Local variable description: ----ircode@cxusb_rc_query
Variable was created at:
cxusb_rc_query+0x4d/0x360 drivers/media/usb/dvb-usb/cxusb.c:543
dvb_usb_read_remote_control+0xf9/0x290 drivers/media/usb/dvb-usb/dvb-usb-remote.c:261
Signed-off-by: Vito Caputo <vcaputo@pengaru.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Christian Hewitt [Fri, 11 Oct 2019 19:43:42 +0000 (16:43 -0300)]
media: rc: add keymap for Tronsmart Vega S95/S96 remote
Add a keymap for the Tronsmart Vega S95 and S96 Android (Amlogic S905/S912)
STB devices. Both use the same IR remote.
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Thomas Voegtle [Wed, 2 Oct 2019 17:26:03 +0000 (14:26 -0300)]
media: dvbsky: add support for eyeTV Geniatech T2 lite
Adds USB ID for the eyeTV Geniatech T2 lite to the dvbsky driver.
This is a Geniatech T230C based stick without IR and a different USB ID.
Signed-off-by: Thomas Voegtle <tv@lio96.de> Tested-by: Jan Pieter van Woerkom <jp@jpvw.nl> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Benoit Parrot [Mon, 7 Oct 2019 15:10:07 +0000 (12:10 -0300)]
media: v4l2-common: add pixel encoding support
It is often useful to figure out if a pixel_format is either YUV or RGB
especially for driver who can perform the pixel encoding conversion.
Instead of having each driver implement its own "is_this_yuv/rgb"
function based on a restricted set of pixel value, it is better to do
this in centralized manner.
We therefore add a pixel_enc member to the v4l2_format_info structure to
quickly identify the related pixel encoding.
And add helper functions to check pixel encoding.
Benoit Parrot [Mon, 7 Oct 2019 15:10:04 +0000 (12:10 -0300)]
media: ti-vpe: vpe: use standard struct instead of duplicating fields
For each queue we need to maintain resolutions, pixel format,
bytesperline, sizeimage, colorspace, etc.
Instead of manually adding more entries in the vpe_q_data struct, it is
better to just add a "struct v4l2_format" member and use that to store
all needed information.
Benoit Parrot [Mon, 7 Oct 2019 15:10:03 +0000 (12:10 -0300)]
media: ti-vpe: Set the DMA mask and coherent mask
VPE uses VPDMA (built-in dma engine) to transfer data to and from the IP
and memory. VPDMA expect 32 bits addresses. To make sure that is always
the case set the DMA mask and coherent mask for the device.
Benoit Parrot [Mon, 7 Oct 2019 15:10:02 +0000 (12:10 -0300)]
media: ti-vpe: vpdma: Use fixed type for address in descriptor
Using dma_addr_t as the type to hold address inside of a fix sized
descriptor used by the vpdma firmware is prone to fail when the expected
width is 32 bits and suddenly when CONFIG_LPAE is enabled the data size
is now 64 bits shifted the remaining members of the descriptor in memory
which confuses the firmware.
These warnings are caused by buffers which not properly cleaned
up/release during an abort use case.
In the abort cases the VPDMA desc buffers would still be mapped and the
in-flight VB2 buffers would not be released properly causing a kernel
warning from being generated by the videobuf2-core level.
Signed-off-by: Benoit Parrot <bparrot@ti.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Benoit Parrot [Mon, 7 Oct 2019 15:09:59 +0000 (12:09 -0300)]
media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage
v4l2-compliance fails with this message:
fail: v4l2-test-formats.cpp(463): !pfmt.sizeimage
fail: v4l2-test-formats.cpp(736): \
Video Capture Multiplanar is valid, \
but TRY_FMT failed to return a format
test VIDIOC_TRY_FMT: FAIL
This failure is causd by the driver failing to handle out range
'bytesperline' values from user space applications.
VPDMA hardware is limited to 64k line stride (16 bytes aligned, so 65520
bytes). So make sure the provided or calculated 'bytesperline' is
smaller than the maximum value.
Signed-off-by: Benoit Parrot <bparrot@ti.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Benoit Parrot [Mon, 7 Oct 2019 15:09:58 +0000 (12:09 -0300)]
media: ti-vpe: vpe: Make sure YUYV is set as default format
v4l2-compliance fails with this message:
fail: v4l2-test-formats.cpp(672): \
Video Capture Multiplanar: TRY_FMT(G_FMT) != G_FMT
fail: v4l2-test-formats.cpp(672): \
Video Output Multiplanar: TRY_FMT(G_FMT) != G_FMT
...
test VIDIOC_TRY_FMT: FAIL
The default pixel format was setup as pointing to a specific offset in
the vpe_formats table assuming it was pointing to the V4L2_PIX_FMT_YUYV
entry. This became false after the addition on the NV21 format (see
above commid-id)
So instead of hard-coding an offset which might change over time we need
to use a lookup helper instead so we know the default will always be what
we intended.
Signed-off-by: Benoit Parrot <bparrot@ti.com> Fixes: 40cc823f7005 ("media: ti-vpe: Add support for NV21 format") Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Benoit Parrot [Mon, 7 Oct 2019 15:09:57 +0000 (12:09 -0300)]
media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
v4l2-compliance warns with this message:
warn: v4l2-test-formats.cpp(717): \
TRY_FMT cannot handle an invalid pixelformat.
warn: v4l2-test-formats.cpp(718): \
This may or may not be a problem. For more information see:
warn: v4l2-test-formats.cpp(719): \
http://www.mail-archive.com/linux-media@vger.kernel.org/msg56550.html
...
test VIDIOC_TRY_FMT: FAIL
We need to make sure that the returns a valid pixel format in all
instance. Based on the v4l2 framework convention drivers must return a
valid pixel format when the requested pixel format is either invalid or
not supported.
Signed-off-by: Benoit Parrot <bparrot@ti.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Ram Prasad [Mon, 7 Oct 2019 15:09:55 +0000 (12:09 -0300)]
media: ti-vpe: Set MAX height supported to 2048 pixels
VPE's max height supported MAX_H is set to 1184 which is the
padded height from VC1 decoder output.
In case of 90, 270 degree rotated video processing, input to
VPE will be 1080x1920, 720x1280 etc and MAX_H needs to be set
correct value. Setting MAX_H to 2048 as worst case height.
SEQ_BT indicates the buffer for bottom field needs to be processed
before the top field.
Simplify the field selection logic to support SEQ_BT as well.
Modify the interlace flags to include any of alternate, SEQ_TB, SEQ_BT.
Update other format error checking to consider SEQ_BT.
Replace SEQ_TB with SEQ_XX wherever applicable.
Benoit Parrot [Mon, 7 Oct 2019 15:09:52 +0000 (12:09 -0300)]
media: ti-vpe: vpe: Remove unnecessary use of container_of
Instead of saving a pointer to the 'fh' member of struct vpe_ctx to
later have to use container_of to retrieve the actual pointer to the
context structure, which seems to confuse static code analysis tool
anyways, just save the pointer to the actual structure and then retrieve
it directly.
commit 3dc2046ca78b ("[media] media: ti-vpe: vpe: allow use of user
specified stride") and commit da4414eaed15 ("[media] media: ti-vpe: vpdma:
add support for user specified stride") resulted in the Motion Vector
stride to be the same as the image stride.
This caused memory corruption in the output image as mentioned in
commit 00db969964c8 ("[media] media: ti-vpe: vpe: Fix line stride
for output motion vector").
Fixes: 3dc2046ca78b ("[media] media: ti-vpe: vpe: allow use of user specified stride") Fixes: da4414eaed15 ("[media] media: ti-vpe: vpdma: add support for user specified stride") Signed-off-by: Benoit Parrot <bparrot@ti.com> Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Benoit Parrot [Mon, 7 Oct 2019 15:09:49 +0000 (12:09 -0300)]
media: ti-vpe: Fix a parallel build issue
When TI CAL was introduce as another driver under platform/ti-vpe
adding a second entry into the ti-vpe directory in the platform
Makefile caused issues during parallel build.
This control returns the unit cell size in nanometres. The struct provides
the width and the height in separated fields to take into consideration
asymmetric pixels and/or hardware binning.
This control is required for automatic calibration of sensors/cameras.
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Ricardo Ribalda Delgado <ribalda@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Currently compound controls do not have a simple way of initializing its
values. This results in ofuscated code with type_ops init.
This patch introduces a new field on the control with the default value
for the compound control that can be set with the brand new
v4l2_ctrl_new_std_compound function
media: rcar-vin: Use bytes per line instead of width for UV offset
The image size is doubled for NV16 and is calculated as bytesperline *
height * 2 to accommodate the split of UV data. When writing the offset
to hardware, the width is used instead of bytesperline, fix this.
Steve Longerbeam [Sat, 24 Aug 2019 16:33:37 +0000 (13:33 -0300)]
media: imx: Move pads init to probe
If a subdevice is unregistered and then registered again without the
driver being removed and re-probed (which will happen when the media
device is removed and re-probed without also removing/re-probing the
subdevice), media_device_register_entity() is called with a non-zero
entity->num_pads, and then the subdevice's .registered callback calls
media_entity_pads_init(). Thus the subdevice's pad objects are added
to the media device pad list twice, causing list corruption.
One way to fix this would be to create media_entity_pads_destroy(),
and call it in the subdevice's .unregistered callback. But calling
media_entity_pads_init() in the .registered callbacks was done for
legacy reasons and is no longer necessary, so move the call to
media_entity_pads_init() into the subdevice's probe functions. This
fixes the duplicate pad obejcts in the media device pad list.
Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Steve Longerbeam [Sat, 24 Aug 2019 16:33:36 +0000 (13:33 -0300)]
media: imx: Move capture device init to registered
If the CSI is unregistered and then registered again without the
driver being removed and re-probed (which will happen when the media
device is removed and re-probed without also removing/re-probing the
CSI), the result is the kobject error and backtrace "tried to init an
initialized object". This is because the video device is left in an
initialized state after being unregistered, thus the video device's
underlying kobject is also left in an initialized state when the device
is registered again.
Fix this by moving imx_media_capture_device_init() and _remove()
into csi_registered() and csi_unregistered(). This will create a new
un-initialized video device when the CSI is re-registered. Do this for
all the subdevices that register a capture device.
Reported-by: Russell King <linux@armlinux.org.uk> Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
media: rcar-vin: Create compose rectangle where it is used
The rectangle used to correct the compose settings when changing the
format was created inside a helper function and not where it was used.
This is confusing and makes the code harder to read, fix this.
This cleanup is made possible due to refactoring elsewhere and there is
no functional change.
After recent refactoring the rectangle named crop no longer reflects it
usage, to contain the source rectangle. Fix this by renaming it. There
is no functional change.
Alan Stern [Mon, 7 Oct 2019 15:09:53 +0000 (12:09 -0300)]
media: usbvision: Fix races among open, close, and disconnect
Visual inspection of the usbvision driver shows that it suffers from
three races between its open, close, and disconnect handlers. In
particular, the driver is careful to update its usbvision->user and
usbvision->remove_pending flags while holding the private mutex, but:
usbvision_v4l2_close() and usbvision_radio_close() don't hold
the mutex while they check the value of
usbvision->remove_pending;
usbvision_disconnect() doesn't hold the mutex while checking
the value of usbvision->user; and
also, usbvision_v4l2_open() and usbvision_radio_open() don't
check whether the device has been unplugged before allowing
the user to open the device files.
Each of these can potentially lead to usbvision_release() being called
twice and use-after-free errors.
This patch fixes the races by reading the flags while the mutex is
still held and checking for pending removes before allowing an open to
succeed.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Alan Stern [Mon, 7 Oct 2019 15:09:04 +0000 (12:09 -0300)]
media: usbvision: Fix invalid accesses after device disconnect
The syzbot fuzzer found two invalid-access bugs in the usbvision
driver. These bugs occur when userspace keeps the device file open
after the device has been disconnected and usbvision_disconnect() has
set usbvision->dev to NULL:
When the device file is closed, usbvision_radio_close() tries
to issue a usb_set_interface() call, passing the NULL pointer
as its first argument.
If userspace performs a querycap ioctl call, vidioc_querycap()
calls usb_make_path() with the same NULL pointer.
This patch fixes the problems by making the appropriate tests
beforehand. Note that vidioc_querycap() is protected by
usbvision->v4l2_lock, acquired in a higher layer of the V4L2
subsystem.
Reported-and-tested-by: syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Colin Ian King [Mon, 7 Oct 2019 10:18:48 +0000 (07:18 -0300)]
media: gspca: make array st6422_bridge_init static, makes object smaller
Don't populate the array st6422_bridge_init on the stack but instead
make it static. Makes the object code smaller by 231 bytes.
Before:
text data bss dec hex filename
3419 752 64 4235 108b gspca/stv06xx/stv06xx_st6422.o
After:
text data bss dec hex filename
3124 816 64 4004 fa4 gspca/stv06xx/stv06xx_st6422.o
(gcc version 9.2.1, amd64)
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Colin Ian King [Mon, 7 Oct 2019 09:52:40 +0000 (06:52 -0300)]
media: cx18: make array mapping static, makes object smaller
Don't populate the array mapping on the stack but instead make it
static. Makes the object code smaller by 79 bytes.
Before:
text data bss dec hex filename
27572 2096 0 29668 73e4 drivers/media/pci/cx18/cx18-ioctl.o
After:
text data bss dec hex filename
27429 2160 0 29589 7395 drivers/media/pci/cx18/cx18-ioctl.o
(gcc version 9.2.1, amd64)
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
media: staging: media: imx: Use devm_platform_ioremap_resource().
This patch fixes a warning by coccicheck:
drivers/staging/media/imx/imx7-mipi-csis.c:973:1-12: WARNING: Use devm_platform_ioremap_resource for state -> regs
Use devm_platform_ioremap_resource helper which wraps platform_get_resource()
and devm_ioremap_resource() together.
Signed-off-by: Jeeeun Evans <jeeeunevans@gmail.com> Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Add support for the PCI hybrid card NotOnlyTV LV3H. This card consists of:
- A/V Controller: Conexant CX-23883
- Tuner: Xceive XC3028L
- DVB-T Decoder: Zarlink ZL10353
This patch adds support for DVB-T, Analog TV, FM radio, composite and
S-video inputs. The IR input isn't supported.
Since the PCI subsystem ID (14f1:8852) is the same as the Geniatech
X8000-MT, but they are different boards, the card is only supported via
insmod option: options cx88xx card=91
For the record this is the eeprom dump, useful if someone wanted to
implement the card auto detection:
media: i2c: Use div64_ul() for u64-by-unsigned-long divide
div_u64() does a 64-by-32 division, while the divisor max2175.xtal_freq
is unsigned long, thus 64-bit on 64-bit platforms. Hence the proper
function to call is div64_ul().
Note that this change does not have any functional impact, as the
crystal frequency must be much lower than the 32-bit limit anyway.
On 32-bit platforms, the generated code is the same. But at least on
arm64, this saves an AND-instruction to truncate xtal_freq to 32-bit.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Simon Horman <horms+renesas@verge.net.au> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Yizhuo [Fri, 30 Aug 2019 00:43:59 +0000 (21:43 -0300)]
media: media/pci/ivtv: Variable vbi.type could be uninitialized if macro v4l2_subdev_call set __result an error code
Inside function compress_sliced_buf(), variable vbi.type is
uninitialized if macro v4l2_subdev_call set __result an
error code. However, vbi.type is used in the if statement
without any check, which is potentially unsafe.
Gon Solo [Thu, 10 Oct 2019 09:51:03 +0000 (06:51 -0300)]
media: af9035: add support for Logilink VG0022A.
This includes a hack for the device as it returns only 0xff after a new
firmware is loaded. To quote Mauro:
"When the [...] firmware that came with the device is replaced
by a new one, any I2C data received from the tuner will be
replaced by 0xff.
Probably, the vendor firmware has some patch specifically
designed for this device. So, we can't replace by the generic
firmware.
The right solution would be to extract the [...] firmware from
the original driver and ask the driver to load the specifically
designed firmware, but, while we don't have that, the next best
solution is to just keep the original firmware at the device."
Signed-off-by: Gon Solo <gonsolo@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Hans Verkuil [Tue, 1 Oct 2019 07:56:38 +0000 (04:56 -0300)]
media: cec-funcs.h: add status_req checks
The CEC_MSG_GIVE_DECK_STATUS and CEC_MSG_GIVE_TUNER_DEVICE_STATUS commands
both have a status_req argument: ON, OFF, ONCE. If ON or ONCE, then the
follower will reply with a STATUS message. Either once or whenever the
status changes (status_req == ON).
If status_req == OFF, then it will stop sending continuous status updates,
but the follower will *not* send a STATUS message in that case.
This means that if status_req == OFF, then msg->reply should be 0 as well
since no reply is expected in that case.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Yang Yingliang [Tue, 24 Sep 2019 09:49:04 +0000 (06:49 -0300)]
media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
If usb_set_interface() failed, iface->cur_altsetting will
not be assigned and it will be used in flexcop_usb_transfer_init()
It may lead a NULL pointer dereference.
Check usb_set_interface() return value in flexcop_usb_init()
and return failed to avoid using this NULL pointer.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Akihiro Tsukada [Thu, 29 Aug 2019 08:38:21 +0000 (05:38 -0300)]
media: dvb-frontends/tc90522: extend i2c algo to support some devices
This demod implements an i2c adapter for attached tuner
and relays i2c messages from users (dvb adapters / bridge chips).
Some of them, such as Friio dvb card using gl861,
require each pair of i2c messages for one read to be issued as
two separate transactions.
This patch adds a configuration option to enable this split.
Signed-off-by: Akihiro Tsukada <tskd08@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
For Friio dvb cards, a distinct I2C algo was provided to support
some "long" I2C messages used in relaying tuner I2C via demod.
Since the other (generic) i2c algo in this module has been patched
to support those messages in a more generic way,
this patch replaces and integrates the device-specific i2c algo
with the generic one and simplifies the code.
Signed-off-by: Akihiro Tsukada <tskd08@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Antti Palosaari [Fri, 23 Aug 2019 23:53:37 +0000 (20:53 -0300)]
media: gl861: re-implement I2C adapter logic
Device I2C adapter is capable of writing and reading large messages.
For I2C writes there is 2 methods: simple for max 2 byte messages and
usb_control_msg() with payload data for larger I2C messages. Add I2C
adapter logic which selects suitable method according to message size.
Add also support for plain I2C read.
Cc: Akihiro TSUKADA <tskd08@gmail.com> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Andrei Koshkosh [Sun, 29 Sep 2019 08:04:05 +0000 (05:04 -0300)]
media: dvbsky: use a single mutex and state buffers for all R/W ops
Re-use usb_mutex from dvb_usb_device for this.
Tested-by: Jan Pieter van Woerkom <jp@jpvw.nl> Signed-off-by: Andrei Koshkosh <andreykosh000@mail.ru> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Colin Ian King [Thu, 1 Aug 2019 16:09:58 +0000 (13:09 -0300)]
media: drxj: remove redundant assignment to variable rc
The variable rc is being initialized with a value that is never
read and it is being updated later with a new value. The
initialization is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
media: usb: tm6000: Use the correct style for SPDX License Identifier
This patch corrects the SPDX License Identifier style
in header files for TV Master Media USB Adapter drivers.
For C header files Documentation/process/license-rules.rst
mandates C-like comments (opposed to C source files where
C++ style should be used)
Changes made by using a script provided by Joe Perches here:
https://lkml.org/lkml/2019/2/7/46.
Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Nishad Kamdar <nishadkamdar@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Markus Elfring [Wed, 18 Sep 2019 10:30:18 +0000 (07:30 -0300)]
media: rc: Use devm_platform_ioremap_resource() in tango_ir_probe()
Simplify this function implementation by using a known wrapper function.
This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Acked-by: Mans Rullgard <mans@mansr.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
media: rc: Use the correct style for SPDX License Identifier
This patch corrects the SPDX License Identifier style
in header file related to Remote Controller Driver for Linux.
For C header files Documentation/process/license-rules.rst
mandates C-like comments (opposed to C source files where
C++ style should be used)
Changes made by using a script provided by Joe Perches here:
https://lkml.org/lkml/2019/2/7/46.
Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Nishad Kamdar <nishadkamdar@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Colin Ian King [Thu, 5 Sep 2019 17:57:26 +0000 (14:57 -0300)]
media: cxd2820r: make arrays tab static const, makes object smaller
Don't populate the array tab on the stack but instead make it
static const. Makes the object size smaller by 170 bytes in total.
Before:
text data bss dec hex filename
7045 1736 0 8781 224d media/dvb-frontends/cxd2820r_c.o
8800 2216 0 11016 2b08 media/dvb-frontends/cxd2820r_t.o
8981 2120 0 11101 2b5d media/dvb-frontends/cxd2820r_t2.o
After:
text data bss dec hex filename
6896 1832 0 8728 2218 media/dvb-frontends/cxd2820r_c.o
8651 2312 0 10963 2ad3 media/dvb-frontends/cxd2820r_t.o
8853 2184 0 11037 2b1d media/dvb-frontends/cxd2820r_t2.o
(gcc version 9.2.1, amd64)
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Sean Young [Sat, 31 Aug 2019 08:37:39 +0000 (05:37 -0300)]
media: rtl28xxu: fix idle handling
Currently the IR receiver is put into idle mode after each interrupt.
However longer IR like NEC can be distributed over multiple interrupts,
so putting the IR into idle in the middle of such a message will break
decoding.
Every IR message has a trailing space of 0xbf (one less than
IR_IDE_LEN{0,1} which is programmed to 0xc0). So, set the timeout to that
value and rc-core will put the IR receiver into idle mode automatically.
Thanks to Jan Pieter van Woerkom <jp@jpvw.nl> for providing the hardware.
Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
media: rc: Add support for another iMON 0xffdc device
The device it's an iMON UltraBay (0x98 in config byte) with LCD,
IR and dual-knobs front panel.
To work properly the device also require its own key table,
and repeat suppression for all buttons.
Signed-off-by: Flavius Georgescu <pretoriano.mp@gmail.com> Co-developed-by: Chris Vandomelen <chris@sightworks.com> Signed-off-by: Chris Vandomelen <chris@sightworks.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
A Sun [Fri, 6 Sep 2019 12:17:20 +0000 (09:17 -0300)]
media: mceusb: fix out of bounds read in MCE receiver buffer
Fix multiple cases of out of bounds (OOB) read associated with
MCE device receive/input data handling.
In reference for the OOB cases below, the incoming/read (byte) data
format when the MCE device responds to a command is:
{ cmd_prefix, subcmd, data0, data1, ... }
where cmd_prefix are:
MCE_CMD_PORT_SYS
MCE_CMD_PORT_IR
and subcmd examples are:
MCE_RSP_GETPORTSTATUS
MCE_RSP_EQIRNUMPORTS
...
Response size dynamically depends on cmd_prefix and subcmd.
So data0, data1, ... may or may not be present on input.
Multiple responses may return in a single receiver buffer.
The trigger condition for OOB read is typically random or
corrupt input data that fills the mceusb receiver buffer.
Case 1:
mceusb_handle_command() reads data0 (var hi) and data1 (var lo)
regardless of whether the response includes such data.
If { cmd_prefix, subcmd } is at the end of the receiver buffer,
read past end of buffer occurs.
This case was reported by
KASAN: slab-out-of-bounds Read in mceusb_dev_recv
https://syzkaller.appspot.com/bug?extid=c7fdb6cb36e65f2fe8c9
Fix: In mceusb_handle_command(), change variable hi and lo to
pointers, and dereference only when required.
Case 2:
If response with data is truncated at end of buffer after
{ cmd_prefix, subcmd }, mceusb_handle_command() reads past
end of buffer for data0, data1, ...
Fix: In mceusb_process_ir_data(), check response size with
remaining buffer size before invoking mceusb_handle_command().
+ if (i + ir->rem < buf_len)
mceusb_handle_command(ir, &ir->buf_in[i - 1]);
Case 3:
mceusb_handle_command() handles invalid/bad response such as
{ 0x??, MCE_RSP_GETPORTSTATUS } of length 2 as a response
{ MCE_CMD_PORT_SYS, MCE_RSP_GETPORTSTATUS, data0, ... }
of length 7. Read OOB occurs for non-existent data0, data1, ...
Cause is mceusb_handle_command() does not check cmd_prefix value.
Fix: mceusb_handle_command() must test both cmd_prefix and subcmd.
Case 4:
mceusb_process_ir_data() receiver parser state SUBCMD is
possible at start (i=0) of receiver buffer resulting in buffer
offset=-1 passed to mceusb_dev_printdata().
Bad offset results in OOB read before start of buffer.
[1214218.580308] mceusb 1-1.3:1.0: rx data[0]: 00 80 (length=2)
[1214218.580323] mceusb 1-1.3:1.0: Unknown command 0x00 0x80
...
[1214218.580406] mceusb 1-1.3:1.0: rx data[14]: 7f 7f (length=2)
[1214218.679311] mceusb 1-1.3:1.0: rx data[-1]: 80 90 (length=2)
[1214218.679325] mceusb 1-1.3:1.0: End of raw IR data
[1214218.679340] mceusb 1-1.3:1.0: rx data[1]: 7f 7f (length=2)
Fix: If parser_state is SUBCMD after processing receiver buffer,
reset parser_state to CMD_HEADER.
In effect, discard cmd_prefix at end of receiver buffer.
In mceusb_dev_printdata(), abort if buffer offset is out of bounds.
Case 5:
If response with data is truncated at end of buffer after
{ cmd_prefix, subcmd }, mceusb_dev_printdata() reads past
end of buffer for data0, data1, ...
while decoding the response to print out.
Fix: In mceusb_dev_printdata(), remove unneeded buffer offset
adjustments (var start and var skip) associated with MCE gen1 header.
Test for truncated MCE cmd response (compare offset+len with buf_len)
and skip decoding of incomplete response.
Move IR data tracing to execute before the truncation test.
Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Current clock scaling calculations are same for vpu4 and
previous versions. For vpu4, Clock scaling calculations
are updated with cycles/mb and bitrate. This helps in
getting precise clock required.
Add vpp cycles for different types of codec.
It indicates the cycles required by video hardware
to process each macroblock. Add vsp cycles, cycles
required by stream processor. Initialize the codec
data with core resources.
media: venus: Fix occasionally failures to suspend
Failure to suspend (venus_suspend_3xx) happens when the system
is fresh booted and loading venus driver. This happens once and
after reload the venus driver modules the problem disrepair.
Fix the failure by skipping the check for WFI and IDLE bits if
PC_READY is on in control status register.
This aims to add a requests for bandwidth scaling depending
on the resolution and framerate (macroblocks per second). The
exact value of the requested bandwidth is get from a
pre-calculated tables for encoder and decoder.
It shows that encoder always needs a higher clock than decoder.
In current venus driver, the unified frequency table is aligned
with the downstream decoder table which causes performance issues
in encoding scenarios. Fix that by aligning frequency table on
worst case (encoding).
The initial registers sequence is only loaded at probe
time. Afterward only the resolution and format specific
register are modified. Care must be taken to make sure
registers modified by one resolution setting are reverted
back when another resolution is programmed.
On some board it is possible that the sensor 'powerdown' and or 'reset'
pin might be controlled by gpio instead of being tied.
To implement we add pm_runtime support which will handle the power
up/down sequence when it is available otherwise the sensor will be
powered on at module insertion/probe and powered off at module removal.
Now originally the driver assumed that the sensor would always stay
powered and keep its register setting. We cannot assume this anymore, so
every time we "power up" we need to re-program the initial registers
configuration first. This was previously done only at probe time.
media: i2c: ov2659: Fix sensor detection to actually fail when device is not present
Make sure that if the expected sensor device id register
is not recognized properly the failure is propagated
up so devices are not left partially initialized.
media: i2c: ov2659: Fix for image wrap-around in lower resolution
Based on recently found sensor configuration examples, it was
discovered that when scaling and binning are used for the lower
resolutions (i.e. 640x480, 320x240) the read offset has to be
increased otherwise the image appears to be wrapped around.
media: i2c: ov5695: Modify the function of async register subdev related devices
This patch adds support for registering a sensor sub-device to the async
sub-device framework and parse set up common sensor related devices such as
actuator/VCM.
[Sakari Ailus: Rewrap commit message]
Signed-off-by: Dongchun Zhu <dongchun.zhu@mediatek.com> Reviewed-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
projects / linux.git / log