aboutsummaryrefslogtreecommitdiff
path: root/drivers/media/video
AgeCommit message (Collapse)Author
2010-12-09V4L/DVB: ivtvfb: prevent reading uninitialized stack memoryDan Rosenberg
commit 405707985594169cfd0b1d97d29fcb4b4c6f2ac9 upstream. The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 bytes of uninitialized stack memory, because the "reserved" member of the fb_vblank struct declared on the stack is not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Signed-off-by: Andy Walls <awalls@md.metrocast.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-12-09V4L/DVB (13154): uvcvideo: Handle garbage at the end of streaming interface ↵Laurent Pinchart
descriptors commit c4ed8c66d79d707d89fe732ff5b97739edf1ba62 upstream. At least one 5986:0241 webcam model includes vendor-specific descriptors at the end of its streaming interface descriptors. Print an information UVC_TRACE_DESCR message and try to continue parsing the descriptors rather than bailing out with an error. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Cc: maximilian attems <max@stro.at> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-10-28V4L/DVB (13966): DVB-T regression fix for saa7134 cardsDmitri Belimov
commit 08be64be3d1e5ecd72e7ba3147aea518e527f08e upstream. Some customers has problem with quality of DVB-T https://bugs.launchpad.net/ubuntu/+source/linux/+bug/446575 After this patch http://patchwork.kernel.org/patch/23345/ This is patch for fix regression with DVB-T. Tested with many people. Signed-off-by: Alexey Osipov <lion-simba@pridelands.ru> Signed-off-by: Beholder Intl. Ltd. Dmitry Belimov <d.belimov@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-10-28V4L/DVB: cx231xx: Avoid an OOPS when card is unknown (card=0)Mauro Carvalho Chehab
commit c10469c637602c2385e2993d8c730cc44fd47d23 upstream. As reported by: Carlos Americo Domiciano <c_domiciano@yahoo.com.br>: [ 220.033500] cx231xx v4l2 driver loaded. [ 220.033571] cx231xx #0: New device Conexant Corporation Polaris AV Capturb @ 480 Mbps (1554:5010) with 6 interfaces [ 220.033577] cx231xx #0: registering interface 0 [ 220.033591] cx231xx #0: registering interface 1 [ 220.033654] cx231xx #0: registering interface 6 [ 220.033910] cx231xx #0: Identified as Unknown CX231xx video grabber (card=0) [ 220.033946] BUG: unable to handle kernel NULL pointer dereference at (null) [ 220.033955] IP: [<ffffffffa0d3c8bd>] cx231xx_pre_card_setup+0x5d/0xb0 [cx231xx] Thanks-to: Carlos Americo Domiciano <c_domiciano@yahoo.com.br> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-10-28v4l1: fix 32-bit compat microcode loading translationLinus Torvalds
commit 3e645d6b485446c54c6745c5e2cf5c528fe4deec upstream. The compat code for the VIDIOCSMICROCODE ioctl is totally buggered. It's only used by the VIDEO_STRADIS driver, and that one is scheduled to staging and eventually removed unless somebody steps up to maintain it (at which point it should use request_firmware() rather than some magic ioctl). So we'll get rid of it eventually. But in the meantime, the compatibility ioctl code is broken, and this tries to get it to at least limp along (even if Mauro suggested just deleting it entirely, which may be the right thing to do - I don't think the compatibility translation code has ever worked unless you were very lucky). Reported-by: Kees Cook <kees.cook@canonical.com> Cc: Mauro Carvalho Chehab <mchehab@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-08-02V4L/DVB (13830): uvcvideo: add another YUYV format GUID for iSight camerasDaniel Ritz
commit 68f194e027ecfbbc8d5515bc40787e542eed59e9 upstream. For some unknown reason, on a MacBookPro5,3 the iSight sometimes report a different video format GUID. This patch add the other (wrong) GUID to the format table, making the iSight work always w/o other problems. What it should report: 32595559-0000-0010-8000-00aa00389b71 What it often reports: 32595559-0000-0010-8000-000000389b71 Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Cc: Leann Ogasawara <leann.ogasawara@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-08-02V4L/DVB: uvcvideo: Add support for V4L2_PIX_FMT_Y16Laurent Pinchart
commit 61421206833a4085d9bdf35b2b84cd9a67dfdfac upstream. The Miricle 307K (17dc:0202) camera reports a 16-bit greyscale format, support it in the driver. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-08-02V4L/DVB: uvcvideo: Add support for Packard Bell EasyNote MX52 integrated webcamLaurent Pinchart
commit f129b03ba272c86c42ad476684caa0d6109cb383 upstream. The camera requires the STREAM_NO_FID quirk. Add a corresponding entry in the device IDs list. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-08-02V4L/DVB: uvcvideo: Add support for unbranded Arkmicro 18ec:3290 webcamsLaurent Pinchart
commit 1e4d05bc95a0fe2972c5c91ed45466587d07cd2c upstream. The camera requires the PROBE_DEF quirk. Add a corresponding entry in the device IDs list. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-08-02V4L/DVB: FusionHDTV: Use quick reads for I2C IR device probingJean Delvare
commit 806b07c29b711aaf90c81d2a19711607769f8246 upstream. IR support on FusionHDTV cards is broken since kernel 2.6.31. One side effect of the switch to the standard binding model for IR I2C devices was to let i2c-core do the probing instead of the ir-kbd-i2c driver. There is a slight difference between the two probe methods: i2c-core uses 0-byte writes, while the ir-kbd-i2c was using 0-byte reads. As some IR I2C devices only support reads, the new probe method fails to detect them. For now, revert to letting the driver do the probe, using 0-byte reads. In the future, i2c-core will be extended to let callers of i2c_new_probed_device() provide a custom probing function. Signed-off-by: Jean Delvare <khali@linux-fr.org> Tested-by: "Timothy D. Lenz" <tlenz@vorgon.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05V4L/DVB: gspca - stv06xx: Remove the 046d:08da from the stv06xx driverErik Andrén
commit 55e0b489a39bb635a44f769d620e44c70d9c065b upstream. The 046d:08da usb id shouldn't be associated with the stv06xx driver as they're not compatible with each other. This fixes a bug where Quickcam Messenger cams fail to use its proper driver (gspca-zc3xx), rendering the camera inoperable. Signed-off-by: Erik Andrén <erik.andren@gmail.com> Tested-by: Gabriel Craciunescu <nix.or.die@googlemail.com> Signed-off-by: Jean-François Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-04-01V4L/DVB (13961): em28xx-dvb: fix memleak in dvb_fini()Francesco Lavra
commit 19f48cb105b7fa18d0dcab435919a3a29b7a7c4c upstream. this patch fixes a memory leak which occurs when an em28xx card with DVB extension is unplugged or its DVB extension driver is unloaded. In dvb_fini(), dev->dvb must be freed before being set to NULL, as is done in dvb_init() in case of error. Note that this bug is also present in the latest stable kernel release. Signed-off-by: Francesco Lavra <francescolavra@interfree.it> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-03-15V4L/DVB (13148): uvcvideo: Handle V4L2_CTRL_TYPE_BUTTON control type in ↵Laurent Pinchart
VIDIOC_QUERYCTRL commit f4eabafeb3ea41801260fba624cbf2da971d19f8 upstream. Return minimum, maximum and step set to 0 without querying the hardware. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Cc: maximilian attems <max@stro.at> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-03-15V4L/DVB (13991): gspca_mr973010a: Fix cif type 1 cameras not streaming on ↵Theodore Kilgore
UHCI controllers commit 70136081fc67ea77d849f86fa323e5773c8e40ea upstream. If you read the mail to Oliver Neukum on the linux-usb list, then you know that I found a cure for the mysterious problem that the MR97310a CIF "type 1" cameras have been freezing up and refusing to stream if hooked up to a machine with a UHCI controller. Namely, the cure is that if the camera is an mr97310a CIF type 1 camera, you have to send it 0xa0, 0x00. Somehow, this is a timing reset command, or such. It un-blocks whatever was previously stopping the CIF type 1 cameras from working on the UHCI-based machines. Signed-off-by: Theodore Kilgore <kilgota@auburn.edu> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-03-15V4L/DVB: bttv: Move I2C IR initializationJean Delvare
commit 2434466432464110b5307757e0285dd41f15512e upstream. Move I2C IR initialization from just after I2C bus setup to right before non-I2C IR initialization. This avoids the case where an I2C IR device is blocking audio support (at least the PV951 suffers from this). It is also more logical to group IR support together, regardless of the connectivity. This fixes bug #15184: http://bugzilla.kernel.org/show_bug.cgi?id=15184 Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-03-15V4L/DVB: Video : pwc : Fix regression in pwc_set_shutter_speed caused by bad ↵Martin Fuzzey
constant => sizeof conversion. commit 53f68607caba85db9a73846ccd289e4b7fa96295 upstream. Regression was caused by my commit 6b35ca0d3d586b8ecb8396821af21186e20afaf0 which determined message size using sizeof rather than hardcoded constants. Unfortunately pwc_set_shutter_speed reuses a 2 byte buffer for a one byte message too so the sizeof was bogus in this case. All other uses of sizeof checked and are ok. Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Martin Fuzzey <mfuzzey@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-01-28V4L/DVB (13826): uvcvideo: Fix controls blacklistingLaurent Pinchart
commit 385097e08b9c24655626ed760bc67eb7e50115a0 upstream. The control blacklisting code erroneously used usb_match_id() by passing a pointer to a usb_device_id structure instead of an array of such structures. Replace the usb_match_id() call by usb_match_id_one(). Thanks to Paulo Assis for diagnosing the bug and providing an initial fix. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-01-28V4L/DVB (13168): Add support for Asus Europa Hybrid DVB-T card (SAA7134 ↵Danny Wood
SubVendor ID: 0x1043 Device ID: 0x4847) commit e3c6e1aaa5db7822524f5b1355960fd732910068 upstream. Adds the device IDs and driver linking to allow the Asus Europa DVB-T card to operate with these drivers. The device has a SAA7134 chipset with a TD1316 Hybrid Tuner. All inputs work on the card including switching between DVB-T and Analogue TV, there is also no IR with this card. [mchehab@redhat.com: CodingStyle fixes] Signed-off-by: Danny Wood <danwood76@gmail.com> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-01-25V4L/DVB (13900): gspca - sunplus: Fix bridge exchanges.Jean-Francois Moine
commit 07d1c69b2dcfdd1b21e36af0ff8b9506234908ee upstream. A previous code optimization inverted bridge registers and values, doing a regression in kernel 2.6.32. Signed-off-by: Jean-Francois Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-01-22V4L/DVB (13868): gspca - sn9c20x: Fix test of unsigned.Roel Kluin
commit c60503c1db76bd46577cc7ff4fafa033b675e0e5 upstream. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Jean-Francois Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-01-06V4L/DVB (13596): ov511.c typo: lock => unlockDan Carpenter
commit 50e9d31183ed61c787b870cb3ee8f6c3db8c8a1e upstream. This was found with a static checker and has not been tested, but it seems pretty clear that the mutex_lock() was supposed to be mutex_unlock() Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Douglas Schilling Landgraf <dougsland@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Cc: Brandon Philips <brandon@ifup.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-12-18V4L/DVB (13116): gspca - ov519: Webcam 041e:4067 added.Rafal Milecki
commit 518c8df77c21b7d1690dd8b96eb0e54c4ec1c9c1 upstream. Signed-off-by: Rafal Milecki <zajec5@gmail.com> Signed-off-by: Jean-Francois Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> Cc: Surbhi Palande <surbhi.palande@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-11-27V4L/DVB (13481): sh_mobile_ceu_camera: fix compile warningHans Verkuil
Trivial fix for this compile warning: v4l/sh_mobile_ceu_camera.c:1789: warning: label 'exit_free_irq' defined but not used Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-26V4L/DVB (13371): davinci: remove stray duplicate config pointerHans Verkuil
The vpif_config struct was renamed to vpif_display_config, but there is still a stray vpif_config *config pointer in vpif_display.c, preventing it from compiling. Remove this old duplicate pointer. Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-26V4L/DVB (13366): em28xx: fix Reddo DVB-C USB TV Box GPIOAntti Palosaari
Set device GPIOs only once. There is no need for .dvb_gpio to select between analog and digital because device is digital only. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-26V4L/DVB (13345): soc-camera: sh_mobile_ceu_camera: call pm_runtime_disableKuninori Morimoto
pm_runtime_disable is needed if it failed or removed Signed-off-by: Kuninori Morimoto <morimoto.kuninori@renesas.com> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-26V4L/DVB (13344): soc-camera: properly initialise the device object when reusingGuennadi Liakhovetski
Commit ef373189f62413803b7b816c972fc154c488cdc0 "fix use-after-free Oops, resulting from a driver-core API change" fixed the Oops, but didn't correct missing device object initialisation. This patch makes unloading and reloading of soc-camera host- and client-drivers possible again. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-26V4L/DVB (13343): v4l: add more missing linux/sched.h includesGuennadi Liakhovetski
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13314): saa7134: set ts_force_val for the Hauppauge WinTV HVR-1150Michael Krufky
The Hauppauge WinTV HVR-1150 retail boards require the FORCE_TS_VALID bit to be set in order to function properly. This change will work on the early revisions on the board as well, but the final revision will not function without this change. Signed-off-by: Michael Krufky <mkrufky@kernellabs.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13313): saa7134: add support for FORCE_TS_VALID mode for mpeg ts inputMichael Krufky
When FORCE_TS_VALID mode is enabled, the saa713x will accept MPEG TS input without requiring TS_VALID set high. This is required for some new boards to function properly, due to the hardware design implementation. The configuration is toggled within the board setup configuration. Boards that do not have this bit set will function as before with no change. Signed-off-by: Michael Krufky <mkrufky@kernellabs.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13311): uvcvideo: Fix compilation warning with 2.6.32 due to type ↵Laurent Pinchart
mismatch with abs() The abs() macro has changed in 2.6.32 and returns a long instead of an int. Fix the driver to avoid compilation warnings. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13309): uvcvideo: Ignore the FIX_BANDWIDTH for compressed videoLaurent Pinchart
The FIX_BANDWIDTH quirk tries to work around cameras requesting the maximum bandwidth regardless of the image size by computing a bandwidth estimate. This works only for uncompressed frames. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13287): ce6230 - saa7164-cmd: Fix wrong sizeofJean Delvare
Which is why I have always preferred sizeof(struct foo) over sizeof(var). Cc: Antti Palosaari <crope@iki.fi> Acked-by: Steven Toth <stoth@kernellabs.com> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Douglas Schilling Landgraf <dougsland@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13286): pxa-camera: Fix missing sched.hJonathan Cameron
Required for wakeup call. Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk> Acked-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Douglas Schilling Landgraf <dougsland@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13264): gspca_mr97310a: Change vstart for CIF sensor type 1 camsTheodore Kilgore
gspca_mr97310a: Change vstart for CIF sensor type 1 cams This fixes the distortion at the end of the frame, and avoids the bad frame dropping done because of this distortion, trippling the framerate! Signed-off-by: Theodore Kilgore <kilgota@banach.math.auburn.edu> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13257): gspca - m5602-s5k4aa: Add vflip for Fujitsu Amilo Xi 2528Erik Andrén
Adds a vflip quirk for the Fujitsu Amilo Xi 2528. Thanks to Evgeny for the report. Signed-off-by: Erik Andrén <erik.andren@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13256): gspca - m5602-s5k4aa: Add another MSI GX700 vflip quirkErik Andrén
Adds another vflip quirk for the MSI GX700. Thanks to John Katzmaier for reporting. Signed-off-by: Erik Andrén <erik.andren@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13255): gspca - m5602-s5k4aa: Add vflip quirk for the Bruneinit laptopErik Andrén
Adds a vflip quirk for the Bruneinit laptop. Thanks to Jörg for the report Signed-off-by: Erik Andrén <erik.andren@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13230): s2255drv: Don't conditionalize video buffer completion on ↵Mike Isely
waiting processes The s2255 driver had logic which aborted processing of a video frame if there was no process waiting on the video buffer in question. That simply doesn't work when the application is doing things in an asynchronous manner. If the application went to the trouble to queue the buffer in the first place, then the driver should always attempt to complete it - even if the application at that moment has its attention turned elsewhere. Applications which always blocked waiting for I/O on the capture device would not have been affected by this. Applications which *mostly* blocked waiting for I/O on the capture device probably only would have been somewhat affected (frame lossage, at a rate which goes up as the application blocks less). Applications which never blocked on the capture device (e.g. polling only) however would never have been able to receive any video frames, since in that case this "is anyone waiting on this?" check on the buffer never would have evalutated true. This patch just deletes that harmful check against the buffer's wait queue. Signed-off-by: Mike Isely <isely@pobox.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> CC: stable@kernel.org
2009-11-07V4L/DVB (13190): em28xx: fix panic that can occur when starting audio streamingDevin Heitmueller
Because the counters were not reset when starting up streaming, they would be reused from the previous run. This can result in cases such that when the second instance of streaming starts up, the "cnt" variable in em28xx_audio_isocirq() can end up being negative, resulting in attempting to write to memory before the start of runtime->dma_area (as well as having a negative number of bytes to copy). Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com> CC: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13170): bttv: Fix reversed polarity error when switching video standardMike Isely
The bttv driver function which handles switching of the video standard (set_tvnorm() in bttv-driver.c) includes a check which can optionally also reset the cropping configuration to a default value. It is "optional" based on a comparison of the cropcap parameters of the previous vs the newly requested video standard. The comparison is being done with a memcmp(), a function which only returns a true value if the comparison actually fails. This if-statement appears to have been written to assume wrong memcmp() semantics. That is, it was re-initializing the cropping configuration only if the new video standard did NOT have different cropcap values. That doesn't make any sense. One definitely should reset things if the cropcap parameters are different - if there's any comparison to made at all. The effect of this problem was that a transition from, say, PAL to NTSC would leave in place old cropping setup that made sense for the PAL geometry but not for NTSC. If the application doesn't care about cropping it also won't try to reset the cropping configuration, resulting in an improperly cropped video frame. In the case I was testing this actually caused black video frames to be displayed. Another interesting effect of this bug is that if one does something which does NOT change the video standard and this function is run, then the cropping setup gets reset anyway - again because of the backwards comparison. It turns out that just running anything which merely opens and closes the video device node (e.g. v4l-info) will cause this to happen. One can argue that simply opening the device node and not doing anything to it should not mess with any of its state - but because of this behavior, any TV app which does such things (e.g. xawtv) probably therefore doesn't see the problem. The solution is to fix the sense of the if-statement. It's easy to see how this mistake could have been made given how memcmp() works. The patch is therefore removal of a single "!" character from the if-statement in set_tvnorm in bttv-driver.c. Signed-off-by: Mike Isely <isely@pobox.com> CC: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13169): bttv: Fix potential out-of-order field processingMike Isely
There is a subtle interaction in the bttv driver which can result in fields being repeatedly processed out of order. This is a problem specifically when running in V4L2_FIELD_ALTERNATE mode (probably the most common case). 1. The determination of which fields are associated with which buffers happens in videobuf, before the bttv driver gets a chance to queue the corresponding DMA. Thus by the point when the DMA is queued for a given buffer, the algorithm has to do the queuing based on the buffer's already assigned field type - not based on which field is "next" in the video stream. 2. The driver normally tries to queue both the top and bottom fields at the same time (see bttv_irq_next_video()). It tries to sort out top vs bottom by looking at the field type for the next 2 available buffers and assigning them appropriately. 3. However the bttv driver *always* actually processes the top field first. There's even an interrupt set aside for specifically recognizing when the top field has been processed so that it can be marked done even while the bottom field is still being DMAed. Given all of the above, if one gets into a situation where bttv_irq_next_video() gets entered when the first available buffer has been pre-associated as a bottom field, then the function is going to process the buffers out of order. That first available buffer will be put into the bottom field slot and the buffer after that will be put into the top field slot. Problem is, since the top field is always processed first by the driver, then that second buffer (the one after the first available buffer) will be the first one to be finished. Because of the strict fifo handling of all video buffers, then that top field won't be seen by the app until after the bottom field is also processed. Worse still, the app will get back the chronologically later bottom field first, *before* the top field is received. The buffer's timestamps will even be backwards. While not fatal to most TV apps, this behavior can subtlely degrade userspace deinterlacing (probably will cause jitter). That's probably why it has gone unnoticed. But it will also cause serious problems if the app in question discards all but the latest received buffer (a latency minimizing tactic) - causing one field to only ever be displayed since the other is now always late. Unfortunately once you get into this state, you're stuck this way - because having consumed two buffers, now the next time around the "first" available buffer will again be a bottom field and the same thing happens. How can we get into this state? In a perfect world, where there's always a few free buffers queued to the driver, it should be impossible. However if something disrupts streaming, e.g. if the userspace app can't queue free buffers fast enough for a moment due perhaps to a CPU scheduling glitch, then the driver can get momentarily starved and some number of fields will be dropped. That's OK. But if an odd number of fields get dropped, then that "first" available buffer might be the bottom field and now we're stuck... This patch fixes that problem by deliberately only setting up a single field for one frame if we don't get a top field as the first available buffer. By purposely skipping the other field, then we only handle a single buffer thus bringing things back into proper sync (i.e. top field first) for the next frame. To do this we just drop the few lines in bttv_irq_next_video() that attempt to set up the second buffer when that second buffer isn't for the bottom field. This is definitely a problem in when in V4L2_FIELD_ALTERNATE mode. In the other modes this change either has no effect or doesn't harm things any further anyway. Signed-off-by: Mike Isely <isely@pobox.com> CC: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13132): fix use-after-free Oops, resulting from a driver-core API ↵Guennadi Liakhovetski
change Commit b4028437876866aba4747a655ede00f892089e14 has broken again re-use of device objects across device_register() / device_unregister() cycles. Fix soc-camera by nullifying the struct after device_unregister(). Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13131): pxa_camera: fix camera pixel format configurationGuennadi Liakhovetski
A missed conversion prevents correct pixel format negotiation with client drivers. Reported-by: Antonio Ospite <ospite@studenti.unina.it> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13129): sh_mobile_ceu_camera: fix cropping for scaling clientsGuennadi Liakhovetski
Fix a bug in cropping calculation, when the client is also scaling the image. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-11-07V4L/DVB (13122): gscpa - stv06xx + ov518: dont discard every other frameHans de Goede
When we call gspca_frame_add, it returns a pointer to the frame passed in, unless we call it with LAST_PACKET, when it will return a pointer to a new frame in which to store the frame data for the next frame. The frame pointer was not updated in stv06xx and ov518. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Jean-Francois Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2009-10-11headers: remove sched.h from interrupt.hAlexey Dobriyan
After m68k's task_thread_info() doesn't refer to current, it's possible to remove sched.h from interrupt.h and not break m68k! Many thanks to Heiko Carstens for allowing this. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
2009-10-04headers: remove sched.h from poll.hAlexey Dobriyan
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-09-27const: mark struct vm_struct_operationsAlexey Dobriyan
* mark struct vm_area_struct::vm_ops as const * mark vm_ops in AGP code But leave TTM code alone, something is fishy there with global vm_ops being used. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-09-25sh_mobile_ceu_camera: fix compile breakage, caused by a bad mergeGuennadi Liakhovetski
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com> Signed-off-by: Paul Mundt <lethal@linux-sh.org>