Markus Elfring [Tue, 27 Aug 2019 14:00:13 +0000 (11:00 -0300)]
media: stm32-dcmi: Delete an unnecessary of_node_put() call in dcmi_probe()
A null pointer would be passed to a call of the function “of_node_put”
immediately after a call of the function “of_graph_get_next_endpoint”
failed at one place.
Remove this superfluous function call.
This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Yizhuo [Mon, 26 Aug 2019 23:55:28 +0000 (20:55 -0300)]
media: pvrusb2: qctrl.flag will be uninitlaized if cx2341x_ctrl_query() returns error code
Inside function ctrl_cx2341x_getv4lflags(), qctrl.flag
will be uninitlaized if cx2341x_ctrl_query() returns -EINVAL.
However, it will be used in the later if statement, which is
potentially unsafe.
Signed-off-by: Yizhuo <yzhai003@ucr.edu> Acked-by: Mike Isely <isely@pobox.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Markus Elfring [Mon, 26 Aug 2019 11:14:02 +0000 (08:14 -0300)]
media: em28xx: Fix exception handling in em28xx_alloc_urbs()
A null pointer would be passed to a call of the function "kfree" directly
after a call of the function "kcalloc" failed at one place.
Pass the data structure member "urb" instead for which memory
was allocated before (so that this resource will be properly cleaned up).
This issue was detected by using the Coccinelle software.
Fixes: d571b592c6206d33731f41aa710fa0f69ac8611b ("media: em28xx: don't use coherent buffer for DMA transfers") Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
[drivers/media/dvb-frontends/cx24123.c:434]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour
[drivers/media/pci/bt8xx/bttv-input.c:87]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour
[drivers/media/pci/bt8xx/bttv-input.c:98]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour
...
[drivers/media/v4l2-core/v4l2-ioctl.c:1391]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour
There are lots of places where we're doing 1 << 31. That's bad,
as, depending on the architecture, this has an undefined behavior.
The BIT() macro is already prepared to handle this, so, let's
just switch all "1 << number" macros by BIT(number) at the header files
with has 1 << 31.
[drivers/media/i2c/ov9650.c:706]: (error) Shifting by a negative value is undefined behaviour
[drivers/media/i2c/ov9650.c:707]: (error) Shifting by a negative value is undefined behaviour
[drivers/media/i2c/ov9650.c:721]: (error) Shifting by a negative value is undefined behaviour
Prevent mangling with gains with invalid values.
As pointed by Sylvester, this should never happen in practice,
as min value of V4L2_CID_GAIN control is 16 (gain is always >= 16
and m is always >= 0), but it is too hard for a static analyzer
to get this, as the logic with validates control min/max is
elsewhere inside V4L2 core.
media: aspeed-video: address a protential usage of an unitialized var
While this might not occur in practice, if the device is doing
the right thing, it would be teoretically be possible to have
both hsync_counter and vsync_counter negatives.
If this ever happen, ctrl will be undefined, but the driver
will still call:
media: vicodec: make life easier for static analyzers
cppcheck incorrectly produces an error here:
[drivers/media/platform/vicodec/vicodec-core.c:1677]: (error) Pointer addition with NULL pointer.
While this is actually a false positive, it doesn't hurt to
reorder the checks to make the code simpler, handling first
the error patch, where no color or alpha components are there.
Ezequiel Garcia [Thu, 15 Aug 2019 16:48:03 +0000 (13:48 -0300)]
media: v4l2-core: move i2c helpers out of v4l2-common.c
Separate the i2c helpers to v4l2-i2c.c, in order to get rid
of the ifdefery. No functional changes intended, this is
just a cosmetic change to organize the code better.
Given I2C is a tristate symbol, a hidden boolean symbol
is introduced, to make the conditional build easier.
Ezequiel Garcia [Thu, 15 Aug 2019 16:48:02 +0000 (13:48 -0300)]
media: v4l2-core: move spi helpers out of v4l2-common.c
Separate the spi helpers to v4l2-spi.c, in order to get rid
of the ifdefery. No functional changes intended, this is
just a cosmetic change to organize the code better.
Ezequiel Garcia [Thu, 15 Aug 2019 16:48:01 +0000 (13:48 -0300)]
media: v4l2-core: Module re-organization
videodev.ko and v4l2-common.ko driver are built under
the same conditions. Therefore, it doesn't make much sense
to split them in two different modules.
Splitting v4l2-common to its own driver was done many years ago:
V4L/DVB (7115): Fix bug #9833: regression when compiling V4L without I2C
Back then, the subsystem organization was different and the module split
was needed. However, with the current organization, there is no issue
compiling V4L2 with I2C as y/m/n.
This commit makes v4l2-common part of our V4L2 core driver (videodev.ko).
media: saa7134: keep demod i2c gate closed on Medion 7134
Medion 7134 has two i2c eeproms on the same i2c bus sharing the same bus
addresses: the first one for SAA7134 chip config and the second one behind
TDA10046 DVB-T demod chip i2c gate storing its firmware.
The TV tuner on this board is not behind this i2c gate.
Due to the bus conflict described above, the card PCI SVID / SSID sometimes
gets garbled after a reboot, which makes it necessary to specify the card
model manually as an insmod option in order for it to be detected reliably.
To avoid this, let's just leave the gate permanently closed so the eeprom
chips won't clash.
The demod firmware load is done with its i2c gate closed anyway so it is
not affected by this change.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Colin Ian King [Sun, 18 Aug 2019 18:36:08 +0000 (15:36 -0300)]
media: hdpvr: remove redundant assignment to retval
Variable retval is initialized to a value that is never read
so this assignment is redundant. Clean up the code by removing
retval completely and just return the error return from the
call to i2c_add_adapter.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Wenwen Wang [Sun, 18 Aug 2019 06:40:04 +0000 (03:40 -0300)]
media: ti-vpe: Add cleanup in vpdma_list_cleanup()
If an error occurs in this function, no cleanup is executed, leading to
memory/resource leaks. To fix this issue, introduce two labels to perform
the cleanup work.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Wenwen Wang [Sun, 18 Aug 2019 05:58:53 +0000 (02:58 -0300)]
media: fdp1: Fix a memory leak bug
In fdp1_open(), 'ctx' is allocated through kzalloc(). However, it is not
deallocated if v4l2_ctrl_new_std() fails, leading to a memory leak bug. To
fix this issue, free 'ctx' before going to the 'done' label.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Wenwen Wang [Sun, 18 Aug 2019 05:40:14 +0000 (02:40 -0300)]
media: saa7146: add cleanup in hexium_attach()
If saa7146_register_device() fails, no cleanup is executed, leading to
memory/resource leaks. To fix this issue, perform necessary cleanup work
before returning the error.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Wenwen Wang [Sat, 17 Aug 2019 06:14:54 +0000 (03:14 -0300)]
media: usb: cx231xx-417: fix a memory leak bug
In cx231xx_load_firmware(), 'p_buffer' is allocated through vmalloc() to
hold the firmware. However, after the usage, it is not deallocated, leading
to a memory leak bug.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Wenwen Wang [Sat, 17 Aug 2019 05:27:46 +0000 (02:27 -0300)]
media: cpia2_usb: fix memory leaks
In submit_urbs(), 'cam->sbuf[i].data' is allocated through kmalloc_array().
However, it is not deallocated if the following allocation for urbs fails.
To fix this issue, free 'cam->sbuf[i].data' if usb_alloc_urb() fails.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Philipp Zabel [Wed, 14 Aug 2019 12:24:44 +0000 (09:24 -0300)]
media: imx: add csc/scaler mem2mem device
Add a single imx-media mem2mem video device that uses the IPU IC PP
(image converter post processing) task for scaling and colorspace
conversion.
On i.MX6Q/DL SoCs with two IPUs currently only the first IPU is used.
The hardware only supports writing to destination buffers up to
1024x1024 pixels in a single pass, arbitrary sizes can be achieved
by rendering multiple tiles per frame.
[slongerbeam@gmail.com: use ipu_image_convert_adjust(), fix
device_run() error handling, add missing media-device header,
unregister and remove the mem2mem device in error paths in
imx_media_probe_complete() and in imx_media_remove(), updated
for sync subdev registration]
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil-cisco@xs4all.nl: correct two minor checkpatch issues]
[hverkuil-cisco@xs4all.nl: sparse warning: make imx6_media_probe_complete static] Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hans Verkuil [Fri, 23 Aug 2019 11:12:59 +0000 (08:12 -0300)]
media: cec-notifier: clear cec_adap in cec_notifier_unregister
If cec_notifier_cec_adap_unregister() is called before
cec_unregister_adapter() then everything is OK (and this is the
case today). But if it is the other way around, then
cec_notifier_unregister() is called first, and that doesn't
set n->cec_adap to NULL.
So if e.g. cec_notifier_set_phys_addr() is called after
cec_notifier_unregister() but before cec_unregister_adapter()
then n->cec_adap points to an unregistered and likely deleted
cec adapter. So just set n->cec_adap->notifier and n->cec_adap
to NULL for rubustness.
Eventually cec_notifier_unregister will disappear and this will
be simplified substantially.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Maxime Ripard [Thu, 22 Aug 2019 08:21:14 +0000 (05:21 -0300)]
media: sunxi: Add A10 CSI driver
The older CSI drivers have camera capture interface different from the one
in the newer ones.
This IP is pretty simple. Some variants (one controller out of two
instances on some SoCs) have an ISP embedded, but there's no code that make
use of it, so we ignored that part for now.
[Sakari Ailus: Wrapped a few long lines, set mbus code using a macro.]
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Maxime Ripard [Thu, 22 Aug 2019 08:21:13 +0000 (05:21 -0300)]
media: sunxi: Refactor the Makefile and Kconfig
The Makefile and Kconfig for the sun6i CSI driver are included in the main
Makefile / KConfig file. Since we're going to add a new CSI driver for an
older chip, and the Cedrus driver eventually, it makes more sense to put
those in our directory.
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
media: atmel: atmel-isi: fix timeout value for stop streaming
In case of sensor malfunction, stop streaming timeout takes much longer
than expected. This is due to conversion of time to jiffies: milliseconds
multiplied with HZ (ticks/second) gives out a value of jiffies with 10^3
greater. We need to also divide by 10^3 to obtain the right jiffies value.
In other words FRAME_INTERVAL_MILLI_SEC must be in seconds in order to
multiply by HZ and get the right jiffies value to add to the current
jiffies for the timeout expire time.
Maxime Ripard [Mon, 19 Aug 2019 18:26:19 +0000 (15:26 -0300)]
media: dt-bindings: media: Convert Allwinner A10 IR to a schema
The older Allwinner SoCs have a IR receiver supported in Linux, with a
matching Device Tree binding.
Now that we have the DT validation in place, let's convert the device tree
bindings for that controller over to a YAML schemas.
Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Maxime Ripard [Mon, 19 Aug 2019 18:26:18 +0000 (15:26 -0300)]
media: dt-bindings: media: Add YAML schemas for the generic RC bindings
The RC controllers have a bunch of generic properties that are needed in a
device tree. Add a YAML schemas for those.
Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Tomas Bortoli [Wed, 31 Jul 2019 15:19:05 +0000 (12:19 -0300)]
media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()
The function at issue does not always initialize each byte allocated
for 'b' and can therefore leak uninitialized memory to a USB device in
the call to usb_bulk_msg()
Use kzalloc() instead of kmalloc()
Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Nishka Dasgupta [Mon, 19 Aug 2019 07:47:01 +0000 (04:47 -0300)]
media: dvb-frontends/cxd2099: Make en_templ constant
Static structure en_templ, of type dvb_ca_en50221, is not used except to
be copied into a local variable. Hence make it const to prevent
unintended modification of the original fields.
Issue found with Coccinelle.
Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Nishka Dasgupta [Mon, 19 Aug 2019 07:38:18 +0000 (04:38 -0300)]
media: ec168: Make structure ec168_props constant
The static structure ec168_props, of type dvb_usb_device_properties, is
used only once, when it is assigned to field props of the constant
structure ec168_driver_info. As this means that ec168_props will never be
modified, make it const as well in order to prevent unintended
modification of its fields.
Issue found with Coccinelle.
Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Nishka Dasgupta [Mon, 19 Aug 2019 07:36:54 +0000 (04:36 -0300)]
media: firewire: Make structure fdtv_ca constant
Static structure fdtv_ca, of type dvb_device, is only used when it is
passed as the third argument to function dvb_register_device(). However,
in the definition of dvb_register_device, the third parameter is
declared as constant. Hence make fdtv_ca const as well.
Issue found with Coccinelle.
Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Nishka Dasgupta [Mon, 19 Aug 2019 07:35:42 +0000 (04:35 -0300)]
media: dvb-bt8xx: Make variable dst_config constant
Static structure dst_config, of type dst_config, is not used except to
be assigned as the value of field state of a variable having type
dst_state *. In the definition of dst_state, field config is declared as
const. Hence dst_config, when assigned to config, cannot be modified.
Therefore, make dst_config const as well.
Issue found with Coccinelle.
Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
commit 5fa88151ecdb ("[media] dvb-usb-cxusb: Geniatech T230 - resync TS
FIFO after lock") does not solve the problem for all devices. This is the
same issue reported on the T230C, which was moved to the dvbsky.c driver
to work around this issue in commit 5742240577b6 ("media: dvbsky: MyGica
T230C support").
In addition, the cxusb driver causes an oops when unplugging the device
while streaming; this problem does not happen any more.
Signed-off-by: Jan Pieter van Woerkom <jp@jpvw.nl> Tested-by: James Hutchinson <jahutchinson99@googlemail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Remove this device from the cxusb driver so it can be added to the dvbsky
driver.
Signed-off-by: Jan Pieter van Woerkom <jp@jpvw.nl> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Wenwen Wang [Sun, 18 Aug 2019 03:45:40 +0000 (00:45 -0300)]
media: dvb-core: fix a memory leak bug
In dvb_create_media_entity(), 'dvbdev->entity' is allocated through
kzalloc(). Then, 'dvbdev->pads' is allocated through kcalloc(). However, if
kcalloc() fails, the allocated 'dvbdev->entity' is not deallocated, leading
to a memory leak bug. To fix this issue, free 'dvbdev->entity' before
returning -ENOMEM.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Wenwen Wang [Sat, 17 Aug 2019 07:04:04 +0000 (04:04 -0300)]
media: dvb-frontends: fix a memory leak bug
In cx24117_load_firmware(), 'buf' is allocated through kmalloc() to hold
the firmware. However, if i2c_transfer() fails, it is not deallocated,
leading to a memory leak bug.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Wenwen Wang [Sat, 17 Aug 2019 06:42:24 +0000 (03:42 -0300)]
media: dvb-frontends: fix memory leaks
In dib7000pc_detection(), 'tx' and 'rx' are allocated through kzalloc()
respectively. However, if DiB7000PC is detected, they are not deallocated,
leading to memory leaks. To fix this issue, create a label to free 'tx' and
'rx' before returning from the function.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
A Sun [Thu, 15 Aug 2019 16:41:19 +0000 (13:41 -0300)]
media: mceusb: fix (eliminate) TX IR signal length limit
Fix and eliminate mceusb's IR length limit for IR signals transmitted to
the MCE IR blaster ports.
An IR signal TX exceeding 306 pulse/space samples presently causes -EINVAL
return error. There's no such limitation nor error with the MCE device
hardware. And valid IR signals exist with more than 400 pulse/space for the
control of certain appliances (eg Panasonic ACXA75C00600 air conditioner).
The scope of this patch is limited to the mceusb driver. There are still
IR signal TX length and time constraints that related modules of rc core
(eg LIRC) impose, further up the driver stack.
Changes for mceusb_tx_ir():
Converts and sends LIRC IR pulse/space sequence to MCE device IR
pulse/space format.
Break long length LIRC sequence into multiple (unlimited number of) parts
for sending to the MCE device.
Reduce kernel stack IR buffer size: 128 (was 384)
Increase MCE IR data packet size: 31 (was 5)
Zero time LIRC pulse/space no longer copied to MCE IR data.
Eliminate overwriting the source/input LIRC IR data in txbuf[].
Eliminate -EINVAL return; return number of IR samples sent (>0) or
MCE write error code (<0).
New mce_write() and mce_write_callback():
Implements synchronous blocking I/O, with timeout, for writing/sending
data to the MCE device.
An unlimited multipart IR signal sent to the MCE device faster than real
time requires flow control absent with the original mce_request_packet()
and mce_async_callback() asynchronous I/O implementation. Also absent is
TX error feedback.
mce_write() combines and replaces mce_request_packet() and
mce_async_callback() with conversion to synchronous I/O.
mce_write() returns bytes sent (>0) or MCE device write error (<0).
Debug hex dump TX data before processing.
Rename mce_async_out() -> mce_command_out():
The original name is misleading with underlying synchronous I/O
implementation. Function renamed to mce_command_out().
Changes in mceusb_handle_command():
Add support for MCE device error case MCE_RSP_TX_TIMEOUT
"IR TX timeout (TX buffer underrun)"
Changes in mceusb_dev_printdata():
Changes support test and debug of multipart TX IR.
Add buffer boundary information (offset and buffer size) to TX hex dump.
Correct TX trace bug "Raw IR data, 0 pulse/space samples"
Add trace for MCE_RSP_TX_TIMEOUT "IR TX timeout (TX buffer underrun)"
Other changes:
The driver's write to USB device architecture change (async to sync I/O)
is significant so we bump DRIVER_VERSION to "1.95" (from "1.94").
Hex dumps limited to 64 bytes.
0x81 is MCE minimum time pulse, 0x01 is MCE minimum time space.
TX IR part 3 sz=11 shows 20msec I/O blocking delay
(100expire - 98wait = 2jiffies)
Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Christian Hewitt [Thu, 15 Aug 2019 14:59:17 +0000 (11:59 -0300)]
media: rc: add keymap for HardKernel ODROID remote
This is a simple NEC remote control device shipped with the HardKernel
ODROID range of SBC devices.
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Christian Hewitt [Thu, 15 Aug 2019 14:59:16 +0000 (11:59 -0300)]
media: rc: add keymap for WeTeK Play 2 remote
The WeTek Play 2 Android STB ships with an unusual remote where the
main up/down/left/right/enter controls are surrounded with an outer
ring of additional keys which are listed in clockwise order.
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Christian Hewitt [Thu, 15 Aug 2019 14:59:15 +0000 (11:59 -0300)]
media: rc: add keymap for WeTek Hub remote
The WeTek Hub Android STB ships with a simple NEC remote.
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Christian Hewitt [Thu, 15 Aug 2019 14:59:14 +0000 (11:59 -0300)]
media: rc: add keymap for Tanix TX5 max remote
The Tanix TX5 max Android STB ships with a simple NEC remote.
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Christian Hewitt [Thu, 15 Aug 2019 14:59:13 +0000 (11:59 -0300)]
media: rc: add keymap for Tanix TX3 mini remote
The Tanix TX3 mini Android STB ships with a simple NEC remote.
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Christian Hewitt [Thu, 15 Aug 2019 14:59:12 +0000 (11:59 -0300)]
media: rc: add keymap for Khadas VIM/EDGE remote
Khadas VIM and Edge SBC devices use the same NEC remote device. The
remote includes a mouse button for Android use. This has been mapped
to KEY_MUTE.
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Christian Hewitt [Thu, 15 Aug 2019 14:59:11 +0000 (11:59 -0300)]
media: rc: add keymap for Amediatech X96-MAX remote
The X96-Max Android STB ships with a simple NEC remote. It includes
a TV section with preset buttons for controlling a TV. These are not
configurable, but are noted to aid visual recognition of the device.
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Marc Gonzalez [Mon, 15 Jul 2019 09:50:29 +0000 (06:50 -0300)]
media: si2168: Refactor command setup code
Use cmd_init() to fill a struct si2168_cmd command.
Signed-off-by: Marc Gonzalez <marc.w.gonzalez@free.fr> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Sean Young [Sat, 3 Aug 2019 03:12:03 +0000 (00:12 -0300)]
media: dvb-frontends: use ida for pll number
KASAN: global-out-of-bounds Read in dvb_pll_attach
Syzbot reported global-out-of-bounds Read in dvb_pll_attach, while
accessing id[dvb_pll_devcount], because dvb_pll_devcount was 65,
that is more than size of 'id' which is DVB_PLL_MAX(64).
Rather than increasing dvb_pll_devcount every time, use ida so that
numbers are allocated correctly. This does mean that no more than
64 devices can be attached at the same time, but this is more than
sufficient.
usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the
software demuxer
dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0)
usb 1-1: media controller created
dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
tc90522 0-0018: Toshiba TC90522 attached.
usb 1-1: DVB: registering adapter 0 frontend 0 (Toshiba TC90522 ISDB-T
module)...
dvbdev: dvb_create_media_entity: media entity 'Toshiba TC90522 ISDB-T
module' registered.
==================================================================
BUG: KASAN: global-out-of-bounds in dvb_pll_attach+0x6c5/0x830
drivers/media/dvb-frontends/dvb-pll.c:798
Read of size 4 at addr ffffffff89c9e5e0 by task kworker/0:1/12
The buggy address belongs to the variable:
id+0x100/0x120
Memory state around the buggy address: ffffffff89c9e480: fa fa fa fa 00 00 fa fa fa fa fa fa 00 00 00 00 ffffffff89c9e500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffffffff89c9e580: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
^ ffffffff89c9e600: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa ffffffff89c9e680: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
==================================================================
Reported-by: syzbot+8a8f48672560c8ca59dd@syzkaller.appspotmail.com Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Tomasz Figa [Thu, 15 Aug 2019 14:44:51 +0000 (11:44 -0300)]
media: docs-rst: Document memory-to-memory video decoder interface
Due to complexity of the video decoding process, the V4L2 drivers of
stateful decoder hardware require specific sequences of V4L2 API calls
to be followed. These include capability enumeration, initialization,
decoding, seek, pause, dynamic resolution change, drain and end of
stream.
Specifics of the above have been discussed during Media Workshops at
LinuxCon Europe 2012 in Barcelona and then later Embedded Linux
Conference Europe 2014 in Düsseldorf. The de facto Codec API that
originated at those events was later implemented by the drivers we already
have merged in mainline, such as s5p-mfc or coda.
The only thing missing was the real specification included as a part of
Linux Media documentation. Fix it now and document the decoder part of
the Codec API.
Signed-off-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Add an enum_fmt format flag to specifically tag coded formats where
dynamic resolution switching is supported by the device.
This is useful for some codec drivers that can support dynamic
resolution switching for one or more of their listed coded formats. It
allows userspace to know whether it should extract the video parameters
itself, or if it can rely on the device to send V4L2_EVENT_SOURCE_CHANGE
when such changes are detected.
Signed-off-by: Maxime Jourdan <mjourdan@baylibre.com> Reviewed-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Reviewed-by: Alexandre Courbot <acourbot@chromium.org> Acked-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Add an enum_fmt format flag to specifically tag coded formats where
full bytestream parsing is supported by the device.
Some stateful decoders are capable of fully parsing a bytestream,
but others require that userspace pre-parses the bytestream into
frames or fields (see the corresponding pixelformat descriptions
for details).
If this flag is set, then this pre-parsing step is not required
(but still possible, of course).
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Reviewed-by: Alexandre Courbot <acourbot@chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Boris Brezillon [Fri, 16 Aug 2019 16:01:29 +0000 (13:01 -0300)]
media: hantro: Move copy_metadata() before doing a decode operation
Some decoders use intra slice/frame references. The capture buffer
pointed by these references might be new and thus have invalid
timestamp which prevents the decoder logic from retrieving the
vb2_buffer object based on the output buf timestamp.
Copy all metadata (including the timestamp) before starting the decode
operation.
Suggested-by: Jonas Karlman <jonas@kwiboo.se> Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Tested-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Boris Brezillon [Fri, 16 Aug 2019 16:01:26 +0000 (13:01 -0300)]
media: uapi: h264: Get rid of the p0/b0/b1 ref-lists
Those lists can be extracted from the dpb, let's simplify userspace
life and build that list kernel-side (generic helpers will be provided
for drivers that need this list).
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com> Reviewed-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Tested-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Ezequiel Garcia [Fri, 16 Aug 2019 16:01:25 +0000 (13:01 -0300)]
media: uapi: h264: Add the concept of start code
Stateless decoders have different expectations about the
start code that is prepended on H264 slices. Add a
menu control to express the supported start code types
(including no start code).
Drivers are allowed to support only one start code type,
but they can support both too.
Note that this is independent of the H264 decoding mode,
which specifies the granularity of the decoding operations.
Either in frame-based or slice-based mode, this new control
will allow to define the start code expected on H264 slices.
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> Tested-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Our list_sort() utility has always supported a context argument that
is passed through to the comparison routine. Now there's a use case
for the similar thing for sort().
This implements sort_r by simply extending the existing sort function
in the obvious way. To avoid code duplication, we want to implement
sort() in terms of sort_r(). The naive way to do that is
but this would do two indirect calls for each comparison. Instead, do
as is done for the default swap functions - that only adds a cost of a
single easily predicted branch to each comparison call.
Aside from introducing support for the context argument, this also
serves as preparation for patches that will eliminate the indirect
comparison calls in common cases.
Requested-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Acked-by: Andrew Morton <akpm@linux-foundation.org> Tested-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hugues Fruchet [Wed, 14 Aug 2019 13:48:53 +0000 (10:48 -0300)]
media: stm32-dcmi: add support of several sub-devices
Add support of several sub-devices within pipeline instead
of a single one.
This allows to support a CSI-2 camera sensor connected
through a CSI-2 to parallel bridge.
media: Clarify how menus are hidden by SUBDRV_AUTOSELECT
Some users have been having a hard time finding the hidden
menus. A typically case are camera sensor drivers
(e.g IMX219, OV5645, etc), which are common on embedded
platforms and not really "ancillary" devices.
The problem with MEDIA_SUBDRV_AUTOSELECT seems to be related
to the fact that it uses the "visible" syntax to hide
the menus.
This is not obvious and it normally takes some time to
figure out.
To fix the problem, add a comment on each of hidden menus,
which should clarify what option is causing menus to be hidden.
Ezequiel Garcia [Thu, 27 Jun 2019 22:29:12 +0000 (19:29 -0300)]
media: imx: mipi csi-2: Don't fail if initial state times-out
Not all sensors will be able to guarantee a proper initial state.
This may be either because the driver is not properly written,
or (probably unlikely) because the hardware won't support it.
While the right solution in the former case is to fix the sensor
driver, the real world not always allows right solutions, due to lack
of available documentation and support on these sensors.
Let's relax this requirement, and allow the driver to support stream start,
even if the sensor initial sequence wasn't the expected.
Also improve the warning message to better explain the problem and provide
a hint that the sensor driver needs to be fixed.
Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> Signed-off-by: Fabio Estevam <festevam@gmail.com> Reviewed-by: Steve Longerbeam <slongerbeam@gmail.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Steve Longerbeam [Tue, 13 Aug 2019 22:36:44 +0000 (19:36 -0300)]
media: docs-rst: Clarify duration of LP-11 mode
Add a sentence that makes it more clear when the CSI-2 transmitter
must, if possible, exit LP-11 mode. That is, maintain LP-11 mode
until stream on, at which point the transmitter activates the clock
lane and transition to HS mode.
Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Sakari Ailus [Tue, 13 Aug 2019 11:31:28 +0000 (08:31 -0300)]
media: v4l: Documentation: Raw Bayer formats are not RGB formats
The raw Bayer formats have been listed under the label of RGB formats but
in fact they're quite different. The latter are readily usable as such
whereas the former require quite bit of image processing before useful.
Split them into RGB and raw Bayer formats.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Sakari Ailus [Tue, 13 Aug 2019 11:26:43 +0000 (08:26 -0300)]
media: v4l: Documentation: Serial busses use parallel mbus codes
When the support for serial busses was introduced in V4L2, it was decided
to use the existing parallel bus media bus pixel codes to describe them.
While this was a practical choice at the time, it necessitates choosing
which one of the many parallel mbus pixel codes to use, for on the serial
busses these formats are effectively all equivalent.
The practice has always been to use the pixel code that describes a bus
that transfers a single sample per clock. Document this.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
- At set_power(1) time power up MIPI Tx/Rx and set data and clock lanes in
LP11 during 'sleep' and 'idle' with MIPI clock in non-continuous mode.
- At set_power(0) time power down MIPI Tx/Rx (in addition to the current
power down of regulators and clock gating).
- At s_stream time enable/disable the MIPI interface output.
With this commit the sensor is able to enter LP-11 mode during power up,
as expected by some CSI-2 controllers.
Many thanks to Fabio Estevam for his help debugging this issue.
Sakari Ailus [Wed, 7 Aug 2019 14:21:27 +0000 (11:21 -0300)]
media: omap3isp: Don't set streaming state on random subdevs
The streaming state should be set to the first upstream sub-device only,
not everywhere, for a sub-device driver itself knows how to best control
the streaming state of its own upstream sub-devices.