Commit Graph

248 Commits

Author SHA1 Message Date
Mauro Carvalho Chehab
f2709c206d Revert "[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations"
While this patch sounded a good idea, unfortunately, it causes
bad dependencies, as drivers that would otherwise work without
the DVB core will now break:

ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5767.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tea5761.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda827x.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/tda18218.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/qt1010.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2266.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt20xx.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mt2060.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/mc44s803.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0013.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0012.ko] undefined!
ERROR: "dvb_tuner_simple_release" [drivers/media/tuners/fc0011.ko] undefined!

So, we have to revert it.

Note: as the argument for the release ops changed from "int"
to "void", we needed to change it at the revert patch, to
avoid compilation issues like:
	drivers/media/tuners/tea5767.c:437:23: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types]
	  .release           = tea5767_release,
	                       ^~~~~~~~~~~~~~~

This reverts commit 22a613e898.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 20:44:33 -02:00
Max Kellermann
1f862a68df [media] dvb_frontend: move kref to struct dvb_frontend
This commit amends my old commit fe35637b0a ("[media] dvb_frontend:
eliminate blocking wait in dvb_unregister_frontend()"), which added
kref to struct dvb_frontend_private.  It turned out that there are
several use-after-free bugs left, which affect the struct
dvb_frontend.  Protecting it with kref also protects struct
dvb_frontend_private, so we can simply move it.

This is how the use-after-free looks like in KASAN:

    BUG: KASAN: use-after-free in string+0x60/0xb1 at addr ffff880033bd9fc0
    Read of size 1 by task kworker/0:2/617
    CPU: 0 PID: 617 Comm: kworker/0:2 Not tainted 4.8.0-rc1-hosting+ #60
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    Workqueue: usb_hub_wq hub_event
     0000000000000000 ffff880033757218 ffffffff81394e50 ffff880033bd9fd0
     ffff880035c03b00 ffff880033757240 ffffffff811f271d ffff880033bd9fc0
     1ffff1000677b3f8 ffffed000677b3f8 ffff8800337572b8 ffffffff811f2afe
    Call Trace:
     [...]
     [<ffffffff813a2d2f>] vsnprintf+0x39d/0x7e9
     [<ffffffff813993f9>] add_uevent_var+0x10f/0x1dc
     [<ffffffff814fe5ca>] rc_dev_uevent+0x55/0x6f
     [<ffffffff814438f8>] dev_uevent+0x2e1/0x316
     [<ffffffff81399744>] kobject_uevent_env+0x27e/0x701
     [<ffffffff81399bd2>] kobject_uevent+0xb/0xd
     [<ffffffff81443445>] device_del+0x322/0x383
     [<ffffffff81500c0c>] rc_unregister_device+0x98/0xc3
     [<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90
     [<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5
     [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
     [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80
     [...]
    Object at ffff880033bd9fc0, in cache kmalloc-16 size: 16
    Allocated:
     [...]
    Freed:
    PID = 617
     [...]
     [<ffffffff811f034c>] kfree+0xd9/0x166
     [<ffffffff814fe513>] ir_free_table+0x2f/0x51
     [<ffffffff81500bc1>] rc_unregister_device+0x4d/0xc3
     [<ffffffff81508fb4>] dvb_usb_remote_exit+0x7a/0x90
     [<ffffffff81506157>] dvb_usb_exit+0x1d/0xe5
     [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
     [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80

Another one:

    BUG: KASAN: use-after-free in do_sys_poll+0x336/0x6b8 at addr ffff88003563fcc0
    Read of size 8 by task tuner on fronte/1042
    CPU: 1 PID: 1042 Comm: tuner on fronte Tainted: G    B           4.8.0-rc1-hosting+ #60
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
     0000000000000000 ffff88003353f910 ffffffff81394e50 ffff88003563fd80
     ffff880035c03200 ffff88003353f938 ffffffff811f271d ffff88003563fc80
     1ffff10006ac7f98 ffffed0006ac7f98 ffff88003353f9b0 ffffffff811f2afe
    Call Trace:
     [...]
     [<ffffffff812289b3>] do_sys_poll+0x336/0x6b8
     [...]
     [<ffffffff81228ed9>] SyS_poll+0xa9/0x194
     [...]
    Object at ffff88003563fc80, in cache kmalloc-256 size: 256
    Allocated:
     [...]
    Freed:
    PID = 617
     [...]
     [<ffffffff811f034c>] kfree+0xd9/0x166
     [<ffffffff814eb60d>] dvb_unregister_device+0xd6/0xe5
     [<ffffffff814fa4ed>] dvb_unregister_frontend+0x4b/0x66
     [<ffffffff8150810b>] dvb_usb_adapter_frontend_exit+0x69/0xac
     [<ffffffff8150617d>] dvb_usb_exit+0x43/0xe5
     [<ffffffff81506e90>] dvb_usb_device_exit+0x69/0x7d
     [<ffffffff8150a181>] pctv452e_usb_disconnect+0x7b/0x80

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:13:22 -02:00
Max Kellermann
d812b3caea [media] dvb_frontend: add "detach" callback
Prepare for making "release" asynchronous (via kref).  Some operations
may need to be run synchronously in dvb_frontend_detach(), and that's
why we need a "detach" callback.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:09:41 -02:00
Max Kellermann
967d8e8f4c [media] dvb_frontend: merge the two dvb_frontend_detach() versions
This code duplication is confusing and error prone.  Let's merge them
by moving the release/dvb_detach call into one function with one

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:08:49 -02:00
Max Kellermann
194ced7a5a [media] dvb_frontend: tuner_ops.release returns void
It is not clear what this return value means.  All implemenations
return 0, and the one caller ignores the value.  Let's remove this
useless return value completely.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:07:26 -02:00
Max Kellermann
22a613e898 [media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations
Most release callback functions are identical: free the "tuner_priv"
and clear it.  Let's eliminate some bloat by providing this simple
implementation in the dvb_frontend library.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:05:44 -02:00
Max Kellermann
4d5030b69b [media] dvb-core/en50221: use dvb_remove_device()
Commit da677fe143 ("[media] dvb-core/en50221: use kref to manage
struct dvb_ca_private") moved the dvb_unregister_device() call to the
kref callback, but that left lots of stale device state visible to
userspace (e.g. in sysfs).  By using dvb_remove_device() and
dvb_free_device() instead of dvb_unregister_device(), we can avoid
that.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:03:45 -02:00
Max Kellermann
1f4ed6cd58 [media] dvbdev: split dvb_unregister_device()
dvb_unregister_device() has a major problem: it combines unregistering
with memory disposal.  Sometimes, it is necessary to unregister a
device, but no memory can be freed yet, because a process still has a
(stale) file handle.  Therefore, we need to split
dvb_unregister_device().  This will allow sanitizing a few callers.

With my new design, dvb_unregister_device() appears misnamed, but to
reduce patch noise, I'm not renaming it just yet.

Signed-off-by: Max Kellermann <max.kellermann@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-18 15:02:39 -02:00
Masahiro Yamada
29a8d97925 [media] squash lines for simple wrapper functions
Remove unneeded variables and assignments.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-16 13:28:40 -02:00
Olli Salonen
82b65714a6 [media] dvb-usb-dvbsky: Add support for TechnoTrend S2-4650 CI
TechnoTrend TT-connect S2-4650 CI seems to be a variation of
the DVBSky S960CI device.

Signed-off-by: Olli Salonen <olli.salonen@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-24 17:14:25 -02:00
CIJOML CIJOMLovic
37e7856827 [media] Add support for EVOLVEO XtraTV stick
Add a new USB ID for EVOLVEO XtraTV stick.

[mchehab@s-opensource.org: fix patch and make checkpatch happy]
Cc: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-24 13:49:30 -02:00
Mauro Carvalho Chehab
b676e7316a [media] dvb-core: move dvb_filter out of the DVB core
The dvb_filter.c can hardly be considered as part of the DVB
core. More than half of the code there is commented out by
av7110 and ttusb_dec.

On the latter, just two small helper functions and a struct
definition is used.

Being part of the core means that it would require an
amount of work to fix issues in it, like bad printk's
on it, and to document it on some future, like other kAPI
headers. It simply not worth the effort for something that
seems to be deprecated, as no new drivers use it.

So, move it out of the core, by moving it to pci/ttpci
directory, where av7110 driver is kept, and copy the two
routines used by ttyusb_dec directly into its code.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-21 08:44:08 -02:00
Mauro Carvalho Chehab
dd79d27e1b [media] dvb-core: get rid of demux optional circular buffer
There is a provision at the dvb_demux.c to use a vmalloc'ed
circular buffer, enabled via an extra #ifdef option that it
is not at Kconfig. Enabling it will only make the Kernel to
allocate/deallocate such buffer, but no code would actually
use it. So, no practical effect, except for sparing some
memory without any good reason.

So, get rid of such dead code.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-21 08:43:24 -02:00
Mauro Carvalho Chehab
801edd6bb9 [media] dvb_demux: uncomment a packet loss check code
There is a commented code that also detects packet loss.
Uncomment it and put into the DVB_DEMUX_SECTION_LOSS_LOG
debug Kconfig option.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-21 08:42:07 -02:00
Mauro Carvalho Chehab
bbd02f6aa9 [media] dvb_demux: convert an internal ifdef into a Kconfig option
There are some ifdefs inside the dvb_demux that are meant to
enable advanced debug capabilities, at the cost of being very
verbose.

Keeping those as internal ifdefs is a very bad idea, as it
doesn't make easy to check if the code there was broken by
some patch. So, let's add an explicit Kconfig option for it.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-21 08:41:45 -02:00
Mauro Carvalho Chehab
b3ad24d2e0 [media] dvb-core: use pr_foo() instead of printk()
The dvb-core directly calls printk() without using the modern
printk macros, or using the proper printk levels. Change it
to use pr_foo().

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-21 08:41:19 -02:00
Mauro Carvalho Chehab
0a93dc1c18 [media] dvb-core: don't break long lines
Due to the 80-cols checkpatch warnings, several strings
were broken into multiple lines. This is not considered
a good practice anymore, as it makes harder to grep for
strings at the source code. So, join those continuation
lines.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-10-21 08:38:33 -02:00
Mauro Carvalho Chehab
e383ce0736 [media] get rid of a number of problems at the cross references
As warned by linuxdoc[1] tool, using:

$ for i in $(git grep kernel-doc Documentation/media/kapi/|cut -d: -f4); do kernel-lintdoc --sloppy $i; done

    include/media/v4l2-dev.h:118 :WARN: function name from comment differs:  v4l2_prio_close <--> v4l2_prio_check
    include/media/v4l2-mc.h:56 [kernel-doc WARN] : enum name from comment differs:  if_vid_dec_index <--> if_vid_dec_pad_index
    include/media/v4l2-mc.h:71 [kernel-doc WARN] : enum name from comment differs:  if_aud_dec_index <--> if_aud_dec_pad_index
    include/media/v4l2-mem2mem.h:396 [kernel-doc WARN] : function name from comment differs:  v4l2_m2m_num_src_bufs_ready <--> v4l2_m2m_num_dst_bufs_ready
    drivers/media/dvb-core/dvb_math.h:28 [kernel-doc WARN] : function name from comment differs:  cintlog2 <--> intlog2
    include/media/v4l2-subdev.h:215 [kernel-doc WARN] : struct name from comment differs:  s_radio <--> v4l2_subdev_tuner_ops
    include/media/v4l2-subdev.h:890 [kernel-doc WARN] : function name from comment differs:  v4l2_set_subdevdata <--> v4l2_set_subdev_hostdata
    include/media/v4l2-subdev.h:901 [kernel-doc WARN] : function name from comment differs:  v4l2_get_subdevdata <--> v4l2_get_subdev_hostdata
    drivers/media/dvb-core/dvb_ringbuffer.h:196 [kernel-doc WARN] : function name from comment differs:  dvb_ringbuffer_writeuser <--> dvb_ringbuffer_write_user
    include/media/videobuf2-core.h:399 [kernel-doc WARN] : struct name from comment differs:  vb2_ops <--> vb2_buf_ops
    include/media/media-entity.h:132 [kernel-doc ERROR] : duplicate parameter definition 'source'
    include/media/media-entity.h:477 [kernel-doc WARN] : function name from comment differs:  media_entity_enum_test <--> media_entity_enum_test_and_set
    include/media/media-entity.h:535 [kernel-doc WARN] : function name from comment differs:  gobj_to_entity <--> gobj_to_pad
    include/media/media-entity.h:544 [kernel-doc WARN] : function name from comment differs:  gobj_to_entity <--> gobj_to_link
    include/media/media-entity.h:553 [kernel-doc WARN] : function name from comment differs:  gobj_to_entity <--> gobj_to_intf
    include/media/media-entity.h:562 [kernel-doc WARN] : function name from comment differs:  gobj_to_entity <--> intf_to_devnode
    include/media/rc-core.h:234 [kernel-doc WARN] : function name from comment differs:  rc_open <--> rc_close
    include/media/v4l2-ctrls.h:397 [kernel-doc WARN] : missing initial short description of 'v4l2_ctrl_handler_init'
    include/media/v4l2-dev.h:118 [kernel-doc WARN] : function name from comment differs:  v4l2_prio_close <--> v4l2_prio_check
    include/media/v4l2-event.h:225 [kernel-doc WARN] : missing initial short description of 'v4l2_src_change_event_subscribe'

[1] https://return42.github.io/linuxdoc/linux.html

The above are real issues at the documentation. On several cases,
caused by cut-and-paste.

 Fix them.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-09-22 10:00:23 -03:00
Mauro Carvalho Chehab
36aefa35f4 [media] demux.h: fix a documentation warning
The kernel-doc parser didn't handle well the private:
tag. Rewrite it.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-09-09 09:23:32 -03:00
Mauro Carvalho Chehab
bb501b76c7 [media] demux.h: Fix a few documentation issues
demux.h was lacking documentation for the DMX_FE_ENTRY macro:
	./drivers/media/dvb-core/demux.h:511: WARNING: c:func reference target not found: DMX_FE_ENTRY

While here, get rid of unused parameters and fix a few minor issues
at the header file.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-09-09 09:22:51 -03:00
Mauro Carvalho Chehab
9aa9d92890 [media] dvb_ringbuffer.h: document the define macros
There are a few define macros not documented, because the ReST
output was causing more warnings.

Now that this got fixed, document them. While here, fix the
remaining coding style issues.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-09-09 09:22:28 -03:00
Mauro Carvalho Chehab
b6df512a9f [media] dtv-core.rst: move DTV ringbuffer notes to kAPI doc
Instead of keeping those notes at the file on a non-structured
way, move them to dtv-core.rst, using the proper ReST tags.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-09-09 09:21:50 -03:00
Mauro Carvalho Chehab
ff54c19d8e [media] dvb_ringbuffer.h: Document all functions
There are several functions there there weren't properly
documented. Add documentation for them.

While here, make checkpatch.pl happier.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-09-09 09:21:30 -03:00
Markus Elfring
fb6609280d [media] dvb_frontend: Use memdup_user() rather than duplicating its implementation
* Reuse existing functionality from memdup_user() instead of keeping
  duplicate source code.

  This issue was detected by using the Coccinelle software.

* Return directly if this copy operation failed.

* Replace the specification of data structures by pointer dereferences
  to make the corresponding size determination a bit safer according to
  the Linux coding style convention.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-08-24 17:20:45 -03:00
Mauro Carvalho Chehab
564aaf6920 [media] doc-rst: add some needed escape codes
Some extra escape codes are needed to avoid Sphinx to not
identify the tags.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-23 08:05:02 -03:00
Mauro Carvalho Chehab
7a23c2574d [media] dvb_ringbuffer.h: some documentation improvements
Better document a note on this header.

While here, better format dvb_ringbuffer_pkt_read_user()
to adjust it to CodingStyle.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-23 08:04:21 -03:00
Mauro Carvalho Chehab
5b8700e9f9 [media] doc-rst: Fix some Sphinx warnings
Fix all remaining media warnings with ReST that are fixable
without changing at the Sphinx code.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-23 08:03:24 -03:00
Mauro Carvalho Chehab
c278256d05 Merge branch 'patchwork' into topic/docs-next
* patchwork: (1492 commits)
  [media] cec: always check all_device_types and features
  [media] cec: poll should check if there is room in the tx queue
  [media] vivid: support monitor all mode
  [media] cec: fix test for unconfigured adapter in main message loop
  [media] cec: limit the size of the transmit queue
  [media] cec: zero unused msg part after msg->len
  [media] cec: don't set fh to NULL in CEC_TRANSMIT
  [media] cec: clear all status fields before transmit and always fill in sequence
  [media] cec: CEC_RECEIVE overwrote the timeout field
  [media] cxd2841er: Reading SNR for DVB-C added
  [media] cxd2841er: Reading BER and UCB for DVB-C added
  [media] cxd2841er: fix switch-case for DVB-C
  [media] cxd2841er: fix signal strength scale for ISDB-T
  [media] cxd2841er: adjust the dB scale for DVB-C
  [media] cxd2841er: provide signal strength for DVB-C
  [media] cxd2841er: fix BER report via DVBv5 stats API
  [media] mb86a20s: apply mask to val after checking for read failure
  [media] airspy: fix error logic during device register
  [media] s5p-cec/TODO: add TODO item
  [media] cec/TODO: drop comment about sphinx documentation
  ...

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-23 07:59:19 -03:00
Mauro Carvalho Chehab
d2f019851a [media] doc-rst: Fix conversion for dvb-core.rst
The conversion from DocBook required some fixes:

- Now, the C files with the exported symbols also need to be
  added. So, all headers need to be included twice: one to
  get the structs/enums/.. and another one for the functions;

- Notes should use the ReST tag, as kernel-doc doesn't
  recognizes it anymore;

- Identation needs to be fixed, as ReST uses it to identify
  when a format "tag" ends.

- Fix the cross-references at the media controller description.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-17 14:02:45 -03:00
Mauro Carvalho Chehab
d26a5d4350 [media] doc-rst: Convert media API to rst
Move the contents of the media section at
DocBooks/DocBook/device-drivers.tmpl to a new ReST book.

For now, the contents is kept as-is. Next patches will fix
the warnings and add cross-references that were removed due to
the conversion.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-17 14:02:41 -03:00
Max Kellermann
da677fe143 [media] dvb-core/en50221: use kref to manage struct dvb_ca_private
Don't free the object until the file handle has been closed.  Fixes
use-after-free bug which occurs when I disconnect my DVB-S received
while VDR is running.

This is a crash dump of such a use-after-free:

    general protection fault: 0000 [#1] SMP
    CPU: 0 PID: 2541 Comm: CI adapter on d Not tainted 4.7.0-rc1-hosting+ #49
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    task: ffff880027d7ce00 ti: ffff88003d8f8000 task.ti: ffff88003d8f8000
    RIP: 0010:[<ffffffff812f3d1f>]  [<ffffffff812f3d1f>] dvb_ca_en50221_io_read_condition.isra.7+0x6f/0x150
    RSP: 0018:ffff88003d8fba98  EFLAGS: 00010206
    RAX: 0000000059534255 RBX: 000000753d470f90 RCX: ffff88003c74d181
    RDX: 00000001bea04ba9 RSI: ffff88003d8fbaf4 RDI: 3a3030a56d763fc0
    RBP: ffff88003d8fbae0 R08: ffff88003c74d180 R09: 0000000000000000
    R10: 0000000000000001 R11: 0000000000000000 R12: ffff88003c480e00
    R13: 00000000ffffffff R14: 0000000059534255 R15: 0000000000000000
    FS:  00007fb4209b4700(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f06445f4078 CR3: 000000003c55b000 CR4: 00000000000006b0
    Stack:
     ffff88003d8fbaf4 000000003c2170c0 0000000000004000 0000000000000000
     ffff88003c480e00 ffff88003d8fbc80 ffff88003c74d180 ffff88003d8fbb8c
     0000000000000000 ffff88003d8fbb10 ffffffff812f3e37 ffff88003d8fbb00
    Call Trace:
     [<ffffffff812f3e37>] dvb_ca_en50221_io_poll+0x37/0xa0
     [<ffffffff8113109b>] do_sys_poll+0x2db/0x520

This is a backtrace of the kernel attempting to lock a freed mutex:

    #0  0xffffffff81083d40 in rep_nop () at ./arch/x86/include/asm/processor.h:569
    #1  cpu_relax () at ./arch/x86/include/asm/processor.h:574
    #2  virt_spin_lock (lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:57
    #3  native_queued_spin_lock_slowpath (lock=0xffff88003c480e90, val=761492029) at kernel/locking/qspinlock.c:304
    #4  0xffffffff810d1a06 in pv_queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/paravirt.h:669
    #5  queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:28
    #6  queued_spin_lock (lock=<optimized out>) at include/asm-generic/qspinlock.h:107
    #7  __mutex_lock_common (use_ww_ctx=<optimized out>, ww_ctx=<optimized out>, ip=<optimized out>, nest_lock=<optimized out>, subclass=<optimized out>,
        state=<optimized out>, lock=<optimized out>) at kernel/locking/mutex.c:526
    #8  mutex_lock_interruptible_nested (lock=0xffff88003c480e88, subclass=<optimized out>) at kernel/locking/mutex.c:647
    #9  0xffffffff812f49fe in dvb_ca_en50221_io_do_ioctl (file=<optimized out>, cmd=761492029, parg=0x1 <irq_stack_union+1>)
        at drivers/media/dvb-core/dvb_ca_en50221.c:1210
    #10 0xffffffff812ee660 in dvb_usercopy (file=<optimized out>, cmd=761492029, arg=<optimized out>, func=<optimized out>) at drivers/media/dvb-core/dvbdev.c:883
    #11 0xffffffff812f3410 in dvb_ca_en50221_io_ioctl (file=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at drivers/media/dvb-core/dvb_ca_en50221.c:1284
    #12 0xffffffff8112eddd in vfs_ioctl (arg=<optimized out>, cmd=<optimized out>, filp=<optimized out>) at fs/ioctl.c:43
    #13 do_vfs_ioctl (filp=0xffff88003c480e90, fd=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at fs/ioctl.c:674
    #14 0xffffffff8112f30c in SYSC_ioctl (arg=<optimized out>, cmd=<optimized out>, fd=<optimized out>) at fs/ioctl.c:689
    #15 SyS_ioctl (fd=6, cmd=2148298626, arg=140734533693696) at fs/ioctl.c:680
    #16 0xffffffff8103feb2 in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:207

Signed-off-by: Max Kellermann <max@duempel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-13 15:45:29 -03:00
Max Kellermann
fe35637b0a [media] dvb_frontend: eliminate blocking wait in dvb_unregister_frontend()
The wait_event() call in dvb_unregister_frontend() waits synchronously
for other tasks to free a file descriptor, but it does that while
holding several mutexes.  That alone is a bad idea, but if one user
process happens to keep a (defunct) file descriptor open indefinitely,
the kernel will correctly detect a hung task:

    INFO: task kworker/0:1:314 blocked for more than 30 seconds.
          Not tainted 4.7.0-rc1-hosting+ #50
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    kworker/0:1     D ffff88003daf7a50     0   314      2 0x00000000
    Workqueue: usb_hub_wq hub_event
     ffff88003daf7a50 0000000000000296 ffff88003daf7a30 ffff88003fc13f98
     ffff88003dadce00 ffff88003daf8000 ffff88003e3fc010 ffff88003d48d4f8
     ffff88003e3b5030 ffff88003e3f8898 ffff88003daf7a68 ffffffff810cf860
    Call Trace:
     [<ffffffff810cf860>] schedule+0x30/0x80
     [<ffffffff812f88d3>] dvb_unregister_frontend+0x93/0xc0
     [<ffffffff8107a000>] ? __wake_up_common+0x80/0x80
     [<ffffffff813019c7>] dvb_usb_adapter_frontend_exit+0x37/0x70
     [<ffffffff81300614>] dvb_usb_exit+0x34/0xb0
     [<ffffffff81300d4a>] dvb_usb_device_exit+0x3a/0x50
     [<ffffffff81302dc2>] pctv452e_usb_disconnect+0x52/0x60
     [<ffffffff81295a07>] usb_unbind_interface+0x67/0x1e0
     [<ffffffff810609f3>] ? __blocking_notifier_call_chain+0x53/0x70
     [<ffffffff8127ba67>] __device_release_driver+0x77/0x110
     [<ffffffff8127c2d3>] device_release_driver+0x23/0x30
     [<ffffffff8127ab5d>] bus_remove_device+0x10d/0x150
     [<ffffffff8127879b>] device_del+0x13b/0x260
     [<ffffffff81299dea>] ? usb_remove_ep_devs+0x1a/0x30
     [<ffffffff8129468e>] usb_disable_device+0x9e/0x1e0
     [<ffffffff8128bb09>] usb_disconnect+0x89/0x260
     [<ffffffff8128db8d>] hub_event+0x30d/0xfc0
     [<ffffffff81059475>] process_one_work+0x1c5/0x4a0
     [<ffffffff8105940c>] ? process_one_work+0x15c/0x4a0
     [<ffffffff81059799>] worker_thread+0x49/0x480
     [<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0
     [<ffffffff81059750>] ? process_one_work+0x4a0/0x4a0
     [<ffffffff8105f65e>] kthread+0xee/0x110
     [<ffffffff810400bf>] ret_from_fork+0x1f/0x40
     [<ffffffff8105f570>] ? __kthread_unpark+0x70/0x70
    5 locks held by kworker/0:1/314:
     #0:  ("usb_hub_wq"){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0
     #1:  ((&hub->events)){......}, at: [<ffffffff8105940c>] process_one_work+0x15c/0x4a0
     #2:  (&dev->mutex){......}, at: [<ffffffff8128d8cb>] hub_event+0x4b/0xfc0
     #3:  (&dev->mutex){......}, at: [<ffffffff8128bad2>] usb_disconnect+0x52/0x260
     #4:  (&dev->mutex){......}, at: [<ffffffff8127c2cb>] device_release_driver+0x1b/0x30

This patch removes the blocking wait, and postpones the kfree() call
until all file handles have been closed by using struct kref.

Signed-off-by: Max Kellermann <max@duempel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-13 15:43:31 -03:00
Soeren Moch
ca6e6126db [media] media: dvb_ringbuffer: Add memory barriers
Implement memory barriers according to Documentation/circular-buffers.txt:
- use smp_store_release() to update ringbuffer read/write pointers
- use smp_load_acquire() to load write pointer on reader side
- use ACCESS_ONCE() to load read pointer on writer side

This fixes data stream corruptions observed e.g. on an ARM Cortex-A9
quad core system with different types (PCI, USB) of DVB tuners.

Signed-off-by: Soeren Moch <smoch@web.de>
Cc: stable@vger.kernel.org # 3.14+
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-09 07:57:47 -03:00
Arnd Bergmann
e95be15886 [media] dvb: use ktime_t for internal timeout
The dvb demuxer code uses a 'struct timespec' to pass a timeout
as absolute time. This will cause problems on 32-bit architectures
in 2038 when time_t overflows, and it is racy with a concurrent
settimeofday() call.

This patch changes the code to use ktime_get() instead, using
the monotonic time base to avoid both the race and the overflow.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-08 16:36:00 -03:00
Max Kellermann
bd3df3c53e [media] drivers/media/dvb-core/en50221: move code to dvb_ca_private_free()
Prepare for postponing the call until all file handles have been
closed.

[mchehab@osg.samsung.com: make checkpatch happy]
Signed-off-by: Max Kellermann <max@duempel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-06-07 17:14:43 -03:00
Max Kellermann
acc37e8f86 [media] media/dvb-core: forward media_create_pad_links() return value
Instead of always return -ENOMEM, return the real error that should
come from media_create_pad_link().

Signed-off-by: Max Kellermann <max@duempel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-05-07 10:56:55 -03:00
Olli Salonen
7977a15ede [media] az6027: Add support for Elgato EyeTV Sat v3
Another version of Elgato EyeTV Sat USB DVB-S2 adapter needs just
a USB ID addition.

Signed-off-by: Christian Knippel <namerp@gmail.com>
Reported-by: Olli Salonen <olli.salonen@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-05-06 15:53:23 -03:00
Mauro Carvalho Chehab
e8364275f9 [media] dw2102: move USB IDs to dvb-usb-ids.h
Right now, dw2102 assumes that the USB IDs will be either at
an external header or defined internally. That doesn't sound
right.

So, let's move the definitions to just one place.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-05-06 10:19:03 -03:00
Olli Salonen
711f3fba6f [media] dvb-core: fix return code checking for devices with CA
The test for the return code was mistakenly inverted. This caused DVB
devices with CA module to fail on modprobe.

Tested with TechnoTrend CT2-4650 CI USB tuner.

Signed-off-by: Olli Salonen <olli.salonen@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-03-03 14:33:33 -03:00
Philippe Valembois
b8ebfafc32 [media] Add support for Avermedia AverTV Volar HD 2 (TD110)
Signed-off-by: Philippe Valembois <lephilousophe@users.sourceforge.net>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-03-03 08:33:05 -03:00
Shuah Khan
68ff5767dd [media] media: dvb-frontend invoke enable/disable_source handlers
Change dvb frontend to check if tuner is free when device opened in RW
mode.

Call to enable_source handler either returns with an active pipeline to
tuner or error if tuner is busy.

Tuner is released when frontend is released calling the disable_source
handler.

Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-27 09:34:06 -03:00
Mauro Carvalho Chehab
bb31d2381c [media] dvb_frontend: Don't let drivers to trash data at cache
GET_FRONTEND and G_PROPERTY can be called anytime, even when the
tuner/demod is not fully locked. However, several parameters
returned by those calls are available only after the demod get
VITERBI lock.

While several drivers do the right thing by checking the status before
returning the parameter, some drivers simply blindly update the
DTV properties cache without checking if the registers at the
hardware contain valid values.

Due to that, programs that call G_PROPERTY (or GET_FRONTEND)
before having a tuner lock may interfere at the zigzag logic,
as the DVB kthread calls the set_frontend() callback several
times, to fine tune the frequency and to identify if the signal
is inverted or not.

While the drivers should be fixed to report the right status,
we should prevent that such bugs would actually interfere at the
device operation.

So, let's use a separate var for userspace calls to get frontend.

As we copy the content of the cache, this should not cause any
troubles.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-04 16:27:41 -02:00
Mauro Carvalho Chehab
7e3e68bcfd [media] dvb_frontend: pass the props cache to get_frontend() as arg
Instead of using the DTV properties cache directly, pass the get
frontend data as an argument. For now, everything should remain
the same, but the next patch will prevent get_frontend to
affect the global cache.

This is needed because several drivers don't care enough to only
change the properties if locked. Due to that, calling
G_PROPERTY before locking on those drivers will make them to
never lock. Ok, those drivers are crap and should never be
merged like that, but the core should not rely that the drivers
would be doing the right thing.

Reviewed-by: Michael Ira Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-04 16:27:30 -02:00
Mauro Carvalho Chehab
2ea9a08d59 [media] dvb_frontend: add props argument to dtv_get_frontend()
Instead of implicitly using the DTV cache properties at
dtv_get_frontend(), pass it as an additional argument.

This patch prepares to use a separate cache for G_PROPERTY,
in order to avoid it to mangle with the DVB thread
zigzag logic.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-04 09:45:14 -02:00
Mauro Carvalho Chehab
c29ebb64a5 [media] dvb_frontend: print DTV property dump also for SET_PROPERTY
When debugging troubles with DTV properties get/set, it is
important to be able to see not only the properties from get, but
also the ones from set. So, improve the dumps to allow reporting
both.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-04 09:06:38 -02:00
Abhilash Jindal
6b3f99989e [media] dvb-frontend: Use boottime
Wall time obtained from ktime_get_real is susceptible to sudden jumps due to
user setting the time or due to NTP.  Boot time is constantly increasing time
better suited for comparing two timestamps.

[mchehab@osg.samsung.com: fix trivial merge conflicts]
Signed-off-by: Abhilash Jindal <klock.android@gmail.com>

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-01 13:35:29 -02:00
Xiubo Li
0ede1876f7 [media] dvbdev: the space is required after ','
The space is missing after ',', and this will be introduce much
noise when checking new patch around them.

Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-01 10:25:59 -02:00
Xiubo Li
5c3fbc5e03 [media] dvbdev: replace kcalloc with kzalloc
Since the number of elements equals to 1, so just use kzalloc to
simplify the code and make it more readable.

Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-01 10:25:16 -02:00
Xiubo Li
eac287adb3 [media] dvbdev: remove useless parentheses after return
The parentheses are not required after return, and just remove it.

Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-01 10:24:44 -02:00
Torbjörn Jansson
d309c8bb70 [media] dvb-usb-dvbsky: add new product id for TT CT2-4650 CI
Add a new product id to dvb-usb-dvbsky for new version of TechnoTrend CT2-4650 CI

Signed-off-by: Torbjörn Jansson <torbjorn.jansson@mbox200.swipnet.se>
Reviewed-by: Olli Salonen <olli.salonen@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-01 09:06:10 -02:00