20 Mar, 2019

40 commits

  • This patch add support for Avermedia TD310 usb stick.

    Signed-off-by: Jose Alberto Reguero
    Signed-off-by: Sean Young
    Signed-off-by: Mauro Carvalho Chehab

    Jose Alberto Reguero
     
  • i2c bus is already needed when the frontend is probed, so init it already
    in it930x_frontend_attach. That prevents errors like:

    si2168: probe of 6-0067 failed with error -5

    Signed-off-by: Andreas Kemnade
    Signed-off-by: Jose Alberto Reguero
    Signed-off-by: Sean Young
    Signed-off-by: Mauro Carvalho Chehab

    Andreas Kemnade
     
  • si2165_readreg8() may fail. Looking into si2165_readreg8(), we will find
    that "val_tmp" will be an uninitialized value when regmap_read() fails.
    "val_tmp" is then assigned to "val". So if si2165_readreg8() fails,
    "val" will be a random value. Further use will lead to undefined
    behaviors. The fix checks if si2165_readreg8() fails, and if so, returns
    its error code upstream.

    Signed-off-by: Kangjie Lu
    Reviewed-by: Matthias Schwarzott
    Tested-by: Matthias Schwarzott
    Signed-off-by: Sean Young
    Signed-off-by: Mauro Carvalho Chehab

    Kangjie Lu
     
  • Syzkaller report this:

    BUG: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
    Read of size 8 at addr ffff8881dc7ae030 by task syz-executor.0/6249

    CPU: 1 PID: 6249 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
    Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0xfa/0x1ce lib/dump_stack.c:113
    print_address_description+0x65/0x270 mm/kasan/report.c:187
    kasan_report+0x149/0x18d mm/kasan/report.c:317
    ? 0xffffffffc1728000
    sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
    sysfs_remove_file include/linux/sysfs.h:519 [inline]
    driver_remove_file+0x40/0x50 drivers/base/driver.c:122
    remove_bind_files drivers/base/bus.c:585 [inline]
    bus_remove_driver+0x186/0x220 drivers/base/bus.c:725
    driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
    serial_ir_init_module+0x169/0x1000 [serial_ir]
    do_one_initcall+0xfa/0x5ca init/main.c:887
    do_init_module+0x204/0x5f6 kernel/module.c:3460
    load_module+0x66b2/0x8570 kernel/module.c:3808
    __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
    do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x462e99
    Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
    RSP: 002b:00007f9450132c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
    RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
    RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
    RBP: 00007f9450132c70 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94501336bc
    R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004

    Allocated by task 6249:
    set_track mm/kasan/common.c:85 [inline]
    __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495
    kmalloc include/linux/slab.h:545 [inline]
    kzalloc include/linux/slab.h:740 [inline]
    bus_add_driver+0xc0/0x610 drivers/base/bus.c:651
    driver_register+0x1bb/0x3f0 drivers/base/driver.c:170
    serial_ir_init_module+0xe8/0x1000 [serial_ir]
    do_one_initcall+0xfa/0x5ca init/main.c:887
    do_init_module+0x204/0x5f6 kernel/module.c:3460
    load_module+0x66b2/0x8570 kernel/module.c:3808
    __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
    do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    Freed by task 6249:
    set_track mm/kasan/common.c:85 [inline]
    __kasan_slab_free+0x130/0x180 mm/kasan/common.c:457
    slab_free_hook mm/slub.c:1430 [inline]
    slab_free_freelist_hook mm/slub.c:1457 [inline]
    slab_free mm/slub.c:3005 [inline]
    kfree+0xe1/0x270 mm/slub.c:3957
    kobject_cleanup lib/kobject.c:662 [inline]
    kobject_release lib/kobject.c:691 [inline]
    kref_put include/linux/kref.h:67 [inline]
    kobject_put+0x146/0x240 lib/kobject.c:708
    bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732
    driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
    serial_ir_init_module+0x14c/0x1000 [serial_ir]
    do_one_initcall+0xfa/0x5ca init/main.c:887
    do_init_module+0x204/0x5f6 kernel/module.c:3460
    load_module+0x66b2/0x8570 kernel/module.c:3808
    __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
    do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    The buggy address belongs to the object at ffff8881dc7ae000
    which belongs to the cache kmalloc-256 of size 256
    The buggy address is located 48 bytes inside of
    256-byte region [ffff8881dc7ae000, ffff8881dc7ae100)
    The buggy address belongs to the page:
    page:ffffea000771eb80 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0
    flags: 0x2fffc0000000200(slab)
    raw: 02fffc0000000200 ffffea0007d14800 0000000400000002 ffff8881f6c02e00
    raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected

    Memory state around the buggy address:
    ffff8881dc7adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    ffff8881dc7adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    >ffff8881dc7ae000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ^
    ffff8881dc7ae080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ffff8881dc7ae100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00

    There are already cleanup handlings in serial_ir_init error path,
    no need to call serial_ir_exit do it again in serial_ir_init_module,
    otherwise will trigger a use-after-free issue.

    Fixes: fa5dc29c1fcc ("[media] lirc_serial: move out of staging and rename to serial_ir")

    Reported-by: Hulk Robot
    Signed-off-by: YueHaibing
    Signed-off-by: Sean Young
    Signed-off-by: Mauro Carvalho Chehab

    YueHaibing
     
  • Remove including that don't need it.

    Signed-off-by: YueHaibing
    Signed-off-by: Sean Young
    Signed-off-by: Mauro Carvalho Chehab

    YueHaibing
     
  • Checking of kmalloc() seems to have been committed - as
    cx23885_dvb_register() is checking for != 0 return, returning
    -ENOMEM should be fine here. While at it address the coccicheck
    suggestion to move to kmemdup rather than using kmalloc+memcpy.

    Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")

    Signed-off-by: Nicholas Mc Guire
    Signed-off-by: Sean Young
    Signed-off-by: Mauro Carvalho Chehab

    Nicholas Mc Guire
     
  • Ref: https://bugzilla.kernel.org/show_bug.cgi?id=199323

    Users are experiencing problems with the DVBSky S960/S960C USB devices
    since the following commit:

    9d659ae: ("locking/mutex: Add lock handoff to avoid starvation")

    The device malfunctions after running for an indeterminable period of
    time, and the problem can only be cleared by rebooting the machine.

    It is possible to encourage the problem to surface by blocking the
    signal to the LNB.

    Further debugging revealed the cause of the problem.

    In the following capture:
    - thread #1325 is running m88ds3103_set_frontend
    - thread #42 is running ts2020_stat_work

    a> [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 07 80
    [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 08
    [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 68 3f
    [42] usb 1-1: dvb_usb_v2_generic_io: <<< 08 ff
    [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11
    [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07
    [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 3d
    [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff
    b> [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 07 00
    [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07
    [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11
    [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07
    [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 21
    [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff
    [42] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11
    [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07
    [42] usb 1-1: dvb_usb_v2_generic_io: >>> 09 01 01 60 66
    [42] usb 1-1: dvb_usb_v2_generic_io: <<< 07 ff
    [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 68 02 03 11
    [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07
    [1325] usb 1-1: dvb_usb_v2_generic_io: >>> 08 60 02 10 0b
    [1325] usb 1-1: dvb_usb_v2_generic_io: <<< 07

    Two i2c messages are sent to perform a reset in m88ds3103_set_frontend:

    a. 0x07, 0x80
    b. 0x07, 0x00

    However, as shown in the capture, the regmap mutex is being handed over
    to another thread (ts2020_stat_work) in between these two messages.

    >From here, the device responds to every i2c message with an 07 message,
    and will only return to normal operation following a power cycle.

    Use regmap_multi_reg_write to group the two reset messages, ensuring
    both are processed before the regmap mutex is unlocked.

    Signed-off-by: James Hutchinson
    Reviewed-by: Antti Palosaari
    Signed-off-by: Sean Young
    Signed-off-by: Mauro Carvalho Chehab

    James Hutchinson
     
  • Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed
    a use-after-free by removing the reference to the frontend after deleting
    the backing i2c device.

    This has the unfortunate side effect the frontend device is never freed
    in the dvb core leaving a dangling device, leading to errors when the
    dvb core tries to register the frontend after e.g. a replug as reported
    here: https://www.spinics.net/lists/linux-media/msg138181.html

    media: dvbsky: issues with DVBSky T680CI

    ===
    [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached
    [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs
    Si2168)...
    [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/
    dvb0.frontend0'
    ===

    The use after free happened as dvb_usbv2_disconnect calls in this order:
    - dvb_usb_device::props->exit(...)
    - dvb_usbv2_adapter_frontend_exit(...)
    + if (fe) dvb_unregister_frontend(fe)
    + dvb_usb_device::props->frontend_detach(...)

    Moving the release of the i2c device from exit() to frontend_detach()
    avoids the dangling pointer access and allows the core to unregister
    the frontend.

    This was originally reported for a DVBSky T680CI, but it also affects
    the MyGica T230C. As all supported devices structure the registration/
    unregistration identically, apply the change for all device types.

    Signed-off-by: Stefan Brüns
    Signed-off-by: Sean Young
    Signed-off-by: Mauro Carvalho Chehab

    Stefan Brüns
     
  • We forgot to set "ret" on this error path.

    Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")

    Signed-off-by: Dan Carpenter
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Dan Carpenter
     
  • There is no need to have the 'T *v' variable static
    since new value always be assigned before use it.

    Signed-off-by: Mao Wenan
    Reviewed-by: Dan Carpenter
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Mao Wenan
     
  • ERROR: do not initialise statics to NULL

    Signed-off-by: claudiojpaz
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    claudiojpaz
     
  • The driver should really call dm365_isif_setup_pinmux() through a callback,
    but uses a hack to include a davinci specific machine header file when
    compile testing instead. This works almost everywhere, but not on the
    ARM omap1 platform, which has another header named mach/mux.h. This
    causes a build failure:

    drivers/staging/media/davinci_vpfe/dm365_isif.c:2028:2: error: implicit declaration of function 'davinci_cfg_reg' [-Werror,-Wimplicit-function-declaration]
    davinci_cfg_reg(DM365_VIN_CAM_WEN);
    ^
    drivers/staging/media/davinci_vpfe/dm365_isif.c:2028:2: error: this function declaration is not a prototype [-Werror,-Wstrict-prototypes]
    drivers/staging/media/davinci_vpfe/dm365_isif.c:2028:18: error: use of undeclared identifier 'DM365_VIN_CAM_WEN'
    davinci_cfg_reg(DM365_VIN_CAM_WEN);
    ^
    drivers/staging/media/davinci_vpfe/dm365_isif.c:2029:18: error: use of undeclared identifier 'DM365_VIN_CAM_VD'
    davinci_cfg_reg(DM365_VIN_CAM_VD);
    ^
    drivers/staging/media/davinci_vpfe/dm365_isif.c:2030:18: error: use of undeclared identifier 'DM365_VIN_CAM_HD'
    davinci_cfg_reg(DM365_VIN_CAM_HD);
    ^
    drivers/staging/media/davinci_vpfe/dm365_isif.c:2031:18: error: use of undeclared identifier 'DM365_VIN_YIN4_7_EN'
    davinci_cfg_reg(DM365_VIN_YIN4_7_EN);
    ^
    drivers/staging/media/davinci_vpfe/dm365_isif.c:2032:18: error: use of undeclared identifier 'DM365_VIN_YIN0_3_EN'
    davinci_cfg_reg(DM365_VIN_YIN0_3_EN);
    ^
    7 errors generated.

    Exclude omap1 from compile-testing, under the assumption that all others
    still work.

    Fixes: 4907c73deefe ("media: staging: davinci_vpfe: allow building with COMPILE_TEST")

    Signed-off-by: Arnd Bergmann
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Arnd Bergmann
     
  • Building adv748x fails now unless V4L2_FWNODE is selected:

    drivers/media/i2c/adv748x/adv748x-core.o: In function `adv748x_probe':
    adv748x-core.c:(.text+0x1b2c): undefined reference to `v4l2_fwnode_endpoint_parse'

    Fixes: 6a18865da8e3 ("media: i2c: adv748x: store number of CSI-2 lanes described in device tree")

    Signed-off-by: Arnd Bergmann
    Reviewed-by: Laurent Pinchart
    Reviewed-by: Niklas Söderlund
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Arnd Bergmann
     
  • The i.MX7 capture support forgot to change the group ID for the CSI
    to the IPU CSI in VDIC sub-device, it was left at the i.MX7 CSI
    group ID.

    Fixes: 67673ed55084 ("media: staging/imx: rearrange group id to take in account IPU")

    Signed-off-by: Steve Longerbeam
    Reviewed-by: Philipp Zabel
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Steve Longerbeam
     
  • Remove duplicated include.

    Signed-off-by: YueHaibing
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    YueHaibing
     
  • strscpy() returns a negative value on failure unlike strlcpy(),
    so fix the WARN_ON accordingly.

    Signed-off-by: Hans Petter Selasky
    Signed-off-by: Hans Verkuil
    [hverkuil-cisco@xs4all.nl: added commit message]
    Signed-off-by: Mauro Carvalho Chehab

    Hans Petter Selasky
     
  • The s_stream callback was not being called for the first entity in the
    stream pipeline array.
    Instead of verifying the type of the node (video or subdevice) and
    calling s_stream from the second entity in the pipeline, do this process
    for all the entities in the pipeline for consistency.

    The previous code was not a problem because the first entity is a video
    device and not a subdevice, but this patch prepares vimc to allow
    setting some configuration in the entity before calling s_stream.

    Signed-off-by: Helen Koike
    Tested-by: André Almeida
    Signed-off-by: Hans Verkuil
    [hverkuil-cisco@xs4all.nl: fix line-too-long warning]
    Signed-off-by: Mauro Carvalho Chehab

    Helen Fornazier
     
  • Add missing documentation for struct vimc_stream

    Signed-off-by: Helen Koike
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Helen Fornazier
     
  • There is no need to have the frame field in the vimc_stream struct.

    Signed-off-by: Helen Koike
    Tested-by: André Almeida
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Helen Fornazier
     
  • The type V4L2_FRMSIZE_TYPE_CONTINUOUS expects a step of 1.
    This fixes v4l2-compliance test error:

    fail: v4l2-test-formats.cpp(184): invalid step_width/height for continuous framesize
    test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: FAIL

    Signed-off-by: Helen Koike
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Helen Fornazier
     
  • The state TASK_UNINTERRUPTIBLE should be set just before
    schedule_timeout() call, so it knows the sleep mode it should enter.
    There is no point in setting TASK_UNINTERRUPTIBLE at the initialization
    of the thread as schedule_timeout() will set the state back to
    TASK_RUNNING.

    This fixes a warning in __might_sleep() call, as it's expecting the
    task to be in TASK_RUNNING state just before changing the state to
    a sleeping state.

    Reported-by: Hans Verkuil
    Signed-off-by: Helen Koike
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Helen Fornazier
     
  • The format of the sink pad should be a bayer mbus format.

    This fixes a kernel NULL pointer dereference error that was caused when
    the stream starts because the configured format was not found in the
    pixelmap table.

    Reported-by: Hans Verkuil
    Signed-off-by: Helen Koike
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Helen Fornazier
     
  • There is no point to continuing assignment after memory allocation
    failed, rather throw error immediately.

    Signed-off-by: Souptick Joarder
    Signed-off-by: Hans Verkuil
    [hverkuil-cisco@xs4all.nl: rebase and remove empty line before the if]
    Signed-off-by: Mauro Carvalho Chehab

    Souptick Joarder
     
  • When streaming is stopped all URBs are killed, but in fill_frame and in
    bulk_irq this results in an attempt to resubmit the killed URB. That is
    not what you want and causes spurious kernel messages.

    So check if streaming has stopped before resubmitting.

    Also check against gspca_dev->streaming rather than vb2_start_streaming_called()
    since vb2_start_streaming_called() will return true when in stop_streaming,
    but gspca_dev->streaming is set to false when stop_streaming is called.

    Fixes: 6992effe5344 ("gspca: Kill all URBs before releasing any of them")

    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Hans Verkuil
     
  • Fix a misleading comment in _close() and a spelling error.

    Reviewed-by: Niklas Söderlund
    Signed-off-by: Shuah Khan
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Shuah Khan
     
  • __media_pipeline_start() does WARN_ON() when active pipe doesn't
    match the input arg entity's pipe.

    Replace WARN_ON with a conditional and error message that includes
    names of both entities.

    Signed-off-by: Shuah Khan
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Shuah Khan
     
  • Clang-9 makes some different inlining decisions compared to gcc, which
    leads to a warning about a possible stack overflow problem when building
    with CONFIG_KASAN, including when setting asan-stack=0, which avoids
    most other frame overflow warnings:

    drivers/media/platform/vicodec/codec-fwht.c:673:12: error: stack frame size of 2224 bytes in function 'encode_plane'

    Manually adding noinline_for_stack annotations in those functions
    called by encode_plane() or decode_plane() that require a significant
    amount of kernel stack makes this impossible to happen with any
    compiler.

    Signed-off-by: Arnd Bergmann
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Arnd Bergmann
     
  • We should be updating *pos. The current code is a no-op.

    Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")

    Signed-off-by: Dan Carpenter
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Dan Carpenter
     
  • We had intended to update *pos, but the current code is a no-op.

    Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")

    Signed-off-by: Dan Carpenter
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Dan Carpenter
     
  • clang-8 warns about one function here when KASAN is enabled, even
    without the 'asan-stack' option:

    drivers/media/usb/go7007/go7007-fw.c:1551:5: warning: stack frame size of 2656 bytes in function

    I have reported this issue in the llvm bugzilla, but to make
    it work with the clang-8 release, a small annotation is still
    needed.

    Link: https://bugs.llvm.org/show_bug.cgi?id=38809

    Signed-off-by: Arnd Bergmann
    Signed-off-by: Hans Verkuil
    [hverkuil-cisco@xs4all.nl: fix checkpatch warning]
    Signed-off-by: Mauro Carvalho Chehab

    Arnd Bergmann
     
  • Two saa7146/hexium files contain a construct that causes a warning
    when built with clang:

    drivers/media/pci/saa7146/hexium_orion.c:210:12: error: stack frame size of 2272 bytes in function 'hexium_probe'
    [-Werror,-Wframe-larger-than=]
    static int hexium_probe(struct saa7146_dev *dev)
    ^
    drivers/media/pci/saa7146/hexium_gemini.c:257:12: error: stack frame size of 2304 bytes in function 'hexium_attach'
    [-Werror,-Wframe-larger-than=]
    static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info)
    ^

    This one happens regardless of KASAN, and the problem is that a
    constructor to initialize a dynamically allocated structure leads
    to a copy of that structure on the stack, whereas gcc initializes
    it in place.

    Link: https://bugs.llvm.org/show_bug.cgi?id=40776

    Signed-off-by: Arnd Bergmann
    Reviewed-by: Nick Desaulniers
    Signed-off-by: Hans Verkuil
    [hverkuil-cisco@xs4all.nl: fix checkpatch warnings]
    Signed-off-by: Mauro Carvalho Chehab

    Arnd Bergmann
     
  • The ISC driver currently supports ITU-R 601 encoding which
    utilizes the external hsync and vsync signals. ITU-R 656
    format removes the need for these pins by embedding the
    sync pulses within the data packet.

    To support this feature, enable necessary register bits
    when this feature is enabled via device tree.

    Signed-off-by: Ken Sloat
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Ken Sloat
     
  • H6 has improved VPU. It supports 10-bit HEVC decoding and AFBC output
    format for HEVC.

    Signed-off-by: Jernej Skrabec
    Acked-by: Maxime Ripard
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Jernej Skrabec
     
  • H6 VPU doesn't work if DMA offset is set.

    Add a quirk for it.

    Signed-off-by: Jernej Skrabec
    Acked-by: Maxime Ripard
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Jernej Skrabec
     
  • This adds a compatible for H6. H6 VPU supports 10-bit HEVC decoding and
    additional AFBC output format for HEVC.

    Signed-off-by: Jernej Skrabec
    Acked-by: Maxime Ripard
    Reviewed-by: Rob Herring
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Jernej Skrabec
     
  • The last user of this state has been converted, so we can now drop
    this. Requeueing causes the queue to become unordered, which causes
    problems with requests and (in the future) fences.

    Since it is no longer needed, just get rid of this.

    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Hans Verkuil
     
  • The cobalt driver is the only driver that uses VB2_BUF_STATE_REQUEUEING.
    Replace it by VB2_BUF_STATE_ERROR so we can drop support for the
    REQUEUEING state.

    The requeueing state was used in the cobalt driver to optimize
    buffer handling while waiting for a valid signal: by requeueing
    buffers internally there was no need for userspace to handle and
    requeue buffers with the ERROR flag set.

    However, requeueing also makes the buffer handling unordered, which
    is generally a bad idea. Requeueing also does not work with requests
    and any future fence support.

    Since it is really a minor optimization in the cobalt driver it is
    best to just return the buffer in an ERROR state. With this change
    support for requeueing can now be removed in vb2.

    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Hans Verkuil
     
  • Avoid call of dmaengine_terminate_all() between
    dmaengine_prep_slave_single() and dmaengine_submit() by locking
    the whole DMA submission sequence.

    Signed-off-by: Hugues Fruchet
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Hugues Fruchet
     
  • Start streaming was sometimes failing because of pm_runtime_get_sync()
    non-0 return value. In fact return value was not an error but a
    positive value (1), indicating that PM was already enabled.
    Fix this by going to error path only with negative return value.

    Signed-off-by: Hugues Fruchet
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Hugues Fruchet
     
  • Function `sh_veu_find_fmt` returns an address that is an addition of a
    base pointer `sh_veu_fmt` and an offset. The base pointer refers to a
    global variable of which address cannot be NULL. Therefore, this commit
    removes the NULL pointer checks on the return values of function
    `sh_veu_find_fmt`.

    Signed-off-by: Shaobo He
    Signed-off-by: Hans Verkuil
    Signed-off-by: Mauro Carvalho Chehab

    Shaobo He