imon_probe() does three usb_get_dev(), but there is no any
usb_put_dev() in the driver.

The patch adds usb_put_dev() to error paths, to imon_disconnect()
and to imon_probe() as far as usbdev is not saved anywhere.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Fix clamp_align() used in v4l_bound_align_image() to prevent overflow
when passed large value like UINT32_MAX.

 In the current implementation:
    clamp_align(UINT32_MAX, 8, 8192, 3)

returns 8, because in line:

    x = (x + (1 << (align - 1))) & mask;

x overflows to (-1 + 4) & 0x7 = 3, while expected value is 8192.

v4l_bound_align_image() is heavily used in VIDIOC_S_FMT and
VIDIOC_SUBDEV_S_FMT ioctls handlers, and documentation of the latter
explicitly states that:

"The modified format should be as close as possible to the original
request."
  -- http://linuxtv.org/downloads/v4l-dvb-apis/vidioc-subdev-g-fmt.html

Thus one would expect, that passing UINT32_MAX as format width and
height will result in setting maximum possible resolution for the
device. Particularly, when the driver doesn't support
VIDIOC_ENUM_FRAMESIZES ioctl, which is common in the codebase.

Fixes changeset: b0d3159bSigned-off-by: NMaciej Matraszek <m.matraszek@samsung.com>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Setting the value of the chip config register to EM28XX_CHIPCFG_AC97 in
case of a read error is a leftover from the past which is no longer
needed.
Signed-off-by: NFrank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Field has_audio in struct em28xx_audio_mode is used together with value
EM28XX_NO_AC97 of field ac97 to determine the internal type of audio
(none/i2s/ac97). This makes the code difficult to understand:

  !audio_mode.has_audio && audio_mode.ac97 == EM28XX_NO_AC97 => no audio
  !audio_mode.has_audio && audio_mode.ac97 != EM28XX_NO_AC97 => BUG
  audio_mode.has_audio  && audio_mode.ac97 == EM28XX_NO_AC97 => AC97 audio
  audio_mode.has_audio  && audio_mode.ac97 != EM28XX_NO_AC97 => I2S audio

Simplify the whole thing by introducing an enum em28xx_int_audio_type
which describes the internal audio type (none, ac97, i2s) and is hooked
directly to the device struct. Then get rid of field has_audio in struct
em28xx_audio_mode.

A follow-up patch will then remove struct em28xx_ac97_mode and finally
the whole struct em28xx_audio_mode.
Signed-off-by: NFrank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

As far as we know devices can either have audio class or vendor class
usb interfaces but not both at the same time. Even if both interface
types could be provided by devices at the same time, the current code is
totally broken for that case.

So clean up and simplify the usb audio class handling by replacing
fields "has_audio_class" (device has usb audio class compliant
interface) and "has_alsa_audio" (device has vendor audio interface) in
struct em28xx with a single enum em28xx_usb_audio_type.
Signed-off-by: NFrank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Fields "ac97_feat", "ac97_vendor_id" and "i2s_samplerates" of struct
em28xx_audio_mode are used nowhere, except in function
em28xx_audio_setup(). So get rid of them and use local variables
instead.
Signed-off-by: NFrank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

The buffer flags are incorrectly referred to as V4L2_BUF_FLAGS_* instead
of V4L2_BUF_FLAG_* in comments. Fix it.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Acked-by: NSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

This patch adds support for Si2147-A30 tuner. Fairly trivial, no firmware needed for this tuner. However, command 14 00 02 07 01 00 seems to be mandatory. On Si2157 and Si2158 the value 0x0100 is the default value, so this patch does not impact the existing tuners/devices. On Si2147 the default is 0x0000 and I can't get a lock with that value.

While here, fix the return length of the previous set command to 4 bytes.
Signed-off-by: NOlli Salonen <olli.salonen@iki.fi>
Acked-by: NAntti Palosaari <crope@iki.fi>
Reviewed-by: NAntti Palosaari <crope@iki.fi>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

"program_info_length" is user controlled and can go up to 4095.  The
operand[] array has 509 bytes so we need to add a limit here to prevent
buffer overflows.

The " - 4" in the limit check is because we have 4 bytes more data to
add after the memcpy().

[mchehab@osg.samsung.com: as I merged the version 1 of the patch, I needed
 to rebase to apply just the differences between v1 and v2]
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

"len" is user controlled and can be up to 255.  Anything more than 59
will cause a buffer overflow so we need to add a test for that.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

mceusb_init_rc_dev() does usb_get_dev(), but there is no any
usb_put_dev() in the driver.

The patch tries to straighten logic. It moves usb_get_dev()
directly to mceusb_dev_probe() and adds usb_put_dev() to an error path
and to mceusb_dev_disconnect().

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

"program_info_length" is user controlled and can go up to 4095.  The
operand[] array has 509 bytes so we need to add a limit here to prevent
buffer overflows.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

We need to add a limit check here so we don't overflow the buffer.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

There is no need to use hex_dump_to_buffer() since we have a kernel helper to
dump up to 64 bytes just via printk().
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

We call kfree(data_buf) in the error handling and that will oops if this
is an error pointer.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

GIT_AUTHOR_DATE=1409603039
This reverts

commit b99f0aad
Author: Mauro Carvalho Chehab <m.chehab@samsung.com>

    [media] em28xx: check if a device has audio earlier

    Better to split chipset detection from the audio setup. So, move the
    detection code to em28xx_init_dev().

It broke analog audio of the Hauppauge winTV HVR 900 and very likely many other
em28xx devices.

Background:
The local variable has_audio in em28xx_usb_probe() describes if the currently
probed _usb_interface_ has an audio endpoint, while dev->audio_mode.has_audio
means that the _device_ as a whole provides analog audio.
Hence it is wrong to set dev->audio_mode.has_audio = has_audio in em28xx_usb_probe().
As result, audio support is no longer detected and configured on devices which
have the audio endpoint on a separate interface, because em28xx_audio_setup()
bails out immediately at the beginning.

Revert the faulty commit to restore the old audio detection procedure, which checks
the chip configuration register to determine if the device has analog audio.

Cc: <stable@vger.kernel.org>	# 3.14 to 3.16
Reported-by: NOravecz Csaba <oravecz@nytud.mta.hu>
Tested-by: NOravecz Csaba <oravecz@nytud.mta.hu>
Signed-off-by: NFrank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Add support for the si2161-based cx231xx devices:
	[2040:b138] Hauppauge WinTV HVR-900-H (model 111xxx)
	[2040:b139] Hauppauge WinTV HVR-901-H (model 1114xx)

They're similar to the already supported:
	[2040:b130] Hauppauge WinTV 930C-HD (model 1113xx)
Signed-off-by: NMatthias Schwarzott <zzam@gentoo.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Add support for:
	[2040:b139] Hauppauge WinTV HVR-901H (1114xx)

According to the inf file, the hardware is similar to [2040:b131] Hauppauge WinTV 930C-HD (model 1114xx)
The only difference is the demod Si2161 instead of Si2165 (but both are
supported by the si2165 driver).
Signed-off-by: NMatthias Schwarzott <zzam@gentoo.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Add support for:
	[2040:b138] Hauppauge WinTV HVR-900H (111xxx)

The hardware is similar to [2040:b130] Hauppauge WinTV 930C-HD (model 1113xx)
The only difference is the demod Si2161 instead of Si2165 (but both are
supported by the si2165 driver).
Signed-off-by: NMatthias Schwarzott <zzam@gentoo.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Additionally print chip name with revision symbolically.
This is a preparation for supporting new Hauppauge WinTV-HVR-900-H based
on cx231xx.
Signed-off-by: NMatthias Schwarzott <zzam@gentoo.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Current firmware is only for revision D.
Signed-off-by: NMatthias Schwarzott <zzam@gentoo.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Casting the return value which is a void pointer is redundant.
The conversion from void pointer to any other pointer type is
guaranteed by the C programming language.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

make vpfe_standards[] static.
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Add a maintainer for the new CIMaX SP2 driver.
Signed-off-by: NOlli Salonen <olli.salonen@iki.fi>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@decl@
identifier i1,fld;
type T;
field list[n] fs;
@@

struct i1 {
 fs
 T fld;
 ...};

@bad@
identifier decl.i1,i2;
expression e;
initializer list[decl.n] is;
@@

struct i1 i2 = { is,
+ .fld = e
- e
 ,...};
// </smpl>

Not sure why, but some tables are still using the old way,
but at least several of them got fixed.
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Use c99 initializers for structures.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@decl@
identifier i1,fld;
type T;
field list[n] fs;
@@

struct i1 {
 fs
 T fld;
 ...};

@bad@
identifier decl.i1,i2;
expression e;
initializer list[decl.n] is;
@@

struct i1 i2 = { is,
+ .fld = e
- e
 ,...};
// </smpl>
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

This is used by the I2C code in order to slow down the
speed to 20 kHz on devices with xc5000 or xc5000c.

So, it needs to be filled for all devices that use either
xc5000 or xc5000c.
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Right now, the au0828 driver uses .tuner to detect if analog
tv is being used or not. By not filling .tuner fields at the
board struct, the I2C core can't do decisions based on it.

So, add a field to explicitly tell when analog TV is supported.

No functional changes.
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

This comment is already at the au0828-i2c where it belongs.
So, remove it from a board's entry. It doesn't make any sense
there, as we're setting the clock to 250kHz there, slowing it
down only at the au0828-i2c.
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

cab_state->modulation is initialized with a wrong value:

drivers/media/dvb-frontends/stv0367.c:3000:42: warning: mixing different enum types
drivers/media/dvb-frontends/stv0367.c:3000:42:     int enum fe_modulation  versus
drivers/media/dvb-frontends/stv0367.c:3000:42:     int enum stv0367cab_mod

as it was declared as "enum stv0367cab_mod". While it could be fixed,
there's no value on it, as this is never used.

So, just remove the modulation from cab_state structure.
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

It was using the wrong constant for QAM256 on get_frontend.
Signed-off-by: NMaks Naumov <maksqwe1@ukr.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Instead of using a temporary stack allocated i2c_client in em28xx_i2c_ir_handle_key(),
allocate/free the i2c_client at module init/uninit and hook it into struct em28xx_IR
(if the device has an i2c IR decoder).
This reduces the frame size of function em28xx_i2c_ir_handle_key() and speeds
it up a bit.
Also make sure that all fields of struct i2c_client are initialized properly.
Signed-off-by: NFrank Schäfer <fschaefer.oss@googlemail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

This patch introduces the use of !usb_endpoint_dir_in(epd) and
!usb_endpoint_xfer_int(epd).

The Coccinelle semantic patch that makes these changes is as follows:

- ((epd->bEndpointAddress & \(USB_ENDPOINT_DIR_MASK\|0x80\)) !=
-  \(USB_DIR_IN\|0x80\))
+ !usb_endpoint_dir_in(epd)

@@ struct usb_endpoint_descriptor *epd; @@

- ((epd->bmAttributes & \(USB_ENDPOINT_XFERTYPE_MASK\|3\)) !=
- \(USB_ENDPOINT_XFER_INT\|3\))
+ !usb_endpoint_xfer_int(epd)
Signed-off-by: NHimangi Saraogi <himangi774@gmail.com>
Acked-by: NJulia Lawall <julia.lawall@lip6.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

This patch introduces the use of the function usb_endpoint_type.

The Coccinelle semantic patch that makes these changes is as follows:

@@ struct usb_endpoint_descriptor *epd; @@

- (epd->bmAttributes & \(USB_ENDPOINT_XFERTYPE_MASK\|3\))
+ usb_endpoint_type(epd)
Signed-off-by: NHimangi Saraogi <himangi774@gmail.com>
Acked-by: NJulia Lawall <julia.lawall@lip6.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Just returns whatever error that was returned by the i2c core,
in the case of errors, only returning -EREMOTEIO if the transfer size
is not what it was expected.
Signed-off-by: NHans Wennborg <hans@hanshq.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

The returned code is 0, 1 or an error. It doesn't make sense to
print it in hexadecimal.
Signed-off-by: NHans Wennborg <hans@hanshq.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81621Reported-by: NDavid Binderman <dcb314@hotmail.com>
Signed-off-by: NAndrey Utkin <andrey.krieger.utkin@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

There are two modprobe parameters for VBI that aren't used
anywhere (one for debug, the other one related to the buffer
size). Get rid of them!
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Signed-off-by: NMorgan Phillips <winter2718@gmail.com>
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>

Signed-off-by: NMorgan Phillips <winter2718@gmail.com>
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>