18 Apr, 2017

2 commits

  • It started with a sporadic message in syslog: "CAM tried to send a
    buffer larger than the ecount size" This message is not the fault
    itself, but a consecutive fault, after a read error from the CAM. This
    happens only on several CAMs, several hardware, and of course sporadic.

    It is a consecutive fault, if the last read from the CAM did fail. I
    guess this will not happen on all CAMs, but at least it did on mine.
    There was a write error to the CAM and during the re-initialization
    procedure, the CAM finished the last read, although it got a RS.

    The write error to the CAM happened because a race condition between HC
    write, checking DA and FR.

    This patch added an additional check for DA(RE), just after checking FR.
    It is important to read the CAMs status register again, to give the CAM
    the necessary time for a proper reaction to HC. Please note the
    description within the source code (patch below).

    [mchehab@s-opensource.com: make checkpatch happy]

    Signed-off-by: Jasmin jessich
    Tested-by: Ralph Metzler
    Signed-off-by: Mauro Carvalho Chehab

    Jasmin J
     
  • The refcount field was added to the struct but it was not
    properly documented.

    Document it.

    [mchehab@s-opensource.com: fix a merge conflict]

    Signed-off-by: Sakari Ailus
    Signed-off-by: Mauro Carvalho Chehab

    Sakari Ailus
     

06 Apr, 2017

1 commit


02 Mar, 2017

1 commit


28 Feb, 2017

1 commit

  • Fix typos and add the following to the scripts/spelling.txt:

    an user||a user
    an userspace||a userspace

    I also added "userspace" to the list since it is a common word in Linux.
    I found some instances for "an userfaultfd", but I did not add it to the
    list. I felt it is endless to find words that start with "user" such as
    "userland" etc., so must draw a line somewhere.

    Link: http://lkml.kernel.org/r/1481573103-11329-4-git-send-email-yamada.masahiro@socionext.com
    Signed-off-by: Masahiro Yamada
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Masahiro Yamada
     

08 Feb, 2017

1 commit


03 Feb, 2017

3 commits

  • Fixed coding style issues of spacing

    Signed-off-by: Devendra Sharma
    Signed-off-by: Mauro Carvalho Chehab

    devendra sharma
     
  • Drivers might try to access and run enable_source and disable_source
    handlers when the driver that implements these handlers is clearing
    the handlers during its unregister.

    Fix the following race condition:

    process 1 process 2

    request video streaming unbind au0828
    v4l2 checks if tuner is free
    ... ...

    au0828_unregister_media_device()
    ... ...
    (doesn't hold graph_mutex)
    mdev->enable_source = NULL;
    if (mdev && mdev->enable_source) mdev->disable_source = NULL;
    mdev->enable_source()
    (enable_source holds graph_mutex)

    As shown above enable_source check is done without holding the graph_mutex.
    If unbind happens to be in progress, au0828 could clear enable_source and
    disable_source handlers leading to null pointer de-reference.

    Fix it by protecting enable_source and disable_source set and clear and
    protecting enable_source and disable_source handler access and the call
    itself.

    process 1 process 2

    request video streaming unbind au0828
    v4l2 checks if tuner is free
    ... ...

    au0828_unregister_media_device()
    ... ...
    (hold graph_mutex while clearing)
    mdev->enable_source = NULL;
    if (mdev) mdev->disable_source = NULL;
    (hold graph_mutex to check and
    call enable_source)
    if (mdev->enable_source)
    mdev->enable_source()

    If graph_mutex is held to just heck for handler being null and needs to be
    released before calling the handler, there will be another window for the
    handlers to be cleared. Hence, enable_source and disable_source handlers
    no longer hold the graph_mutex and expect callers to hold it to avoid
    forcing them release the graph_mutex before calling the handlers.

    Signed-off-by: Shuah Khan
    Signed-off-by: Mauro Carvalho Chehab

    Shuah Khan
     
  • ZyDAS ZD1301 is chip having USB interface and DVB-T demodulator
    integrated. This driver is for USB interface part.

    Device has USB ID 0ace:13a1. Used tuner is MT2060.

    Signed-off-by: Antti Palosaari
    Signed-off-by: Mauro Carvalho Chehab

    Antti Palosaari
     

27 Jan, 2017

1 commit

  • Drop the FSF's postal address from the source code files that typically
    contain mostly the license text. Of the 628 removed instances, 578 are
    outdated.

    The patch has been created with the following command without manual edits:

    git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \
    drivers/media/ include/media|while read i; do i=$i perl -e '
    open(F,"< $ENV{i}");
    $a=join("", );
    $a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m
    && $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m;
    close(F);
    open(F, "> $ENV{i}");
    print F $a;
    close(F);'; done

    Signed-off-by: Sakari Ailus

    Sakari Ailus
     

27 Dec, 2016

1 commit

  • Linux 4.10-rc1

    * tag 'v4.10-rc1': (11427 commits)
    Linux 4.10-rc1
    powerpc: Fix build warning on 32-bit PPC
    avoid spurious "may be used uninitialized" warning
    mm: add PageWaiters indicating tasks are waiting for a page bit
    mm: Use owner_priv bit for PageSwapCache, valid when PageSwapBacked
    ktime: Get rid of ktime_equal()
    ktime: Cleanup ktime_set() usage
    ktime: Get rid of the union
    clocksource: Use a plain u64 instead of cycle_t
    irqchip/armada-xp: Consolidate hotplug state space
    irqchip/gic: Consolidate hotplug state space
    coresight/etm3/4x: Consolidate hotplug state space
    cpu/hotplug: Cleanup state names
    cpu/hotplug: Remove obsolete cpu hotplug register/unregister functions
    staging/lustre/libcfs: Convert to hotplug state machine
    scsi/bnx2i: Convert to hotplug state machine
    scsi/bnx2fc: Convert to hotplug state machine
    cpu/hotplug: Prevent overwriting of callbacks
    x86/msr: Remove bogus cleanup from the error path
    bus: arm-ccn: Prevent hotplug callback leak
    ...

    Mauro Carvalho Chehab
     

26 Dec, 2016

1 commit

  • ktime_set(S,N) was required for the timespec storage type and is still
    useful for situations where a Seconds and Nanoseconds part of a time value
    needs to be converted. For anything where the Seconds argument is 0, this
    is pointless and can be replaced with a simple assignment.

    Signed-off-by: Thomas Gleixner
    Cc: Peter Zijlstra

    Thomas Gleixner
     

25 Dec, 2016

1 commit


21 Dec, 2016

1 commit

  • With gcc-5 or higher on x86, we can get a bogus warning in the
    dvb-net code:

    drivers/media/dvb-core/dvb_net.c: In function 'dvb_net_ule':
    arch/x86/include/asm/string_32.h:78:22: error: '*((void *)&dest_addr+4)' may be used uninitialized in this function [-Werror=maybe-uninitialized]

    The problem here is that gcc doesn't track all of the conditions
    to prove it can't end up copying uninitialized data.
    This changes the logic around so we zero out the destination
    address earlier when we determine that it is not set here.
    This allows the compiler to figure it out.

    Signed-off-by: Arnd Bergmann
    Signed-off-by: Mauro Carvalho Chehab

    Arnd Bergmann
     

15 Dec, 2016

1 commit

  • * patchwork: (496 commits)
    [media] v4l: tvp5150: Add missing break in set control handler
    [media] v4l: tvp5150: Don't inline the tvp5150_selmux() function
    [media] v4l: tvp5150: Compile tvp5150_link_setup out if !CONFIG_MEDIA_CONTROLLER
    [media] em28xx: don't store usb_device at struct em28xx
    [media] em28xx: use usb_interface for dev_foo() calls
    [media] em28xx: don't change the device's name
    [media] mn88472: fix chip id check on probe
    [media] mn88473: fix chip id check on probe
    [media] lirc: fix error paths in lirc_cdev_add()
    [media] s5p-mfc: Add support for MFC v8 available in Exynos 5433 SoCs
    [media] s5p-mfc: Rework clock handling
    [media] s5p-mfc: Don't keep clock prepared all the time
    [media] s5p-mfc: Kill all IS_ERR_OR_NULL in clocks management code
    [media] s5p-mfc: Remove dead conditional code
    [media] s5p-mfc: Ensure that clock is disabled before turning power off
    [media] s5p-mfc: Remove special clock rate management
    [media] s5p-mfc: Use printk_ratelimited for reporting ioctl errors
    [media] s5p-mfc: Set DMA_ATTR_ALLOC_SINGLE_PAGES
    [media] vivid: Set color_enc on HSV formats
    [media] v4l2-tpg: Init hv_enc field with a valid value
    ...

    Mauro Carvalho Chehab
     

25 Nov, 2016

2 commits


23 Nov, 2016

1 commit


19 Nov, 2016

8 commits

  • While this patch sounded a good idea, unfortunately, it causes
    bad dependencies, as drivers that would otherwise work without
    the DVB core will now break:

    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5767.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5761.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda827x.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda18218.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/qt1010.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2266.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt20xx.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2060.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mc44s803.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0013.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0012.ko] undefined!
    ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0011.ko] undefined!

    So, we have to revert it.

    Note: as the argument for the release ops changed from "int"
    to "void", we needed to change it at the revert patch, to
    avoid compilation issues like:
    drivers/media/tuners/tea5767.c:437:23: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
    .release = tea5767_release,
    ^~~~~~~~~~~~~~~

    This reverts commit 22a613e89825ea7a3984a968463cc6d425bd8856.

    Signed-off-by: Mauro Carvalho Chehab

    Mauro Carvalho Chehab
     
  • This commit amends my old commit fe35637b0a9f ("[media] dvb_frontend:
    eliminate blocking wait in dvb_unregister_frontend()"), which added
    kref to struct dvb_frontend_private. It turned out that there are
    several use-after-free bugs left, which affect the struct
    dvb_frontend. Protecting it with kref also protects struct
    dvb_frontend_private, so we can simply move it.

    This is how the use-after-free looks like in KASAN:

    BUG: KASAN: use-after-free in string+0x60/0xb1 at addr ffff880033bd9fc0
    Read of size 1 by task kworker/0:2/617
    CPU: 0 PID: 617 Comm: kworker/0:2 Not tainted 4.8.0-rc1-hosting+ #60
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    Workqueue: usb_hub_wq hub_event
    0000000000000000 ffff880033757218 ffffffff81394e50 ffff880033bd9fd0
    ffff880035c03b00 ffff880033757240 ffffffff811f271d ffff880033bd9fc0
    1ffff1000677b3f8 ffffed000677b3f8 ffff8800337572b8 ffffffff811f2afe
    Call Trace:
    [...]
    [] vsnprintf+0x39d/0x7e9
    [] add_uevent_var+0x10f/0x1dc
    [] rc_dev_uevent+0x55/0x6f
    [] dev_uevent+0x2e1/0x316
    [] kobject_uevent_env+0x27e/0x701
    [] kobject_uevent+0xb/0xd
    [] device_del+0x322/0x383
    [] rc_unregister_device+0x98/0xc3
    [] dvb_usb_remote_exit+0x7a/0x90
    [] dvb_usb_exit+0x1d/0xe5
    [] dvb_usb_device_exit+0x69/0x7d
    [] pctv452e_usb_disconnect+0x7b/0x80
    [...]
    Object at ffff880033bd9fc0, in cache kmalloc-16 size: 16
    Allocated:
    [...]
    Freed:
    PID = 617
    [...]
    [] kfree+0xd9/0x166
    [] ir_free_table+0x2f/0x51
    [] rc_unregister_device+0x4d/0xc3
    [] dvb_usb_remote_exit+0x7a/0x90
    [] dvb_usb_exit+0x1d/0xe5
    [] dvb_usb_device_exit+0x69/0x7d
    [] pctv452e_usb_disconnect+0x7b/0x80

    Another one:

    BUG: KASAN: use-after-free in do_sys_poll+0x336/0x6b8 at addr ffff88003563fcc0
    Read of size 8 by task tuner on fronte/1042
    CPU: 1 PID: 1042 Comm: tuner on fronte Tainted: G B 4.8.0-rc1-hosting+ #60
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    0000000000000000 ffff88003353f910 ffffffff81394e50 ffff88003563fd80
    ffff880035c03200 ffff88003353f938 ffffffff811f271d ffff88003563fc80
    1ffff10006ac7f98 ffffed0006ac7f98 ffff88003353f9b0 ffffffff811f2afe
    Call Trace:
    [...]
    [] do_sys_poll+0x336/0x6b8
    [...]
    [] SyS_poll+0xa9/0x194
    [...]
    Object at ffff88003563fc80, in cache kmalloc-256 size: 256
    Allocated:
    [...]
    Freed:
    PID = 617
    [...]
    [] kfree+0xd9/0x166
    [] dvb_unregister_device+0xd6/0xe5
    [] dvb_unregister_frontend+0x4b/0x66
    [] dvb_usb_adapter_frontend_exit+0x69/0xac
    [] dvb_usb_exit+0x43/0xe5
    [] dvb_usb_device_exit+0x69/0x7d
    [] pctv452e_usb_disconnect+0x7b/0x80

    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     
  • Prepare for making "release" asynchronous (via kref). Some operations
    may need to be run synchronously in dvb_frontend_detach(), and that's
    why we need a "detach" callback.

    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     
  • This code duplication is confusing and error prone. Let's merge them
    by moving the release/dvb_detach call into one function with one

    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     
  • It is not clear what this return value means. All implemenations
    return 0, and the one caller ignores the value. Let's remove this
    useless return value completely.

    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     
  • Most release callback functions are identical: free the "tuner_priv"
    and clear it. Let's eliminate some bloat by providing this simple
    implementation in the dvb_frontend library.

    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     
  • Commit da677fe14364 ("[media] dvb-core/en50221: use kref to manage
    struct dvb_ca_private") moved the dvb_unregister_device() call to the
    kref callback, but that left lots of stale device state visible to
    userspace (e.g. in sysfs). By using dvb_remove_device() and
    dvb_free_device() instead of dvb_unregister_device(), we can avoid
    that.

    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     
  • dvb_unregister_device() has a major problem: it combines unregistering
    with memory disposal. Sometimes, it is necessary to unregister a
    device, but no memory can be freed yet, because a process still has a
    (stale) file handle. Therefore, we need to split
    dvb_unregister_device(). This will allow sanitizing a few callers.

    With my new design, dvb_unregister_device() appears misnamed, but to
    reduce patch noise, I'm not renaming it just yet.

    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     

16 Nov, 2016

1 commit


25 Oct, 2016

1 commit


24 Oct, 2016

1 commit


21 Oct, 2016

6 commits

  • The dvb_filter.c can hardly be considered as part of the DVB
    core. More than half of the code there is commented out by
    av7110 and ttusb_dec.

    On the latter, just two small helper functions and a struct
    definition is used.

    Being part of the core means that it would require an
    amount of work to fix issues in it, like bad printk's
    on it, and to document it on some future, like other kAPI
    headers. It simply not worth the effort for something that
    seems to be deprecated, as no new drivers use it.

    So, move it out of the core, by moving it to pci/ttpci
    directory, where av7110 driver is kept, and copy the two
    routines used by ttyusb_dec directly into its code.

    Signed-off-by: Mauro Carvalho Chehab

    Mauro Carvalho Chehab
     
  • There is a provision at the dvb_demux.c to use a vmalloc'ed
    circular buffer, enabled via an extra #ifdef option that it
    is not at Kconfig. Enabling it will only make the Kernel to
    allocate/deallocate such buffer, but no code would actually
    use it. So, no practical effect, except for sparing some
    memory without any good reason.

    So, get rid of such dead code.

    Signed-off-by: Mauro Carvalho Chehab

    Mauro Carvalho Chehab
     
  • There is a commented code that also detects packet loss.
    Uncomment it and put into the DVB_DEMUX_SECTION_LOSS_LOG
    debug Kconfig option.

    Signed-off-by: Mauro Carvalho Chehab

    Mauro Carvalho Chehab
     
  • There are some ifdefs inside the dvb_demux that are meant to
    enable advanced debug capabilities, at the cost of being very
    verbose.

    Keeping those as internal ifdefs is a very bad idea, as it
    doesn't make easy to check if the code there was broken by
    some patch. So, let's add an explicit Kconfig option for it.

    Signed-off-by: Mauro Carvalho Chehab

    Mauro Carvalho Chehab
     
  • The dvb-core directly calls printk() without using the modern
    printk macros, or using the proper printk levels. Change it
    to use pr_foo().

    Signed-off-by: Mauro Carvalho Chehab

    Mauro Carvalho Chehab
     
  • Due to the 80-cols checkpatch warnings, several strings
    were broken into multiple lines. This is not considered
    a good practice anymore, as it makes harder to grep for
    strings at the source code. So, join those continuation
    lines.

    Signed-off-by: Mauro Carvalho Chehab

    Mauro Carvalho Chehab
     

13 Oct, 2016

1 commit

  • With centralized MTU checking, there's nothing productive done by
    eth_change_mtu that isn't already done in dev_set_mtu, so mark it as
    deprecated and remove all usage of it in the kernel. All callers have been
    audited for calls to alloc_etherdev* or ether_setup directly, which means
    they all have a valid dev->min_mtu and dev->max_mtu. Now eth_change_mtu
    prints out a netdev_warn about being deprecated, for the benefit of
    out-of-tree drivers that might be utilizing it.

    Of note, dvb_net.c actually had dev->mtu = 4096, while using
    eth_change_mtu, meaning that if you ever tried changing it's mtu, you
    couldn't set it above 1500 anymore. It's now getting dev->max_mtu also set
    to 4096 to remedy that.

    v2: fix up lantiq_etop, missed breakage due to drive not compiling on x86

    CC: netdev@vger.kernel.org
    Signed-off-by: Jarod Wilson
    Signed-off-by: David S. Miller

    Jarod Wilson
     

22 Sep, 2016

1 commit

  • As warned by linuxdoc[1] tool, using:

    $ for i in $(git grep kernel-doc Documentation/media/kapi/|cut -d: -f4); do kernel-lintdoc --sloppy $i; done

    include/media/v4l2-dev.h:118 :WARN: function name from comment differs: v4l2_prio_close v4l2_prio_check
    include/media/v4l2-mc.h:56 [kernel-doc WARN] : enum name from comment differs: if_vid_dec_index if_vid_dec_pad_index
    include/media/v4l2-mc.h:71 [kernel-doc WARN] : enum name from comment differs: if_aud_dec_index if_aud_dec_pad_index
    include/media/v4l2-mem2mem.h:396 [kernel-doc WARN] : function name from comment differs: v4l2_m2m_num_src_bufs_ready v4l2_m2m_num_dst_bufs_ready
    drivers/media/dvb-core/dvb_math.h:28 [kernel-doc WARN] : function name from comment differs: cintlog2 intlog2
    include/media/v4l2-subdev.h:215 [kernel-doc WARN] : struct name from comment differs: s_radio v4l2_subdev_tuner_ops
    include/media/v4l2-subdev.h:890 [kernel-doc WARN] : function name from comment differs: v4l2_set_subdevdata v4l2_set_subdev_hostdata
    include/media/v4l2-subdev.h:901 [kernel-doc WARN] : function name from comment differs: v4l2_get_subdevdata v4l2_get_subdev_hostdata
    drivers/media/dvb-core/dvb_ringbuffer.h:196 [kernel-doc WARN] : function name from comment differs: dvb_ringbuffer_writeuser dvb_ringbuffer_write_user
    include/media/videobuf2-core.h:399 [kernel-doc WARN] : struct name from comment differs: vb2_ops vb2_buf_ops
    include/media/media-entity.h:132 [kernel-doc ERROR] : duplicate parameter definition 'source'
    include/media/media-entity.h:477 [kernel-doc WARN] : function name from comment differs: media_entity_enum_test media_entity_enum_test_and_set
    include/media/media-entity.h:535 [kernel-doc WARN] : function name from comment differs: gobj_to_entity gobj_to_pad
    include/media/media-entity.h:544 [kernel-doc WARN] : function name from comment differs: gobj_to_entity gobj_to_link
    include/media/media-entity.h:553 [kernel-doc WARN] : function name from comment differs: gobj_to_entity gobj_to_intf
    include/media/media-entity.h:562 [kernel-doc WARN] : function name from comment differs: gobj_to_entity intf_to_devnode
    include/media/rc-core.h:234 [kernel-doc WARN] : function name from comment differs: rc_open rc_close
    include/media/v4l2-ctrls.h:397 [kernel-doc WARN] : missing initial short description of 'v4l2_ctrl_handler_init'
    include/media/v4l2-dev.h:118 [kernel-doc WARN] : function name from comment differs: v4l2_prio_close v4l2_prio_check
    include/media/v4l2-event.h:225 [kernel-doc WARN] : missing initial short description of 'v4l2_src_change_event_subscribe'

    [1] https://return42.github.io/linuxdoc/linux.html

    The above are real issues at the documentation. On several cases,
    caused by cut-and-paste.

    Fix them.

    Signed-off-by: Mauro Carvalho Chehab

    Mauro Carvalho Chehab
     

09 Sep, 2016

3 commits