linux-toradex.git/drivers/media/dvb-core, branch v4.8-rc2

[media] doc-rst: add some needed escape codes

2016-07-23T11:05:02+00:00

Some extra escape codes are needed to avoid Sphinx to not
identify the tags.

Signed-off-by: Mauro Carvalho Chehab

[media] dvb_ringbuffer.h: some documentation improvements

2016-07-23T11:04:21+00:00

Better document a note on this header.

While here, better format dvb_ringbuffer_pkt_read_user()
to adjust it to CodingStyle.

Signed-off-by: Mauro Carvalho Chehab

[media] doc-rst: Fix some Sphinx warnings

2016-07-23T11:03:24+00:00

Fix all remaining media warnings with ReST that are fixable
without changing at the Sphinx code.

Signed-off-by: Mauro Carvalho Chehab

Merge branch 'patchwork' into topic/docs-next

2016-07-23T10:59:19+00:00

* patchwork: (1492 commits)
  [media] cec: always check all_device_types and features
  [media] cec: poll should check if there is room in the tx queue
  [media] vivid: support monitor all mode
  [media] cec: fix test for unconfigured adapter in main message loop
  [media] cec: limit the size of the transmit queue
  [media] cec: zero unused msg part after msg->len
  [media] cec: don't set fh to NULL in CEC_TRANSMIT
  [media] cec: clear all status fields before transmit and always fill in sequence
  [media] cec: CEC_RECEIVE overwrote the timeout field
  [media] cxd2841er: Reading SNR for DVB-C added
  [media] cxd2841er: Reading BER and UCB for DVB-C added
  [media] cxd2841er: fix switch-case for DVB-C
  [media] cxd2841er: fix signal strength scale for ISDB-T
  [media] cxd2841er: adjust the dB scale for DVB-C
  [media] cxd2841er: provide signal strength for DVB-C
  [media] cxd2841er: fix BER report via DVBv5 stats API
  [media] mb86a20s: apply mask to val after checking for read failure
  [media] airspy: fix error logic during device register
  [media] s5p-cec/TODO: add TODO item
  [media] cec/TODO: drop comment about sphinx documentation
  ...

Signed-off-by: Mauro Carvalho Chehab

[media] doc-rst: Fix conversion for dvb-core.rst

2016-07-17T17:02:45+00:00

The conversion from DocBook required some fixes:

- Now, the C files with the exported symbols also need to be
  added. So, all headers need to be included twice: one to
  get the structs/enums/.. and another one for the functions;

- Notes should use the ReST tag, as kernel-doc doesn't
  recognizes it anymore;

- Identation needs to be fixed, as ReST uses it to identify
  when a format "tag" ends.

- Fix the cross-references at the media controller description.

Signed-off-by: Mauro Carvalho Chehab

[media] doc-rst: Convert media API to rst

2016-07-17T17:02:41+00:00

Move the contents of the media section at
DocBooks/DocBook/device-drivers.tmpl to a new ReST book.

For now, the contents is kept as-is. Next patches will fix
the warnings and add cross-references that were removed due to
the conversion.

Signed-off-by: Mauro Carvalho Chehab

[media] dvb-core/en50221: use kref to manage struct dvb_ca_private

2016-07-13T18:45:29+00:00

Don't free the object until the file handle has been closed.  Fixes
use-after-free bug which occurs when I disconnect my DVB-S received
while VDR is running.

This is a crash dump of such a use-after-free:

    general protection fault: 0000 [#1] SMP
    CPU: 0 PID: 2541 Comm: CI adapter on d Not tainted 4.7.0-rc1-hosting+ #49
    Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    task: ffff880027d7ce00 ti: ffff88003d8f8000 task.ti: ffff88003d8f8000
    RIP: 0010:[]  [] dvb_ca_en50221_io_read_condition.isra.7+0x6f/0x150
    RSP: 0018:ffff88003d8fba98  EFLAGS: 00010206
    RAX: 0000000059534255 RBX: 000000753d470f90 RCX: ffff88003c74d181
    RDX: 00000001bea04ba9 RSI: ffff88003d8fbaf4 RDI: 3a3030a56d763fc0
    RBP: ffff88003d8fbae0 R08: ffff88003c74d180 R09: 0000000000000000
    R10: 0000000000000001 R11: 0000000000000000 R12: ffff88003c480e00
    R13: 00000000ffffffff R14: 0000000059534255 R15: 0000000000000000
    FS:  00007fb4209b4700(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f06445f4078 CR3: 000000003c55b000 CR4: 00000000000006b0
    Stack:
     ffff88003d8fbaf4 000000003c2170c0 0000000000004000 0000000000000000
     ffff88003c480e00 ffff88003d8fbc80 ffff88003c74d180 ffff88003d8fbb8c
     0000000000000000 ffff88003d8fbb10 ffffffff812f3e37 ffff88003d8fbb00
    Call Trace:
     [] dvb_ca_en50221_io_poll+0x37/0xa0
     [] do_sys_poll+0x2db/0x520

This is a backtrace of the kernel attempting to lock a freed mutex:

    #0  0xffffffff81083d40 in rep_nop () at ./arch/x86/include/asm/processor.h:569
    #1  cpu_relax () at ./arch/x86/include/asm/processor.h:574
    #2  virt_spin_lock (lock=) at ./arch/x86/include/asm/qspinlock.h:57
    #3  native_queued_spin_lock_slowpath (lock=0xffff88003c480e90, val=761492029) at kernel/locking/qspinlock.c:304
    #4  0xffffffff810d1a06 in pv_queued_spin_lock_slowpath (val=, lock=) at ./arch/x86/include/asm/paravirt.h:669
    #5  queued_spin_lock_slowpath (val=, lock=) at ./arch/x86/include/asm/qspinlock.h:28
    #6  queued_spin_lock (lock=) at include/asm-generic/qspinlock.h:107
    #7  __mutex_lock_common (use_ww_ctx=, ww_ctx=, ip=, nest_lock=, subclass=,
        state=, lock=) at kernel/locking/mutex.c:526
    #8  mutex_lock_interruptible_nested (lock=0xffff88003c480e88, subclass=) at kernel/locking/mutex.c:647
    #9  0xffffffff812f49fe in dvb_ca_en50221_io_do_ioctl (file=, cmd=761492029, parg=0x1 )
        at drivers/media/dvb-core/dvb_ca_en50221.c:1210
    #10 0xffffffff812ee660 in dvb_usercopy (file=, cmd=761492029, arg=, func=) at drivers/media/dvb-core/dvbdev.c:883
    #11 0xffffffff812f3410 in dvb_ca_en50221_io_ioctl (file=, cmd=, arg=) at drivers/media/dvb-core/dvb_ca_en50221.c:1284
    #12 0xffffffff8112eddd in vfs_ioctl (arg=, cmd=, filp=) at fs/ioctl.c:43
    #13 do_vfs_ioctl (filp=0xffff88003c480e90, fd=, cmd=, arg=) at fs/ioctl.c:674
    #14 0xffffffff8112f30c in SYSC_ioctl (arg=, cmd=, fd=) at fs/ioctl.c:689
    #15 SyS_ioctl (fd=6, cmd=2148298626, arg=140734533693696) at fs/ioctl.c:680
    #16 0xffffffff8103feb2 in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:207

Signed-off-by: Max Kellermann 
Signed-off-by: Mauro Carvalho Chehab

[media] dvb_frontend: eliminate blocking wait in dvb_unregister_frontend()

2016-07-13T18:43:31+00:00

The wait_event() call in dvb_unregister_frontend() waits synchronously
for other tasks to free a file descriptor, but it does that while
holding several mutexes.  That alone is a bad idea, but if one user
process happens to keep a (defunct) file descriptor open indefinitely,
the kernel will correctly detect a hung task:

    INFO: task kworker/0:1:314 blocked for more than 30 seconds.
          Not tainted 4.7.0-rc1-hosting+ #50
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    kworker/0:1     D ffff88003daf7a50     0   314      2 0x00000000
    Workqueue: usb_hub_wq hub_event
     ffff88003daf7a50 0000000000000296 ffff88003daf7a30 ffff88003fc13f98
     ffff88003dadce00 ffff88003daf8000 ffff88003e3fc010 ffff88003d48d4f8
     ffff88003e3b5030 ffff88003e3f8898 ffff88003daf7a68 ffffffff810cf860
    Call Trace:
     [] schedule+0x30/0x80
     [] dvb_unregister_frontend+0x93/0xc0
     [] ? __wake_up_common+0x80/0x80
     [] dvb_usb_adapter_frontend_exit+0x37/0x70
     [] dvb_usb_exit+0x34/0xb0
     [] dvb_usb_device_exit+0x3a/0x50
     [] pctv452e_usb_disconnect+0x52/0x60
     [] usb_unbind_interface+0x67/0x1e0
     [] ? __blocking_notifier_call_chain+0x53/0x70
     [] __device_release_driver+0x77/0x110
     [] device_release_driver+0x23/0x30
     [] bus_remove_device+0x10d/0x150
     [] device_del+0x13b/0x260
     [] ? usb_remove_ep_devs+0x1a/0x30
     [] usb_disable_device+0x9e/0x1e0
     [] usb_disconnect+0x89/0x260
     [] hub_event+0x30d/0xfc0
     [] process_one_work+0x1c5/0x4a0
     [] ? process_one_work+0x15c/0x4a0
     [] worker_thread+0x49/0x480
     [] ? process_one_work+0x4a0/0x4a0
     [] ? process_one_work+0x4a0/0x4a0
     [] kthread+0xee/0x110
     [] ret_from_fork+0x1f/0x40
     [] ? __kthread_unpark+0x70/0x70
    5 locks held by kworker/0:1/314:
     #0:  ("usb_hub_wq"){......}, at: [] process_one_work+0x15c/0x4a0
     #1:  ((&hub->events)){......}, at: [] process_one_work+0x15c/0x4a0
     #2:  (&dev->mutex){......}, at: [] hub_event+0x4b/0xfc0
     #3:  (&dev->mutex){......}, at: [] usb_disconnect+0x52/0x260
     #4:  (&dev->mutex){......}, at: [] device_release_driver+0x1b/0x30

This patch removes the blocking wait, and postpones the kfree() call
until all file handles have been closed by using struct kref.

Signed-off-by: Max Kellermann 
Signed-off-by: Mauro Carvalho Chehab

[media] media: dvb_ringbuffer: Add memory barriers

2016-07-09T10:57:47+00:00

Implement memory barriers according to Documentation/circular-buffers.txt:
- use smp_store_release() to update ringbuffer read/write pointers
- use smp_load_acquire() to load write pointer on reader side
- use ACCESS_ONCE() to load read pointer on writer side

This fixes data stream corruptions observed e.g. on an ARM Cortex-A9
quad core system with different types (PCI, USB) of DVB tuners.

Signed-off-by: Soeren Moch 
Cc: stable@vger.kernel.org # 3.14+
Signed-off-by: Mauro Carvalho Chehab

[media] dvb: use ktime_t for internal timeout

2016-07-08T19:36:00+00:00

The dvb demuxer code uses a 'struct timespec' to pass a timeout
as absolute time. This will cause problems on 32-bit architectures
in 2038 when time_t overflows, and it is racy with a concurrent
settimeofday() call.

This patch changes the code to use ktime_get() instead, using
the monotonic time base to avoid both the race and the overflow.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab