Make sure to save IRQ states before taking the dma lock, as already done
in it's input_work() counterpart.

Picked up from the upstream dddvb-0.9.33 release.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab+samsung@kernel.org>

Improve IRQ handling in the separated MSG/I2C and IO/TSDATA handlers by
applying a mask for recognized bits immediately upon reading the IRQ mask
from the hardware, so only the bits/IRQs that actually were set will be
acked.

Picked up from the upstream dddvb-0.9.33 release.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab+samsung@kernel.org>

Currently, each IRQ requires one IRQ_HANDLE() line to call each IRQ
handler that was set up. Add a IRQ_HANDLE_NIBBLE() and IRQ_HANDLE_BYTE()
macro to call all handlers in blocks of four (_NIBBLE) or eight (_BYTE)
handlers at a time, to make this construct more compact.

Picked up from the upstream dddvb-0.9.33 release.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab+samsung@kernel.org>

Introduce the ddb_irq_set() helper function (along with a matching
prototype in ddbridge.h) to improve the set up of the IRQ handlers
and handler_data, and rework storing this data into the ddb_link
using a new ddb_irq struct. This also does the necessary rework
of affected variables. And while at it, always do queue_work in
input_handler() as there's not much of a difference to directly
calling input_work if there's no ptr at input->redi, or queueing
this call.

Picked up from the upstream dddvb-0.9.33 release.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab+samsung@kernel.org>

Move the ddbridge module initialisation and cleanup code to ddbridge-core
and set up the ddb_wq workqueue there, and create and destroy the ddb
device class there aswell. Due to this, the prototypes for ddb_wq,
ddb_class_create() and ddb_class_destroy() aren't required in ddbridge.h
anymore, so remove them. Also, declare ddb_wq and the ddb_class_*()
functions static.

Picked up from the upstream dddvb-0.9.33 release.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab+samsung@kernel.org>

Besides the 'msi' module option, all options are used from within
ddbridge-core only, so move them over from ddbridge-main, and declare the
associated variables static. Since the prototypes in ddbridge.h aren't
necessary anymore now, remove them. As a side effect, this has the benefit
of aligning things more with the dddvb upstream.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab+samsung@kernel.org>

The check for a valid ptr in ddb_io->dma isn't really necessary since only
devices that do data transport using DMA are supported by the driver, and
all previous initialisation code (through input_init(), output_init() and
dma_init(), has_dma is always true as it's set in ddb_probe() during
driver load) guarantees the ptr is set.

As a side effect, this silences these sparse warnings (albeit them being
false positives as ddb_io->dma won't change in these functions so the
condition always equals to the same result):

    drivers/media/pci/ddbridge/ddbridge-core.c:495:9: warning: context imbalance in 'ddb_output_start' - different lock contexts for basic block
    drivers/media/pci/ddbridge/ddbridge-core.c:510:9: warning: context imbalance in 'ddb_output_stop' - different lock contexts for basic block
    drivers/media/pci/ddbridge/ddbridge-core.c:525:9: warning: context imbalance in 'ddb_input_stop' - different lock contexts for basic block
    drivers/media/pci/ddbridge/ddbridge-core.c:560:9: warning: context imbalance in 'ddb_input_start' - different lock contexts for basic block
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Instead of keeping duplicated I2C client handling construct, make use of
the newly introduced dvb_module_*() helpers. This not only keeps things
way cleaner and removes the need for duplicated I2C client attach code,
but even allows to get rid of some variables that won't help in making
things look cleaner anymore.

The check on a valid ptr on port->en isn't really needed since the cxd2099
driver will set it at a time where it is going to return successfully
from probing.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This is the mindless scripted replacement of kernel use of POLL*
variables as described by Al, done by this script:

    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
        L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
        for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done
    done

with de-mangling cleanups yet to come.

NOTE! On almost all architectures, the EPOLL* constants have the same
values as the POLL* constants do.  But they keyword here is "almost".
For various bad reasons they aren't the same, and epoll() doesn't
actually work quite correctly in some cases due to this on Sparc et al.

The next patch from Al will sort out the final differences, and we
should be all done.
Scripted-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Move the CI teardown code to ddbridge-ci.c where everything else related
to CI hardware lives.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

As all error handling improved quite a bit, don't stop attaching frontends
if one of them failed, since - if other tuner modules are connected to
the PCIe bridge - other hardware may just work, so don't break on a single
port failure, but rather initialise as much as possible. Ie. if there are
issues with a C2T2-equipped PCIe bridge card which has additional DuoFlex
modules connected and the bridge generally works, the DuoFlex tuners can
still work fine.

If all ports failed to initialise where connected hardware was detected on
at first, return -ENODEV though to cause this PCI device to fail and free
all allocated resources. In any case, leave a kernel log warning (or
error, even) if things went wrong.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

In ddb_ports_attach(), if the second input of a dual tuner failed to
initialise, the first one can be detached (and resources be freed) as
this will be counted as the whole port having failed to initialise,
thus the first one won't be used anyway.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

In ddb_init(), the deinitialization sequence isn't correct when handling
errors, and could even lead to a memleak depending on where things failed.
Fix the deinit order.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

In dvb_input_attach(), whenever a demod driver fails to initialise, or if
frontend registration fails, perform a full input/frontend teardown using
dvb_input_detach() (which can safely be done since the current init state
is tracked in the 'attached' struct member). Claimed resources thus are
freed which aren't needed when an input or a port is not functional.

While at it, in ddb_ports_detach(), detach the secondary input first. Also
increase the kernlog severity of TDA18212 errors and tuner failures in
general.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Do kfree() on port->en->data instead of port->en. port->en only holds a
ptr to a struct dvb_ca_en50221, which is a member either of a memalloc'ed
struct ddb_ci (DuoFlex CI, Octopus CI Duo) or a struct cxd (CXD2099AR
based Single Flex, allocated by the cxd2099 driver). port->en.data
though holds the ptr to the allocated memory, which must rather be
kfree()'d. Change this accordingly.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Currently, rmmod ddbridge on a KASAN enabled kernel yields this report
for hardware that utilises the tda18212 tuner driver:

  [   50.355229] ==================================================================
  [   50.355271] BUG: KASAN: use-after-free in tda18212_remove+0x5c/0xb0 [tda18212]
  [   50.355290] Write of size 288 at addr ffff8800c235cf18 by task rmmod/285

  [   50.355316] CPU: 1 PID: 285 Comm: rmmod Not tainted 4.15.0-rc1-13744-g352a86ad536f #11
  [   50.355318] Hardware name: Gigabyte Technology Co., Ltd. P35-DS3/P35-DS3, BIOS F3 06/11/2007
  [   50.355319] Call Trace:
  [   50.355326]  dump_stack+0x46/0x61
  [   50.355332]  print_address_description+0x79/0x270
  [   50.355336]  ? tda18212_remove+0x5c/0xb0 [tda18212]
  [   50.355339]  kasan_report+0x229/0x340
  [   50.355342]  memset+0x1f/0x40
  [   50.355345]  tda18212_remove+0x5c/0xb0 [tda18212]
  [   50.355350]  i2c_device_remove+0x97/0xe0
  [   50.355355]  device_release_driver_internal+0x267/0x510
  [   50.355358]  bus_remove_device+0x296/0x470
  [   50.355360]  device_del+0x35c/0x890
  [   50.355363]  ? __device_links_no_driver+0x1c0/0x1c0
  [   50.355367]  ? cxd2841er_get_algo+0x10/0x10 [cxd2841er]
  [   50.355371]  ? cxd2841er_get_algo+0x10/0x10 [cxd2841er]
  [   50.355374]  ? __module_text_address+0xe/0x140
  [   50.355377]  device_unregister+0x9/0x20
  [   50.355382]  dvb_input_detach.isra.24+0x286/0x480 [ddbridge]
  [   50.355388]  ddb_ports_detach+0x15f/0x4f0 [ddbridge]
  [   50.355393]  ddb_remove+0x3c/0xb0 [ddbridge]
  [   50.355397]  pci_device_remove+0x93/0x1d0
  [   50.355400]  device_release_driver_internal+0x267/0x510
  [   50.355403]  driver_detach+0xb9/0x1b0
  [   50.355406]  bus_remove_driver+0xd0/0x1f0
  [   50.355410]  pci_unregister_driver+0x25/0x210
  [   50.355415]  module_exit_ddbridge+0xc/0x45 [ddbridge]
  [   50.355418]  SyS_delete_module+0x314/0x440
  [   50.355420]  ? free_module+0x5b0/0x5b0
  [   50.355423]  ? exit_to_usermode_loop+0xa9/0xc0
  [   50.355425]  ? free_module+0x5b0/0x5b0
  [   50.355428]  do_syscall_64+0x179/0x4c0
  [   50.355432]  ? do_page_fault+0x1b/0x60
  [   50.355435]  entry_SYSCALL64_slow_path+0x25/0x25
  [   50.355438] RIP: 0033:0x7fe65d08ade7
  [   50.355439] RSP: 002b:00007fff5a6a09a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000b0
  [   50.355443] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe65d08ade7
  [   50.355445] RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000000000f4e268
  [   50.355447] RBP: 0000000000f4e200 R08: 0000000000000000 R09: 1999999999999999
  [   50.355449] R10: 0000000000000891 R11: 0000000000000202 R12: 00007fff5a6a14ef
  [   50.355451] R13: 0000000000000000 R14: 0000000000f4e200 R15: 0000000000f4d010

  [   50.355462] Allocated by task 164:
  [   50.355477]  cxd2841er_attach+0xc3/0x7f0 [cxd2841er]
  [   50.355482]  demod_attach_cxd28xx+0x14c/0x3f0 [ddbridge]
  [   50.355486]  dvb_input_attach+0x671/0x1e20 [ddbridge]
  [   50.355490]  ddb_ports_attach+0x3d7/0xbf0 [ddbridge]
  [   50.355495]  ddb_init+0x4b3/0xa30 [ddbridge]
  [   50.355499]  ddb_probe+0xa51/0xfe0 [ddbridge]
  [   50.355501]  pci_device_probe+0x279/0x480
  [   50.355504]  driver_probe_device+0x46f/0x7a0
  [   50.355506]  __driver_attach+0x133/0x170
  [   50.355509]  bus_for_each_dev+0x10a/0x190
  [   50.355511]  bus_add_driver+0x2a3/0x5a0
  [   50.355513]  driver_register+0x182/0x3a0
  [   50.355516]  arc4_set_key+0x8f/0x2a0 [arc4]
  [   50.355518]  do_one_initcall+0x77/0x1d0
  [   50.355521]  do_init_module+0x1c2/0x548
  [   50.355523]  load_module+0x5e61/0x8df0
  [   50.355525]  SyS_finit_module+0x142/0x150
  [   50.355527]  do_syscall_64+0x179/0x4c0
  [   50.355529]  return_from_SYSCALL_64+0x0/0x65

  [   50.355539] Freed by task 285:
  [   50.355551]  kfree+0x6c/0xa0
  [   50.355558]  __dvb_frontend_free+0x81/0xb0 [dvb_core]
  [   50.355562]  dvb_input_detach.isra.24+0x17c/0x480 [ddbridge]
  [   50.355566]  ddb_ports_detach+0x15f/0x4f0 [ddbridge]
  [   50.355570]  ddb_remove+0x3c/0xb0 [ddbridge]
  [   50.355573]  pci_device_remove+0x93/0x1d0
  [   50.355576]  device_release_driver_internal+0x267/0x510
  [   50.355578]  driver_detach+0xb9/0x1b0
  [   50.355580]  bus_remove_driver+0xd0/0x1f0
  [   50.355583]  pci_unregister_driver+0x25/0x210
  [   50.355587]  module_exit_ddbridge+0xc/0x45 [ddbridge]
  [   50.355590]  SyS_delete_module+0x314/0x440
  [   50.355592]  do_syscall_64+0x179/0x4c0
  [   50.355594]  return_from_SYSCALL_64+0x0/0x65

  [   50.355604] The buggy address belongs to the object at ffff8800c235cd80
                  which belongs to the cache kmalloc-2048 of size 2048
  [   50.355630] The buggy address is located 408 bytes inside of
                  2048-byte region [ffff8800c235cd80, ffff8800c235d580)
  [   50.355652] The buggy address belongs to the page:
  [   50.355666] page:ffffea0002a7bc20 count:1 mapcount:0 mapping:ffff8800c235c500 index:0x0 compound_mapcount: 0
  [   50.355688] flags: 0x4000000000008100(slab|head)
  [   50.355703] raw: 4000000000008100 ffff8800c235c500 0000000000000000 0000000100000003
  [   50.355720] raw: ffffea000382b4b0 ffffea0002b91550 ffff88010b000800
  [   50.355734] page dumped because: kasan: bad access detected

  [   50.355754] Memory state around the buggy address:
  [   50.355767]  ffff8800c235ce00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  [   50.355783]  ffff8800c235ce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  [   50.355800] >ffff8800c235cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  [   50.355815]                             ^
  [   50.355827]  ffff8800c235cf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  [   50.355843]  ffff8800c235d000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  [   50.355858] ==================================================================

This is due to dvb_frontend_detach() being called before
i2c_unregister_device() on the TDA18212 tuner client instance, as
dvb_frontend_detach() causes the demod drivers to release all their
resources, and the tuner driver's _remove method does further cleanup on
the now invalid (freed) resources. Fix this by putting the I2C client
deregistration in dvb_input_detach() to state/case 0x30, right before the
call to dvb_frontend_detach(). This also makes sure that any further
(tuner) hardware driven by I2C client drivers unload cleanly.

Fixes: 1502efd2 ("media: ddbridge: fix teardown/deregistration order in ddb_input_detach()")
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

While the failure handling in dvb_input_attach() has been improved lately
so any tuner failure won't result in demod driver modules with a
usecount > 0 anymore (thus requiring rmmod -f), there's still an issue
with stv090x and stv0910 based tuner modules, in that LNB driver attach
failures leave an attached demod frontend driver behind which have a
usecount of > 0 in this failure case, due to them not being detached/
released. Fix this by detaching the demod frontends if the LNB driver
fails.

Richard tested and verified the changes with STV0910 hardware, thus adding
his Tested-by.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Tested-by: NRichard Scobie <rascobie@slingshot.co.nz>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This change makes sure that demod frontends are always detached whenever
a tuner frontend attach failed. Achieve this by moving the detach-on-
failure logic at the end of dvb_input_attach(), and adding a goto to this
block on every tuner attach failure case, so if an error occurs, there are
no stray attached frontends left. As a side effect, this removes some
duplicated code.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Add a ddb_ prefix to the two functions to better avoid conflicts in the
global namespace, ie. when building everything into the kernel image.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Rename the MaxS4/8 support files following upstream. References to these
files and descriptions have been updated aswell.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Move all CI device support related code from ddbridge-core to ddbridge-ci,
following the previously split off MaxS4/8 support.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fixes several alignment, braces, space-before-cast, camelcase et al issues
reported by checkpatch --strict, plus a few more checkpatch didn't report.

Three checks are left after this though:
- one CamelCase in ddbridge-core, related to defines/vars/enums referenced
  from the stv090x demod driver
- one macro argument reuse in ddbridge-core aswell
- one unbalanced braces around else in ddbridge-main, which is due to
  #ifdefs related to CONFIG_PCI_MSI, which preferrably should be kept
  as-is for readability.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These are only used in C/T demod attach functions, don't add any real
benefit (ie. line length savings) and in case of cxd28xx_attach aren't
even used consequently. Remove them.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Fix several

  drivers/media/pci/ddbridge/ddbridge-core.c: warning: symbol ... was not declared. Should it be static?
  drivers/media/pci/ddbridge/ddbridge-core.c: warning: Using plain integer as NULL pointer
  drivers/media/pci/ddbridge/ddbridge-io.h: warning: cast removes address space of expression
  drivers/media/pci/ddbridge/ddbridge-io.h: warning: incorrect type in argument 1 (different address spaces)

at multiple places.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Brought to attention by Matthias Schwarzott <zzam@gentoo.org> by fixing
possible use-after-free faults in some demod drivers:

In ddb_input_detach(), the i2c_client is unregistered and removed before
dvb frontends are unregistered and detached. While no use-after-free issue
was observed so far, there is another issue with this:

dvb->attached keeps track of the state of the input/output registration,
and the i2c_client unregistration takes place only if everything was
successful (dvb->attached == 0x31). If for some reason an error occurred
during the frontend setup, that value stays at 0x20. In the following
error handling and cleanup, ddb_input_detach() will skip down to that
state, leaving the i2c_client registered, causing refcount issues.

Fix this by moving the i2c_client deregistration down to case 0x20.

Cc: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

drivers/media/pci/ddbridge/ddbridge-core.c: In function 'ddb_port_attach':
drivers/media/pci/ddbridge/ddbridge-core.c:2261:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
   if (ret < 0)
      ^
drivers/media/pci/ddbridge/ddbridge-core.c:2263:2: note: here
  case DDB_PORT_LOOP:
  ^~~~
drivers/media/pci/ddbridge/ddbridge-core.c: In function 'dvb_input_attach':
drivers/media/pci/ddbridge/ddbridge-core.c:1492:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
   if (input->port->dev->link[input->port->lnr].info->ts_quirks &
      ^
drivers/media/pci/ddbridge/ddbridge-core.c:1497:2: note: here
  case DDB_TUNER_DVBCT2_SONY_P:
  ^~~~
drivers/media/pci/ddbridge/ddbridge-core.c:1516:9: warning: this statement may fall through [-Wimplicit-fallthrough=]
   osc24 = 1;
   ~~~~~~^~~
drivers/media/pci/ddbridge/ddbridge-core.c:1517:2: note: here
  case DDB_TUNER_DVBCT2_SONY:
  ^~~~
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

These structures are only copied into other structures, so
they can be const.

Done with the help of Coccinelle.
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

All data is accessed RO, so mark everything const. Some vars in several
functions aswell as function signatures also require the const keyword
now, they're also added by this commit.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

adapter_alloc is only used from within ddbridge-core, so move it there,
this removes the need for prototyping/referencing the variable. While at
it, msi isn't needed outside of ddbridge-main, so don't extref that one
aswell.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This further cleans up ddbridge-main from hardware-related data and moves
the exact card type determination into ddbridge-hw.c:get_ddb_info(), right
to the hardware maps/structs. Also, const'ify more structs and pointers.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Force gap setting if given by attribute and enable gap for older regmaps.
Also, setting a gap value of 128 via sysfs will now disable gap.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

This enables MaxS4/S8 and Octopus Max card support in ddbridge by adding
glue code into ddbridge-core, having another PCI ID, and have the LNB IC
control code (and all other MaxS4/8 related code) in ddbridge-maxs8.c
(rather than another ~400 LoC in ddbridge-core.c like it's done in the
original vendor driver package).
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Both ts_release() and ts_open() can use "output" before check (smatch):

  drivers/media/pci/ddbridge/ddbridge-core.c:816 ts_release() warn: variable dereferenced before check 'output' (see line 809)
  drivers/media/pci/ddbridge/ddbridge-core.c:836 ts_open() warn: variable dereferenced before check 'output' (see line 828)

Fix by performing checks on those pointers.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Tested-by: NRichard Scobie <r.scobie@clear.net.nz>
Tested-by: NJasmin Jessich <jasmin@anw.at>
Tested-by: NDietmar Spingler <d_spingler@freenet.de>
Tested-by: NManfred Knick <Manfred.Knick@t-online.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Smatch and gcc complained:

  drivers/media/pci/ddbridge/ddbridge-core.c:3491 bpsnr_show() warn: impossible condition '(snr[0] == 255) => ((-128)-127 == 255)'

  drivers/media/pci/ddbridge/ddbridge-core.c: In function ‘bpsnr_show’:
  drivers/media/pci/ddbridge/ddbridge-core.c:3491:13: warning: comparison is always false due to limited range of data type [-Wtype-limits]

Fix this by changing the type of snr to unsigned char.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Tested-by: NRichard Scobie <r.scobie@clear.net.nz>
Tested-by: NJasmin Jessich <jasmin@anw.at>
Tested-by: NDietmar Spingler <d_spingler@freenet.de>
Tested-by: NManfred Knick <Manfred.Knick@t-online.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

>From smatch:

  drivers/media/pci/ddbridge/ddbridge-core.c:3490 snr_store() info: ignoring unreachable code.

In fact, the function immediately returns zero, so remove it and update
ddb_attrs_snr[] to not reference it anymore.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Tested-by: NRichard Scobie <r.scobie@clear.net.nz>
Tested-by: NJasmin Jessich <jasmin@anw.at>
Tested-by: NDietmar Spingler <d_spingler@freenet.de>
Tested-by: NManfred Knick <Manfred.Knick@t-online.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Report from smatch:

  drivers/media/pci/ddbridge/ddbridge-core.c:2659 ddb_ports_init() error: buffer overflow 'dev->port' 32 <= u32max

Fix by making sure "p" is greater than zero before checking for
"dev->port[].type == DDB_CI_EXTERNAL_XO2".

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Tested-by: NRichard Scobie <r.scobie@clear.net.nz>
Tested-by: NJasmin Jessich <jasmin@anw.at>
Tested-by: NDietmar Spingler <d_spingler@freenet.de>
Tested-by: NManfred Knick <Manfred.Knick@t-online.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Smatch reported:

  drivers/media/pci/ddbridge/ddbridge-core.c:1602 dvb_input_attach() error: we previously assumed 'dvb->fe' could be null (see line 1595)

dvb->fe2 will ever only be populated when dvb->fe is set. So only handle
registration of dvb->fe2 when dvb->fe got set beforehand by moving the
registration into the "if (dvb->fe)" conditional.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Tested-by: NRichard Scobie <r.scobie@clear.net.nz>
Tested-by: NJasmin Jessich <jasmin@anw.at>
Tested-by: NDietmar Spingler <d_spingler@freenet.de>
Tested-by: NManfred Knick <Manfred.Knick@t-online.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Fixes two warnings reported by smatch:

  drivers/media/pci/ddbridge/ddbridge-core.c:240 ddb_redirect() warn: variable dereferenced before check 'idev' (see line 238)
  drivers/media/pci/ddbridge/ddbridge-core.c:240 ddb_redirect() warn: variable dereferenced before check 'pdev' (see line 238)

Fixed by moving the existing checks up before accessing members.

Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Tested-by: NRichard Scobie <r.scobie@clear.net.nz>
Tested-by: NJasmin Jessich <jasmin@anw.at>
Tested-by: NDietmar Spingler <d_spingler@freenet.de>
Tested-by: NManfred Knick <Manfred.Knick@t-online.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>

Further cleanup of ddbridge-core and ddbridge-main, and moves all such
hw definitions into one single place, making things easier to maintain.
Signed-off-by: NDaniel Scheller <d.scheller@gmx.net>
Tested-by: NRichard Scobie <r.scobie@clear.net.nz>
Tested-by: NJasmin Jessich <jasmin@anw.at>
Tested-by: NDietmar Spingler <d_spingler@freenet.de>
Tested-by: NManfred Knick <Manfred.Knick@t-online.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>