summaryrefslogtreecommitdiffstats
path: root/drivers/media
Commit message (Collapse)AuthorAgeFilesLines
* media: vicodec: Introducing stateless fwht defs and structsDafna Hirschfeld2019-03-252-28/+25Star
| | | | | | | | | | Add structs and definitions needed to implement stateless decoder for fwht and add I/P-frames QP controls to the public api. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: add struct for encoder/decoder instanceDafna Hirschfeld2019-03-251-102/+92Star
| | | | | | | | | Add struct 'vicodec_dev_instance' for the fields in vicodec_dev that have have both decoder and encoder versions. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: Handle the case that the reference buffer is NULLDafna Hirschfeld2019-03-252-4/+16
| | | | | | | | | | In the stateless decoder the reference buffer is null if the frame is an I-frame (flagged with FWHT_FL_I_FRAME). Make sure not to dereference it in that case. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: rename v4l2_fwht_default_fmt to v4l2_fwht_find_nth_fmtDafna Hirschfeld2019-03-253-8/+23
| | | | | | | | | | | | Rename 'v4l2_fwht_default_fmt' to 'v4l2_fwht_find_nth_fmt' and add a function 'v4l2_fwht_validate_fmt' to check if a format info matches the parameters. This function will also be used to validate the stateless params when adding support for stateless codecs. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: Validate version dependent header values in a separate functionDafna Hirschfeld2019-03-251-12/+19
| | | | | | | | | Move the code that validates version dependent header values to a separate function 'validate_by_version' Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: keep the ref frame according to the format in decoderDafna Hirschfeld2019-03-255-268/+122Star
| | | | | | | | | | | | In the decoder, save the inner reference frame in the same format as the capture buffer. The decoder writes directly to the capture buffer and then the capture buffer is copied to the reference buffer. This will simplify the stateless decoder. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: add field 'buf' to fwht_raw_frameDafna Hirschfeld2019-03-252-2/+6
| | | | | | | | | | | Add the field 'buf' to fwht_raw_frame to indicate the start of the raw frame buffer. This field will be used to copy the capture buffer to the reference buffer in the next patch. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: Move raw frame preparation code to a functionDafna Hirschfeld2019-03-251-65/+78
| | | | | | | | | Introduce 'prepare_raw_frame' function that fills the values of a raw frame struct according to the format. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: bugfix: free compressed_frame upon device releaseDafna Hirschfeld2019-03-251-0/+1
| | | | | | | | Free compressed_frame buffer upon device release. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: bugfix - call v4l2_m2m_buf_copy_metadata also if decoding failsDafna Hirschfeld2019-03-251-8/+9
| | | | | | | | | | | The function 'v4l2_m2m_buf_copy_metadata' should be called even if decoding/encoding ends with status VB2_BUF_STATE_ERROR, so that the metadata is copied from the source buffer to the dest buffer. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: change variable name for the return value of v4l2_fwht_encodeDafna Hirschfeld2019-03-251-4/+5
| | | | | | | | | | | v4l2_fwht_encode returns either an error code on failure or the size of the compressed frame on success. So change the var assigned to it from 'ret' to 'comp_sz_or_errcode' to clarify that. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: v4l2-ctrl: v4l2_ctrl_request_setup returns with error upon failureDafna Hirschfeld2019-03-251-7/+11
| | | | | | | | | | | If one of the controls fails to set, then 'v4l2_ctrl_request_setup' immediately returns with the error code. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Reviewed-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: upon release, call m2m release before freeing ctrl handlerDafna Hirschfeld2019-03-251-3/+3
| | | | | | | | | 'v4l2_m2m_ctx_release' calls request complete so it should be called before 'v4l2_ctrl_handler_free'. Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: fix g_selection: either handle crop or composeHans Verkuil2019-03-251-5/+17
| | | | | | | | The logic of g_selection was wrong: encoders support crop, decoders support compose, but the code allowed both. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: selection api should only check single buffer typesDafna Hirschfeld2019-03-251-17/+3Star
| | | | | | | | | | The selection api should check only single buffer types because multiplanar types are converted to single in drivers/media/v4l2-core/v4l2-ioctl.c Signed-off-by: Dafna Hirschfeld <dafna3@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: media requests: return EBADR instead of EACCESHans Verkuil2019-03-252-3/+3
| | | | | | | | | | | | | | If requests are used when they shouldn't, or not used when they should, then return EBADR (Invalid request descriptor) instead of EACCES. The reason for this change is that EACCES has more to do with permissions (not being the owner of the resource), but in this case the request file descriptor is just wrong for the current mode of the device. Update the documentation accordingly. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vb2: add requires_requests bit for stateless codecsHans Verkuil2019-03-252-0/+13
| | | | | | | | | | | | | | | | | Stateless codecs require the use of the Request API as opposed of it being optional. So add a bit to indicate this and let vb2 check for this. If an attempt is made to queue a buffer without an associated request, then the EBADR error is returned to userspace. Doing this check in the vb2 core simplifies drivers, since they don't have to check for this, they can just set this flag. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: Kconfig files: use the right help coding styleMauro Carvalho Chehab2019-03-2065-314/+314
| | | | | | | | | | | Checkpatch wants to use 'help' instead of '---help---': WARNING: prefer 'help' over '---help---' for new help texts Let's change it globally at the media subsystem, as otherwise people would keep using the old way. Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: v4l2-fwnode: Add a deprecation note in the old ACPI parsing exampleSakari Ailus2019-03-201-1/+4
| | | | | | | | This is not how ACPI tables are written. Add a deprecation note and refer to the proper documentation. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: ipu3-cio2: Set CSI-2 receiver sub-device entity functionSakari Ailus2019-03-201-0/+1
| | | | | | | | | Set the entity function for the four CSI-2 receiver sub-devices the driver creates. This avoids a kernel warning from each as well. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Bingbu Cao <bingbu.cao@intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: v4l: i2c: Regroup lens drivers under their own sectionSakari Ailus2019-03-201-37/+39
| | | | | | | | The lens drivers had ended up under the video decoder section; add a new one just for them, between the camera sensors and flash drivers. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: ti-vpe: Parse local endpoint for properties, not the remote oneSakari Ailus2019-03-201-10/+2Star
| | | | | | | | ti-vpe driver parsed the remote endpoints for properties but ignored the local ones. Fix this by parsing the local endpoint properties instead. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: pxa-camera: Match with device node, not the port nodeSakari Ailus2019-03-201-1/+1
| | | | | | | | V4L2 fwnode matching right now still works based on device nodes, not port nodes. Fix this. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: v4l2-fwnode: The first default data lane is 0 on C-PHYSakari Ailus2019-03-201-1/+5
| | | | | | | | | C-PHY has no clock lanes. Therefore the first data lane is 0 by default. Fixes: edc6d56c2e7e ("media: v4l: fwnode: Support parsing of CSI-2 C-PHY endpoints") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: v4l2-fwnode: Defaults may not override endpoint configuration in firmwareSakari Ailus2019-03-201-1/+5
| | | | | | | | | | | | | | | | | The lack of defaults provided by the caller to v4l2_fwnode_endpoint_parse() signals the use of the default lane mapping. The default lane mapping must not be used however if the firmmare contains the lane mapping. Disable the default lane mapping in that case, and improve the debug messages telling of the use of the defaults. This was missed previously since the default mapping will only unsed in this case if the bus type is set, and no driver did both while still needing the lane mapping configuration. Fixes: b4357d21d674 ("media: v4l: fwnode: Support default CSI-2 lane mapping for drivers") Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: ov7670: don't access registers when the device is powered offAkinobu Mita2019-03-201-5/+26
| | | | | | | | | | | | | | | | | | | | | | Since commit 3d6a8fe25605 ("media: ov7670: hook s_power onto v4l2 core"), the device is actually powered off while the video stream is stopped. So now set_format and s_frame_interval could be called while the device is powered off, but these callbacks try to change the register settings at this time. The frame format and framerate will be restored right after power-up, so we can just postpone applying these changes at these callbacks if the device is not powered up. Fixes: 3d6a8fe25605 ("media: ov7670: hook s_power onto v4l2 core") Cc: Jonathan Corbet <corbet@lwn.net> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Reviewed-by: Lubomir Rintel <lkundrak@v3.sk> Tested-by: Lubomir Rintel <lkundrak@v3.sk> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: ov7670: restore default settings after power-upAkinobu Mita2019-03-201-0/+1
| | | | | | | | | | | | | | | | | Since commit 3d6a8fe25605 ("media: ov7670: hook s_power onto v4l2 core"), the device is actually powered off while the video stream is stopped. The frame format and framerate are restored right after power-up, but restoring the default register settings is forgotten. Fixes: 3d6a8fe25605 ("media: ov7670: hook s_power onto v4l2 core") Cc: Jonathan Corbet <corbet@lwn.net> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Reviewed-by: Lubomir Rintel <lkundrak@v3.sk> Tested-by: Lubomir Rintel <lkundrak@v3.sk> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: reset last_src/dst_buf based on the IS_OUTPUTHans Verkuil2019-03-201-2/+5
| | | | | | | | | | | | | | | | When start_streaming was called both last_src_buf and last_dst_buf pointers were set to NULL, but this depends on whether the capture or output queue starts streaming. When decoding with resolution changes in between the capture queue has to restart streaming whenever a resolution change occurs. And that would reset last_src_buf as well, which causes a problem if the decoder was stopped by the application. Since last_src_buf is now NULL, the LAST flag is never set for the last capture buffer. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vicodec: remove WARN_ON(1) from get_q_data()Hans Verkuil2019-03-201-1/+0Star
| | | | | | | | | Some functions like enum_fmt use the buffer type as was passed from userspace, which might cause the switch to fall into the default case. Just drop the WARN_ON(1) to avoid kernel log pollution. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: em28xx-input: make const array addr_list staticColin Ian King2019-03-191-1/+1
| | | | | | | | | | | | | | | | | | | Don't populate the array addr_list on the stack but instead make it static. Makes the object code smaller by 20 bytes Before: text data bss dec hex filename^M 16929 3626 384 20939 51cb ../usb/em28xx/em28xx-input.o After: text data bss dec hex filename^M 16829 3706 384 20919 51b7 ../usb/em28xx/em28xx-input.o (gcc version 8.3.0, aarch64) Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: dvb: Add support for the Avermedia TD310Jose Alberto Reguero2019-03-192-6/+26
| | | | | | | | This patch add support for Avermedia TD310 usb stick. Signed-off-by: Jose Alberto Reguero <jose.alberto.reguero@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: dvb: init i2c already in it930x_frontend_attachAndreas Kemnade2019-03-191-42/+42
| | | | | | | | | | | | i2c bus is already needed when the frontend is probed, so init it already in it930x_frontend_attach. That prevents errors like: si2168: probe of 6-0067 failed with error -5 Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Signed-off-by: Jose Alberto Reguero <jose.alberto.reguero@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: si2165: fix a missing check of return valueKangjie Lu2019-03-191-3/+5
| | | | | | | | | | | | | | | si2165_readreg8() may fail. Looking into si2165_readreg8(), we will find that "val_tmp" will be an uninitialized value when regmap_read() fails. "val_tmp" is then assigned to "val". So if si2165_readreg8() fails, "val" will be a random value. Further use will lead to undefined behaviors. The fix checks if si2165_readreg8() fails, and if so, returns its error code upstream. Signed-off-by: Kangjie Lu <kjlu@umn.edu> Reviewed-by: Matthias Schwarzott <zzam@gentoo.org> Tested-by: Matthias Schwarzott <zzam@gentoo.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: serial_ir: Fix use-after-free in serial_ir_init_moduleYueHaibing2019-03-191-8/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Syzkaller report this: BUG: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468 Read of size 8 at addr ffff8881dc7ae030 by task syz-executor.0/6249 CPU: 1 PID: 6249 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xfa/0x1ce lib/dump_stack.c:113 print_address_description+0x65/0x270 mm/kasan/report.c:187 kasan_report+0x149/0x18d mm/kasan/report.c:317 ? 0xffffffffc1728000 sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468 sysfs_remove_file include/linux/sysfs.h:519 [inline] driver_remove_file+0x40/0x50 drivers/base/driver.c:122 remove_bind_files drivers/base/bus.c:585 [inline] bus_remove_driver+0x186/0x220 drivers/base/bus.c:725 driver_unregister+0x6c/0xa0 drivers/base/driver.c:197 serial_ir_init_module+0x169/0x1000 [serial_ir] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462e99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9450132c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003 RBP: 00007f9450132c70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94501336bc R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004 Allocated by task 6249: set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495 kmalloc include/linux/slab.h:545 [inline] kzalloc include/linux/slab.h:740 [inline] bus_add_driver+0xc0/0x610 drivers/base/bus.c:651 driver_register+0x1bb/0x3f0 drivers/base/driver.c:170 serial_ir_init_module+0xe8/0x1000 [serial_ir] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 6249: set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:457 slab_free_hook mm/slub.c:1430 [inline] slab_free_freelist_hook mm/slub.c:1457 [inline] slab_free mm/slub.c:3005 [inline] kfree+0xe1/0x270 mm/slub.c:3957 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:67 [inline] kobject_put+0x146/0x240 lib/kobject.c:708 bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732 driver_unregister+0x6c/0xa0 drivers/base/driver.c:197 serial_ir_init_module+0x14c/0x1000 [serial_ir] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881dc7ae000 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 48 bytes inside of 256-byte region [ffff8881dc7ae000, ffff8881dc7ae100) The buggy address belongs to the page: page:ffffea000771eb80 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0 flags: 0x2fffc0000000200(slab) raw: 02fffc0000000200 ffffea0007d14800 0000000400000002 ffff8881f6c02e00 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881dc7adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881dc7adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8881dc7ae000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881dc7ae080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881dc7ae100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 There are already cleanup handlings in serial_ir_init error path, no need to call serial_ir_exit do it again in serial_ir_init_module, otherwise will trigger a use-after-free issue. Fixes: fa5dc29c1fcc ("[media] lirc_serial: move out of staging and rename to serial_ir") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: rc: remove unused including <linux/version.h>YueHaibing2019-03-191-1/+0Star
| | | | | | | | Remove including <linux/version.h> that don't need it. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: cx23885: check allocation returnNicholas Mc Guire2019-03-191-2/+3
| | | | | | | | | | | | | Checking of kmalloc() seems to have been committed - as cx23885_dvb_register() is checking for != 0 return, returning -ENOMEM should be fine here. While at it address the coccicheck suggestion to move to kmemdup rather than using kmalloc+memcpy. Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2") Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: m88ds3103: serialize reset messages in m88ds3103_set_frontendJames Hutchinson2019-03-191-5/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ref: https://bugzilla.kernel.org/show_bug.cgi?id=199323 Users are experiencing problems with the DVBSky S960/S960C USB devices since the following commit: 9d659ae: ("locking/mutex: Add lock handoff to avoid starvation") The device malfunctions after running for an indeterminable period of time, and the problem can only be cleared by rebooting the machine. It is possible to encourage the problem to surface by blocking the signal to the LNB. Further debugging revealed the cause of the problem. In the following capture: - thread #1325 is running m88ds3103_set_frontend - thread #42 is running ts2020_stat_work a> [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 07 80 [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 08 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 68 3f [42] usb 1-1: dvb_usb_v2_generic_io: <<< 08 ff [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 3d [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff b> [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 07 00 [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 21 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 66 [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11 [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07 [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 60 02 10 0b [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07 Two i2c messages are sent to perform a reset in m88ds3103_set_frontend: a. 0x07, 0x80 b. 0x07, 0x00 However, as shown in the capture, the regmap mutex is being handed over to another thread (ts2020_stat_work) in between these two messages. >From here, the device responds to every i2c message with an 07 message, and will only return to normal operation following a power cycle. Use regmap_multi_reg_write to group the two reset messages, ensuring both are processed before the regmap mutex is unlocked. Signed-off-by: James Hutchinson <jahutchinson99@googlemail.com> Reviewed-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: dvbsky: Avoid leaking dvb frontendStefan Brüns2019-03-191-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: wl128x: Fix an error code in fm_download_firmware()Dan Carpenter2019-03-191-2/+3
| | | | | | | | | | We forgot to set "ret" on this error path. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: i2c: adv748x: select V4L2_FWNODEArnd Bergmann2019-03-191-0/+1
| | | | | | | | | | | | | | | Building adv748x fails now unless V4L2_FWNODE is selected: drivers/media/i2c/adv748x/adv748x-core.o: In function `adv748x_probe': adv748x-core.c:(.text+0x1b2c): undefined reference to `v4l2_fwnode_endpoint_parse' Fixes: 6a18865da8e3 ("media: i2c: adv748x: store number of CSI-2 lanes described in device tree") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: strscpy() returns a negative value on failure unlike strlcpy().Hans Petter Selasky2019-03-191-1/+1
| | | | | | | | | | strscpy() returns a negative value on failure unlike strlcpy(), so fix the WARN_ON accordingly. Signed-off-by: Hans Petter Selasky <hps@selasky.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil-cisco@xs4all.nl: added commit message] Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vimc: stream: init/terminate the first entityHelen Fornazier2019-03-191-10/+16
| | | | | | | | | | | | | | | | | | The s_stream callback was not being called for the first entity in the stream pipeline array. Instead of verifying the type of the node (video or subdevice) and calling s_stream from the second entity in the pipeline, do this process for all the entities in the pipeline for consistency. The previous code was not a problem because the first entity is a video device and not a subdevice, but this patch prepares vimc to allow setting some configuration in the entity before calling s_stream. Signed-off-by: Helen Koike <helen.koike@collabora.com> Tested-by: André Almeida <andre.almeida@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil-cisco@xs4all.nl: fix line-too-long warning] Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vimc: stream: add docs to struct vimc_streamHelen Fornazier2019-03-191-0/+15
| | | | | | | | Add missing documentation for struct vimc_stream Signed-off-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vimc: stream: cleanup frame field from struct vimc_streamHelen Fornazier2019-03-192-7/+4Star
| | | | | | | | | There is no need to have the frame field in the vimc_stream struct. Signed-off-by: Helen Koike <helen.koike@collabora.com> Tested-by: André Almeida <andre.almeida@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vimc: cap: fix step width/height in enum framesizeHelen Fornazier2019-03-191-2/+2
| | | | | | | | | | | | The type V4L2_FRMSIZE_TYPE_CONTINUOUS expects a step of 1. This fixes v4l2-compliance test error: fail: v4l2-test-formats.cpp(184): invalid step_width/height for continuous framesize test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: FAIL Signed-off-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vimc: stream: fix thread state before sleepHelen Fornazier2019-03-191-1/+1
| | | | | | | | | | | | | | | | | The state TASK_UNINTERRUPTIBLE should be set just before schedule_timeout() call, so it knows the sleep mode it should enter. There is no point in setting TASK_UNINTERRUPTIBLE at the initialization of the thread as schedule_timeout() will set the state back to TASK_RUNNING. This fixes a warning in __might_sleep() call, as it's expecting the task to be in TASK_RUNNING state just before changing the state to a sleeping state. Reported-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: vimc: deb: fix default sink bayer formatHelen Fornazier2019-03-191-1/+1
| | | | | | | | | | | | | The format of the sink pad should be a bayer mbus format. This fixes a kernel NULL pointer dereference error that was caused when the stream starts because the configured format was not found in the pixelmap table. Reported-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: videobuf2: Return error after allocation failureSouptick Joarder2019-03-191-5/+5
| | | | | | | | | | There is no point to continuing assignment after memory allocation failed, rather throw error immediately. Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil-cisco@xs4all.nl: rebase and remove empty line before the if] Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: gspca: do not resubmit URBs when streaming has stoppedHans Verkuil2019-03-191-2/+6
| | | | | | | | | | | | | | | | | When streaming is stopped all URBs are killed, but in fill_frame and in bulk_irq this results in an attempt to resubmit the killed URB. That is not what you want and causes spurious kernel messages. So check if streaming has stopped before resubmitting. Also check against gspca_dev->streaming rather than vb2_start_streaming_called() since vb2_start_streaming_called() will return true when in stop_streaming, but gspca_dev->streaming is set to false when stop_streaming is called. Fixes: 6992effe5344 ("gspca: Kill all URBs before releasing any of them") Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: au0828: minor fix to a misleading comment in _close()Shuah Khan2019-03-191-2/+2
| | | | | | | | | Fix a misleading comment in _close() and a spelling error. Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Signed-off-by: Shuah Khan <shuah@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-18 10:52:17 +0200