Hans Verkuil [Sun, 17 Jul 2016 08:16:40 +0000 (05:16 -0300)]
[media] cec: zero unused msg part after msg->len
Ensure that the unused part of the msg array is zeroed. This is
required by CEC 2.0 when receiving shorter messages than expected.
In that case the remaining bytes are assumed to be 0.
There are no such CEC messages yet, but it is required to be future proof.
And since we're doing it for received messages, do it for transmitted
messages as well. It's unambiguous this way.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Hans Verkuil [Sat, 16 Jul 2016 12:59:18 +0000 (09:59 -0300)]
[media] cec: don't set fh to NULL in CEC_TRANSMIT
The filehandle was set to NULL when in non-blocking mode or when
no reply is needed.
This is wrong: the filehandle is needed in non-blocking mode to ensure
that the result of the transmit can be obtained through CEC_RECEIVE.
And the 'reply' check was also incorrect since it should have checked the
timeout field (the reply can be 0). In any case, when in blocking mode
there is no need to set the fh to NULL either.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Now driver returns correct values for DVB-C:
SNR (in dB)
[mchehab@s-opensource.com: fix a new function to be static] Signed-off-by: Abylay Ospan <aospan@netup.ru> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[media] cxd2841er: Reading BER and UCB for DVB-C added
now driver returns correct values for DVB-C:
BER (post_bit_count and post_bit_error values)
UCB (count of uncorrected errors)
also, some code cleanup was done - checkpatch.pl now is happy
[media] cxd2841er: fix signal strength scale for ISDB-T
The scale for ISDB-T was wrong too: it was inverted, and
on a relative scale.
Use a linear interpolation to make it look better.
The formula was empirically determined, using 3 frequencies
(175 MHz, 410 MHz and 800 MHz), measuring from -50dBm to
-12dBm in steps of 0.5dB.
Instead of using a relative frequency range, calibrate it to
show the results in dB. The callibration was done getting
samples with a signal generated from -50dBm to -12dBm,
incremented in steps of 0.5 dB, using 3 frequencies:
175 MHz, 410 MHz and 800 MHz. The modulated signal was
using QAM64, and it was used a linear interpolation of all
the results.
[media] cxd2841er: provide signal strength for DVB-C
Currently, there's no stats for DVB-C. Let's at least return
signal strength. The scale is different than on DVB-T, so let's
use a relative scale, for now.
[media] cxd2841er: fix BER report via DVBv5 stats API
What userspace expects is to receive both bit_error and bit_count
counters. So, instead of doing the division at the Kernel,
return the counters for userspace to handle it the way it
wants.
Colin Ian King [Fri, 15 Jul 2016 15:59:15 +0000 (12:59 -0300)]
[media] mb86a20s: apply mask to val after checking for read failure
Appling the mask 0x0f to the immediate return of the call to
mb86a20s_readreg will always result in a positive value, meaning that the
check of ret < 0 will never work. Instead, check for a -ve return value
first, and then mask val with 0x0f.
Kudos to Mauro Carvalho Chehab for spotting the mistake in my original fix.
Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[media] airspy: fix error logic during device register
This patch addresses CVE-2016-5400, a local DOS vulnerability caused by
a memory leak in the airspy usb device driver.
The vulnerability is triggered when more than 64 usb devices register
with v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.A badusb device can
emulate 64 of these devices then through continual emulated
connect/disconnect of the 65th device, cause the kernel to run out of
RAM and crash the kernel.
The vulnerability exists in kernel versions from 3.17 to current 4.7.
The memory leak is caused by the probe function of the airspy driver
mishandeling errors and not freeing the corresponding control structures
when an error occours registering the device to v4l2 core.
Signed-off-by: James Patrick-Evans <james@jmp-e.com> Cc: stable@vger.kernel.org # Up to Kernel 3.17 Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Hans Verkuil [Fri, 15 Jul 2016 14:13:49 +0000 (11:13 -0300)]
[media] cec: set timestamp for selfie transmits
Attempts to send CEC messages to yourself are detected in the framework and
returned with a NACK error. However, the tx_ts was never filled in that case.
So just set it.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
When calculate OUTPUT buffer size in vidioc_try_fmt, it will
add more size hw need in each plane.
But in mtk_vcodec_enc_set_default_params, it do not add
same size in each plane.
This makes v4l2-compliance test fail.
This patch fix the issue.
Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Hans Verkuil [Wed, 13 Jul 2016 07:33:58 +0000 (04:33 -0300)]
[media] cec: don't zero reply and timeout on error
There is really no reason to zero the reply and timeout fields if an
error occurs. This is a left-over from earlier versions where that
was used to signal errors, but this is now handled by the rx/tx_status
fields.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
The newly added mtk-vcodec driver produces a number of warnings in an
ARM allmodconfig build, mainly since it assumes that dma_addr_t is
32-bit wide:
mtk-vcodec/venc/venc_vp8_if.c: In function 'vp8_enc_alloc_work_buf':
mtk-vcodec/venc/venc_vp8_if.c:212:191: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
mtk-vcodec/venc/venc_h264_if.c: In function 'h264_enc_alloc_work_buf':
mtk-vcodec/venc/venc_h264_if.c:297:190: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
This rearranges the format strings and type casts to what they should
have been in order to avoid the warnings. e0f80d8d62f5 ("[media]
mtk-vcodec: fix two compiler warnings") fixed some of the problems that
were introduced at the same time, but missed two others.
Sean Young [Sun, 10 Jul 2016 16:34:37 +0000 (13:34 -0300)]
[media] redrat3: fix timeout handling
The redrat3 sends an usb packet to the host either when the minimum pause
or the timeout occurs, so we can always add a trailing space in our
processing.
Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Stefan Pöschel [Mon, 11 Jul 2016 17:31:59 +0000 (14:31 -0300)]
[media] af9035: fix dual tuner detection with PCTV 79e
The value 5 of the EEPROM_TS_MODE register (meaning dual tuner presence) is
only valid for AF9035 devices. For IT9135 devices it is invalid and led to a
false positive dual tuner mode detection with PCTV 79e.
Therefore on non-AF9035 devices and with value 5 the driver now defaults to
single tuner mode and outputs a regarding info message to log.
This fixes Bugzilla bug #118561.
Reported-by: Marc Duponcheel <marc@offline.be> Signed-off-by: Stefan Pöschel <basic.master@gmx.de> Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[media] rc: nuvoton: fix hang if chip is configured for alternative EFM IO address
If a system configures the Nuvoton chip to use the alternative
EFM IO address (CR_EFIR2) then after probing the primary EFM IO
address (CR_EFIR) this region is not released.
If a driver for another function of the Nuvoton Super I/O
chip uses the same probing mechanism then it will hang if
loaded after the nuvoton-cir driver.
This was reported for the nct6775 hwmon driver.
Fix this by properly releasing the region after probing CR_EFIR.
This regression was introduced with kernel 4.6 so cc it to stable.
Max Kellermann [Mon, 4 Jul 2016 12:08:45 +0000 (14:08 +0200)]
[media] dvb-core/en50221: use kref to manage struct dvb_ca_private
Don't free the object until the file handle has been closed. Fixes
use-after-free bug which occurs when I disconnect my DVB-S received
while VDR is running.
Max Kellermann [Mon, 4 Jul 2016 12:08:51 +0000 (09:08 -0300)]
[media] dvb_frontend: eliminate blocking wait in dvb_unregister_frontend()
The wait_event() call in dvb_unregister_frontend() waits synchronously
for other tasks to free a file descriptor, but it does that while
holding several mutexes. That alone is a bad idea, but if one user
process happens to keep a (defunct) file descriptor open indefinitely,
the kernel will correctly detect a hung task:
When opening or closing a lirc character device, the framework
provides to the user the possibility to keep track of opening or
closing of the device by calling two functions:
- set_use_inc() when opening the device
- set_use_dec() when closing the device
if those are not set by the lirc user, the system segfaults.
Check the pointer value before calling the above functions.
If ioctl is called, it cannot be a case of invalid system call
number (ENOSYS), that is a ENOTTY case which means that the
device doesn't support that specific ioctl command.
When comparing a variable with a constant, the comparison should
start from the variable and not from the constant. It's also
written in the human DNA.
Swap the terms of comparisons whenever the constant comes first
and fix the following checkpatch warning:
WARNING: Comparisons should place the constant on the right side of the test
Transmitters don't necessarily need to have a FIFO managed buffer
for their transfers.
When registering the driver, before allocating the buffer, check
whether the device is a transmitter or receiver. Allocate the
buffer only for receivers.
Arnd Bergmann [Thu, 30 Jun 2016 12:23:03 +0000 (09:23 -0300)]
[media] vsp1: clarify FCP dependency
The newly added FCP support in the vsp1 driver causes a link error
when CONFIG_RENESAS_FCP=m, since it's not reachable by built-in code:
drivers/media/built-in.o: In function `vsp1_remove':
:(.text+0xdeca0): undefined reference to `rcar_fcp_put'
drivers/media/built-in.o: In function `vsp1_probe':
:(.text+0xdef44): undefined reference to `rcar_fcp_get'
We already have a conditional dependency on FCP that requires
it for ARM64, so for all others we just have to prevent setting
RENESAS_VSP1=y when RENESAS_FCP=m by extending the FCP dependency.
Arnd Bergmann [Thu, 30 Jun 2016 12:23:02 +0000 (09:23 -0300)]
[media] vsp1: use __maybe_unused for PM handlers
Building without CONFIG_PM results in a harmless warning from
slightly incorrect #ifdef guards:
drivers/media/platform/vsp1/vsp1_drv.c:525:12: error: 'vsp1_pm_runtime_resume' defined but not used [-Werror=unused-function]
drivers/media/platform/vsp1/vsp1_drv.c:516:12: error: 'vsp1_pm_runtime_suspend' defined but not used [-Werror=unused-function]
This removes the existing #ifdef and instead marks all four
PM functions as __maybe_unused.
* topic/vsp1: (36 commits)
[media] v4l: vsp1: wpf: Add flipping support
[media] v4l: vsp1: rwpf: Support runtime modification of controls
[media] v4l: vsp1: Simplify alpha propagation
[media] v4l: vsp1: clu: Support runtime modification of controls
[media] v4l: vsp1: lut: Support runtime modification of controls
[media] v4l: vsp1: Support runtime modification of controls
[media] v4l: vsp1: Add Cubic Look Up Table (CLU) support
[media] v4l: vsp1: lut: Expose configuration through a control
[media] v4l: vsp1: lut: Initialize the mutex
[media] v4l: vsp1: dl: Don't free fragments with interrupts disabled
[media] v4l: vsp1: Set entities functions
[media] v4l: vsp1: Don't create LIF entity when the userspace API is enabled
[media] v4l: vsp1: Don't register media device when userspace API is disabled
[media] v4l: vsp1: Base link creation on availability of entities
[media] media: Add video statistics computation functions
[media] media: Add video processing entity functions
[media] v4l: vsp1: sru: Fix intensity control ID
[media] v4l: vsp1: Stop the pipeline upon the first STREAMOFF
[media] v4l: vsp1: Constify operation structures
[media] v4l: vsp1: pipe: Fix typo in comment
...
[media] tw686x: use a formula instead of two tables for div
Instead of using two tables to estimate the temporal decimation
factor, use a formula. This allows to get the closest fps, which
sounds better than the current tables.
Also, the current code doesn't store the real framerate.
This patch fixes the above issues.
[Ezequiel:
- introduce a TW686X_MAX_FPS macro for max_fps.
- use hweight_long instead of open coding the set bits count.]
Dan Carpenter [Mon, 27 Jun 2016 14:29:46 +0000 (11:29 -0300)]
[media] dvb-usb: silence an uninitialized variable warning
My static checker complains that if adap->props.num_frontends is 0 then
"ret" is uninitialized. I don't think that can happen. But "ret" is
always zero here so we can just remove the condition.
This extra check was added in commit 0d3ab8410dcb ('[media] dvb core:
must check dvb_create_media_graph()').
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Colin Ian King [Fri, 24 Jun 2016 18:00:24 +0000 (15:00 -0300)]
[media] netup_unidvb: trivial fix of spelling mistake "initizalize" -> "initialize"
trivial fix to spelling mistake in dev_err message
Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Abylay Ospan <aospan@netup.ru> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[media] vcodec: mediatek: Fix return value check in mtk_vcodec_init_enc_pm()
In case of error, the function devm_clk_get() returns ERR_PTR()
and not returns NULL. The NULL test in the return value check
should be replaced with IS_ERR().
[media] VPU: mediatek: fix return value check in mtk_vpu_probe()
In case of error, the function devm_clk_get() returns ERR_PTR()
and not returns NULL. The NULL test in the return value check
should be replaced with IS_ERR().
Hans Verkuil [Tue, 12 Jul 2016 14:10:42 +0000 (11:10 -0300)]
[media] cec: split the timestamp into an rx and tx timestamp
When transmitting a message and waiting for a reply it would be good
to know the time between when the message was transmitted and when
the reply arrived. With only one timestamp field it was set to when
the reply arrived and the original transmit time was overwritten.
Just taking the timestamp in userspace right before CEC_TRANSMIT is
called is not reliable, since the actual transmit can be delayed if
the CEC bus is busy. Only the driver can fill this in accurately.
So split up the ts field into an rx_ts and a tx_ts. Also move the
status fields to after the 'reply' field: they were placed in a
strange position and make much more sense when grouped with the
other status-related fields.
This patch also makes sure that the timestamp is taken as soon as
possible.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[media] Remove spurious blank lines in dw2101 kernel messages
The DW2102 DVB-S/S2 driver uses the info() logging function from
dvb-usb.h. This function already appends a newline to the provided log
message, causing the dmesg output from DW2102 to include blank lines.
Fix this by removing the newline in the calls to info().
Signed-off-by: Jonathan McDowell <noodles@earth.li> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Andrew Morton [Tue, 12 Jul 2016 22:30:55 +0000 (15:30 -0700)]
[media] cec-adap.c: work around gcc-4.4.4 anon union initializer bug
drivers/staging/media/cec/cec-adap.c: In function 'cec_queue_msg_fh':
drivers/staging/media/cec/cec-adap.c:141: error: unknown field 'lost_msgs' specified in initializer
Stephen Backway [Sat, 2 Jul 2016 09:46:23 +0000 (06:46 -0300)]
[media] cx23885: Add support for Hauppauge WinTV quadHD DVB version
Add support fo the Hauppauge WinTV quadHD DVB version.
IR support has not been provided, all 4 tuners, demodulators etc are working.
Further documentation can be found on Linux TV wiki.
Signed-off-by: Stephen Backway <stev391@gmail.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Hans Verkuil [Sun, 10 Jul 2016 13:11:17 +0000 (10:11 -0300)]
[media] cec: add check if adapter is unregistered
CEC USB dongles can be unplugged at any time, and at that point they will
be unregistered. Make sure that any attempt afterwards to set the physical
or logical addresses will be ignored.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Hans Verkuil [Tue, 28 Jun 2016 14:43:01 +0000 (11:43 -0300)]
[media] adv7604/adv7842: fix quantization range handling
Fix a number of bugs that appeared when support for mediabus formats was
added:
- Support for V4L2_DV_RGB_RANGE_FULL/LIMITED should only be enabled
for HDMI RGB formats, not for YCbCr formats. Since, as the name
says, this setting is for RGB only. So read the InfoFrame to check
the format.
- the quantization range for the pixelport depends on whether the
mediabus code is RGB or not: if it is RGB, then produce full range
RGB values, otherwise produce limited range YCbCr values.
This means that the op_656_range and alt_data_sat fields of the
platform data are no longer used and these will be removed in a
following patch.
- when setting up a new format the RGB quantization range settings
were never updated. Do so, since this depends on the format.
- fix the log_status output which was confusing and incorrect.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Hans Verkuil [Tue, 28 Jun 2016 14:32:36 +0000 (11:32 -0300)]
[media] adv7511: fix quantization range handling
Commit 1fb69bfd29e4b2e5e93922105326dd6cbd5ef6eb (adv7511: improve
colorspace handling) introduced a number of bugs, specifically with
regards to YCbCr output and quantization range handling:
- if the output is not RGB, then disable the full-to-limited range
CSC matrix since that is meant for RGB formats. YCbCr formats are
always limited range, so there is nothing to convert. (OK, full
range YCbCr is possible, but we don't support that right now).
- the mediabus code that was passed to adv7511_set_fmt was always cleared
by the memset in adv7511_fill_format. This made it effectively impossible
to select YCbCr output.
- adv7511_set_fmt never updated the rgb quantization range.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Hans Verkuil [Tue, 28 Jun 2016 14:30:35 +0000 (11:30 -0300)]
[media] adv7511: drop adv7511_set_IT_content_AVI_InfoFrame
The IT Content bit has nothing to do with CE vs IT timings.
Delete this code. This will also fix a bug where this could
override the 'content type' control, which is actually the
correct place to set/clear the ITC bit.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Hans Verkuil [Mon, 11 Jul 2016 03:23:11 +0000 (00:23 -0300)]
[media] af9033: fix compiler warnings
Fix two warnings:
af9033.c: In function 'af9033_read_status':
af9033.c:883:25: warning: 'snr_lut' may be used uninitialized in this function [-Wmaybe-uninitialized]
const struct val_snr *snr_lut;
^
af9033.c:952:25: warning: 'tmp' may be used uninitialized in this function [-Wmaybe-uninitialized]
c->cnr.stat[0].svalue = tmp;
^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
In practice, devices sometimes return frames larger than current buffer
size, leading to failure in solo_send_desc().
It is not clear which minimal increase in buffer size would be enough,
so this patch doubles it, this should be safely assumed as sufficient.
Matthew Leach [Fri, 8 Jul 2016 12:04:27 +0000 (09:04 -0300)]
[media] media: usbtv: prevent access to free'd resources
When disconnecting the usbtv device, the sound card is unregistered
from ALSA and the snd member of the usbtv struct is set to NULL. If
the usbtv snd_trigger work is running, this can cause a race condition
where the kernel will attempt to access free'd resources, shown in
[1].
This patch fixes the disconnection code by cancelling any snd_trigger
work before unregistering the sound card from ALSA and checking that
the snd member still exists in the work function.
[media] Convert Wideview WT220 DVB USB driver to rc-core
Converts the dtt200u DVB USB driver over to the rc-core
infrastructure for its handling of IR remotes. This device can receive
generic NEC / NEC Extended signals and the switch to the newer core
enables the easy use of tools such as ir-keytable to modify the active
key map.
Signed-off-by: Jonathan McDowell <noodles@earth.li> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
projects / mirror_ubuntu-bionic-kernel.git / log