@collabora.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 05:46:25 -04:00
Hans Verkuil
0e50e84a11 media: dvb-core/demux.h: fix kernel-doc warning
Fix this kernel-doc warning:

WARNING: kernel-doc 'media-git/scripts/kernel-doc -rst -enable-lineno media-git/drivers/media/dvb-core/demux.h' processing failed with: 'ascii' codec can't decode byte 0xe2 in position 6368: ordinal
not in range(128)

Caused by using fancy quotes instead of regular quotes.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-21 08:01:08 -04:00
Todor Tomov
6538b02d21 media: Make parameter of media_entity_remote_pad() const
The local pad parameter in media_entity_remote_pad() is not modified.
Make that explicit by adding a const modifier.

Signed-off-by: Todor Tomov <todor.tomov@linaro.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20 16:54:04 -04:00
Nuno Henriques
b5e0733ffc media: Added support for the TerraTec T1 DVB-T USB tuner [IT9135 chipset]
Signed-off-by: Nuno Henriques <nuno.amhenriques@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20 16:46:49 -04:00
Bhumika Goyal
ff05c9849a media: : usb: add const to v4l2_file_operations structures
Declare v4l2_file_operations structures as const as they are only stored
in the fops field of video_device structures. This field is of type
const, so declare v4l2_file_operations structures with similar properties
as const.

Signed-off-by: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20 16:45:25 -04:00
Gustavo A. R. Silva
488e27ad81 media: dvb-frontends: mb86a16: remove useless variables in signal_det()
Remove useless variables wait_t and wait_sym and code related.

Also, fix some coding style issues.

Addresses-Coverity-ID: 1226947

Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20 16:29:11 -04:00
Mauro Carvalho Chehab
abc5b2cbc2 media: v4l2-fwnode: make v4l2_fwnode_endpoint_parse_csi1_bus static
This function is used only internally. So, make it static.
Shuts up this warning:

drivers/media/v4l2-core/v4l2-fwnode.c:153:6: warning: no previous prototype for 'v4l2_fwnode_endpoint_parse_csi1_bus' [-Wmissing-prototypes]
 void v4l2_fwnode_endpoint_parse_csi1_bus(struct fwnode_handle *fwnode,
      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20 16:27:27 -04:00
Mauro Carvalho Chehab
4ee236219f media: v4l2-fwnode: suppress a warning at OF parsing logic
smatch produce this warning:
	drivers/media/v4l2-core/v4l2-fwnode.c:76 v4l2_fwnode_endpoint_parse_csi_bus() error: buffer overflow 'array' 5 <= u16max

That's because, in thesis, the routine might have called with
some value at bus->num_data_lanes. That's not the current
case.

Yet, better to shut up this warning, and make the code more
reliable if some future changes might cause a bug.

While here, simplify the code a little bit by reading only
once from lanes-properties array.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20 16:26:21 -04:00
Mauro Carvalho Chehab
1ad371deb9 media: pvrusb2: fix the retry logic
As reported by this warning:
	drivers/media/usb/pvrusb2/pvrusb2-encoder.c:263 pvr2_encoder_cmd() warn: continue to end of do { ... } while(0); loop

There's an issue at the retry logic there: the current logic is:

	do {
		if (need_to_retry)
			continue;

		some_code();
	} while (0);

Well, that won't work, as continue will make it test for zero, and
abort the loop. So, change the loop to:

	while (1) {
		if (need_to_retry)
			continue;

		some_code();
		break;
	};

With seems to be what's actually expected there.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-20 16:25:41 -04:00