summaryrefslogtreecommitdiff
path: root/drivers/media/rc
AgeCommit message (Collapse)Author
2017-07-26media: lirc: LIRC_GET_REC_RESOLUTION should return microsecondsSean Young
Since commit e8f4818895b3 ("[media] lirc: advertise LIRC_CAN_GET_REC_RESOLUTION and improve") lircd uses the ioctl LIRC_GET_REC_RESOLUTION to determine the shortest pulse or space that the hardware can detect. This breaks decoding in lirc because lircd expects the answer in microseconds, but nanoseconds is returned. Cc: <stable@vger.kernel.org> # v2.6.36+ Reported-by: Derek <user.vdr@gmail.com> Tested-by: Derek <user.vdr@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-13[media] rc-core: cleanup rc_register_device pt2David Härdeman
Now that rc_register_device() is reorganised, the dev->initialized hack can be removed. Any driver which calls rc_register_device() must be prepared for the device to go live immediately. The dev->initialized commits that are relevant are commit c73bbaa4ec3e ("[media] rc-core: don't lock device at rc_register_device()") and commit 08aeb7c9a42a ("[media] rc: add locking to fix register/show race"). The original problem was that show_protocols() would access dev->rc_map.* and various other bits which are now properly initialized before device_add() is called. At the same time, remove the bogus "device is being removed" check. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-13[media] rc-core: cleanup rc_register_deviceDavid Härdeman
The device core infrastructure is based on the presumption that once a driver calls device_add(), it must be ready to accept userspace interaction. This requires splitting rc_setup_rx_device() into two functions and reorganizing rc_register_device() so that as much work as possible is performed before calling device_add(). Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-13[media] sir_ir: annotate hardware config module parametersSean Young
This module was merged after commit 5a8fc6a3cebb ("Annotate hardware config module parameters in drivers/media/"), so add add the missing hardware annotations. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-07[media] ir-spi: Fix issues with lirc APIAnton Blanchard
The ir-spi driver has 2 issues which prevents it from working with lirc: 1. The ir-spi driver uses 16 bits of SPI data to create one cycle of the waveform. As such our SPI clock needs to be 16x faster than the carrier frequency. The driver is inconsistent in how it currently handles this. It initializes it to the carrier frequency: But the commit message has some example code which initialises it to 16x the carrier frequency: val = 608000; ret = ioctl(fd, LIRC_SET_SEND_CARRIER, &val); To maintain compatibility with lirc, always do the frequency adjustment in the driver. 2. lirc presents pulses in microseconds, but the ir-spi driver treats them as cycles of the carrier. Similar to other lirc drivers, do the conversion with DIV_ROUND_CLOSEST(). Fixes: fe052da49201 ("[media] rc: add support for IR LEDs driven through SPI") Cc: stable@vger.kernel.org Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-07[media] mceusb: drop redundant urb reinitialisationJohan Hovold
Drop a since commit e1159cb35712 ("[media] mceusb: remove pointless mce_flush_rx_buffer function") redundant reinitialisation of two urb fields immediately after they have been initialised. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-07[media] mceusb: fix memory leaks in error pathJohan Hovold
Fix urb and transfer-buffer leaks in an urb-submission error path which may be hit when a device is disconnected. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: stable <stable@vger.kernel.org> # 2.6.36 Cc: Jarod Wilson <jarod@redhat.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-07Merge tag 'media/v4.12-2' into patchworkMauro Carvalho Chehab
media fixes for v4.12-rc4 * tag 'media/v4.12-2': (598 commits) [media] rc-core: race condition during ir_raw_event_register() [media] cec: drop MEDIA_CEC_DEBUG [media] cec: rename MEDIA_CEC_NOTIFIER to CEC_NOTIFIER [media] cec: select CEC_CORE instead of depend on it [media] rainshadow-cec: ensure exit_loop is intialized [media] atomisp: don't treat warnings as errors Linux 4.12-rc3 x86/ftrace: Make sure that ftrace trampolines are not RWX x86/mm/ftrace: Do not bug in early boot on irqs_disabled in cpu_flush_range() selftests/ftrace: Add a testcase for many kprobe events kprobes/x86: Fix to set RWX bits correctly before releasing trampoline ftrace: Fix memory leak in ftrace_graph_release() ipv4: add reference counting to metrics net: ethernet: ax88796: don't call free_irq without request_irq first ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets sctp: fix ICMP processing if skb is non-linear net: llc: add lock_sock in llc_ui_bind to avoid a race condition PCI/msi: fix the pci_alloc_irq_vectors_affinity stub blk-mq: Only register debugfs attributes for blk-mq queues x86/timers: Move simple_udelay_calibration past init_hypervisor_platform ... Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] sir_ir: remove init_chrdev and init_sir_ir functionsSean Young
Inlining these functions into the probe function makes it much more readable. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] sir_ir: remove init_port and drop_port functionsSean Young
These functions are too short and removing them makes the code more readable. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] sir_ir: use dev managed resourcesSean Young
Several error paths do not free up resources. This simplifies the code and fixes this. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] sir_ir: attempt to free already free_irqSean Young
If the probe fails (e.g. port already in use), rmmod causes null deref. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc-core: img-ir - leave the internals of rc_dev aloneDavid Härdeman
Changing the protocol does not imply that the keymap changes. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc-core: ati_remote - leave the internals of rc_dev aloneDavid Härdeman
The REP_DELAY setting on the input device is independent of hardware. This change should not change how to driver works (as it does a keydown/keyup and has no real repeat handling). Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: cleanup includesDavid Härdeman
Remove superfluous includes and defines. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: return POLLHUP and POLLERR when device is goneDavid Härdeman
Most drivers return both values when the device is gone. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: remove unused module parameterDavid Härdeman
The "debug" parameter isn't actually used anywhere. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: remove superfluous get/put_device() callsDavid Härdeman
device_add() and friends already manage the references to the parent device so these calls aren't necessary. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: remove lirc_irctl_init() and lirc_cdev_add()David Härdeman
These two functions only make the logic in lirc_register_driver() harder to follow. (Note that almost no other driver calls kobject_set_name() on their cdev so I simply removed that part). Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: merge lirc_register_driver() and lirc_allocate_driver()David Härdeman
Merging the two means that lirc_allocate_buffer() is called before device_add() and cdev_add() which makes more sense. This also simplifies the locking slightly because lirc_allocate_buffer() will always be called with lirc_dev_lock held. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: make fops mandatoryDavid Härdeman
Every caller of lirc_register_driver() passes their own fops and there are no users of lirc_dev_fop_write() in the kernel tree. Thus we can make fops mandatory and remove lirc_dev_fop_write(). Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: clarify error handlingDavid Härdeman
out_sysfs is misleading, sysfs only comes into play after device_add(). Also, calling device_init() before the rest of struct dev is filled out is clearer. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: remove sampling kthreadDavid Härdeman
There are no drivers which use this functionality. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: remove unused set_use_inc/set_use_decDavid Härdeman
Since there are no users of this functionality, it can be removed altogether. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] lirc_dev: remove pointless functionsDavid Härdeman
drv->set_use_inc and drv->set_use_dec are already optional so we can remove all dummy functions. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] mceusb: TX -EPIPE (urb status = -32) lockup fixA Sun
Once IR blasting or mceusb device commands fail with mce_async_callback() TX -EPIPE error, all subsequent TX to device then fail with the same error. ... [ 249.986174] mceusb 1-1.2:1.0: requesting 38000 HZ carrier [ 249.986210] mceusb 1-1.2:1.0: send request called (size=0x4) [ 249.986256] mceusb 1-1.2:1.0: send request complete (res=0) [ 249.986403] mceusb 1-1.2:1.0: Error: request urb status = -32 (TX HALT) [ 249.999885] mceusb 1-1.2:1.0: send request called (size=0x3) [ 249.999929] mceusb 1-1.2:1.0: send request complete (res=0) [ 250.000013] mceusb 1-1.2:1.0: Error: request urb status = -32 (TX HALT) [ 250.019830] mceusb 1-1.2:1.0: send request called (size=0x21) [ 250.019868] mceusb 1-1.2:1.0: send request complete (res=0) [ 250.020007] mceusb 1-1.2:1.0: Error: request urb status = -32 (TX HALT) ... Fault simulation/injection is by executing the following USB operation in a mceusb instrumented driver, prior to TX I/O. retval = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT, USB_ENDPOINT_HALT, usb_pipeendpoint(ir->pipe_out), NULL, 0, USB_CTRL_SET_TIMEOUT); dev_dbg(ir->dev, "set halt retval, %d", retval); After setting halt state for the TX endpoint, perform an lirc "irsend" to generate TX traffic to device. After the TX HALT, the patch restores subsequent TX to working state. ... [ 508.009638] mceusb 1-1.2:1.0: send request called (size=0x3) [ 508.009697] mceusb 1-1.2:1.0: send request complete (res=0) [ 508.009847] mce_async_callback() [ 508.009864] mceusb 1-1.2:1.0: Error: request urb status = -32 (TX HALT) [ 508.009890] mceusb 1-1.2:1.0: kevent 0 scheduled [ 508.021552] mceusb 1-1.2:1.0: send request called (size=0x21) [ 508.021598] mceusb 1-1.2:1.0: send request complete (res=0) [ 508.021963] mce_async_callback() [ 508.021981] mceusb 1-1.2:1.0: tx data: 84 b0 0c 8c 0c 84 8c 0c 8c 0c 84 8c 0c 8c 0c 84 98 0c 98 0c 84 98 0c 8c 0c 84 8c 0c 8c 0c 81 8c 80 (length=33) [ 508.021997] mceusb 1-1.2:1.0: Raw IR data, 0 pulse/space samples [ 508.066627] mceusb 1-1.2:1.0: send request called (size=0x3) [ 508.066669] mceusb 1-1.2:1.0: send request complete (res=0) [ 508.066841] mce_async_callback() [ 508.066858] mceusb 1-1.2:1.0: tx data: 9f 08 03 (length=3) ... Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] mceusb: RX -EPIPE (urb status = -32) lockup failure fixA Sun
RX -EPIPE failure with infinite loop and flooding of [ 2851.966506] mceusb 1-1.2:1.0: Error: urb status = -32 log message at 8000 messages per second. Bug trigger appears to be normal, but heavy, IR receiver use. Driver and Linux host become unusable after error. Also seen at https://sourceforge.net/p/lirc/mailman/message/34886165/ Fix: Message reports RX usb halt (stall) condition requiring usb_clear_halt() call in non-interrupt context to recover. Add driver workqueue call to perform this recovery based on method in use for the usbnet device driver. Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc: meson-ir: switch config to NEC decoding on shutdownAlex Deryskyba
On the Amlogic SoCs, the bootloader firmware can handle the IR hardware in order to Wake up or Power back the system when in suspend on shutdown mode. This patch switches the hardware configuration in a state usable by the firmware to permit powering the system back. Some vendor bootloader firmware were modified to switch to this configuration but it may not be the case for all available products. This patch was originally posted at [1]. [1] https://github.com/LibreELEC/linux-amlogic/pull/27 Signed-off-by: Alex Deryskyba <alex@codesnake.com> Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc: meson-ir: store raw event without processingJonas Karlman
This patch fixes meson-it driver by storing event without processing to avoid losing key pressed events when system is loaded and events are occurring too fast. This issue was reported at [1] [1] https://github.com/LibreELEC/linux-amlogic/pull/42 Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc: fix breakage in "make menuconfig" for media_buildDevin Heitmueller
The Kconfig format is strict enough where if the indentation isn't correct then the "make menuconfig" will break. Fix the indentation to match all the other entries. Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc: meson-ir: change irq name to to of node nameHeiner Kallweit
Switch the interrupt description to the default which is the of node name. This is more in line with the interrupt descriptions in other meson drivers. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc: meson-ir: use readl_relaxed in the interrupt handlerHeiner Kallweit
We don't need the memory barriers here and an interrupt handler should be as fast as possible. Therefore switch to readl_relaxed. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc: meson-ir: switch to managed rc device allocation / registrationHeiner Kallweit
Switch to the managed versions of rc_allocate_device/rc_register_device, thus simplifying the code. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc: meson-ir: make use of the bitfield macrosHeiner Kallweit
Make use of the bitfield macros thus partially hiding the complexity of dealing with bitfields. The patch also includes a minor fix to REG0_RATE_MASK, so far it was set to bit 0..10, but according to the spec it's bit 0..11. [mchehab@s-opensource.com: readd REG1_MODE_SHIFT and REG2_MODE_SHIFT that got removed on the original patch, as this will be used on another patch] Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc: meson-ir: remove irq from struct meson_irHeiner Kallweit
The irq number is used in the probe function only, therefore just use a local variable. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] rc: ir-spi: remove unnecessary initializationAndi Shyti
Signed-off-by: Andi Shyti <andi.shyti@samsung.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] mceusb: fix inaccurate debug buffer dumps, and misleading debug messagesA Sun
Some dev_dbg messages are misleading. Some dev_dbg messages have inconsistent formatting. mceusb_dev_printdata() prints incorrect range of bytes (0 to len) in buffer which the driver will actually process next. Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-06[media] mceusb: sporadic RX truncation corruption fixA Sun
Intermittent RX truncation and loss of IR received data. This resulted in receive stream synchronization errors where driver attempted to incorrectly parse IR data (eg 0x90 below) as command response. [ 3969.139898] mceusb 1-1.2:1.0: processed IR data [ 3969.151315] mceusb 1-1.2:1.0: rx data: 00 90 (length=2) [ 3969.151321] mceusb 1-1.2:1.0: Unknown command 0x00 0x90 [ 3969.151336] mceusb 1-1.2:1.0: rx data: 98 0a 8d 0a 8e 0a 8e 0a 8e 0a 8e 0a 9a 0a 8e 0a 0b 3a 8e 00 80 41 59 00 00 (length=25) [ 3969.151341] mceusb 1-1.2:1.0: Raw IR data, 24 pulse/space samples [ 3969.151348] mceusb 1-1.2:1.0: Storing space with duration 500000 Bug trigger appears to be normal, but heavy, IR receiver use. Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-06-04[media] rc-core: race condition during ir_raw_event_register()Sean Young
A rc device can call ir_raw_event_handle() after rc_allocate_device(), but before rc_register_device() has completed. This is racey because rcdev->raw is set before rcdev->raw->thread has a valid value. Cc: stable@kernel.org Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-05-19[media] media drivers: annotate fall-throughMauro Carvalho Chehab
Avoid warnings like those: drivers/media/pci/ddbridge/ddbridge-core.c: In function 'dvb_input_detach': drivers/media/pci/ddbridge/ddbridge-core.c:787:6: warning: this statement may fall through [-Wimplicit-fallthrough=] if (input->fe) { ^ drivers/media/pci/ddbridge/ddbridge-core.c:792:2: note: here case 4: ^~~~ ... On several cases, it is just that gcc 7.1 is not capable of understanding the comment, but on other places, we need an annotation. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-05-19[media] ir-core: fix gcc-7 warning on bool arithmeticArnd Bergmann
gcc-7 suggests that an expression using a bitwise not and a bitmask on a 'bool' variable is better written using boolean logic: drivers/media/rc/imon.c: In function 'imon_incoming_scancode': drivers/media/rc/imon.c:1725:22: error: '~' on a boolean expression [-Werror=bool-operation] ictx->pad_mouse = ~(ictx->pad_mouse) & 0x1; ^ drivers/media/rc/imon.c:1725:22: note: did you mean to use logical not? I agree. Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-05-18[media] ir-lirc-codec: let lirc_dev handle the lirc_bufferDavid Härdeman
ir_lirc_register() currently creates its own lirc_buffer before passing the lirc_driver to lirc_register_driver(). When a module is later unloaded, ir_lirc_unregister() gets called which performs a call to lirc_unregister_driver() and then free():s the lirc_buffer. The problem is that: a) there can still be a userspace app holding an open lirc fd when lirc_unregister_driver() returns; and b) the lirc_buffer contains "wait_queue_head_t wait_poll" which is potentially used as long as any userspace app is still around. The result is an oops which can be triggered quite easily by a userspace app monitoring its lirc fd using epoll() and not closing the fd promptly on device removal. The minimalistic fix is to let lirc_dev create the lirc_buffer since lirc_dev will then also free the buffer once it believes it is safe to do so. Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-05-18[media] rc-core: fix input repeat handlingDavid Härdeman
The call to input_register_device() needs to take place before the repeat parameters are set or the input subsystem repeat handling will be disabled (as was already noted in the comments in that function). Cc: stable <stable@vger.kernel.org> # v4.11 Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-05-18[media] sir_ir: infinite loop in interrupt handlerSean Young
Since this driver does no detection of hardware, it might be used with a non-sir port. Escape out if we are spinning. Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-05-10Merge tag 'hwparam-20170420' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull hw lockdown support from David Howells: "Annotation of module parameters that configure hardware resources including ioports, iomem addresses, irq lines and dma channels. This allows a future patch to prohibit the use of such module parameters to prevent that hardware from being abused to gain access to the running kernel image as part of locking the kernel down under UEFI secure boot conditions. Annotations are made by changing: module_param(n, t, p) module_param_named(n, v, t, p) module_param_array(n, t, m, p) to: module_param_hw(n, t, hwtype, p) module_param_hw_named(n, v, t, hwtype, p) module_param_hw_array(n, t, hwtype, m, p) where the module parameter refers to a hardware setting hwtype specifies the type of the resource being configured. This can be one of: ioport Module parameter configures an I/O port iomem Module parameter configures an I/O mem address ioport_or_iomem Module parameter could be either (runtime set) irq Module parameter configures an I/O port dma Module parameter configures a DMA channel dma_addr Module parameter configures a DMA buffer address other Module parameter configures some other value Note that the hwtype is compile checked, but not currently stored (the lockdown code probably won't require it). It is, however, there for future use. A bonus is that the hwtype can also be used for grepping. The intention is for the kernel to ignore or reject attempts to set annotated module parameters if lockdown is enabled. This applies to options passed on the boot command line, passed to insmod/modprobe or direct twiddling in /sys/module/ parameter files. The module initialisation then needs to handle the parameter not being set, by (1) giving an error, (2) probing for a value or (3) using a reasonable default. What I can't do is just reject a module out of hand because it may take a hardware setting in the module parameters. Some important modules, some ipmi stuff for instance, both probe for hardware and allow hardware to be manually specified; if the driver is aborts with any error, you don't get any ipmi hardware. Further, trying to do this entirely in the module initialisation code doesn't protect against sysfs twiddling. [!] Note that in and of itself, this series of patches should have no effect on the the size of the kernel or code execution - that is left to a patch in the next series to effect. It does mark annotated kernel parameters with a KERNEL_PARAM_FL_HWPARAM flag in an already existing field" * tag 'hwparam-20170420' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: (38 commits) Annotate hardware config module parameters in sound/pci/ Annotate hardware config module parameters in sound/oss/ Annotate hardware config module parameters in sound/isa/ Annotate hardware config module parameters in sound/drivers/ Annotate hardware config module parameters in fs/pstore/ Annotate hardware config module parameters in drivers/watchdog/ Annotate hardware config module parameters in drivers/video/ Annotate hardware config module parameters in drivers/tty/ Annotate hardware config module parameters in drivers/staging/vme/ Annotate hardware config module parameters in drivers/staging/speakup/ Annotate hardware config module parameters in drivers/staging/media/ Annotate hardware config module parameters in drivers/scsi/ Annotate hardware config module parameters in drivers/pcmcia/ Annotate hardware config module parameters in drivers/pci/hotplug/ Annotate hardware config module parameters in drivers/parport/ Annotate hardware config module parameters in drivers/net/wireless/ Annotate hardware config module parameters in drivers/net/wan/ Annotate hardware config module parameters in drivers/net/irda/ Annotate hardware config module parameters in drivers/net/hamradio/ Annotate hardware config module parameters in drivers/net/ethernet/ ...
2017-04-20Annotate hardware config module parameters in drivers/media/David Howells
When the kernel is running in secure boot mode, we lock down the kernel to prevent userspace from modifying the running kernel image. Whilst this includes prohibiting access to things like /dev/mem, it must also prevent access by means of configuring driver modules in such a way as to cause a device to access or modify the kernel image. To this end, annotate module_param* statements that refer to hardware configuration and indicate for future reference what type of parameter they specify. The parameter parser in the core sees this information and can skip such parameters with an error message if the kernel is locked down. The module initialisation then runs as normal, but just sees whatever the default values for those parameters is. Note that we do still need to do the module initialisation because some drivers have viable defaults set in case parameters aren't specified and some drivers support automatic configuration (e.g. PNP or PCI) in addition to manually coded parameters. This patch annotates drivers in drivers/media/. Suggested-by: Alan Cox <gnomes@lxorguk.ukuu.org.uk> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> cc: mjpeg-users@lists.sourceforge.net cc: linux-media@vger.kernel.org
2017-04-10[media] imon: use setup_timerGeliang Tang
Use setup_timer() instead of init_timer() to simplify the code. Signed-off-by: Geliang Tang <geliangtang@gmail.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-04-05[media] rc: promote lirc_sir out of stagingSean Young
Rename lirc_sir to sir_ir in the process. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-04-04Merge tag 'v4.11-rc5' into patchworkMauro Carvalho Chehab
Linux 4.11-rc5 * tag 'v4.11-rc5': (1168 commits) Linux 4.11-rc5 tty: pl011: fix earlycon work-around for QDF2400 erratum 44 kasan: do not sanitize kexec purgatory drivers/rapidio/devices/tsi721.c: make module parameter variable name unique mm/hugetlb.c: don't call region_abort if region_chg fails kasan: report only the first error by default hugetlbfs: initialize shared policy as part of inode allocation mm: fix section name for .data..ro_after_init mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() mm: workingset: fix premature shadow node shrinking with cgroups mm: rmap: fix huge file mmap accounting in the memcg stats mm: move mm_percpu_wq initialization earlier mm: migrate: fix remove_migration_pte() for ksm pages nfs: flexfiles: fix kernel OOPS if MDS returns unsupported DS type NFSv4.1 fix infinite loop on IO BAD_STATEID error serial: 8250_EXAR: fix duplicate Kconfig text and add missing help text tty/serial: atmel: fix TX path in atmel_console_write() tty/serial: atmel: fix race condition (TX+DMA) serial: mxs-auart: Fix baudrate calculation irqchip/mips-gic: Fix Local compare interrupt ...
2017-03-24[media] rc: sunxi-cir: simplify optional reset handlingPhilipp Zabel
As of commit bb475230b8e5 ("reset: make optional functions really optional"), the reset framework API calls use NULL pointers to describe optional, non-present reset controls. This allows to return errors from devm_reset_control_get_optional and to call reset_control_(de)assert unconditionally. Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>