- 20 Jul, 2017 40 commits
-
-
Prabhakar Lad authored
this patch makes sure VPFE_CMD_S_CCDC_RAW_PARAMS ioctl no longer works for vpfe_capture driver with a minimal patch suitable for backporting. - This ioctl was never in public api and was only defined in kernel header. - The function set_params constantly mixes up pointers and phys_addr_t numbers. - This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is described as an 'experimental ioctl that will change in future kernels'. - The code to allocate the table never gets called after we copy_from_user the user input over the kernel settings, and then compare them for inequality. - We then go on to use an address provided by user space as both the __user pointer for input and pass it through phys_to_virt to come up with a kernel pointer to copy the data to. This looks like a trivially exploitable root hole. Due to these reasons we make sure this ioctl now returns -EINVAL and backport this patch as far as possible. Fixes: 5f15fbb6 ("V4L/DVB (12251): v4l: dm644x ccdc module for vpfe capture driver") Signed-off-by:
Lad, Prabhakar <prabhakar.csengg@gmail.com> Cc: <stable@vger.kernel.org> # for v3.7 and up Signed-off-by:
Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by:
Mauro Carvalho Chehab <mchehab@s-opensource.com>
-
Stanimir Varbanov authored
In venus_boot(), we pass a pointer to a phys_addr_t into dmam_alloc_coherent, which the compiler warns about: platform/qcom/venus/firmware.c: In function 'venus_boot': platform/qcom/venus/firmware.c:63:49: error: passing argument 3 of 'dmam_alloc_coherent' from incompatible pointer type [-Werror=incompatible-pointer-types] To avoid the error refactor venus_boot function by discard dma_alloc_coherent invocation because we don't want to map the memory for the device. Something more, the usage of DMA mapping API is actually wrong and the current implementation relies on several bugs in DMA mapping code. When these bugs are fixed that will break firmware loading, so fix this now to avoid future troubles. The meaning of venus_boot is to copy the content of the firmware buffer into reserved (and memblock removed) block of memory and pass that physical address to the trusted zone for authentication and mapping through iommu form the secure world. After iommu mapping is done the iova is passed as ane entry point to the remote processor. After this change memory-region property is parsed manually and the physical address is memremap to CPU, call mdt_load to load firmware segments into proper places and unmap reserved memory. Fixes: af2c3834 ("[media] media: venus: adding core part and helper functions") Signed-off-by:
Stanimir Varbanov <stanimir.varbanov@linaro.org> Reviewed-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
Rob Clark authored
Not entirely sure what triggers it, but with venus build as kernel module and in initrd, we hit this crash: Unable to handle kernel paging request at virtual address ffff80003c039000 pgd = ffff00000a14f000 [ffff80003c039000] *pgd=00000000bd9f7003, *pud=00000000bd9f6003, *pmd=00000000bd9f0003, *pte=0000000000000000 Internal error: Oops: 96000007 [#1] SMP Modules linked in: qcom_wcnss_pil(E+) crc32_ce(E) qcom_common(E) venus_core(E+) remoteproc(E) snd_soc_msm8916_digital(E) virtio_ring(E) cdc_ether(E) snd_soc_lpass_apq8016(E) snd_soc_lpass_cpu(E) snd_soc_apq8016_sbc(E) snd_soc_lpass_platform(E) v4l2_mem2mem(E) virtio(E) snd_soc_core(E) ac97_bus(E) snd_pcm_dmaengine(E) snd_seq(E) leds_gpio(E) videobuf2_v4l2(E) videobuf2_core(E) snd_seq_device(E) snd_pcm(E) videodev(E) media(E) nvmem_qfprom(E) msm(E) snd_timer(E) snd(E) soundcore(E) spi_qup(E) mdt_loader(E) qcom_tsens(E) qcom_spmi_temp_alarm(E) nvmem_core(E) msm_rng(E) uas(E) usb_storage(E) dm9601(E) usbnet(E) mii(E) mmc_block(E) adv7511(E) drm_kms_helper(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) fb_sys_fops(E) qcom_spmi_vadc(E) qcom_vadc_common(PE) industrialio(E) pinctrl_spmi_mpp(E) pinctrl_spmi_gpio(E) rtc_pm8xxx(E) clk_smd_rpm(E) sdhci_msm(E) sdhci_pltfm(E) qcom_smd_regulator(E) drm(E) smd_rpm(E) qcom_spmi_pmic(E) regmap_spmi(E) ci_hdrc_msm(E) ci_hdrc(E) usb3503(E) extcon_usb_gpio(E) phy_msm_usb(E) udc_core(E) qcom_hwspinlock(E) extcon_core(E) ehci_msm(E) i2c_qup(E) sdhci(E) mmc_core(E) spmi_pmic_arb(E) spmi(E) qcom_smd(E) smsm(E) rpmsg_core(E) smp2p(E) smem(E) hwspinlock_core(E) gpio_keys(E) CPU: 2 PID: 551 Comm: irq/150-venus Tainted: P E 4.12.0+ #1625 Hardware name: qualcomm dragonboard410c/dragonboard410c, BIOS 2017.07-rc2-00144-ga97bdbdf72-dirty 07/08/2017 task: ffff800037338000 task.stack: ffff800038e00000 PC is at hfi_sys_init_done+0x64/0x140 [venus_core] LR is at hfi_process_msg_packet+0xcc/0x1e8 [venus_core] pc : [<ffff00000118b384>] lr : [<ffff00000118c11c>] pstate: 20400145 sp : ffff800038e03c60 x29: ffff800038e03c60 x28: 0000000000000000 x27: 00000000000df018 x26: ffff00000118f4d0 x25: 0000000000020003 x24: ffff80003a8d3010 x23: ffff00000118f760 x22: ffff800037b40028 x21: ffff8000382981f0 x20: ffff800037b40028 x19: ffff80003c039000 x18: 0000000000000020 x17: 0000000000000000 x16: ffff800037338000 x15: ffffffffffffffff x14: 0000001000000014 x13: 0000000100001007 x12: 0000000100000020 x11: 0000100e00000000 x10: 0000000000000001 x9 : 0000000200000000 x8 : 0000001400000001 x7 : 0000000000001010 x6 : 0000000000000148 x5 : 0000000000001009 x4 : ffff80003c039000 x3 : 00000000cd770abb x2 : 0000000000000042 x1 : 0000000000000788 x0 : 0000000000000002 Process irq/150-venus (pid: 551, stack limit = 0xffff800038e00000) Call trace: [<ffff00000118b384>] hfi_sys_init_done+0x64/0x140 [venus_core] [<ffff00000118c11c>] hfi_process_msg_packet+0xcc/0x1e8 [venus_core] [<ffff00000118a2b4>] venus_isr_thread+0x1b4/0x208 [venus_core] [<ffff00000118e750>] hfi_isr_thread+0x28/0x38 [venus_core] [<ffff000008161550>] irq_thread_fn+0x30/0x70 [<ffff0000081617fc>] irq_thread+0x14c/0x1c8 [<ffff000008105e68>] kthread+0x138/0x140 [<ffff000008083590>] ret_from_fork+0x10/0x40 Code: 52820125 52820207 7a431820 54000249 (b9400263) ---[ end trace c963460f20a984b6 ]--- The problem is that in the error case, we've incremented the data ptr but not decremented rem_bytes, and keep reading (presumably garbage) until eventually we go beyond the end of the buffer. Instead, on first error, we should probably just bail out. Other option is to increment read_bytes by sizeof(u32) before the switch, rather than only accounting for the ptype header in the non-error case. Note that in this case it is HFI_ERR_SYS_INVALID_PARAMETER, ie. an unrecognized/unsupported parameter, so interpreting the next word as a property type would be bogus. The other error cases are due to truncated buffer, so there isn't likely to be anything valid to interpret in the remainder of the buffer. So just bailing seems like a reasonable solution. Signed-off-by:
Rob Clark <robdclark@gmail.com> Reviewed-by:
-
Arnd Bergmann authored
If QCOM_MDT_LOADER is enabled, but ARCH_QCOM is not, we run into a build error: ERROR: "qcom_mdt_load" [drivers/media/platform/qcom/venus/venus-core.ko] undefined! ERROR: "qcom_mdt_get_size" [drivers/media/platform/qcom/venus/venus-core.ko] undefined! This changes the 'select' statement again, so we only try to enable those symbols when the drivers will actually get built, and explicitly test for QCOM_MDT_LOADER to be enabled before calling into it. Fixes: 76724b30 ("[media] media: venus: enable building with COMPILE_TEST") Signed-off-by:
-
Arnd Bergmann authored
Without PM support, gcc warns about two unused functions: platform/qcom/venus/core.c:146:13: error: 'venus_clks_disable' defined but not used [-Werror=unused-function] platform/qcom/venus/core.c:126:12: error: 'venus_clks_enable' defined but not used [-Werror=unused-function] The problem as usual are incorrect #ifdefs, so the easiest fix is to do away with the #ifdef completely and mark the suspend/resume handlers as __maybe_unused, which they are. Fixes: af2c3834 ("[media] media: venus: adding core part and helper functions") Signed-off-by:
-
Mauro Carvalho Chehab authored
As we're already touching on dvb_ca_en50221 to cleanup checkpatch issues, do that also for its header file, with: $ ./scripts/checkpatch.pl --strict --fix-inplace -f drivers/media/dvb-core/dvb_ca_en50221.h Signed-off-by: -
Jasmin Jessich authored
- Running "checkpatch.pl -strict -f ..." complained * Please don't use multiple blank lines Signed-off-by:
Jasmin Jessich <jasmin@anw.at> Signed-off-by:
-
Jasmin Jessich authored
- Running "checkpatch.pl -strict -f ..." gave more checks to fix. * Blank lines aren't necessary after an open brace '{' * Comparison to NULL written as "!<var>" * CHECK: Blank lines aren't necessary before a close brace '}' Signed-off-by: -
Jasmin Jessich authored
- Added the missing opening empty comment line. Signed-off-by:
-
Jasmin Jessich authored
Some EXPORT_SYMBOL() on this file don't match the name of functions that precedes them. Signed-off-by:
-
Jasmin Jessich authored
- "dont" -> "don't" Signed-off-by:
-
Jasmin Jessich authored
Fixed most of: WARNING: line over 80 characters The remaining lines are printk strings, which should not be split and lines where I thing they should stay as they are. Signed-off-by:
-
Jasmin Jessich authored
- Changed all C++ style comments ("// ..") to C style ones ("/* .. */"). Signed-off-by: -
Jasmin Jessich authored
- The STATUSREG_TXERR definition is not used and it has style problems, too. Removing it seems to solve both issues. Signed-off-by:
-
Jasmin Jessich authored
Fixed all: WARNING: braces {} are not necessary for single statement blocks Signed-off-by: -
Jasmin Jessich authored
Fixed all: WARNING: Missing a blank line after declarations Signed-off-by:
-
Jasmin Jessich authored
Used a helper variable "struct dvb_ca_slot *sl" instead of "ca->slot_info[slot]". This reduces the line length and simplifies code reading. Fixed also "-strict" checks in this patch: - Comparison to NULL written as "!<var>". Signed-off-by:
-
Jasmin Jessich authored
Fixed all: ERROR: do not use assignment in if condition Fixed also "-strict" checks in this patch: - Changed "if (ret != 0)" to "if (ret)". - Camel case variables have been converted to kernel_case. - Comparison to NULL written as "!<var>". - No space is necessary after a cast. Signed-off-by:
-
Jasmin Jessich authored
Fixed all: WARNING: Block comments use * on subsequent lines Added also the missing opening empty comment line. Signed-off-by:
-
Jasmin Jessich authored
Fixed all: WARNING: msleep < 20ms can sleep for up to 20ms by using usleep_range. Signed-off-by:
-
Jasmin Jessich authored
The CAM poll code for the budget-av is exactly the same on several places. Extracting the code to a new function improves maintainability. Signed-off-by:
-
Jasmin Jessich authored
Refactored "dvb_ca_en50221_thread" by moving the state machine into the new function "dvb_ca_en50221_thread_state_machine". This reduces the thread function size and reduces the structural complexity and of course gives us more space to meet the line length goal in the new function. Signed-off-by:
-
Daniel Scheller authored
While cab_state->state gives a quite accurate indication of the demod signal status, it might be incorrect if cab_algo() wasn't able to determine the exact status, with cab_algo() being the only place where this status was updated from, and it is only called upon tuning to new parameters passed to set_frontend(). Thus, the status will be wrong until the demod is retuned. With the cab_signal_type parsing in read_status(), this results in unusual fe_states like FE_HAS_SIGNAL | FE_HAS_CARRIER | FE_HAS_LOCK, which, while userspace applications check for FE_HAS_LOCK and work fine, leads to missing CNR or UCB stats. Fix this by re-reading CAB_FSM_STATUS and updating cab_state->state() in read_status(). While at it, refactor the fsm/qamfeclock and the fsm->signaltype parsing into separate functions to make things cleaner and deduplicate code. Also, assume full QAM FEC lock equals full FE_STATUS. Signed-off-by:
Daniel Scheller <d.scheller@gmx.net> Signed-off-by:
-
Sakari Ailus authored
Historically, mdev argument name was being used on both struct media_device and struct media_devnode. Recently most occurrences of mdev referring to struct media_devnode were replaced by devnode, which makes more sense. Fix the last remaining occurrence. Fixes: 163f1e93 ("[media] media-devnode: fix namespace mess") Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Sakari Ailus authored
Simplify the code to satisfy Linux coding style. Signed-off-by:
-
Colin Ian King authored
Don't populate array dib0090_tuning_table_cband_7090e_aci on the stack but instead make it static. Makes the object code smaller by over 180 bytes: Before: text data bss dec hex filename 40052 7320 192 47564 b9cc dib0090.o After: text data bss dec hex filename 39780 7408 192 47380 b914 dib0090.o Signed-off-by:
Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
Colin Ian King authored
Don't populate const arrays on the stack but instead make them static. Makes the object code smaller by over 1800 bytes: Before: text data bss dec hex filename 94100 9160 0 103260 1935c drxj.o After: text data bss dec hex filename 91044 10400 0 101444 18c44 drxj.o Signed-off-by:
-
Colin Ian King authored
Don't populate arrays slowIncrDecLUT and fastIncrDecLUT on the stack but instead make them static. Makes the object code smaller by over 100 bytes: text data bss dec hex filename 27776 832 64 28672 7000 drxd_hard.o text data bss dec hex filename 27530 976 64 28570 6f9a drxd_hard.o Signed-off-by:
-
Daniel Scheller authored
Discovered using w_scan when scanning DVB-T/T2: When w_scan goes from -T to -T2, it does so without stopping the frontend using .sleep. Due to this, the demod operation mode isn't re-setup, but as it still is in STATE_ACTIVE_TC, PLP and T2 Profile are set up, but only retune_active() is called, leaving the demod in T mode, thus not operable on any T2 frequency. Fix this by putting the demod to sleep if priv->system isn't equal to p->delsys. To properly accomplish this, sleep_tc() is split into sleep_tc() and shutdown_tc(), where sleep_tc() will only perform the sleep operation, while shutdown_tc() additionally performs the full demod shutdown (to keep the behaviour when the .sleep FE_OP is called). Signed-off-by:
-
Colin Ian King authored
Don't populate array gamma_par_mask on the stack but instead make it static. Makes the object code smaller by 148 bytes: Before: text data bss dec hex filename 2993 1104 0 4097 1001 drivers/staging/fbtft/fb_st7789v.o After: text data bss dec hex filename 2757 1192 0 3949 f6d drivers/staging/fbtft/fb_st7789v.o Signed-off-by:
-
Colin Ian King authored
Don't populate arrays on the stack but make them static. Makes the object code smaller: Before: text data bss dec hex filename 89299 21704 64 111067 1b1db cxd2841er.o After: text data bss dec hex filename 85823 23432 64 109319 1ab07 cxd2841er.o Signed-off-by:
-
Akihiro Tsukada authored
When a user starts and stops filtering at a demux device too quickly in a very short interval, the user process hangs in uninterruptible sleep, due to an inconsistency of kthread status in the driver. The kthread can be stopped before it starts running its thread function, but the invocation status was partly managed in the kthread function, which resulted in a double kthread_stop() of one kthread. Signed-off-by:
Akihiro Tsukada <tskd08@gmail.com> Signed-off-by:
-
Gustavo A. R. Silva authored
Check for i2c_algorithm structures that are only stored in the algo field of an i2c_adapter structure. This field is declared const, so i2c_algorithm structures that have this property can be declared as const also. This issue was identified using Coccinelle and the following semantic patch: @r disable optional_qualifier@ identifier i; position p; @@ static struct i2c_algorithm i@p = { ... }; @ok@ identifier r.i; struct i2c_adapter e; position p; @@ e.algo = &i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct i2c_algorithm i = { ... }; Signed-off-by:Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by:
-
Gustavo A. R. Silva authored
Check for i2c_algorithm structures that are only stored in the algo field of an i2c_adapter structure. This field is declared const, so i2c_algorithm structures that have this property can be declared as const also. This issue was identified using Coccinelle and the following semantic patch: @r disable optional_qualifier@ identifier i; position p; @@ static struct i2c_algorithm i@p = { ... }; @ok@ identifier r.i; struct i2c_adapter e; position p; @@ e.algo = &i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct i2c_algorithm i = { ... }; Signed-off-by: -
Gustavo A. R. Silva authored
Check for i2c_algorithm structures that are only stored in the algo field of an i2c_adapter structure. This field is declared const, so i2c_algorithm structures that have this property can be declared as const also. This issue was identified using Coccinelle and the following semantic patch: @r disable optional_qualifier@ identifier i; position p; @@ static struct i2c_algorithm i@p = { ... }; @ok@ identifier r.i; struct i2c_adapter e; position p; @@ e.algo = &i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct i2c_algorithm i = { ... }; Signed-off-by: -
Gustavo A. R. Silva authored
Check for i2c_algorithm structures that are only stored in the algo field of an i2c_adapter structure. This field is declared const, so i2c_algorithm structures that have this property can be declared as const also. This issue was identified using Coccinelle and the following semantic patch: @r disable optional_qualifier@ identifier i; position p; @@ static struct i2c_algorithm i@p = { ... }; @ok@ identifier r.i; struct i2c_adapter e; position p; @@ e.algo = &i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct i2c_algorithm i = { ... }; Signed-off-by: -
Gustavo A. R. Silva authored
Check for i2c_algorithm structures that are only stored in the algo field of an i2c_adapter structure. This field is declared const, so i2c_algorithm structures that have this property can be declared as const also. This issue was identified using Coccinelle and the following semantic patch: @r disable optional_qualifier@ identifier i; position p; @@ static struct i2c_algorithm i@p = { ... }; @ok@ identifier r.i; struct i2c_adapter e; position p; @@ e.algo = &i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct i2c_algorithm i = { ... }; Signed-off-by: -
Gustavo A. R. Silva authored
Check for i2c_algorithm structures that are only stored in the algo field of an i2c_adapter structure. This field is declared const, so i2c_algorithm structures that have this property can be declared as const also. This issue was identified using Coccinelle and the following semantic patch: @r disable optional_qualifier@ identifier i; position p; @@ static struct i2c_algorithm i@p = { ... }; @ok@ identifier r.i; struct i2c_adapter e; position p; @@ e.algo = &i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct i2c_algorithm i = { ... }; Signed-off-by: -
Gustavo A. R. Silva authored
Check for i2c_algorithm structures that are only stored in the algo field of an i2c_adapter structure. This field is declared const, so i2c_algorithm structures that have this property can be declared as const also. This issue was identified using Coccinelle and the following semantic patch: @r disable optional_qualifier@ identifier i; position p; @@ static struct i2c_algorithm i@p = { ... }; @ok@ identifier r.i; struct i2c_adapter e; position p; @@ e.algo = &i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct i2c_algorithm i = { ... }; Signed-off-by: -
Gustavo A. R. Silva authored
Check for i2c_algorithm structures that are only stored in the algo field of an i2c_adapter structure. This field is declared const, so i2c_algorithm structures that have this property can be declared as const also. This issue was identified using Coccinelle and the following semantic patch: @r disable optional_qualifier@ identifier i; position p; @@ static struct i2c_algorithm i@p = { ... }; @ok@ identifier r.i; struct i2c_adapter e; position p; @@ e.algo = &i@p; @bad@ position p != {r.p,ok.p}; identifier r.i; @@ i@p @depends on !bad disable optional_qualifier@ identifier r.i; @@ static +const struct i2c_algorithm i = { ... }; Signed-off-by:
-
