cron job: media_tree daily build: WARNINGS

2017-10-24 Thread Hans Verkuil 
This message is generated daily by a cron job that builds media_tree for
the kernels and architectures in the list below.

Results of the daily build of media_tree:

date:   Wed Oct 25 05:00:14 CEST 2017
media-tree git hash:61065fc3e32002ba48aa6bc3816c1f6f9f8daf55
media_build git hash:   c93534951f5d66bef7f17f16293acf2be346b726
v4l-utils git hash: 482c52f946af4c6b16efa63a35790d92fb65326c
gcc version:i686-linux-gcc (GCC) 7.1.0
sparse version: v0.5.0
smatch version: v0.5.0-3553-g78b2ea6
host hardware:  x86_64
host os:4.12.0-164

linux-git-arm-at91: OK
linux-git-arm-davinci: OK
linux-git-arm-multi: OK
linux-git-arm-pxa: OK
linux-git-arm-stm32: OK
linux-git-blackfin-bf561: OK
linux-git-i686: OK
linux-git-m32r: WARNINGS
linux-git-mips: OK
linux-git-powerpc64: OK
linux-git-sh: OK
linux-git-x86_64: OK
linux-2.6.36.4-i686: WARNINGS
linux-2.6.37.6-i686: WARNINGS
linux-2.6.38.8-i686: WARNINGS
linux-2.6.39.4-i686: WARNINGS
linux-3.0.60-i686: WARNINGS
linux-3.1.10-i686: WARNINGS
linux-3.2.37-i686: WARNINGS
linux-3.3.8-i686: WARNINGS
linux-3.4.27-i686: WARNINGS
linux-3.5.7-i686: WARNINGS
linux-3.6.11-i686: WARNINGS
linux-3.7.4-i686: WARNINGS
linux-3.8-i686: WARNINGS
linux-3.9.2-i686: WARNINGS
linux-3.10.1-i686: WARNINGS
linux-3.11.1-i686: WARNINGS
linux-3.12.67-i686: WARNINGS
linux-3.13.11-i686: WARNINGS
linux-3.14.9-i686: WARNINGS
linux-3.15.2-i686: WARNINGS
linux-3.16.7-i686: WARNINGS
linux-3.17.8-i686: WARNINGS
linux-3.18.7-i686: WARNINGS
linux-3.19-i686: WARNINGS
linux-4.0.9-i686: WARNINGS
linux-4.1.33-i686: WARNINGS
linux-4.2.8-i686: WARNINGS
linux-4.3.6-i686: WARNINGS
linux-4.4.22-i686: WARNINGS
linux-4.5.7-i686: WARNINGS
linux-4.6.7-i686: WARNINGS
linux-4.7.5-i686: WARNINGS
linux-4.8-i686: OK
linux-4.9.26-i686: OK
linux-4.10.14-i686: OK
linux-4.11-i686: OK
linux-4.12.1-i686: OK
linux-4.13-i686: OK
linux-2.6.36.4-x86_64: WARNINGS
linux-2.6.37.6-x86_64: WARNINGS
linux-2.6.38.8-x86_64: WARNINGS
linux-2.6.39.4-x86_64: WARNINGS
linux-3.0.60-x86_64: WARNINGS
linux-3.1.10-x86_64: WARNINGS
linux-3.2.37-x86_64: WARNINGS
linux-3.3.8-x86_64: WARNINGS
linux-3.4.27-x86_64: WARNINGS
linux-3.5.7-x86_64: WARNINGS
linux-3.6.11-x86_64: WARNINGS
linux-3.7.4-x86_64: WARNINGS
linux-3.8-x86_64: WARNINGS
linux-3.9.2-x86_64: WARNINGS
linux-3.10.1-x86_64: WARNINGS
linux-3.11.1-x86_64: WARNINGS
linux-3.12.67-x86_64: WARNINGS
linux-3.13.11-x86_64: WARNINGS
linux-3.14.9-x86_64: WARNINGS
linux-3.15.2-x86_64: WARNINGS
linux-3.16.7-x86_64: WARNINGS
linux-3.17.8-x86_64: WARNINGS
linux-3.18.7-x86_64: WARNINGS
linux-3.19-x86_64: WARNINGS
linux-4.0.9-x86_64: WARNINGS
linux-4.1.33-x86_64: WARNINGS
linux-4.2.8-x86_64: WARNINGS
linux-4.3.6-x86_64: WARNINGS
linux-4.4.22-x86_64: WARNINGS
linux-4.5.7-x86_64: WARNINGS
linux-4.6.7-x86_64: WARNINGS
linux-4.7.5-x86_64: WARNINGS
linux-4.8-x86_64: WARNINGS
linux-4.9.26-x86_64: WARNINGS
linux-4.10.14-x86_64: WARNINGS
linux-4.11-x86_64: WARNINGS
linux-4.12.1-x86_64: WARNINGS
linux-4.13-x86_64: OK
apps: OK
spec-git: OK

Detailed results are available here:

http://www.xs4all.nl/~hverkuil/logs/Wednesday.log

Full logs are available here:

http://www.xs4all.nl/~hverkuil/logs/Wednesday.tar.bz2

The Media Infrastructure API from this daily build is here:

http://www.xs4all.nl/~hverkuil/spec/index.html

Re: [PATCH] media: av7110: switch to useing timer_setup()

2017-10-24 Thread Jaejoong Kim 
Hi,

[PATCH] media: av7110: switch to useing timer_setup()
   ^^^
typo error.

2017-10-25 9:40 GMT+09:00 Dmitry Torokhov :
> In preparation for unconditionally passing the struct timer_list pointer to
> all timer callbacks, switch to using the new timer_setup() and from_timer()
> to pass the timer pointer explicitly.
>
> Also stop poking into input core internals and override its autorepeat
> timer function. I am not sure why we have such convoluted autorepeat
> handling in this driver instead of letting input core handle autorepeat,
> but this preserves current behavior of allowing controlling autorepeat
> delay and forcing autorepeat period to be whatever the hardware has.
>
> Signed-off-by: Dmitry Torokhov 
> ---
>
> Note that this has not been tested on the hardware. But it should
> compile, so I have that going for me.
>
>  drivers/media/pci/ttpci/av7110.h|  4 ++--
>  drivers/media/pci/ttpci/av7110_ir.c | 40 
> +
>  2 files changed, 20 insertions(+), 24 deletions(-)
>
> diff --git a/drivers/media/pci/ttpci/av7110.h 
> b/drivers/media/pci/ttpci/av7110.h
> index 347827925c14..0aa3c6f01853 100644
> --- a/drivers/media/pci/ttpci/av7110.h
> +++ b/drivers/media/pci/ttpci/av7110.h
> @@ -80,10 +80,11 @@ struct av7110;
>
>  /* infrared remote control */
>  struct infrared {
> -   u16 key_map[256];
> +   u16 key_map[256];
> struct input_dev*input_dev;
> charinput_phys[32];
> struct timer_list   keyup_timer;
> +   unsigned long   keydown_time;
> struct tasklet_struct   ir_tasklet;
> void(*ir_handler)(struct av7110 *av7110, u32 
> ircom);
> u32 ir_command;
> @@ -93,7 +94,6 @@ struct infrared {
> u8  inversion;
> u16 last_key;
> u16 last_toggle;
> -   u8  delay_timer_finished;
>  };
>
>
> diff --git a/drivers/media/pci/ttpci/av7110_ir.c 
> b/drivers/media/pci/ttpci/av7110_ir.c
> index ca05198de2c2..b602e64b3412 100644
> --- a/drivers/media/pci/ttpci/av7110_ir.c
> +++ b/drivers/media/pci/ttpci/av7110_ir.c
> @@ -84,9 +84,9 @@ static u16 default_key_map [256] = {
>
>
>  /* key-up timer */
> -static void av7110_emit_keyup(unsigned long parm)
> +static void av7110_emit_keyup(struct timer_list *t)
>  {
> -   struct infrared *ir = (struct infrared *) parm;
> +   struct infrared *ir = from_timer(ir, keyup_timer, t);
>
> if (!ir || !test_bit(ir->last_key, ir->input_dev->key))
> return;
> @@ -152,19 +152,20 @@ static void av7110_emit_key(unsigned long parm)
> return;
> }
>
> -   if (timer_pending(>keyup_timer)) {
> -   del_timer(>keyup_timer);
> +   if (del_timer(>keyup_timer)) {
> if (ir->last_key != keycode || toggle != ir->last_toggle) {
> -   ir->delay_timer_finished = 0;
> +   ir->keydown_time = jiffies;
> input_event(ir->input_dev, EV_KEY, ir->last_key, 0);
> input_event(ir->input_dev, EV_KEY, keycode, 1);
> input_sync(ir->input_dev);
> -   } else if (ir->delay_timer_finished) {
> +   } else if (time_after(jiffies, ir->keydown_time +
> +   msecs_to_jiffies(
> +   ir->input_dev->rep[REP_PERIOD]))) {
> input_event(ir->input_dev, EV_KEY, keycode, 2);
> input_sync(ir->input_dev);
> }
> } else {
> -   ir->delay_timer_finished = 0;
> +   ir->keydown_time = jiffies;
> input_event(ir->input_dev, EV_KEY, keycode, 1);
> input_sync(ir->input_dev);
> }
> @@ -172,9 +173,7 @@ static void av7110_emit_key(unsigned long parm)
> ir->last_key = keycode;
> ir->last_toggle = toggle;
>
> -   ir->keyup_timer.expires = jiffies + UP_TIMEOUT;
> -   add_timer(>keyup_timer);
> -
> +   mod_timer(>keyup_timer, jiffies + UP_TIMEOUT);
>  }
>
>
> @@ -184,12 +183,19 @@ static void input_register_keys(struct infrared *ir)
> int i;
>
> set_bit(EV_KEY, ir->input_dev->evbit);
> -   set_bit(EV_REP, ir->input_dev->evbit);
> set_bit(EV_MSC, ir->input_dev->evbit);
>
> set_bit(MSC_RAW, ir->input_dev->mscbit);
> set_bit(MSC_SCAN, ir->input_dev->mscbit);
>
> +   set_bit(EV_REP, ir->input_dev->evbit);
> +   /*
> +* By setting the delay before registering input device we
> +* indicate that we will be implementing the autorepeat
> +* ourselves.
> +*/
> +   ir->input_dev->rep[REP_DELAY] = 250;
> +
>

[PATCH] media: av7110: switch to useing timer_setup()

2017-10-24 Thread Dmitry Torokhov 
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Also stop poking into input core internals and override its autorepeat
timer function. I am not sure why we have such convoluted autorepeat
handling in this driver instead of letting input core handle autorepeat,
but this preserves current behavior of allowing controlling autorepeat
delay and forcing autorepeat period to be whatever the hardware has.

Signed-off-by: Dmitry Torokhov 
---

Note that this has not been tested on the hardware. But it should
compile, so I have that going for me.

 drivers/media/pci/ttpci/av7110.h|  4 ++--
 drivers/media/pci/ttpci/av7110_ir.c | 40 +
 2 files changed, 20 insertions(+), 24 deletions(-)

diff --git a/drivers/media/pci/ttpci/av7110.h b/drivers/media/pci/ttpci/av7110.h
index 347827925c14..0aa3c6f01853 100644
--- a/drivers/media/pci/ttpci/av7110.h
+++ b/drivers/media/pci/ttpci/av7110.h
@@ -80,10 +80,11 @@ struct av7110;
 
 /* infrared remote control */
 struct infrared {
-   u16 key_map[256];
+   u16 key_map[256];
struct input_dev*input_dev;
charinput_phys[32];
struct timer_list   keyup_timer;
+   unsigned long   keydown_time;
struct tasklet_struct   ir_tasklet;
void(*ir_handler)(struct av7110 *av7110, u32 ircom);
u32 ir_command;
@@ -93,7 +94,6 @@ struct infrared {
u8  inversion;
u16 last_key;
u16 last_toggle;
-   u8  delay_timer_finished;
 };
 
 
diff --git a/drivers/media/pci/ttpci/av7110_ir.c 
b/drivers/media/pci/ttpci/av7110_ir.c
index ca05198de2c2..b602e64b3412 100644
--- a/drivers/media/pci/ttpci/av7110_ir.c
+++ b/drivers/media/pci/ttpci/av7110_ir.c
@@ -84,9 +84,9 @@ static u16 default_key_map [256] = {
 
 
 /* key-up timer */
-static void av7110_emit_keyup(unsigned long parm)
+static void av7110_emit_keyup(struct timer_list *t)
 {
-   struct infrared *ir = (struct infrared *) parm;
+   struct infrared *ir = from_timer(ir, keyup_timer, t);
 
if (!ir || !test_bit(ir->last_key, ir->input_dev->key))
return;
@@ -152,19 +152,20 @@ static void av7110_emit_key(unsigned long parm)
return;
}
 
-   if (timer_pending(>keyup_timer)) {
-   del_timer(>keyup_timer);
+   if (del_timer(>keyup_timer)) {
if (ir->last_key != keycode || toggle != ir->last_toggle) {
-   ir->delay_timer_finished = 0;
+   ir->keydown_time = jiffies;
input_event(ir->input_dev, EV_KEY, ir->last_key, 0);
input_event(ir->input_dev, EV_KEY, keycode, 1);
input_sync(ir->input_dev);
-   } else if (ir->delay_timer_finished) {
+   } else if (time_after(jiffies, ir->keydown_time +
+   msecs_to_jiffies(
+   ir->input_dev->rep[REP_PERIOD]))) {
input_event(ir->input_dev, EV_KEY, keycode, 2);
input_sync(ir->input_dev);
}
} else {
-   ir->delay_timer_finished = 0;
+   ir->keydown_time = jiffies;
input_event(ir->input_dev, EV_KEY, keycode, 1);
input_sync(ir->input_dev);
}
@@ -172,9 +173,7 @@ static void av7110_emit_key(unsigned long parm)
ir->last_key = keycode;
ir->last_toggle = toggle;
 
-   ir->keyup_timer.expires = jiffies + UP_TIMEOUT;
-   add_timer(>keyup_timer);
-
+   mod_timer(>keyup_timer, jiffies + UP_TIMEOUT);
 }
 
 
@@ -184,12 +183,19 @@ static void input_register_keys(struct infrared *ir)
int i;
 
set_bit(EV_KEY, ir->input_dev->evbit);
-   set_bit(EV_REP, ir->input_dev->evbit);
set_bit(EV_MSC, ir->input_dev->evbit);
 
set_bit(MSC_RAW, ir->input_dev->mscbit);
set_bit(MSC_SCAN, ir->input_dev->mscbit);
 
+   set_bit(EV_REP, ir->input_dev->evbit);
+   /*
+* By setting the delay before registering input device we
+* indicate that we will be implementing the autorepeat
+* ourselves.
+*/
+   ir->input_dev->rep[REP_DELAY] = 250;
+
memset(ir->input_dev->keybit, 0, sizeof(ir->input_dev->keybit));
 
for (i = 0; i < ARRAY_SIZE(ir->key_map); i++) {
@@ -205,15 +211,6 @@ static void input_register_keys(struct infrared *ir)
 }
 
 
-/* called by the input driver after rep[REP_DELAY] ms */
-static void input_repeat_key(unsigned long parm)
-{
-   struct infrared *ir = (struct infrared *) parm;
-
-   ir->delay_timer_finished = 1;
-}
-
-
 /* check

RE: [PATCH v5 2/3] doc-rst: add IPU3 raw10 bayer pixel format definitions

2017-10-24 Thread Zhi, Yong 
Hi, Sakari,

Thanks for the feedback.

> -Original Message-
> From: Sakari Ailus [mailto:sakari.ai...@iki.fi]
> Sent: Tuesday, October 10, 2017 1:33 AM
> To: Zhi, Yong 
> Cc: linux-media@vger.kernel.org; sakari.ai...@linux.intel.com;
> hans.verk...@cisco.com; Zheng, Jian Xu ;
> tf...@chromium.org; Mani, Rajmohan ;
> Toivonen, Tuukka ; Yang, Hyungwoo
> ; Vijaykumar, Ramya
> ; Rapolu, Chiranjeevi
> 
> Subject: Re: [PATCH v5 2/3] doc-rst: add IPU3 raw10 bayer pixel format
> definitions
> 
> Hi Yong,
> 
> On Fri, Oct 06, 2017 at 06:39:00PM -0500, Yong Zhi wrote:
> > The formats added by this patch are:
> >
> > V4L2_PIX_FMT_IPU3_SBGGR10
> > V4L2_PIX_FMT_IPU3_SGBRG10
> > V4L2_PIX_FMT_IPU3_SGRBG10
> > V4L2_PIX_FMT_IPU3_SRGGB10
> >
> > Signed-off-by: Yong Zhi 
> > Signed-off-by: Hyungwoo Yang 
> > ---
> >  Documentation/media/uapi/v4l/pixfmt-rgb.rst|   1 +
> >  .../media/uapi/v4l/pixfmt-srggb10-ipu3.rst | 166
> +
> >  2 files changed, 167 insertions(+)
> >  create mode 100644
> > Documentation/media/uapi/v4l/pixfmt-srggb10-ipu3.rst
> >
> > diff --git a/Documentation/media/uapi/v4l/pixfmt-rgb.rst
> > b/Documentation/media/uapi/v4l/pixfmt-rgb.rst
> > index 4cc27195dc79..cf2ef7df9616 100644
> > --- a/Documentation/media/uapi/v4l/pixfmt-rgb.rst
> > +++ b/Documentation/media/uapi/v4l/pixfmt-rgb.rst
> > @@ -16,6 +16,7 @@ RGB Formats
> >  pixfmt-srggb10p
> >  pixfmt-srggb10alaw8
> >  pixfmt-srggb10dpcm8
> > +pixfmt-srggb10-ipu3
> >  pixfmt-srggb12
> >  pixfmt-srggb12p
> >  pixfmt-srggb16
> > diff --git a/Documentation/media/uapi/v4l/pixfmt-srggb10-ipu3.rst
> > b/Documentation/media/uapi/v4l/pixfmt-srggb10-ipu3.rst
> > new file mode 100644
> > index ..50292186a8b4
> > --- /dev/null
> > +++ b/Documentation/media/uapi/v4l/pixfmt-srggb10-ipu3.rst
> > @@ -0,0 +1,166 @@
> > +.. -*- coding: utf-8; mode: rst -*-
> > +
> > +.. _V4L2_PIX_FMT_IPU3_SBGGR10:
> > +.. _V4L2_PIX_FMT_IPU3_SGBRG10:
> > +.. _V4L2_PIX_FMT_IPU3_SGRBG10:
> > +.. _V4L2_PIX_FMT_IPU3_SRGGB10:
> > +
> >
> +***
> **
> >
> +***
> **
> > +
> > +V4L2_PIX_FMT_IPU3_SBGGR10 ('ip3b'), V4L2_PIX_FMT_IPU3_SGBRG10
> > +('ip3g'), V4L2_PIX_FMT_IPU3_SGRBG10 ('ip3G'),
> > +V4L2_PIX_FMT_IPU3_SRGGB10 ('ip3r')
> >
> +***
> **
> >
> +***
> **
> > +
> > +
> > +10-bit Bayer formats
> > +
> > +Description
> > +===
> > +
> > +These four pixel formats are used by Intel IPU3 driver, they are raw
> > +sRGB / Bayer formats with 10 bits per sample with every 25 pixels
> > +packed to 32 bytes leaving 6 most significant bits padding in the last 
> > byte.
> > +The format is little endian.
> > +
> > +In other respects this format is similar to :ref:`V4L2-PIX-FMT-SRGGB10`.
> 
> You could add:
> 
> Below is an example of a small image in V4L2_PIX_FMT_IPU3_SBGGR10
> format.
> 

Ack.

> > +
> > +**Byte Order.**
> > +Each cell is one byte.
> > +
> > +.. raw:: latex
> > +
> > +\newline\newline\begin{adjustbox}{width=\columnwidth}
> > +
> > +.. tabularcolumns::
> >
> +|p{1.3cm}|p{1.0cm}|p{10.9cm}|p{10.9cm}|p{10.9cm}|p{1.0cm}|p{1.0cm}|p
> {
> >
> +10.9cm}|p{10.9cm}|p{10.9cm}|p{1.0cm}|p{1.0cm}|p{10.9cm}|p{10.9cm}|p{
> 1
> >
> +0.9cm}|p{1.0cm}|p{1.0cm}|p{10.9cm}|p{10.9cm}|p{10.9cm}|p{1.0cm}|p{1.
> 0
> >
> +cm}|p{10.9cm}|p{10.9cm}|p{10.9cm}|p{1.0cm}|p{1.0cm}|p{10.9cm}|p{10.9
> c
> > +m}|p{10.9cm}|p{1.0cm}|p{1.0cm}|p{10.9cm}|
> 
> The width of this table is over one metre. Could you use fewer columns in it,
> say, four or eight?
> 

Sure, will do four columns in next update.

(snip)
> 
> --
> Kind regards,
> 
> Sakari Ailus
> e-mail: sakari.ai...@iki.fi

[PATCH] media: usbtv: fix brightness and contrast controls

2017-10-24 Thread Adam Sampson 
Because the brightness and contrast controls share a register,
usbtv_s_ctrl needs to read the existing values for both controls before
inserting the new value. However, the code accidentally wrote to the
registers (from an uninitialised stack array), rather than reading them.

The user-visible effect of this was that adjusting the brightness would
also set the contrast to a random value, and vice versa -- so it wasn't
possible to correctly adjust the brightness of usbtv's video output.

Tested with an "EasyDAY" UTV007 device.

Fixes: c53a846c48f2 ("usbtv: add video controls")
Signed-off-by: Adam Sampson 
---
 drivers/media/usb/usbtv/usbtv-video.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/usbtv/usbtv-video.c 
b/drivers/media/usb/usbtv/usbtv-video.c
index 95b5f43..3668a04 100644
--- a/drivers/media/usb/usbtv/usbtv-video.c
+++ b/drivers/media/usb/usbtv/usbtv-video.c
@@ -718,8 +718,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl *ctrl)
 */
if (ctrl->id == V4L2_CID_BRIGHTNESS || ctrl->id == V4L2_CID_CONTRAST) {
ret = usb_control_msg(usbtv->udev,
-   usb_sndctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
-   USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+   usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
+   USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
0, USBTV_BASE + 0x0244, (void *)data, 3, 0);
if (ret < 0)
goto error;
-- 
2.1.4

Re: [PATCH v15.2 24/32] v4l: fwnode: Add a helper function to obtain device / integer references

2017-10-24 Thread Sakari Ailus 
On Tue, Oct 24, 2017 at 11:32:54PM +0300, Sakari Ailus wrote:
> v4l2_fwnode_reference_parse_int_prop() will find an fwnode such that under
> the device's own fwnode, it will follow child fwnodes with the given
> property-value pair and return the resulting fwnode.
> 
> Signed-off-by: Sakari Ailus 
> ---

since v15.1:

- Add DT example.

- Add textual description as suggested by Hans.


-- 
Sakari Ailus
e-mail: sakari.ai...@iki.fi

[PATCH v15.2 24/32] v4l: fwnode: Add a helper function to obtain device / integer references

2017-10-24 Thread Sakari Ailus 
v4l2_fwnode_reference_parse_int_prop() will find an fwnode such that under
the device's own fwnode, it will follow child fwnodes with the given
property-value pair and return the resulting fwnode.

Signed-off-by: Sakari Ailus 
---
 drivers/media/v4l2-core/v4l2-fwnode.c | 286 ++
 1 file changed, 286 insertions(+)

diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c 
b/drivers/media/v4l2-core/v4l2-fwnode.c
index edd2e8d983a1..ed7e363a8a6a 100644
--- a/drivers/media/v4l2-core/v4l2-fwnode.c
+++ b/drivers/media/v4l2-core/v4l2-fwnode.c
@@ -578,6 +578,292 @@ static int v4l2_fwnode_reference_parse(
return ret;
 }
 
+/*
+ * v4l2_fwnode_reference_get_int_prop - parse a reference with integer
+ * arguments
+ * @fwnode: fwnode to read @prop from
+ * @notifier: notifier for @dev
+ * @prop: the name of the property
+ * @index: the index of the reference to get
+ * @props: the array of integer property names
+ * @nprops: the number of integer property names in @nprops
+ *
+ * First find an fwnode referred to by the reference at @index in @prop.
+ *
+ * Then under that fwnode, @nprops times, for each property in @props,
+ * iteratively follow child nodes starting from fwnode such that they have the
+ * property in @props array at the index of the child node distance from the
+ * root node and the value of that property matching with the integer argument
+ * of the reference, at the same index.
+ *
+ * The child fwnode reched at the end of the iteration is then returned to the
+ * caller.
+ *
+ * The core reason for this is that you cannot refer to just any node in ACPI.
+ * So to refer to an endpoint (easy in DT) you need to refer to a device, then
+ * provide a list of (property name, property value) tuples where each tuple
+ * uniquely identifies a child node. The first tuple identifies a child 
directly
+ * underneath the device fwnode, the next tuple identifies a child node
+ * underneath the fwnode identified by the previous tuple, etc. until you
+ * reached the fwnode you need.
+ *
+ * An example with a graph, as defined in Documentation/acpi/dsd/graph.txt:
+ *
+ * Scope (\_SB.PCI0.I2C2)
+ * {
+ * Device (CAM0)
+ * {
+ * Name (_DSD, Package () {
+ * ToUUID("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"),
+ * Package () {
+ * Package () {
+ * "compatible",
+ * Package () { "nokia,smia" }
+ * },
+ * },
+ * ToUUID("dbb8e3e6-5886-4ba6-8795-1319f52a966b"),
+ * Package () {
+ * Package () { "port0", "PRT0" },
+ * }
+ * })
+ * Name (PRT0, Package() {
+ * ToUUID("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"),
+ * Package () {
+ * Package () { "port", 0 },
+ * },
+ * ToUUID("dbb8e3e6-5886-4ba6-8795-1319f52a966b"),
+ * Package () {
+ * Package () { "endpoint0", "EP00" },
+ * }
+ * })
+ * Name (EP00, Package() {
+ * ToUUID("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"),
+ * Package () {
+ * Package () { "endpoint", 0 },
+ * Package () {
+ * "remote-endpoint",
+ * Package() {
+ * \_SB.PCI0.ISP, 4, 0
+ * }
+ * },
+ * }
+ * })
+ * }
+ * }
+ *
+ * Scope (\_SB.PCI0)
+ * {
+ * Device (ISP)
+ * {
+ * Name (_DSD, Package () {
+ * ToUUID("dbb8e3e6-5886-4ba6-8795-1319f52a966b"),
+ * Package () {
+ * Package () { "port4", "PRT4" },
+ * }
+ * })
+ *
+ * Name (PRT4, Package() {
+ * ToUUID("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"),
+ * Package () {
+ * Package () { "port", 4 },
+ * },
+ * ToUUID("dbb8e3e6-5886-4ba6-8795-1319f52a966b"),
+ * Package () {
+

Re: [PATCH 4/7] media: exynos4-is: Remove dependency on obsolete SoC support

2017-10-24 Thread Sylwester Nawrocki 
On 10/04/2017 08:38 AM, Marek Szyprowski wrote:
> Support for Exynos4212 SoCs has been removed by commit bca9085e0ae9 ("ARM:
> dts: exynos: remove Exynos4212 support (dead code)"), so there is no need
> to keep remaining dead code related to this SoC version.
> 
> Signed-off-by: Marek Szyprowski 

Acked-by: Sylwester Nawrocki

[PATCH] media: s2255: Convert timers to use timer_setup()

2017-10-24 Thread Kees Cook 
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Mauro Carvalho Chehab 
Cc: Laurent Pinchart 
Cc: Sakari Ailus 
Cc: Bhumika Goyal 
Cc: Mike Isely 
Cc: Arvind Yadav 
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/media/usb/s2255/s2255drv.c | 7 ---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/usb/s2255/s2255drv.c 
b/drivers/media/usb/s2255/s2255drv.c
index b2f239c4ba42..7fee5766587a 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -485,9 +485,10 @@ static void s2255_reset_dsppower(struct s2255_dev *dev)
 
 /* kickstarts the firmware loading. from probe
  */
-static void s2255_timer(unsigned long user_data)
+static void s2255_timer(struct timer_list *t)
 {
-   struct s2255_fw *data = (struct s2255_fw *)user_data;
+   struct s2255_dev *dev = from_timer(dev, t, timer);
+   struct s2255_fw *data = dev->fw_data;
if (usb_submit_urb(data->fw_urb, GFP_ATOMIC) < 0) {
pr_err("s2255: can't submit urb\n");
atomic_set(>fw_state, S2255_FW_FAILED);
@@ -2283,7 +2284,7 @@ static int s2255_probe(struct usb_interface *interface,
dev_err(>dev, "Could not find bulk-in endpoint\n");
goto errorEP;
}
-   setup_timer(>timer, s2255_timer, (unsigned long)dev->fw_data);
+   timer_setup(>timer, s2255_timer, 0);
init_waitqueue_head(>fw_data->wait_fw);
for (i = 0; i < MAX_CHANNELS; i++) {
struct s2255_vc *vc = >vc[i];
-- 
2.7.4


-- 
Kees Cook
Pixel Security

[PATCH] media: radio: Convert timers to use timer_setup()

2017-10-24 Thread Kees Cook 
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Hans Verkuil 
Cc: Mauro Carvalho Chehab 
Cc: "David S. Miller" 
Cc: Johannes Berg 
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/media/radio/radio-cadet.c | 7 +++
 drivers/media/radio/wl128x/fmdrv_common.c | 7 +++
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/media/radio/radio-cadet.c 
b/drivers/media/radio/radio-cadet.c
index 6888b7db449d..7575e5370a49 100644
--- a/drivers/media/radio/radio-cadet.c
+++ b/drivers/media/radio/radio-cadet.c
@@ -281,9 +281,9 @@ static bool cadet_has_rds_data(struct cadet *dev)
 }
 
 
-static void cadet_handler(unsigned long data)
+static void cadet_handler(struct timer_list *t)
 {
-   struct cadet *dev = (void *)data;
+   struct cadet *dev = from_timer(dev, t, readtimer);
 
/* Service the RDS fifo */
if (mutex_trylock(>lock)) {
@@ -309,7 +309,6 @@ static void cadet_handler(unsigned long data)
/*
 * Clean up and exit
 */
-   setup_timer(>readtimer, cadet_handler, data);
dev->readtimer.expires = jiffies + msecs_to_jiffies(50);
add_timer(>readtimer);
 }
@@ -318,7 +317,7 @@ static void cadet_start_rds(struct cadet *dev)
 {
dev->rdsstat = 1;
outb(0x80, dev->io);/* Select RDS fifo */
-   setup_timer(>readtimer, cadet_handler, (unsigned long)dev);
+   timer_setup(>readtimer, cadet_handler, 0);
dev->readtimer.expires = jiffies + msecs_to_jiffies(50);
add_timer(>readtimer);
 }
diff --git a/drivers/media/radio/wl128x/fmdrv_common.c 
b/drivers/media/radio/wl128x/fmdrv_common.c
index ab3428bf63fe..800d69c3f80b 100644
--- a/drivers/media/radio/wl128x/fmdrv_common.c
+++ b/drivers/media/radio/wl128x/fmdrv_common.c
@@ -543,13 +543,13 @@ static inline void fm_irq_common_cmd_resp_helper(struct 
fmdev *fmdev, u8 stage)
  * interrupt process. Therefore reset stage index to re-enable default
  * interrupts. So that next interrupt will be processed as usual.
  */
-static void int_timeout_handler(unsigned long data)
+static void int_timeout_handler(struct timer_list *t)
 {
struct fmdev *fmdev;
struct fm_irq *fmirq;
 
fmdbg("irq: timeout,trying to re-enable fm interrupts\n");
-   fmdev = (struct fmdev *)data;
+   fmdev = from_timer(fmdev, t, irq_info.timer);
fmirq = >irq_info;
fmirq->retry++;
 
@@ -1550,8 +1550,7 @@ int fmc_prepare(struct fmdev *fmdev)
atomic_set(>tx_cnt, 1);
fmdev->resp_comp = NULL;
 
-   setup_timer(>irq_info.timer, _timeout_handler,
-   (unsigned long)fmdev);
+   timer_setup(>irq_info.timer, int_timeout_handler, 0);
/*TODO: add FM_STIC_EVENT later */
fmdev->irq_info.mask = FM_MAL_EVENT;
 
-- 
2.7.4


-- 
Kees Cook
Pixel Security

[PATCH] media: rc: Convert timers to use timer_setup()

2017-10-24 Thread Kees Cook 
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Maxim Levitsky 
Cc: Mauro Carvalho Chehab 
Cc: Sean Young 
Cc: James Hogan 
Cc: Hans Verkuil 
Cc: "Antti Seppälä" 
Cc: Heiner Kallweit 
Cc: "David Härdeman" 
Cc: Andi Shyti 
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/media/rc/ene_ir.c |  7 +++
 drivers/media/rc/igorplugusb.c|  6 +++---
 drivers/media/rc/img-ir/img-ir-hw.c   | 13 ++---
 drivers/media/rc/img-ir/img-ir-raw.c  |  6 +++---
 drivers/media/rc/imon.c   |  7 +++
 drivers/media/rc/ir-mce_kbd-decoder.c |  7 +++
 drivers/media/rc/rc-ir-raw.c  |  8 
 drivers/media/rc/rc-main.c|  7 +++
 drivers/media/rc/sir_ir.c |  4 ++--
 9 files changed, 30 insertions(+), 35 deletions(-)

diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index af7ba23e16e1..71b8c9bbf6c4 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -670,9 +670,9 @@ static void ene_tx_sample(struct ene_device *dev)
 }
 
 /* timer to simulate tx done interrupt */
-static void ene_tx_irqsim(unsigned long data)
+static void ene_tx_irqsim(struct timer_list *t)
 {
-   struct ene_device *dev = (struct ene_device *)data;
+   struct ene_device *dev = from_timer(dev, t, tx_sim_timer);
unsigned long flags;
 
spin_lock_irqsave(>hw_lock, flags);
@@ -1045,8 +1045,7 @@ static int ene_probe(struct pnp_dev *pnp_dev, const 
struct pnp_device_id *id)
 
if (!dev->hw_learning_and_tx_capable && txsim) {
dev->hw_learning_and_tx_capable = true;
-   setup_timer(>tx_sim_timer, ene_tx_irqsim,
-   (long unsigned int)dev);
+   timer_setup(>tx_sim_timer, ene_tx_irqsim, 0);
pr_warn("Simulation of TX activated\n");
}
 
diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
index 4b715eb995f8..f563ddd7f739 100644
--- a/drivers/media/rc/igorplugusb.c
+++ b/drivers/media/rc/igorplugusb.c
@@ -137,9 +137,9 @@ static void igorplugusb_cmd(struct igorplugusb *ir, int cmd)
dev_err(ir->dev, "submit urb failed: %d", ret);
 }
 
-static void igorplugusb_timer(unsigned long data)
+static void igorplugusb_timer(struct timer_list *t)
 {
-   struct igorplugusb *ir = (struct igorplugusb *)data;
+   struct igorplugusb *ir = from_timer(ir, t, timer);
 
igorplugusb_cmd(ir, GET_INFRACODE);
 }
@@ -174,7 +174,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
 
ir->dev = >dev;
 
-   setup_timer(>timer, igorplugusb_timer, (unsigned long)ir);
+   timer_setup(>timer, igorplugusb_timer, 0);
 
ir->request.bRequest = GET_INFRACODE;
ir->request.bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
diff --git a/drivers/media/rc/img-ir/img-ir-hw.c 
b/drivers/media/rc/img-ir/img-ir-hw.c
index 82fdf4cc0824..f54bc5d23893 100644
--- a/drivers/media/rc/img-ir/img-ir-hw.c
+++ b/drivers/media/rc/img-ir/img-ir-hw.c
@@ -867,9 +867,9 @@ static void img_ir_handle_data(struct img_ir_priv *priv, 
u32 len, u64 raw)
 }
 
 /* timer function to end waiting for repeat. */
-static void img_ir_end_timer(unsigned long arg)
+static void img_ir_end_timer(struct timer_list *t)
 {
-   struct img_ir_priv *priv = (struct img_ir_priv *)arg;
+   struct img_ir_priv *priv = from_timer(priv, t, hw.end_timer);
 
spin_lock_irq(>lock);
img_ir_end_repeat(priv);
@@ -881,9 +881,9 @@ static void img_ir_end_timer(unsigned long arg)
  * cleared when invalid interrupts were generated due to a quirk in the
  * img-ir decoder.
  */
-static void img_ir_suspend_timer(unsigned long arg)
+static void img_ir_suspend_timer(struct timer_list *t)
 {
-   struct img_ir_priv *priv = (struct img_ir_priv *)arg;
+   struct img_ir_priv *priv = from_timer(priv, t, hw.suspend_timer);
 
spin_lock_irq(>lock);
/*
@@ -1055,9 +1055,8 @@ int img_ir_probe_hw(struct img_ir_priv *priv)
img_ir_probe_hw_caps(priv);
 
/* Set up the end timer */
-   setup_timer(>end_timer, img_ir_end_timer, (unsigned long)priv);
-   setup_timer(>suspend_timer, img_ir_suspend_timer,
-   (unsigned long)priv);
+   timer_setup(>end_timer, img_ir_end_timer, 0);
+   timer_setup(>suspend_timer, img_ir_suspend_timer, 0);
 
/* Register a clock notifier */
if (!IS_ERR(priv->clk)) {
diff --git a/drivers/media/rc/img-ir/img-ir-raw.c 
b/drivers/media/rc/img-ir/img-ir-raw.c
index 64714efc1145..6e545680d3b6 100644
--- a/drivers/media/rc/img-ir/img-ir-raw.c

[PATCH] media: pvrusb2: Convert timers to use timer_setup()

2017-10-24 Thread Kees Cook 
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Mike Isely 
Cc: Mauro Carvalho Chehab 
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 64 ++---
 1 file changed, 36 insertions(+), 28 deletions(-)

diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c 
b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
index ad5b25b89699..8289ee482f49 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -330,10 +330,10 @@ static void pvr2_hdw_state_log_state(struct pvr2_hdw *);
 static int pvr2_hdw_cmd_usbstream(struct pvr2_hdw *hdw,int runFl);
 static int pvr2_hdw_commit_setup(struct pvr2_hdw *hdw);
 static int pvr2_hdw_get_eeprom_addr(struct pvr2_hdw *hdw);
-static void pvr2_hdw_quiescent_timeout(unsigned long);
-static void pvr2_hdw_decoder_stabilization_timeout(unsigned long);
-static void pvr2_hdw_encoder_wait_timeout(unsigned long);
-static void pvr2_hdw_encoder_run_timeout(unsigned long);
+static void pvr2_hdw_quiescent_timeout(struct timer_list *);
+static void pvr2_hdw_decoder_stabilization_timeout(struct timer_list *);
+static void pvr2_hdw_encoder_wait_timeout(struct timer_list *);
+static void pvr2_hdw_encoder_run_timeout(struct timer_list *);
 static int pvr2_issue_simple_cmd(struct pvr2_hdw *,u32);
 static int pvr2_send_request_ex(struct pvr2_hdw *hdw,
unsigned int timeout,int probe_fl,
@@ -2373,18 +2373,15 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface 
*intf,
}
if (!hdw) goto fail;
 
-   setup_timer(>quiescent_timer, pvr2_hdw_quiescent_timeout,
-   (unsigned long)hdw);
+   timer_setup(>quiescent_timer, pvr2_hdw_quiescent_timeout, 0);
 
-   setup_timer(>decoder_stabilization_timer,
-   pvr2_hdw_decoder_stabilization_timeout,
-   (unsigned long)hdw);
+   timer_setup(>decoder_stabilization_timer,
+   pvr2_hdw_decoder_stabilization_timeout, 0);
 
-   setup_timer(>encoder_wait_timer, pvr2_hdw_encoder_wait_timeout,
-   (unsigned long)hdw);
+   timer_setup(>encoder_wait_timer, pvr2_hdw_encoder_wait_timeout,
+   0);
 
-   setup_timer(>encoder_run_timer, pvr2_hdw_encoder_run_timeout,
-   (unsigned long)hdw);
+   timer_setup(>encoder_run_timer, pvr2_hdw_encoder_run_timeout, 0);
 
hdw->master_state = PVR2_STATE_DEAD;
 
@@ -3539,10 +3536,16 @@ static void pvr2_ctl_read_complete(struct urb *urb)
complete(>ctl_done);
 }
 
+struct hdw_timer {
+   struct timer_list timer;
+   struct pvr2_hdw *hdw;
+};
 
-static void pvr2_ctl_timeout(unsigned long data)
+static void pvr2_ctl_timeout(struct timer_list *t)
 {
-   struct pvr2_hdw *hdw = (struct pvr2_hdw *)data;
+   struct hdw_timer *timer = from_timer(timer, t, timer);
+   struct pvr2_hdw *hdw = timer->hdw;
+
if (hdw->ctl_write_pend_flag || hdw->ctl_read_pend_flag) {
hdw->ctl_timeout_flag = !0;
if (hdw->ctl_write_pend_flag)
@@ -3564,7 +3567,10 @@ static int pvr2_send_request_ex(struct pvr2_hdw *hdw,
 {
unsigned int idx;
int status = 0;
-   struct timer_list timer;
+   struct hdw_timer timer = {
+   .hdw = hdw,
+   };
+
if (!hdw->ctl_lock_held) {
pvr2_trace(PVR2_TRACE_ERROR_LEGS,
   "Attempted to execute control transfer without 
lock!!");
@@ -3621,8 +3627,8 @@ static int pvr2_send_request_ex(struct pvr2_hdw *hdw,
hdw->ctl_timeout_flag = 0;
hdw->ctl_write_pend_flag = 0;
hdw->ctl_read_pend_flag = 0;
-   setup_timer(, pvr2_ctl_timeout, (unsigned long)hdw);
-   timer.expires = jiffies + timeout;
+   timer_setup_on_stack(, pvr2_ctl_timeout, 0);
+   timer.timer.expires = jiffies + timeout;
 
if (write_len && write_data) {
hdw->cmd_debug_state = 2;
@@ -3677,7 +3683,7 @@ status);
}
 
/* Start timer */
-   add_timer();
+   add_timer();
 
/* Now wait for all I/O to complete */
hdw->cmd_debug_state = 4;
@@ -3687,7 +3693,7 @@ status);
hdw->cmd_debug_state = 5;
 
/* Stop timer */
-   del_timer_sync();
+   del_timer_sync();
 
hdw->cmd_debug_state = 6;
status = 0;
@@ -3769,6 +3775,8 @@ status);
if ((status < 0) && (!probe_fl)) {
pvr2_hdw_render_useless(hdw);
}
+   destroy_timer_on_stack();
+
return status;
 }
 
@@ -4366,9 +4374,9 @@ static int state_eval_encoder_run(struct pvr2_hdw *hdw)
 
 
 /* Timeout function for quiescent timer. */
-static void pvr2_hdw_quiescent_timeout(unsigned long data)
+static void

[PATCH] media: pci: Convert timers to use timer_setup()

2017-10-24 Thread Kees Cook 
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Mauro Carvalho Chehab 
Cc: Andy Walls 
Cc: Sergey Kozlov 
Cc: Abylay Ospan 
Cc: Ezequiel Garcia 
Cc: Hans Verkuil 
Cc: Arvind Yadav 
Cc: Geliang Tang 
Cc: Sean Young 
Cc: Sakari Ailus 
Cc: "Pali Rohár" 
Cc: linux-media@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/media/pci/bt8xx/bttv-driver.c  |  6 +++---
 drivers/media/pci/bt8xx/bttv-input.c   | 19 ++-
 drivers/media/pci/bt8xx/bttvp.h|  1 +
 drivers/media/pci/cx18/cx18-fileops.c  |  4 ++--
 drivers/media/pci/cx18/cx18-fileops.h  |  2 +-
 drivers/media/pci/cx18/cx18-streams.c  |  2 +-
 drivers/media/pci/ivtv/ivtv-driver.c   |  3 +--
 drivers/media/pci/ivtv/ivtv-irq.c  |  4 ++--
 drivers/media/pci/ivtv/ivtv-irq.h  |  2 +-
 drivers/media/pci/netup_unidvb/netup_unidvb_core.c |  7 +++
 drivers/media/pci/ttpci/av7110_ir.c|  7 +++
 drivers/media/pci/tw686x/tw686x-core.c |  7 +++
 12 files changed, 31 insertions(+), 33 deletions(-)

diff --git a/drivers/media/pci/bt8xx/bttv-driver.c 
b/drivers/media/pci/bt8xx/bttv-driver.c
index 227086a2e99c..b366a7e1d976 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -3652,9 +3652,9 @@ bttv_irq_wakeup_vbi(struct bttv *btv, struct bttv_buffer 
*wakeup,
wake_up(>vb.done);
 }
 
-static void bttv_irq_timeout(unsigned long data)
+static void bttv_irq_timeout(struct timer_list *t)
 {
-   struct bttv *btv = (struct bttv *)data;
+   struct bttv *btv = from_timer(btv, t, timeout);
struct bttv_buffer_set old,new;
struct bttv_buffer *ovbi;
struct bttv_buffer *item;
@@ -4043,7 +4043,7 @@ static int bttv_probe(struct pci_dev *dev, const struct 
pci_device_id *pci_id)
INIT_LIST_HEAD(>capture);
INIT_LIST_HEAD(>vcapture);
 
-   setup_timer(>timeout, bttv_irq_timeout, (unsigned long)btv);
+   timer_setup(>timeout, bttv_irq_timeout, 0);
 
btv->i2c_rc = -1;
btv->tuner_type  = UNSET;
diff --git a/drivers/media/pci/bt8xx/bttv-input.c 
b/drivers/media/pci/bt8xx/bttv-input.c
index 73d655d073d6..ac7674700685 100644
--- a/drivers/media/pci/bt8xx/bttv-input.c
+++ b/drivers/media/pci/bt8xx/bttv-input.c
@@ -133,10 +133,10 @@ void bttv_input_irq(struct bttv *btv)
ir_handle_key(btv);
 }
 
-static void bttv_input_timer(unsigned long data)
+static void bttv_input_timer(struct timer_list *t)
 {
-   struct bttv *btv = (struct bttv*)data;
-   struct bttv_ir *ir = btv->remote;
+   struct bttv_ir *ir = from_timer(ir, t, timer);
+   struct bttv *btv = ir->btv;
 
if (btv->c.type == BTTV_BOARD_ENLTV_FM_2)
ir_enltv_handle_key(btv);
@@ -189,9 +189,9 @@ static u32 bttv_rc5_decode(unsigned int code)
return rc5;
 }
 
-static void bttv_rc5_timer_end(unsigned long data)
+static void bttv_rc5_timer_end(struct timer_list *t)
 {
-   struct bttv_ir *ir = (struct bttv_ir *)data;
+   struct bttv_ir *ir = from_timer(ir, t, timer);
ktime_t tv;
u32 gap, rc5, scancode;
u8 toggle, command, system;
@@ -296,15 +296,15 @@ static int bttv_rc5_irq(struct bttv *btv)
 
 /* -- */
 
-static void bttv_ir_start(struct bttv *btv, struct bttv_ir *ir)
+static void bttv_ir_start(struct bttv_ir *ir)
 {
if (ir->polling) {
-   setup_timer(>timer, bttv_input_timer, (unsigned long)btv);
+   timer_setup(>timer, bttv_input_timer, 0);
ir->timer.expires  = jiffies + msecs_to_jiffies(1000);
add_timer(>timer);
} else if (ir->rc5_gpio) {
/* set timer_end for code completion */
-   setup_timer(>timer, bttv_rc5_timer_end, (unsigned long)ir);
+   timer_setup(>timer, bttv_rc5_timer_end, 0);
ir->shift_by = 1;
ir->rc5_remote_gap = ir_rc5_remote_gap;
}
@@ -531,6 +531,7 @@ int bttv_input_init(struct bttv *btv)
 
/* init input device */
ir->dev = rc;
+   ir->btv = btv;
 
snprintf(ir->name, sizeof(ir->name), "bttv IR (card=%d)",
 btv->c.type);
@@ -553,7 +554,7 @@ int bttv_input_init(struct bttv *btv)
rc->driver_name = MODULE_NAME;
 
btv->remote = ir;
-   bttv_ir_start(btv, ir);
+   bttv_ir_start(ir);
 
/* all done */
err = rc_register_device(rc);
diff --git

RE: Enabling peer to peer device transactions for PCIe devices

2017-10-24 Thread David Laight 
Please don't top post, write shorter lines, and add the odd blank line.
Big blocks of text are hard to read quickly.

> From: Petrosyan, Ludwig [mailto:ludwig.petros...@desy.de]
> Yes I agree it has to be started with the write transaction, according of 
> PCIe standard all write
> transaction are address routed, and I agree with Logan:
> if in write transaction TLP the endpoint address written in header the TLP 
> should not touch CPU, the
> PCIe Switch has to route it to endpoint.

That depends, IIRC there is a feature for PCIe switches to force them
to send all transactions to the root hub.
This is there so that the host can enforce rules to stop p2p transfers.
It might enabled on the switch you have.

> The idea was: in MTCA system there is PCIe Switch on MCH (MTCA crate HUB) 
> this switch connects CPU to
> other Crate Slots, so one port is Upstream and others are Downstream  ports, 
> DMA read from CPU is
> usual write on endpoint side, Xilinx DMA core has two registers Destination 
> Address and Source
> Address,
> device driver to make DMA has to set up these registers,
> usually device driver to start DMA read from Board sets Source address as 
> FPGA memory address and
> Destination address is DMA prepared system address,
> in case of testing p2p I set Destination address as physical address of other 
> endpoint.

Unnecessary detail...

> More detailed:
> we have so called pcie universal driver: the idea behind is
> 1. all pcie configuration staff, find enabled BARs, mapping BARs, usual 
> read/write and common ioctl
> (get slot number, get driver version ...) implemented in universal driver and 
> EXPORTed.
> 2. if some system function in new kernel are changed we change it only in 
> universal parts (easy
> support a big number of drivers )
> so the universal driver something like PCIe Driver API
> 3. the universal driver provides read/writ functions so we have the same 
> device access API for any
> PCIe device, we could use the same user application with any PCIe device

More crap...

> now. during BARs finding and mapping universal driver keeps pcie endpoint 
> physical address in some
> internal structures, any top driver may get physical address
> of other pcie endpoint by slot number.
> in may case during get_resorce the physical address is 0xB200, I check 
> lspci -H1 - -s psie
> switch port bus address (the endpoint connected to this port, checked by 
> lspci -H1 -t) the same
> address (0xB20) is the memory behind bridge,

Overly verbose...

> I want to make p2p writes to offset 0x4, so I set DMA destination address 
> 0xB240
> is something wrong?

Possibly.

You almost certainly need the address that is written into the BAR of the
target endpoint.
This could well be different from the physical address that the cpu uses
to write to the endpoint (as well as the cpu virtual address).

lspci lies [1], run lspci -x  (or hexdump config space through /sys/devices)
to see what is actually in the BAR.

[1] The addresses come from somewhere other than reading the BAR.
If the endpoint resets the BAR lspci will still report the old
addresses.

David

Re: [PATCH] media: input: Convert timers to use timer_setup()

2017-10-24 Thread Kees Cook 
On Thu, Oct 19, 2017 at 3:48 PM, Dmitry Torokhov
 wrote:
> On Thu, Oct 19, 2017 at 03:45:38PM -0700, Kees Cook wrote:
>> On Thu, Oct 19, 2017 at 3:32 PM, Dmitry Torokhov
>>  wrote:
>> > On Mon, Oct 16, 2017 at 04:14:43PM -0700, Kees Cook wrote:
>> >> In preparation for unconditionally passing the struct timer_list pointer 
>> >> to
>> >> all timer callbacks, switch to using the new timer_setup() and 
>> >> from_timer()
>> >> to pass the timer pointer explicitly.
>> >>
>> >> One input_dev user hijacks the input_dev software autorepeat timer to
>> >> perform its own repeat management. However, there is no path back to the
>> >> existing status variable, so add a generic one to the input structure and
>> >> use that instead.
>> >
>> > That is too bad and it should not be doing this. I'd rather av7110 used
>> > its own private timer for that.
>>
>> Yeah, that was a pretty weird case. I couldn't see how to avoid it,
>> though. I didn't see a way to hook the autorepeat, but I'm not too
>> familiar with the code here.
>
> You just need to manage the private timer in the driver and not mess up
> with the input core if input core's autorepeat does not provide the
> desired behavior...

I don't know how to fix this, but I still need to do this refactoring.
What's the correct step forward here? Should I temporarily disable the
timer in av7110?

Seems like the hijacking was introduced in ee820a648fb3 ("V4L/DVB
(5334): Dvb-ttpci: Infrared remote control refactoring").

Thanks!

-Kees

-- 
Kees Cook
Pixel Security

Re: [PATCH v2] drm: bridge: synopsys/dw-hdmi: Enable cec clock

2017-10-24 Thread Heiko Stuebner 
Hi Pierre,

Am Freitag, 20. Oktober 2017, 21:18:38 CEST schrieb Pierre-Hugues Husson:
> The documentation already mentions "cec" optional clock, but
> currently the driver doesn't enable it.
> 
> Changes:
> v2:
> - Separate ENOENT errors from others
> - Propagate other errors (especially -EPROBE_DEFER)
> 
> Signed-off-by: Pierre-Hugues Husson 
> ---

it looks like you might be missing some important people in your recipient list.
get_maintainer.pl shows me:
- Archit Taneja  (maintainer:DRM DRIVERS FOR BRIDGE 
CHIPS)
- Andrzej Hajda  (maintainer:DRM DRIVERS FOR BRIDGE CHIPS)
- dri-de...@lists.freedesktop.org (open list:DRM DRIVERS)

So these should definitly be included in your recipients, as they're the
ones that will apply your patch :-)

One further nit below.


>  drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 26 ++
>  1 file changed, 26 insertions(+)
> 
> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c 
> b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
> index bf14214fa464..b31fc95d5fef 100644
> --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
> @@ -138,6 +138,7 @@ struct dw_hdmi {
>   struct device *dev;
>   struct clk *isfr_clk;
>   struct clk *iahb_clk;
> + struct clk *cec_clk;
>   struct dw_hdmi_i2c *i2c;
>  
>   struct hdmi_data_info hdmi_data;
> @@ -2382,6 +2383,27 @@ __dw_hdmi_probe(struct platform_device *pdev,
>   goto err_isfr;
>   }
>  
> + hdmi->cec_clk = devm_clk_get(hdmi->dev, "cec");
> + if (PTR_ERR(hdmi->cec_clk) == -ENOENT) {
> + hdmi->cec_clk = NULL;
> + } else if (IS_ERR(hdmi->cec_clk)) {
> + ret = PTR_ERR(hdmi->cec_clk);
> + if (ret != -EPROBE_DEFER) {
> + dev_err(hdmi->dev, "Cannot get HDMI cec clock: %d\n",
> + ret);
> + }

braces around the single dev_err are not necessary.

Heiko

Re: [RFC v4 08/17] [media] vb2: add 'ordered_in_driver' property to queues

2017-10-24 Thread Hans Verkuil 
On 10/20/2017 11:50 PM, Gustavo Padovan wrote:
> From: Gustavo Padovan 
> 
> For explicit synchronization (and soon for HAL3/Request API) we need
> the v4l2-driver to guarantee the ordering in which the buffers were queued
> by userspace. This is already true for many drivers, but we never needed
> to say it.
> 
> v2: rename property to 'ordered_in_driver' to avoid confusion
> 
> Signed-off-by: Gustavo Padovan 
> ---
>  include/media/videobuf2-core.h | 6 ++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
> index 96af4eb49e52..6dd3f0181107 100644
> --- a/include/media/videobuf2-core.h
> +++ b/include/media/videobuf2-core.h
> @@ -500,6 +500,11 @@ struct vb2_buf_ops {
>   * @last_buffer_dequeued: used in poll() and DQBUF to immediately return if 
> the
>   *   last decoded buffer was already dequeued. Set for capture queues
>   *   when a buffer with the V4L2_BUF_FLAG_LAST is dequeued.
> + * @ordered_in_driver: if the driver can guarantee that the queue will be
> + *   ordered or not, i.e., the buffers are queued to the driver in
> + *   the same order they are dequeued from the driver. The default

I'd swap the words 'queued' and 'dequeued'. It's more logical that way.

Regards,

Hans

> + *   is not ordered unless the driver sets this flag. As of now it
> + *   is mandatory for using explicit fences.
>   * @fileio:  file io emulator internal data, used only if emulator is active
>   * @threadio:thread io internal data, used only if thread is active
>   */
> @@ -552,6 +557,7 @@ struct vb2_queue {
>   unsigned intis_output:1;
>   unsigned intcopy_timestamp:1;
>   unsigned intlast_buffer_dequeued:1;
> + unsigned intordered_in_driver:1;
>  
>   struct vb2_fileio_data  *fileio;
>   struct vb2_threadio_data*threadio;
>

Re: [RFC v4 05/17] [media] v4l: add V4L2_EVENT_OUT_FENCE event

2017-10-24 Thread Hans Verkuil 
On 10/20/2017 11:50 PM, Gustavo Padovan wrote:
> From: Gustavo Padovan 
> 
> Add a new event the userspace can subscribe to receive notifications
> of the out_fence_fd when a buffer is queued onto the driver.
> The event provides the index of the queued buffer and the out_fence_fd.
> 
> v3: - Rename event to V4L2_EVENT_OUT_FENCE
> 
> v2: - Add missing Documentation (Mauro)
> 
> Signed-off-by: Gustavo Padovan 
> ---
>  Documentation/media/uapi/v4l/vidioc-dqevent.rst | 23 +++
>  Documentation/media/videodev2.h.rst.exceptions  |  1 +
>  include/uapi/linux/videodev2.h  | 12 
>  3 files changed, 36 insertions(+)
> 
> diff --git a/Documentation/media/uapi/v4l/vidioc-dqevent.rst 
> b/Documentation/media/uapi/v4l/vidioc-dqevent.rst
> index cb3565f36793..2143df63aeb1 100644
> --- a/Documentation/media/uapi/v4l/vidioc-dqevent.rst
> +++ b/Documentation/media/uapi/v4l/vidioc-dqevent.rst
> @@ -79,6 +79,10 @@ call.
>- ``src_change``
>- Event data for event V4L2_EVENT_SOURCE_CHANGE.
>  * -
> +  - struct :c:type:`v4l2_event_buf_queued`
> +  - ``buf_queued``
> +  - Event data for event V4L2_EVENT_OUT_FENCE.
> +* -
>- __u8
>- ``data``\ [64]
>- Event data. Defined by the event type. The union should be used to
> @@ -338,6 +342,25 @@ call.
>   each cell in the motion detection grid, then that all cells are
>   automatically assigned to the default region 0.
>  
> +.. c:type:: v4l2_event_out_fence
> +
> +.. flat-table:: struct v4l2_event_out_fence
> +:header-rows:  0
> +:stub-columns: 0
> +:widths:   1 1 2
> +
> +* - __u32
> +  - ``index``
> +  - The index of the buffer that was queued to the driver.
> +* - __s32
> +  - ``out_fence_fd``
> +  - The out-fence file descriptor of the buffer that was queued to
> + the driver. It will signal when the buffer is ready, or if an
> + error happens.

What happens when the buffer has already been dequeued? This needs to be 
defined.

Perhaps set out_fence_fd to 0 or -1 in that case?

Regards,

Hans

> +
> +
> +
> +.. tabularcolumns:: |p{4.4cm}|p{4.4cm}|p{8.7cm}|
>  
>  
>  .. tabularcolumns:: |p{6.6cm}|p{2.2cm}|p{8.7cm}|
> diff --git a/Documentation/media/videodev2.h.rst.exceptions 
> b/Documentation/media/videodev2.h.rst.exceptions
> index a5cb0a8686ac..32f3d5b37e3a 100644
> --- a/Documentation/media/videodev2.h.rst.exceptions
> +++ b/Documentation/media/videodev2.h.rst.exceptions
> @@ -462,6 +462,7 @@ replace define V4L2_EVENT_CTRL event-type
>  replace define V4L2_EVENT_FRAME_SYNC event-type
>  replace define V4L2_EVENT_SOURCE_CHANGE event-type
>  replace define V4L2_EVENT_MOTION_DET event-type
> +replace define V4L2_EVENT_OUT_FENCE event-type
>  replace define V4L2_EVENT_PRIVATE_START event-type
>  
>  replace define V4L2_EVENT_CTRL_CH_VALUE ctrl-changes-flags
> diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
> index 185d6a0acc06..2a432e8c18e3 100644
> --- a/include/uapi/linux/videodev2.h
> +++ b/include/uapi/linux/videodev2.h
> @@ -2156,6 +2156,7 @@ struct v4l2_streamparm {
>  #define V4L2_EVENT_FRAME_SYNC4
>  #define V4L2_EVENT_SOURCE_CHANGE 5
>  #define V4L2_EVENT_MOTION_DET6
> +#define V4L2_EVENT_OUT_FENCE 7
>  #define V4L2_EVENT_PRIVATE_START 0x0800
>  
>  /* Payload for V4L2_EVENT_VSYNC */
> @@ -2208,6 +2209,16 @@ struct v4l2_event_motion_det {
>   __u32 region_mask;
>  };
>  
> +/**
> + * struct v4l2_event_out_fence - out fence fd event
> + * @index:   index of the buffer queued in the driver
> + * @out_fence_fd:out-fence fd of the buffer queued
> + */
> +struct v4l2_event_out_fence {
> + __u32 index;
> + __s32 out_fence_fd;
> +};
> +
>  struct v4l2_event {
>   __u32   type;
>   union {
> @@ -2216,6 +2227,7 @@ struct v4l2_event {
>   struct v4l2_event_frame_syncframe_sync;
>   struct v4l2_event_src_changesrc_change;
>   struct v4l2_event_motion_detmotion_det;
> + struct v4l2_event_out_fence out_fence;
>   __u8data[64];
>   } u;
>   __u32   pending;
>

Re: [RFC v4 01/17] [media] v4l: create v4l2_event_subscribe_v4l2()

2017-10-24 Thread Hans Verkuil 
On 10/20/2017 11:49 PM, Gustavo Padovan wrote:
> From: Gustavo Padovan 
> 
> We need a common function to subscribe all the common events in drivers,
> so far we had only V4L2_EVENT_CTRL, so such a function wasn't necessary,
> but we are about to introduce a new event for the upcoming explicit fences
> implementation, thus a common place is needed.
> 
> Signed-off-by: Gustavo Padovan 
> ---
>  drivers/media/v4l2-core/v4l2-event.c | 12 
>  include/media/v4l2-event.h   |  8 
>  2 files changed, 20 insertions(+)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-event.c 
> b/drivers/media/v4l2-core/v4l2-event.c
> index 968c2eb08b5a..313ee9d1f9ee 100644
> --- a/drivers/media/v4l2-core/v4l2-event.c
> +++ b/drivers/media/v4l2-core/v4l2-event.c
> @@ -20,6 +20,7 @@
>  #include 
>  #include 
>  #include 
> +#include 
>  
>  #include 
>  #include 
> @@ -354,3 +355,14 @@ int v4l2_src_change_event_subdev_subscribe(struct 
> v4l2_subdev *sd,
>   return v4l2_src_change_event_subscribe(fh, sub);
>  }
>  EXPORT_SYMBOL_GPL(v4l2_src_change_event_subdev_subscribe);
> +
> +int v4l2_subscribe_event_v4l2(struct v4l2_fh *fh,
> +   const struct v4l2_event_subscription *sub)
> +{
> + switch (sub->type) {
> + case V4L2_EVENT_CTRL:
> + return v4l2_ctrl_subscribe_event(fh, sub);
> + }
> + return -EINVAL;
> +}
> +EXPORT_SYMBOL(v4l2_subscribe_event_v4l2);
> diff --git a/include/media/v4l2-event.h b/include/media/v4l2-event.h
> index 6741910c3a18..2b794f2ad824 100644
> --- a/include/media/v4l2-event.h
> +++ b/include/media/v4l2-event.h
> @@ -236,4 +236,12 @@ int v4l2_src_change_event_subscribe(struct v4l2_fh *fh,
>  int v4l2_src_change_event_subdev_subscribe(struct v4l2_subdev *sd,
>  struct v4l2_fh *fh,
>  struct v4l2_event_subscription *sub);
> +/**
> + * v4l2_subscribe_event_v4l2 - helper function that subscribe all v4l2 events
> + *
> + * @fh: pointer to struct v4l2_fh
> + * @sub: pointer to  v4l2_event_subscription
> + */
> +int v4l2_subscribe_event_v4l2(struct v4l2_fh *fh,

Why the _v4l2 suffix? It's weird and I think you can just drop it. Otherwise 
this looks good.

Regards,

Hans

> +   const struct v4l2_event_subscription *sub);
>  #endif /* V4L2_EVENT_H */
>

Re: [RFT] media: dvb_frontend: Fix use-after-free in __dvb_frontend_free

2017-10-24 Thread Andrey Konovalov 
On Tue, Oct 24, 2017 at 1:36 PM, Arvind Yadav  wrote:
> Here, dvb_free_device will free dvb_device. dvb_frontend_invoke_release
> is using  dvb_device after free.

Hi Arvind,

Matthias already suggested a fix. Also it looks like your patch is
based on an outdated tree, which doesn't contain the commit that seems
to have caused the bug (ead666000a5fe34bdc82d61838e4df2d416ea15e).

Thanks!

>
> Signed-off-by: Arvind Yadav 
> ---
> This bug report by Andrey Konovalov (usb/media/dtt200u: use-after-free
> in __dvb_frontend_free).
>
>  drivers/media/dvb-core/dvb_frontend.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/dvb-core/dvb_frontend.c 
> b/drivers/media/dvb-core/dvb_frontend.c
> index 2fcba16..7f1ef12 100644
> --- a/drivers/media/dvb-core/dvb_frontend.c
> +++ b/drivers/media/dvb-core/dvb_frontend.c
> @@ -147,10 +147,10 @@ static void dvb_frontend_free(struct kref *ref)
> container_of(ref, struct dvb_frontend, refcount);
> struct dvb_frontend_private *fepriv = fe->frontend_priv;
>
> -   dvb_free_device(fepriv->dvbdev);
> -
> dvb_frontend_invoke_release(fe, fe->ops.release);
>
> +   dvb_free_device(fepriv->dvbdev);
> +
> kfree(fepriv);
>  }
>
> --
> 1.9.1
>

[RFT] media: dvb_frontend: Fix use-after-free in __dvb_frontend_free

2017-10-24 Thread Arvind Yadav 
Here, dvb_free_device will free dvb_device. dvb_frontend_invoke_release
is using  dvb_device after free.

Signed-off-by: Arvind Yadav 
---
This bug report by Andrey Konovalov (usb/media/dtt200u: use-after-free
in __dvb_frontend_free).

 drivers/media/dvb-core/dvb_frontend.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/dvb-core/dvb_frontend.c 
b/drivers/media/dvb-core/dvb_frontend.c
index 2fcba16..7f1ef12 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -147,10 +147,10 @@ static void dvb_frontend_free(struct kref *ref)
container_of(ref, struct dvb_frontend, refcount);
struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
-   dvb_free_device(fepriv->dvbdev);
-
dvb_frontend_invoke_release(fe, fe->ops.release);
 
+   dvb_free_device(fepriv->dvbdev);
+
kfree(fepriv);
 }
 
-- 
1.9.1

Re: usb/media/dtt200u: use-after-free in __dvb_frontend_free

2017-10-24 Thread Andrey Konovalov 
On Mon, Oct 23, 2017 at 8:58 PM, Matthias Schwarzott  wrote:
> Am 23.10.2017 um 16:41 schrieb Andrey Konovalov:
>> Hi!
>>
>> I've got the following report while fuzzing the kernel with syzkaller.
>>
>> On commit 3e0cc09a3a2c40ec1ffb6b4e12da86e98feccb11 (4.14-rc5+).
>>
>> dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)'
>> in warm state.
>> dvb-usb: bulk message failed: -22 (2/1102416563)
>> dvb-usb: will use the device's hardware PID filter (table count: 15).
>> dvbdev: DVB: registering new adapter (WideView WT-220U PenType
>> Receiver (based on ZL353))
>> usb 1-1: media controller created
>> dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
>> usb 1-1: DVB: registering adapter 0 frontend 0 (WideView USB DVB-T)...
>> dvbdev: dvb_create_media_entity: media entity 'WideView USB DVB-T' 
>> registered.
>> Registered IR keymap rc-dtt200u
>> rc rc1: IR-receiver inside an USB DVB receiver as
>> /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc1
>> input: IR-receiver inside an USB DVB receiver as
>> /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc1/input9
>> dvb-usb: schedule remote query interval to 300 msecs.
>> dvb-usb: WideView WT-220U PenType Receiver (based on ZL353)
>> successfully initialized and connected.
>> dvb-usb: bulk message failed: -22 (1/1807119384)
>> dvb-usb: error -22 while querying for an remote control event.
>> dvb-usb: bulk message failed: -22 (1/1807119384)
>> dvb-usb: error -22 while querying for an remote control event.
>> dvb-usb: bulk message failed: -22 (1/1807119384)
>> dvb-usb: error -22 while querying for an remote control event.
>> dvb-usb: bulk message failed: -22 (1/1807119384)
>> dvb-usb: error -22 while querying for an remote control event.
>> dvb-usb: bulk message failed: -22 (1/1807119384)
>> dvb-usb: error -22 while querying for an remote control event.
>> dvb-usb: bulk message failed: -22 (1/1807119384)
>> dvb-usb: error -22 while querying for an remote control event.
>> usb 1-1: USB disconnect, device number 2
>> ==
>> BUG: KASAN: use-after-free in __dvb_frontend_free+0x113/0x120
>> Write of size 8 at addr 880067d45a00 by task kworker/0:1/24
>>
>> CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc5-43687-g06ab8a23e0e6 
>> #545
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> Workqueue: usb_hub_wq hub_event
>> Call Trace:
>>  __dump_stack lib/dump_stack.c:16
>>  dump_stack+0x292/0x395 lib/dump_stack.c:52
>>  print_address_description+0x78/0x280 mm/kasan/report.c:252
>>  kasan_report_error mm/kasan/report.c:351
>>  kasan_report+0x23d/0x350 mm/kasan/report.c:409
>>  __asan_report_store8_noabort+0x1c/0x20 mm/kasan/report.c:435
>>  __dvb_frontend_free+0x113/0x120 drivers/media/dvb-core/dvb_frontend.c:156
>>  dvb_frontend_put+0x59/0x70 drivers/media/dvb-core/dvb_frontend.c:176
>>  dvb_frontend_detach+0x120/0x150 drivers/media/dvb-core/dvb_frontend.c:2803
>>  dvb_usb_adapter_frontend_exit+0xd6/0x160
>> drivers/media/usb/dvb-usb/dvb-usb-dvb.c:340
>>  dvb_usb_adapter_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:116
>>  dvb_usb_exit+0x9b/0x200 drivers/media/usb/dvb-usb/dvb-usb-init.c:132
>>  dvb_usb_device_exit+0xa5/0xf0 drivers/media/usb/dvb-usb/dvb-usb-init.c:295
>>  usb_unbind_interface+0x21c/0xa90 drivers/usb/core/driver.c:423
>>  __device_release_driver drivers/base/dd.c:861
>>  device_release_driver_internal+0x4f1/0x5c0 drivers/base/dd.c:893
>>  device_release_driver+0x1e/0x30 drivers/base/dd.c:918
>>  bus_remove_device+0x2f4/0x4b0 drivers/base/bus.c:565
>>  device_del+0x5c4/0xab0 drivers/base/core.c:1985
>>  usb_disable_device+0x1e9/0x680 drivers/usb/core/message.c:1170
>>  usb_disconnect+0x260/0x7a0 drivers/usb/core/hub.c:2124
>>  hub_port_connect drivers/usb/core/hub.c:4754
>>  hub_port_connect_change drivers/usb/core/hub.c:5009
>>  port_event drivers/usb/core/hub.c:5115
>>  hub_event+0x1318/0x3740 drivers/usb/core/hub.c:5195
>>  process_one_work+0xc73/0x1d90 kernel/workqueue.c:2119
>>  worker_thread+0x221/0x1850 kernel/workqueue.c:2253
>>  kthread+0x363/0x440 kernel/kthread.c:231
>>  ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
>>
> It looks like this is caused by commit
> ead666000a5fe34bdc82d61838e4df2d416ea15e ("media: dvb_frontend: only use
> kref after initialized").
>
> The writing to "fe->frontend_priv" in dvb_frontend.c:156 is a
> use-after-free in case the object dvb_frontend *fe is already freed by
> the release callback called in line 153.
> Only if the demod driver is based on new style i2c_client the memory is
> still accessible.
>
> There are two possible solutions:
> 1. Clear fe->frontend_priv earlier (before line 153).
> 2. Do not clear fe->frontend_priv
>
> Can you try if the following patch (solution 1) fixes the issue?

Hi Matthias,

Your patch fixes the issue.

Thanks!

Tested-by: Andrey Konovalov 

>
> Regards
> Matthias
>
> diff --git

[PATCH] staging: atomisp: i2c: Convert timers to use timer_setup()

2017-10-24 Thread Kees Cook 
In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Signed-off-by: Kees Cook 
---
 drivers/staging/media/atomisp/i2c/lm3554.c | 8 +++-
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/media/atomisp/i2c/lm3554.c 
b/drivers/staging/media/atomisp/i2c/lm3554.c
index 679176f7c542..a815f208409f 100644
--- a/drivers/staging/media/atomisp/i2c/lm3554.c
+++ b/drivers/staging/media/atomisp/i2c/lm3554.c
@@ -171,10 +171,9 @@ static int lm3554_set_config1(struct lm3554 *flash)
 /* 
-
  * Hardware trigger
  */
-static void lm3554_flash_off_delay(long unsigned int arg)
+static void lm3554_flash_off_delay(struct timer_list *t)
 {
-   struct v4l2_subdev *sd = i2c_get_clientdata((struct i2c_client *)arg);
-   struct lm3554 *flash = to_lm3554(sd);
+   struct lm3554 *flash = from_timer(flash, t, flash_off_delay);
struct lm3554_platform_data *pdata = flash->pdata;
 
gpio_set_value(pdata->gpio_strobe, 0);
@@ -915,8 +914,7 @@ static int lm3554_probe(struct i2c_client *client,
 
mutex_init(>power_lock);
 
-   setup_timer(>flash_off_delay, lm3554_flash_off_delay,
-   (unsigned long)client);
+   timer_setup(>flash_off_delay, lm3554_flash_off_delay, 0);
 
err = lm3554_gpio_init(client);
if (err) {
-- 
2.7.4


-- 
Kees Cook
Pixel Security

Android tv box supplier in China

2017-10-24 Thread Aidan 
Dear sir/Madam,

Nice to meet you.

This is Aidan from SENROO company,specialized in android tv box and other 
consumer electronics since 2006.

As a manufacturer,we can offer you high quality product at original factory 
price.

For V88 rk3229  1g/8g tv box,17~19 USD /unit

Tx3 mini/x96 mini s905w 2g/16g android 7.1 tv box,28~30 USD/unit.
 
X96 Amlogic s905x 1g/8g tv box,24~25.5 USD/unit,and 30~32 USD/unit for 
2g/16g version.

Latest H96 Amlogic s912 tv box,47~48 USD/unit for 2g/16g version,and 52~55 
USD/unit for 3g/16g version,and 58~60 USD/unit for 3g/32g version.

And we have mini i8 keyboard for android tv box,5~6 USD/unit.

If you want more details or price lists,pls feel free to contact me.

Best Regards
Aidan