summaryrefslogtreecommitdiff
path: root/drivers/media/usb
AgeCommit message (Collapse)Author
2021-03-22media: flexcop-usb: delete unneeded returnJulia Lawall
No need for a return after a break; Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-19media: uvcvideo: Use dma_alloc_noncontiguous APIRicardo Ribalda
On architectures where there is no coherent caching such as ARM use the dma_alloc_noncontiguous API and handle manually the cache flushing using dma_sync_sgtable(). If the architechture has coherent cache, the API falls back to alloc_dma_pages, so we can remove the coherent caching code-path from the driver, making it simpler. With this patch on the affected architectures we can measure up to 20x performance improvement in uvc_video_copy_data_work(). Eg: aarch64 with an external usb camera NON_CONTIGUOUS frames: 999 packets: 999 empty: 0 (0 %) errors: 0 invalid: 0 pts: 0 early, 0 initial, 999 ok scr: 0 count ok, 0 diff ok sof: 2048 <= sof <= 0, freq 0.000 kHz bytes 67034480 : duration 33303 FPS: 29.99 URB: 523446/4993 uS/qty: 104.836 avg 132.532 std 13.230 min 831.094 max (uS) header: 76564/4993 uS/qty: 15.334 avg 15.229 std 3.438 min 186.875 max (uS) latency: 468945/4992 uS/qty: 93.939 avg 132.577 std 9.531 min 824.010 max (uS) decode: 54161/4993 uS/qty: 10.847 avg 6.313 std 1.614 min 111.458 max (uS) raw decode speed: 9.931 Gbits/s raw URB handling speed: 1.025 Gbits/s throughput: 16.102 Mbits/s URB decode CPU usage 0.162600 % COHERENT frames: 999 packets: 999 empty: 0 (0 %) errors: 0 invalid: 0 pts: 0 early, 0 initial, 999 ok scr: 0 count ok, 0 diff ok sof: 2048 <= sof <= 0, freq 0.000 kHz bytes 54683536 : duration 33302 FPS: 29.99 URB: 1478135/4000 uS/qty: 369.533 avg 390.357 std 22.968 min 3337.865 max (uS) header: 79761/4000 uS/qty: 19.940 avg 18.495 std 1.875 min 336.719 max (uS) latency: 281077/4000 uS/qty: 70.269 avg 83.102 std 5.104 min 735.000 max (uS) decode: 1197057/4000 uS/qty: 299.264 avg 318.080 std 1.615 min 2806.667 max (uS) raw decode speed: 365.470 Mbits/s raw URB handling speed: 295.986 Mbits/s throughput: 13.136 Mbits/s URB decode CPU usage 3.594500 % In non-affected architectures we see no significant impact. Eg: x86 with an external usb camera NON_CONTIGUOUS frames: 999 packets: 999 empty: 0 (0 %) errors: 0 invalid: 0 pts: 0 early, 0 initial, 999 ok scr: 0 count ok, 0 diff ok sof: 2048 <= sof <= 0, freq 0.000 kHz bytes 70179056 : duration 33301 FPS: 29.99 URB: 288901/4897 uS/qty: 58.995 avg 26.022 std 4.319 min 253.853 max (uS) header: 54792/4897 uS/qty: 11.189 avg 6.218 std 0.620 min 61.750 max (uS) latency: 236602/4897 uS/qty: 48.315 avg 24.244 std 1.764 min 240.924 max (uS) decode: 52298/4897 uS/qty: 10.679 avg 8.299 std 1.638 min 108.861 max (uS) raw decode speed: 10.796 Gbits/s raw URB handling speed: 1.949 Gbits/s throughput: 16.859 Mbits/s URB decode CPU usage 0.157000 % COHERENT frames: 999 packets: 999 empty: 0 (0 %) errors: 0 invalid: 0 pts: 0 early, 0 initial, 999 ok scr: 0 count ok, 0 diff ok sof: 2048 <= sof <= 0, freq 0.000 kHz bytes 71818320 : duration 33301 FPS: 29.99 URB: 321021/5000 uS/qty: 64.204 avg 23.001 std 10.430 min 268.837 max (uS) header: 54308/5000 uS/qty: 10.861 avg 5.104 std 0.778 min 54.736 max (uS) latency: 268799/5000 uS/qty: 53.759 avg 21.827 std 6.095 min 255.153 max (uS) decode: 52222/5000 uS/qty: 10.444 avg 7.137 std 1.874 min 71.103 max (uS) raw decode speed: 11.048 Gbits/s raw URB handling speed: 1.789 Gbits/s throughput: 17.253 Mbits/s URB decode CPU usage 0.156800 % Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Christoph Hellwig <hch@lst.de>
2021-03-17module: remove never implemented MODULE_SUPPORTED_DEVICELeon Romanovsky
MODULE_SUPPORTED_DEVICE was added in pre-git era and never was implemented. We can safely remove it, because the kernel has grown to have many more reliable mechanisms to determine if device is supported or not. Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-03-11media: anysee: simplify the return expression of anysee_ci_* functionLiu Shixin
Simplify the return expression. Signed-off-by: Liu Shixin <liushixin2@huawei.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: fix incorrect kernel doc usagesHans Verkuil
This patch fixes the following trivial warnings w.r.t. kernel-doc usage: drivers/media/common/videobuf2/frame_vector.c:38: warning: Excess function parameter 'gup_flags' description in 'get_vaddr_frames' drivers/media/dvb-core/dvb_ca_en50221.c:193: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1014: warning: expecting prototype for Wake up the DVB CA thread(). Prototype was for dvb_ca_en50221_thread_wakeup() instead drivers/media/dvb-core/dvb_ca_en50221.c:1023: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1081: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1112: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1327: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1411: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1426: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1582: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1693: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1743: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1772: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1830: warning: wrong kernel-doc identifier on line: drivers/media/dvb-core/dvb_ca_en50221.c:1922: warning: wrong kernel-doc identifier on line: drivers/media/rc/img-ir/img-ir-hw.c:628: warning: expecting prototype for img_ir_decoder_compatable(). Prototype was for img_ir_decoder_compatible() instead drivers/media/v4l2-core/v4l2-jpeg.c:461: warning: expecting prototype for jpeg_parse_header(). Prototype was for v4l2_jpeg_parse_header() instead drivers/media/platform/vsp1/vsp1_dl.c:166: warning: expecting prototype for struct vsp1_cmd_pool. Prototype was for struct vsp1_dl_cmd_pool instead drivers/media/platform/mtk-vpu/mtk_vpu.c:28: warning: expecting prototype for is a tiny processor controlling video hardware(). Prototype was for INIT_TIMEOUT_MS() instead drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:73: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct vp9_ref_buf instead drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c:85: warning: expecting prototype for struct vp9_fb_info. Prototype was for struct vp9_sf_ref_fb instead drivers/media/tuners/mt2063.c:1404: warning: expecting prototype for fLO_FractionalTerm(). Prototype was for MT2063_fLO_FractionalTerm() instead drivers/media/tuners/mt2063.c:1465: warning: expecting prototype for CalcLO2Mult(). Prototype was for MT2063_CalcLO2Mult() instead drivers/media/usb/pwc/pwc-dec23.c:640: warning: wrong kernel-doc identifier on line: drivers/media/platform/exynos4-is/media-dev.c:820: warning: expecting prototype for __fimc_md_create_fimc_links(). Prototype was for __fimc_md_create_fimc_sink_links() instead drivers/media/i2c/s5k6aa.c:426: warning: expecting prototype for s5k6aa_configure_pixel_clock(). Prototype was for s5k6aa_configure_pixel_clocks() instead drivers/media/i2c/imx274.c:700: warning: wrong kernel-doc identifier on line: drivers/media/i2c/imx274.c:735: warning: wrong kernel-doc identifier on line: drivers/media/i2c/imx274.c:983: warning: wrong kernel-doc identifier on line: Most are missing or mistyped function names. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: drivers/media/usb: fix memory leak in zr364xx_probePavel Skripkin
syzbot reported memory leak in zr364xx_probe()[1]. The problem was in invalid error handling order. All error conditions rigth after v4l2_ctrl_handler_init() must call v4l2_ctrl_handler_free(). Reported-by: syzbot+efe9aefc31ae1e6f7675@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: media/usb:Remove superfluous "breaks" in the ttusb_dec.cdingsenjie
Remove superfluous "breaks", as there is a "return" before them. Signed-off-by: dingsenjie <dingsenjie@yulong.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: media/usb:Remove superfluous "breaks"dingsenjie
Remove superfluous "breaks", as there is a "return" before them. Signed-off-by: dingsenjie <dingsenjie@yulong.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: usbtv: constify static structsRikard Falkeborn
Constify two static structs which are never modified to allow the compiler to put them in read-only memory. The only usage of norm_params is only read from it in usbtv_configure_for_norm(). Making it const shrinks the resulting ko-file with 300 bytes (tested with gcc 10). The only usage of usbtv_ioctl_ops is to put its address to the ioctl_ops field in the video_device struct. Making it const moves ~1kb to read-only memory. Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: dvb-usb: Fix use-after-free accessTakashi Iwai
dvb_usb_device_init() copies the properties to the own data, so that the callers can release the original properties later (as done in the commit 299c7007e936 ("media: dw2102: Fix memleak on sequence of probes")). However, it also stores dev->desc pointer that is a reference to the original properties data. Since dev->desc is referred later, it may result in use-after-free, in the worst case, leading to a kernel Oops as reported. This patch addresses the problem by allocating and copying the properties at first, then get the desc from the copied properties. Reported-and-tested-by: Stefan Seyfried <seife+kernel@b1-systems.com> BugLink: http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 Reviewed-by: Robert Foss <robert.foss@linaro.org> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: dvb-usb: Fix memory leak at error in dvb_usb_device_init()Takashi Iwai
dvb_usb_device_init() allocates a dvb_usb_device object, but it doesn't release the object by itself even at errors. The object is released in the callee side (dvb_usb_init()) in some error cases via dvb_usb_exit() call, but it also missed the object free in other error paths. And, the caller (it's only dvb_usb_device_init()) doesn't seem caring the resource management as well, hence those memories are leaked. This patch assures releasing the memory at the error path in dvb_usb_device_init(). Now dvb_usb_init() frees the resources it allocated but leaves the passed dvb_usb_device object intact. In turn, the dvb_usb_device object is released in dvb_usb_device_init() instead. We could use dvb_usb_exit() function for releasing everything in the callee (as it was used for some error cases in the original code), but releasing the passed object in the callee is non-intuitive and error-prone. So I took this approach (which is more standard in Linus kernel code) although it ended with a bit more open codes. Along with the change, the patch makes sure that USB intfdata is reset and don't return the bogus pointer to the caller of dvb_usb_device_init() at the error path, too. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: em28xx: Add pid for bulk revision of Hauppauge 461eV2Brad Love
Manufacturing has switched from ISOC to bulk transport, the pid has accordingly changed to signify this. 0x2013:0x0461 is an ISOC 461e v2 0x2013:0x8461 is a bulk transport 461e v2 Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: em28xx: Add pid for bulk revision of Hauppauge 461eBrad Love
Manufacturing has switched from ISOC to bulk transport, the pid has accordingly changed to signify this. 0x2013:0x0258 is an ISOC 461e 0x2013:0x8258 is a bulk transport 461e Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-03-11media: usbtv: Fix deadlock on suspendMaxim Mikityanskiy
usbtv doesn't support power management, so on system suspend the .disconnect callback of the driver is called. The teardown sequence includes a call to snd_card_free. Its implementation waits until the refcount of the sound card device drops to zero, however, if its file is open, snd_card_file_add takes a reference, which can't be dropped during the suspend, because the userspace processes are already frozen at this point. snd_card_free waits for completion forever, leading to a hang on suspend. This commit fixes this deadlock condition by replacing snd_card_free with snd_card_free_when_closed, that doesn't wait until all references are released, allowing suspend to progress. Fixes: 63ddf68de52e ("[media] usbtv: add audio support") Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-02-05media: uvc: strncpy -> strscpyHans Verkuil
The use of strncpy is discouraged, use strscpy instead. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-02-05media: em28xx: Add support for Hauppauge USB QuadHDBrad Love
Hauppauge USB QuadHD contains two two-tuner em28xx devices behind a usb hub. Each of the four dvb adapters contains a MaxLinear 692 combo ATSC demod/tuner. Bus 003 Device 006: ID 2040:846d Hauppauge Bus 003 Device 005: ID 2040:846d Hauppauge Bus 003 Device 004: ID 04e2:0404 Exar Corp. Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-02-05media: em28xx-core: Fix i2c error debugBrad Love
Read errors are currently reported as write errors. An incorrectly received read operation is never reported at all. Add a debug statement indicating the request mismatch. Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-02-05media: em28xx-core: Fix TS2 active ledBrad Love
TS2 active led is completely igored, fix that. Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Rename debug functionsJoe Perches
trace isn't a good name as it's not a trace mechanism, it is a typical debug mechanism. Rename uvc_trace/uvc_trace_cont macros to uvc_dbg/uvc_dbg_cont. Rename uvc_trace_param to uvc_dbg_param Rename UVC_TRACE_<FOO> defines to UVC_DBG_<FOO> Use ## concatenation in uvc_dbg macros to avoid overly long and repetitive UVC_DBG uses Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: use dev_printk() for uvc_trace()Ricardo Ribalda
Instead of calling prink() inside uvc_trace, use dev_printk(), which adds context to the output. Now that we are at it, regroup the strings so the messages can be easily "grepable". Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: New macro uvc_trace_contRicardo Ribalda
Remove all the duplicated code around printk(KERN_CONT, with a new macro. Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Use dev_ printk aliasesRicardo Ribalda
Replace all the uses of printk() and uvc_printk() with its equivalent dev_ alias macros. Modify uvc_warn_once() macro to use dev_info instead printk(). They are more standard across the kernel tree and provide more context about the error. Suggested-by: Joe Perches <joe@perches.com> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Add Privacy control based on EXT_GPIORicardo Ribalda
Add a new control and mapping for Privacy controls connected to UVC_GUID_EXT_GPIO_CONTROLLERs. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Implement UVC_EXT_GPIO_UNITRicardo Ribalda
Some devices can implement a physical switch to disable the input of the camera on demand. Think of it like an elegant privacy sticker. The system can read the status of the privacy switch via a GPIO. It is important to know the status of the switch, e.g. to notify the user when the camera will produce black frames and a videochat application is used. In some systems, the GPIO is connected to the main SoC instead of the camera controller, with the connection reported by the system firmware (ACPI or DT). In that case, the UVC device isn't aware of the GPIO. We need to implement a virtual entity to handle the GPIO fully on the driver side. For example, for ACPI-based systems, the GPIO is reported in the USB device object: Scope (\_SB.PCI0.XHCI.RHUB.HS07) { /.../ Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings { GpioIo (Exclusive, PullDefault, 0x0000, 0x0000, IoRestrictionOutputOnly, "\\_SB.PCI0.GPIO", 0x00, ResourceConsumer, , ) { // Pin list 0x0064 } }) Name (_DSD, Package (0x02) // _DSD: Device-Specific Data { ToUUID ("daffd814-6eba-4d8c-8a91-bc9bbf4aa301") /* Device Properties for _DSD */, Package (0x01) { Package (0x02) { "privacy-gpio", Package (0x04) { \_SB.PCI0.XHCI.RHUB.HS07, Zero, Zero, One } } } }) } Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Allow entity-defined get_info and get_curRicardo Ribalda
Allows controls to get their properties and current value from an entity-defined function instead of via a query to the USB device. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Provide sync and async uvc_ctrl_status_eventRicardo Ribalda
Split the functionality of void uvc_ctrl_status_event_work in two, so it can be called by functions outside interrupt context and not part of an URB. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Allow entities with no padsRicardo Ribalda
Avoid an underflow while calculating the number of inputs for entities with zero pads. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Allow extra entitiesRicardo Ribalda
Increase the size of the id, to avoid collisions with entities implemented by the driver that are not part of the UVC device. Entities exposed by the UVC device use IDs 0-255, extra entities implemented by the driver (such as the GPIO entity) use IDs 256 and up. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Move guid to entityRicardo Ribalda
Instead of having multiple copies of the entity guid on the code, move it to the entity structure. Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex valuesLaurent Pinchart
The Renkforce RF AC4K 300 Action Cam 4K reports invalid bFormatIndex and bFrameIndex values when negotiating the video probe and commit controls. The UVC descriptors report a single supported format and frame size, with bFormatIndex and bFrameIndex both equal to 2, but the video probe and commit controls report bFormatIndex and bFrameIndex set to 1. The device otherwise operates correctly, but the driver rejects the values and fails the format try operation. Fix it by ignoring the invalid indices, and assuming that the format and frame requested by the driver are accepted by the device. Link: https://bugzilla.kernel.org/show_bug.cgi?id=210767 Fixes: 8a652a17e3c0 ("media: uvcvideo: Ensure all probed info is returned to v4l2") Reported-by: Till Dörges <doerges@pre-sense.de> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: uvcvideo: Force UVC version to 1.0a for 1bcf:0b40Laurent Pinchart
The Shenzhen Aoni Electronic Co.,Ltd 2K FHD camera reports a UVC 1.10 version, but implements UVC 1.0a as shown by the UVC probe control being 26 bytes long. Force the UVC version for that device. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reported-by: Doncho Minkov <donchominkov@gmail.com> Tested-by: Doncho Minkov <donchominkov@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: zr364xx: fix memory leaks in probe()Dan Carpenter
Syzbot discovered that the probe error handling doesn't clean up the resources allocated in zr364xx_board_init(). There are several related bugs in this code so I have re-written the error handling. 1) Introduce a new function zr364xx_board_uninit() which cleans up the resources in zr364xx_board_init(). 2) In zr364xx_board_init() if the call to zr364xx_start_readpipe() fails then release the "cam->buffer.frame[i].lpvbits" memory before returning. This way every function either allocates everything successfully or it cleans up after itself. 3) Re-write the probe function so that each failure path goto frees the most recent allocation. That way we don't free anything before it has been allocated and we can also verify that everything is freed. 4) Originally, in the probe function the "cam->v4l2_dev.release" pointer was set to "zr364xx_release" near the start but I moved that assignment to the end, after everything had succeeded. The release function was never actually called during the probe cleanup process, but with this change I wanted to make it clear that we don't want to call zr364xx_release() until everything is allocated successfully. Next I re-wrote the zr364xx_release() function. Ideally this would have been a simple matter of copy and pasting the cleanup code from probe and adding an additional call to video_unregister_device(). But there are a couple quirks to note. 1) The probe function does not call videobuf_mmap_free() and I don't know where the videobuf_mmap is allocated. I left the code as-is to avoid introducing a bug in code I don't understand. 2) The zr364xx_board_uninit() has a call to zr364xx_stop_readpipe() which is a change from the original behavior with regards to unloading the driver. Calling zr364xx_stop_readpipe() on a stopped pipe is not a problem so this is safe and is potentially a bugfix. Reported-by: syzbot+b4d54814b339b5c6bbd4@syzkaller.appspotmail.com Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: rc: select CONFIG_BITREVERSE where neededArnd Bergmann
A number of remote control drivers require the bitreverse helper, and run into a link error when it is disabled: arm-linux-gnueabi-ld: drivers/media/rc/img-ir/img-ir-nec.o: in function `img_ir_nec_scancode': img-ir-nec.c:(.text+0x10c): undefined reference to `byte_rev_table' arm-linux-gnueabi-ld: drivers/media/rc/img-ir/img-ir-nec.o: in function `img_ir_nec_filter': img-ir-nec.c:(.text+0x2dc): undefined reference to `byte_rev_table' arm-linux-gnueabi-ld: drivers/media/usb/cx231xx/cx231xx-input.o: in function `get_key_isdbt': cx231xx-input.c:(.text+0x38c): undefined reference to `byte_rev_table' arm-linux-gnueabi-ld: drivers/media/usb/em28xx/em28xx-input.o: in function `em28xx_get_key_em_haup': em28xx-input.c:(.text+0x1704): undefined reference to `byte_rev_table' Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Sean Young <sean@mess.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: usb: dvb-usb-v2: Fix fall-through warnings for ClangGustavo A. R. Silva
In preparation to enable -Wimplicit-fallthrough for Clang, fix multiple warnings by explicitly adding a couple of break statements instead of just letting the code fall through to the next case. Link: https://github.com/KSPP/linux/issues/115 Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: usb/dvb-usb-v2/rtl28xxu.c: clean up code to fix smatch warningHans Verkuil
Fixes this smatch warning: drivers/media/usb/dvb-usb-v2/rtl28xxu.c:1040 rtl2832u_frontend_attach() warn: missing error code 'ret' It is actually a bogus warning since in this particular case ret isn't meant to be set. But by reworking the code a bit the code is actually a lot more understandable and it fixes this warning. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: lmedm04: Remove lme2510_kill_urb function.Malcolm Priestley
This function is not necessary and largely a remnant of dvb-usb workaround and is now controlled by dvb-usb-v2. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: lmedm04: Use GFP_KERNEL for URB allocation/submission.Malcolm Priestley
lme2510_int_read is not atomically called so use GFP_KERNEL for usb_alloc_urb and usb_submit_urb which is the first in the chain of interrupt submissions. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-27media: lmedm04: Fix misuse of commaJoe Perches
There's a comma used instead of a semicolon that causes multiple statements to be executed after an if instead of just the intended single statement. Replace the comma with a semicolon. Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb") Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-12media: pwc: Use correct device for DMAMatwey V. Kornilov
This fixes the following newly introduced warning: [ 15.518253] ------------[ cut here ]------------ [ 15.518941] WARNING: CPU: 0 PID: 246 at kernel/dma/mapping.c:149 dma_map_page_attrs+0x1a8/0x1d0 [ 15.520634] Modules linked in: pwc videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc efivarfs [ 15.522335] CPU: 0 PID: 246 Comm: v4l2-test Not tainted 5.11.0-rc1+ #1 [ 15.523281] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 [ 15.524438] RIP: 0010:dma_map_page_attrs+0x1a8/0x1d0 [ 15.525135] Code: 10 5b 5d 41 5c 41 5d c3 4d 89 d0 eb d7 4d 89 c8 89 e9 48 89 da e8 68 29 00 00 eb d1 48 89 f2 48 2b 50 18 48 89 d0 eb 83 0f 0b <0f> 0b 48 c7 c0 ff ff ff ff eb b8 48 89 d9 48 8b 40 40 e8 61 69 d2 [ 15.527938] RSP: 0018:ffffa2694047bca8 EFLAGS: 00010246 [ 15.528716] RAX: 0000000000000000 RBX: 0000000000002580 RCX: 0000000000000000 [ 15.529782] RDX: 0000000000000000 RSI: ffffcdce000ecc00 RDI: ffffa0b4bdb888a0 [ 15.530849] RBP: 0000000000000002 R08: 0000000000000002 R09: 0000000000000000 [ 15.531881] R10: 0000000000000004 R11: 000000000002d8c0 R12: 0000000000000000 [ 15.532911] R13: ffffa0b4bdb88800 R14: ffffa0b483820000 R15: ffffa0b4bdb888a0 [ 15.533942] FS: 00007fc5fbb5e4c0(0000) GS:ffffa0b4fc000000(0000) knlGS:0000000000000000 [ 15.535141] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 15.535988] CR2: 00007fc5fb6ea138 CR3: 0000000003812000 CR4: 00000000001506f0 [ 15.537025] Call Trace: [ 15.537425] start_streaming+0x2e9/0x4b0 [pwc] [ 15.538143] vb2_start_streaming+0x5e/0x110 [videobuf2_common] [ 15.538989] vb2_core_streamon+0x107/0x140 [videobuf2_common] [ 15.539831] __video_do_ioctl+0x18f/0x4a0 [videodev] [ 15.540670] video_usercopy+0x13a/0x5b0 [videodev] [ 15.541349] ? video_put_user+0x230/0x230 [videodev] [ 15.542096] ? selinux_file_ioctl+0x143/0x200 [ 15.542752] v4l2_ioctl+0x40/0x50 [videodev] [ 15.543360] __x64_sys_ioctl+0x89/0xc0 [ 15.543930] do_syscall_64+0x33/0x40 [ 15.544448] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 15.545236] RIP: 0033:0x7fc5fb671587 [ 15.545780] Code: b3 66 90 48 8b 05 11 49 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 48 2c 00 f7 d8 64 89 01 48 [ 15.548486] RSP: 002b:00007fff0f71f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 15.549578] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc5fb671587 [ 15.550664] RDX: 00007fff0f71f060 RSI: 0000000040045612 RDI: 0000000000000003 [ 15.551706] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 15.552738] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff0f71f060 [ 15.553817] R13: 00007fff0f71f1d0 R14: 0000000000de1270 R15: 0000000000000000 [ 15.554914] ---[ end trace 7be03122966c2486 ]--- Fixes: 1161db6776bd ("media: usb: pwc: Don't use coherent DMA buffers for ISO transfer") Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-12media: tm6000: Fix memleak in tm6000_start_streamDinghao Liu
When usb_clear_halt() fails, dvb->bulk_urb->transfer_buffer and dvb->bulk_urb should be freed just like when usb_submit_urb() fails. Fixes: 3169c9b26fffa ("V4L/DVB (12788): tm6000: Add initial DVB-T support") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2021-01-12media: em28xx: Fix use-after-free in em28xx_alloc_urbsDinghao Liu
When kzalloc() fails, em28xx_uninit_usb_xfer() will free usb_bufs->buf and set it to NULL. Thus the later access to usb_bufs->buf[i] will lead to null pointer dereference. Also the kfree(usb_bufs->buf) after that is redundant. Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: gspca: Fix memory leak in probeAlan Stern
The gspca driver leaks memory when a probe fails. gspca_dev_probe2() calls v4l2_device_register(), which takes a reference to the underlying device node (in this case, a USB interface). But the failure pathway neglects to call v4l2_device_unregister(), the routine responsible for dropping this reference. Consequently the memory for the USB interface and its device never gets released. This patch adds the missing function call. Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-27media: uvcvideo: Use DIV_ROUND_CLOSEST directly to make it readablezhong jiang
The kernel.h macro DIV_ROUND_CLOSEST performs the computation (x + d/2)/d but is perhaps more readable. Signed-off-by: zhong jiang <zhongjiang@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-27media: msi2500: assign SPI bus number dynamicallyAntti Palosaari
SPI bus number must be assigned dynamically for each device, otherwise it will crash when multiple devices are plugged to system. Reported-and-tested-by: syzbot+c60ddb60b685777d9d59@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-27media: usb: msi2500: Fix a possible null-pointer dereference in ↵Jia-Ju Bai
msi2500_stop_streaming() In msi2500_stop_streaming(), there is an if statement on line 870 to check whether dev->udev is NULL: if (dev->udev) When dev->udev is NULL, it is used on line 877: msi2500_ctrl_msg(dev, CMD_STOP_STREAMING, 0) usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), ...) Thus, a possible null-pointer dereference may occur. To fix this bug, dev->udev is checked before calling msi2500_ctrl_msg(). This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-27media: gp8psk: initialize stats at power control logicMauro Carvalho Chehab
As reported on: https://lore.kernel.org/linux-media/20190627222020.45909-1-willemdebruijn.kernel@gmail.com/ if gp8psk_usb_in_op() returns an error, the status var is not initialized. Yet, this var is used later on, in order to identify: - if the device was already started; - if firmware has loaded; - if the LNBf was powered on. Using status = 0 seems to ensure that everything will be properly powered up. So, instead of the proposed solution, let's just set status = 0. Reported-by: syzbot <syzkaller@googlegroups.com> Reported-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-26media: dvb-usb: Add Hauppauge MAX S2's USB-IDsKai Muenz
Hauppauge MAX S2 or WinTV NOVA HD USB2.0. Signed-off-by: Kai Muenz <squ@tent.at> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-17media: cx231xx: Use snd_card_free_when_closed() instead of snd_card_free().Zebediah Figura
cx231xx_close_extension and hence cx231xx_audio_fini() are called with the cx231xx device lock held, but snd_cx231xx_pcm_close() also grabs that mutex when closing the file on behalf of arecord. There seems to be no reason to wait for sound card resources to be released, so let the release be asynchronous. Tested with a Hauppauge 955Q (2040:b123) and Linux 5.9.6; the hang described in the bug no longer occurs and disconnecting the device correctly terminates arecord with ENODEV. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=204087 Signed-off-by: Zebediah Figura <zfigura@codeweavers.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-17media: usb: dvb-usb-v2: zd1301: fix missing platform_device_unregister()Qinglang Miao
Add the missing platform_device_unregister() before return from zd1301_frontend_attach in the error handling case when pdev->dev.driver is empty. There's an error handling route named err_platform_device_unregister, so just reuse it. Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-11-16media: cx231xx: Consolidate dmesg outputThomas Gleixner
The memory allocations in cx231xx_init_*() happen all in task context with GFP_KERNEL. Therefore a dev_err() trying to deduce whether this is called from task or interrupt context is pretty useless. Remove these historical leftovers. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
generated by cgit (git 2.34.1) at 2025-10-02 20:24:52 +0000