summaryrefslogtreecommitdiffstats
path: root/drivers/media/rc/mceusb.c
Commit message (Collapse)AuthorAgeFilesLines
* media: mceusb: fix out of bounds read in MCE receiver bufferA Sun2019-10-071-43/+98
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix multiple cases of out of bounds (OOB) read associated with MCE device receive/input data handling. In reference for the OOB cases below, the incoming/read (byte) data format when the MCE device responds to a command is: { cmd_prefix, subcmd, data0, data1, ... } where cmd_prefix are: MCE_CMD_PORT_SYS MCE_CMD_PORT_IR and subcmd examples are: MCE_RSP_GETPORTSTATUS MCE_RSP_EQIRNUMPORTS ... Response size dynamically depends on cmd_prefix and subcmd. So data0, data1, ... may or may not be present on input. Multiple responses may return in a single receiver buffer. The trigger condition for OOB read is typically random or corrupt input data that fills the mceusb receiver buffer. Case 1: mceusb_handle_command() reads data0 (var hi) and data1 (var lo) regardless of whether the response includes such data. If { cmd_prefix, subcmd } is at the end of the receiver buffer, read past end of buffer occurs. This case was reported by KASAN: slab-out-of-bounds Read in mceusb_dev_recv https://syzkaller.appspot.com/bug?extid=c7fdb6cb36e65f2fe8c9 Fix: In mceusb_handle_command(), change variable hi and lo to pointers, and dereference only when required. Case 2: If response with data is truncated at end of buffer after { cmd_prefix, subcmd }, mceusb_handle_command() reads past end of buffer for data0, data1, ... Fix: In mceusb_process_ir_data(), check response size with remaining buffer size before invoking mceusb_handle_command(). + if (i + ir->rem < buf_len) mceusb_handle_command(ir, &ir->buf_in[i - 1]); Case 3: mceusb_handle_command() handles invalid/bad response such as { 0x??, MCE_RSP_GETPORTSTATUS } of length 2 as a response { MCE_CMD_PORT_SYS, MCE_RSP_GETPORTSTATUS, data0, ... } of length 7. Read OOB occurs for non-existent data0, data1, ... Cause is mceusb_handle_command() does not check cmd_prefix value. Fix: mceusb_handle_command() must test both cmd_prefix and subcmd. Case 4: mceusb_process_ir_data() receiver parser state SUBCMD is possible at start (i=0) of receiver buffer resulting in buffer offset=-1 passed to mceusb_dev_printdata(). Bad offset results in OOB read before start of buffer. [1214218.580308] mceusb 1-1.3:1.0: rx data[0]: 00 80 (length=2) [1214218.580323] mceusb 1-1.3:1.0: Unknown command 0x00 0x80 ... [1214218.580406] mceusb 1-1.3:1.0: rx data[14]: 7f 7f (length=2) [1214218.679311] mceusb 1-1.3:1.0: rx data[-1]: 80 90 (length=2) [1214218.679325] mceusb 1-1.3:1.0: End of raw IR data [1214218.679340] mceusb 1-1.3:1.0: rx data[1]: 7f 7f (length=2) Fix: If parser_state is SUBCMD after processing receiver buffer, reset parser_state to CMD_HEADER. In effect, discard cmd_prefix at end of receiver buffer. In mceusb_dev_printdata(), abort if buffer offset is out of bounds. Case 5: If response with data is truncated at end of buffer after { cmd_prefix, subcmd }, mceusb_dev_printdata() reads past end of buffer for data0, data1, ... while decoding the response to print out. Fix: In mceusb_dev_printdata(), remove unneeded buffer offset adjustments (var start and var skip) associated with MCE gen1 header. Test for truncated MCE cmd response (compare offset+len with buf_len) and skip decoding of incomplete response. Move IR data tracing to execute before the truncation test. Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: mceusb: fix (eliminate) TX IR signal length limitA Sun2019-08-211-138/+196
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix and eliminate mceusb's IR length limit for IR signals transmitted to the MCE IR blaster ports. An IR signal TX exceeding 306 pulse/space samples presently causes -EINVAL return error. There's no such limitation nor error with the MCE device hardware. And valid IR signals exist with more than 400 pulse/space for the control of certain appliances (eg Panasonic ACXA75C00600 air conditioner). The scope of this patch is limited to the mceusb driver. There are still IR signal TX length and time constraints that related modules of rc core (eg LIRC) impose, further up the driver stack. Changes for mceusb_tx_ir(): Converts and sends LIRC IR pulse/space sequence to MCE device IR pulse/space format. Break long length LIRC sequence into multiple (unlimited number of) parts for sending to the MCE device. Reduce kernel stack IR buffer size: 128 (was 384) Increase MCE IR data packet size: 31 (was 5) Zero time LIRC pulse/space no longer copied to MCE IR data. Eliminate overwriting the source/input LIRC IR data in txbuf[]. Eliminate -EINVAL return; return number of IR samples sent (>0) or MCE write error code (<0). New mce_write() and mce_write_callback(): Implements synchronous blocking I/O, with timeout, for writing/sending data to the MCE device. An unlimited multipart IR signal sent to the MCE device faster than real time requires flow control absent with the original mce_request_packet() and mce_async_callback() asynchronous I/O implementation. Also absent is TX error feedback. mce_write() combines and replaces mce_request_packet() and mce_async_callback() with conversion to synchronous I/O. mce_write() returns bytes sent (>0) or MCE device write error (<0). Debug hex dump TX data before processing. Rename mce_async_out() -> mce_command_out(): The original name is misleading with underlying synchronous I/O implementation. Function renamed to mce_command_out(). Changes in mceusb_handle_command(): Add support for MCE device error case MCE_RSP_TX_TIMEOUT "IR TX timeout (TX buffer underrun)" Changes in mceusb_dev_printdata(): Changes support test and debug of multipart TX IR. Add buffer boundary information (offset and buffer size) to TX hex dump. Correct TX trace bug "Raw IR data, 0 pulse/space samples" Add trace for MCE_RSP_TX_TIMEOUT "IR TX timeout (TX buffer underrun)" Other changes: The driver's write to USB device architecture change (async to sync I/O) is significant so we bump DRIVER_VERSION to "1.95" (from "1.94"). Tests: $ cat -n irdata1 | head -3 1 carrier 36000 2 pulse 6350 3 space 6350 $ cat -n irdata1 | tail -3 76 pulse 6350 77 space 6350 78 pulse 6350 $ ir-ctl -s irdata1 [1549021.073612] mceusb 1-1.3:1.0: requesting 36000 HZ carrier [1549021.073635] mceusb 1-1.3:1.0: tx data[0]: 9f 06 01 45 (len=4 sz=4) [1549021.073649] mceusb 1-1.3:1.0: Request carrier of 35714 Hz (period 28us) [1549021.073848] mceusb 1-1.3:1.0: tx done status = 4 (wait = 100, expire = 100 (1000ms), urb->actual_length = 4, urb->status = 0) [1549021.074689] mceusb 1-1.3:1.0: rx data[0]: 9f 06 01 45 (len=4 sz=4) [1549021.074701] mceusb 1-1.3:1.0: Got carrier of 35714 Hz (period 28us) [1549021.102023] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3) [1549021.102036] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03 [1549021.102219] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0) [1549021.131979] mceusb 1-1.3:1.0: tx data[0]: 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 91 ff (len=81 sz=81) [1549021.131992] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples [1549021.133592] mceusb 1-1.3:1.0: tx done status = 81 (wait = 100, expire = 100 (1000ms), urb->actual_length = 81, urb->status = 0) Hex dumps limited to 64 bytes. 0xff is MCE maximum time pulse, 0x7f is MCE maximum time space. $ cat -n irdata2 | head -3 1 carrier 36000 2 pulse 50 3 space 50 $ cat -n irdata2 | tail -3 254 pulse 50 255 space 50 256 pulse 50 $ ir-ctl -s irdata2 [1549306.586998] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3) [1549306.587015] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03 [1549306.587252] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0) [1549306.613275] mceusb 1-1.3:1.0: tx data[0]: 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 (len=128 sz=128) [1549306.613291] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples [1549306.614837] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0) [1549306.614861] mceusb 1-1.3:1.0: tx data[0]: 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 (len=128 sz=128) [1549306.614869] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples [1549306.620199] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0) [1549306.620212] mceusb 1-1.3:1.0: tx data[0]: 89 81 01 81 01 81 01 81 01 81 80 (len=11 sz=11) [1549306.620221] mceusb 1-1.3:1.0: Raw IR data, 9 pulse/space samples [1549306.633294] mceusb 1-1.3:1.0: tx done status = 11 (wait = 98, expire = 100 (1000ms), urb->actual_length = 11, urb->status = 0) Hex dumps limited to 64 bytes. 0x81 is MCE minimum time pulse, 0x01 is MCE minimum time space. TX IR part 3 sz=11 shows 20msec I/O blocking delay (100expire - 98wait = 2jiffies) Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: mceusb: USB reset device following USB clear halt errorA Sun2019-07-221-12/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch schedules a USB reset device call following a USB clear halt error. The issues solved, and patch implementation, are similar to those found in drivers/hid/usbhid/hid-core.c. As seen on very rare occasions approximately one time per month (mceusb device 2304:0225 in this sample) Jul 27 2018 15:09:39 [59388.696941] mceusb 1-1.1.2:1.0: Error: urb status = -32 (RX HALT) [59388.698838] mceusb 1-1.1.2:1.0: rx clear halt error -32 the device can get into RX or TX HALT state where usb_clear_halt() also fails and also returns -EPIPE (HALT/STALL). After which, all further mceusb device control and data I/O always fail with HALT/STALL. Subsequently, the entire mceusb device no longer functions. Cause and problem replication conditions remain unknown. Further troubleshooting reveals usb_reset_device() restores mceusb device operation. Patch test 1: Hot unplugging the mceusb device triggers USB RX HALT and USB clear halt errors. A mceusb_dev_disconnect() call follows unplug. This patch's reset device call invokes an extra mceusb_dev_probe() mceusb_dev_disconnect() cycle, before the mceusb driver detaches. The additional probe/disconnect verifies the patch's device reset code executed. But note this patch is for USB clear halt error cases not caused by unplugging the mceusb device. Patch test 2: Simulate a RX HALT and a clear halt error with instrumented code in the driver. Jul 12 2019 19:41:18 [522745.263104] mceusb 1-1.3:1.0: set rx halt retval, 0 [522745.263943] mceusb 1-1.3:1.0: Error: rx urb status = -32 (RX HALT) [522745.263970] mceusb 1-1.3:1.0: kevent 1 scheduled [522745.264016] mceusb 1-1.3:1.0: kevent handler called (flags 0x2) [522745.272883] mceusb 1-1.3:1.0: rx clear halt status = 0 [522745.272917] mceusb 1-1.3:1.0: stuck RX HALT state requires USB Reset Device to clear [522745.273005] mceusb 1-1.3:1.0: mceusb_dev_disconnect called [522745.702815] usb 1-1.3: reset full-speed USB device number 14 using dwc_otg [522745.836812] mceusb 1-1.3:1.0: mceusb_dev_probe called [522745.836823] mceusb 1-1.3:1.0: acceptable bulk inbound endpoint found [522745.836832] mceusb 1-1.3:1.0: acceptable bulk outbound endpoint found ... The result matches what is expected when the device gets into a real rx clear halt error case by itself. This is the same sequence of messages when manually invoking the ./usbreset command line utility with an unpatched mceusb driver. Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: mceusb: disable "nonsensical irdata" messagesA Sun2019-06-271-2/+2
| | | | | | | | | | | | | | | | | | mceusb device 2304:0225, and likely others, produces numerous [ 4231.111310] mceusb 1-1.1.2:1.0: nonsensical irdata 80 with duration 0 [ 4381.493597] mceusb 1-1.1.2:1.0: nonsensical irdata 80 with duration 0 [ 4410.247568] mceusb 1-1.1.2:1.0: nonsensical irdata 80 with duration 0 ... [60153.264064] mceusb 1-1.1.2:1.0: nonsensical irdata 00 with duration 0 ... due to reception of ambient IR noise. Change these warning messages to debug messages. Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157Thomas Gleixner2019-05-301-12/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Based on 3 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version [author] [kishon] [vijay] [abraham] [i] [kishon]@[ti] [com] this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version [author] [graeme] [gregory] [gg]@[slimlogic] [co] [uk] [author] [kishon] [vijay] [abraham] [i] [kishon]@[ti] [com] [based] [on] [twl6030]_[usb] [c] [author] [hema] [hk] [hemahk]@[ti] [com] this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 1105 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Reviewed-by: Richard Fontana <rfontana@redhat.com> Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070033.202006027@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* media: rc: fix several typosMauro Carvalho Chehab2019-03-011-1/+1
| | | | | | | | | | Use codespell to fix lots of typos over frontends. Manually verified to avoid false-positives. Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Acked-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: mceusb: Include three Hauppauge USB dvb device with IR rxBrad Love2018-11-221-0/+9
| | | | | | | | | | | | | | The three following Hauppauge USB DVB devices have IR receivers, but lacked the support in mceusb to enable it: - WinTV-HVR-935C - WinTV-HVR-955Q - WinTV-HVR-975 Tested HVR-955Q and HVR-975 plus RC5 remote and irw, works as intended. Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: rc: Remove init_ir_raw_event and DEFINE_IR_RAW_EVENT macrosSean Young2018-10-041-7/+8
| | | | | | | | | | | | | | This can be done with c99 initializers, which makes the code cleaner and more transparent. It does require gcc 4.6, because of this bug in earlier versions: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=10676 Since commit cafa0010cd51 ("Raise the minimum required gcc version to 4.6"), this is the case. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: use strscpy() instead of strlcpy()Mauro Carvalho Chehab2018-09-111-1/+1
| | | | | | | | | | | The implementation of strscpy() is more robust and safer. That's now the recommended way to copy NUL terminated strings. Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: mceusb: add missing breakSean Young2018-05-141-0/+1
| | | | | | | Fallthrough is not intended here. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: mceusb: filter out bogus timing irdata of duration 0Sean Young2018-05-141-0/+5
| | | | | | | | | A mceusb device has been observed producing invalid irdata. Proactively guard against this. Suggested-by: Matthias Reichl <hias@horus.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: mceusb: MCE_CMD_SETIRTIMEOUT cause strange behaviour on deviceSean Young2018-05-141-3/+19
| | | | | | | | | If the IR timeout is set on vid 1784 pid 0011, the device starts behaving strangely. Reported-by: Matthias Reichl <hias@horus.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* media: rc: mceusb: allow the timeout to be configurableSean Young2018-04-201-0/+22
| | | | | | | mceusb devices have a default timeout of 100ms, but this can be changed. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* media: rc: mceusb: IR of length 0 means IR timeout, not resetSean Young2018-04-201-1/+6
| | | | | | | | The last usb packet with IR data will end with 0x80 (MCE_IRDATA_TRAILER). If we reset the decoder state at this point, IR decoding can fail. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* media: rc: mceusb: pid 0x0609 vid 0x031d does not under report carrier cyclesSean Young2018-03-211-1/+7
| | | | | | | | This mceusb does not need the carrier count quirk, with it set it reports the carrier higher than it is. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* media: mceusb: add IR learning support features (IR carrier frequency ↵A Sun2018-03-211-12/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | measurement and wide-band/short-range receiver) Windows Media Center IR transceivers include two IR receivers; wide-band/short-range and narrow-band/long-range. The short-range (5cm distance) receiver is for IR learning and has IR carrier frequency measuring ability. Add mceusb driver support to select the short range IR receiver and enable pass through of its IR carrier frequency measurements. RC and LIRC already support these mceusb driver additions. Test platform: Linux raspberrypi 4.9.59-v7+ #1047 SMP Sun Oct 29 12:19:23 GMT 2017 armv7l GNU/Linux mceusb 1-1.2:1.0: Registered Pinnacle Systems PCTV Remote USB with mce emulator interface version 1 mceusb 1-1.2:1.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x1 active) Sony TV remote control ir-ctl from v4l-utils pi@raspberrypi:~ $ ir-ctl -V IR raw version 1.12.3 pi@raspberrypi:~ $ ir-ctl -m -r ... pulse 650 space 550 pulse 650 space 600 pulse 600 space 600 pulse 1200 space 600 pulse 650 space 550 pulse 650 space 600 pulse 600 space 600 pulse 550 carrier 40004 space 16777215 ^C pi@raspberrypi:~ $ exit Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* media: rc: mceusb: add support for 15f4:0135Oleh Kravchenko2017-10-311-0/+9
| | | | | | | | Astrometa T2hybrid (15f4:0135) has IR on Interface 0. Signed-off-by: Oleh Kravchenko <oleg@kaa.org.ua> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* media: rc: mceusb: add support for 1b80:d3b2Oleh Kravchenko2017-10-311-0/+9
| | | | | | | | | | Evromedia USB Full Hybrid Full HD (1b80:d3b2) has IR on Interface 0. Remote controller supplied with this tuner fully compatible with RC_MAP_MSI_DIGIVOX_III. Signed-off-by: Oleh Kravchenko <oleg@kaa.org.ua> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] media: rc: constify usb_device_idArvind Yadav2017-10-041-1/+1
| | | | | | | | | | usb_device_id are not supposed to change at runtime. All functions working with usb_device_id provided by <linux/usb.h> work with const usb_device_id. So mark the non-const structs as const. Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
* media: rc: rename RC_TYPE_* to RC_PROTO_* and RC_BIT_* to RC_PROTO_BIT_*Sean Young2017-08-201-1/+1
| | | | | | | | | RC_TYPE is confusing and it's just the protocol. So rename it. Suggested-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Sean Young <sean@mess.org> Acked-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* media: mceusb: do not read data parameters unless requiredSean Young2017-08-201-19/+17
| | | | | | | | | This causes out-of-bounds read on device probe. BUG: KASAN: slab-out-of-bounds in mceusb_dev_printdata+0xdc/0x830 [mceusb] Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* media: rc-core: rename input_name to device_nameSean Young2017-08-201-1/+1
| | | | | | | | | | | | | | | | | | When an ir-spi is registered, you get this message. rc rc0: Unspecified device as /devices/platform/soc/3f215080.spi/spi_master/spi32766/spi32766.128/rc/rc0 "Unspecified device" refers to input_name, which makes no sense for IR TX only devices. So, rename to device_name. Also make driver_name const char* so that no casts are needed anywhere. Now ir-spi reports: rc rc0: IR SPI as /devices/platform/soc/3f215080.spi/spi_master/spi32766/spi32766.128/rc/rc0 Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: drop redundant urb reinitialisationJohan Hovold2017-06-071-3/+0
| | | | | | | | | | Drop a since commit e1159cb35712 ("[media] mceusb: remove pointless mce_flush_rx_buffer function") redundant reinitialisation of two urb fields immediately after they have been initialised. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: fix memory leaks in error pathJohan Hovold2017-06-071-0/+2
| | | | | | | | | | | | | Fix urb and transfer-buffer leaks in an urb-submission error path which may be hit when a device is disconnected. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: stable <stable@vger.kernel.org> # 2.6.36 Cc: Jarod Wilson <jarod@redhat.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: TX -EPIPE (urb status = -32) lockup fixA Sun2017-06-061-19/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Once IR blasting or mceusb device commands fail with mce_async_callback() TX -EPIPE error, all subsequent TX to device then fail with the same error. ... [ 249.986174] mceusb 1-1.2:1.0: requesting 38000 HZ carrier [ 249.986210] mceusb 1-1.2:1.0: send request called (size=0x4) [ 249.986256] mceusb 1-1.2:1.0: send request complete (res=0) [ 249.986403] mceusb 1-1.2:1.0: Error: request urb status = -32 (TX HALT) [ 249.999885] mceusb 1-1.2:1.0: send request called (size=0x3) [ 249.999929] mceusb 1-1.2:1.0: send request complete (res=0) [ 250.000013] mceusb 1-1.2:1.0: Error: request urb status = -32 (TX HALT) [ 250.019830] mceusb 1-1.2:1.0: send request called (size=0x21) [ 250.019868] mceusb 1-1.2:1.0: send request complete (res=0) [ 250.020007] mceusb 1-1.2:1.0: Error: request urb status = -32 (TX HALT) ... Fault simulation/injection is by executing the following USB operation in a mceusb instrumented driver, prior to TX I/O. retval = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT, USB_ENDPOINT_HALT, usb_pipeendpoint(ir->pipe_out), NULL, 0, USB_CTRL_SET_TIMEOUT); dev_dbg(ir->dev, "set halt retval, %d", retval); After setting halt state for the TX endpoint, perform an lirc "irsend" to generate TX traffic to device. After the TX HALT, the patch restores subsequent TX to working state. ... [ 508.009638] mceusb 1-1.2:1.0: send request called (size=0x3) [ 508.009697] mceusb 1-1.2:1.0: send request complete (res=0) [ 508.009847] mce_async_callback() [ 508.009864] mceusb 1-1.2:1.0: Error: request urb status = -32 (TX HALT) [ 508.009890] mceusb 1-1.2:1.0: kevent 0 scheduled [ 508.021552] mceusb 1-1.2:1.0: send request called (size=0x21) [ 508.021598] mceusb 1-1.2:1.0: send request complete (res=0) [ 508.021963] mce_async_callback() [ 508.021981] mceusb 1-1.2:1.0: tx data: 84 b0 0c 8c 0c 84 8c 0c 8c 0c 84 8c 0c 8c 0c 84 98 0c 98 0c 84 98 0c 8c 0c 84 8c 0c 8c 0c 81 8c 80 (length=33) [ 508.021997] mceusb 1-1.2:1.0: Raw IR data, 0 pulse/space samples [ 508.066627] mceusb 1-1.2:1.0: send request called (size=0x3) [ 508.066669] mceusb 1-1.2:1.0: send request complete (res=0) [ 508.066841] mce_async_callback() [ 508.066858] mceusb 1-1.2:1.0: tx data: 9f 08 03 (length=3) ... Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: RX -EPIPE (urb status = -32) lockup failure fixA Sun2017-06-061-1/+73
| | | | | | | | | | | | | | | | | | | RX -EPIPE failure with infinite loop and flooding of [ 2851.966506] mceusb 1-1.2:1.0: Error: urb status = -32 log message at 8000 messages per second. Bug trigger appears to be normal, but heavy, IR receiver use. Driver and Linux host become unusable after error. Also seen at https://sourceforge.net/p/lirc/mailman/message/34886165/ Fix: Message reports RX usb halt (stall) condition requiring usb_clear_halt() call in non-interrupt context to recover. Add driver workqueue call to perform this recovery based on method in use for the usbnet device driver. Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: fix inaccurate debug buffer dumps, and misleading debug messagesA Sun2017-06-061-14/+15
| | | | | | | | | | Some dev_dbg messages are misleading. Some dev_dbg messages have inconsistent formatting. mceusb_dev_printdata() prints incorrect range of bytes (0 to len) in buffer which the driver will actually process next. Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: sporadic RX truncation corruption fixA Sun2017-06-061-2/+7
| | | | | | | | | | | | | | | | | | | Intermittent RX truncation and loss of IR received data. This resulted in receive stream synchronization errors where driver attempted to incorrectly parse IR data (eg 0x90 below) as command response. [ 3969.139898] mceusb 1-1.2:1.0: processed IR data [ 3969.151315] mceusb 1-1.2:1.0: rx data: 00 90 (length=2) [ 3969.151321] mceusb 1-1.2:1.0: Unknown command 0x00 0x90 [ 3969.151336] mceusb 1-1.2:1.0: rx data: 98 0a 8d 0a 8e 0a 8e 0a 8e 0a 8e 0a 9a 0a 8e 0a 0b 3a 8e 00 80 41 59 00 00 (length=25) [ 3969.151341] mceusb 1-1.2:1.0: Raw IR data, 24 pulse/space samples [ 3969.151348] mceusb 1-1.2:1.0: Storing space with duration 500000 Bug trigger appears to be normal, but heavy, IR receiver use. Signed-off-by: A Sun <as1033x@comcast.net> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: fix NULL-deref at probeJohan Hovold2017-03-241-2/+2
| | | | | | | | | | | | | Make sure to check for the required out endpoint to avoid dereferencing a NULL-pointer in mce_request_packet should a malicious device lack such an endpoint. Note that this path is hit during probe. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: stable <stable@vger.kernel.org> # 2.6.36 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] rc-main: assign driver type during allocationAndi Shyti2017-01-301-2/+1
| | | | | | | | | | | | | | | | | | | The driver type can be assigned immediately when an RC device requests to the framework to allocate the device. This is an 'enum rc_driver_type' data type and specifies whether the device is a raw receiver or scancode receiver. The type will be given as parameter to the rc_allocate_device device. Change accordingly all the drivers calling rc_allocate_device() so that the device type is specified during the rc device allocation. Whenever the device type is not specified, it will be set as RC_DRIVER_SCANCODE which was the default '0' value. Suggested-by: Sean Young <sean@mess.org> Signed-off-by: Andi Shyti <andi.shyti@samsung.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] rc: raw IR drivers cannot handle cec, unknown or otherSean Young2017-01-301-1/+1
| | | | | | | | | | | | unknown and other are for IR protocols for which we have no decoder, so the raw IR drivers have no chance of generating them. cec is not an IR protocol. Signed-off-by: Sean Young <sean@mess.org> Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: Bruno Prémont <bonbons@linux-vserver.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: LIRC_SET_SEND_CARRIER returns 0 on successSean Young2017-01-301-2/+2
| | | | | | | | | LIRC_SET_SEND_CARRIER ioctl should not return the carrier used, it should return 0. Signed-off-by: Sean Young <sean@mess.org> Reviewed-by: Andi Shyti <andi.shyti@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] media: Drop FSF's postal address from the source code filesSakari Ailus2017-01-271-4/+0
| | | | | | | | | | | | | | | | | | | | | Drop the FSF's postal address from the source code files that typically contain mostly the license text. Of the 628 removed instances, 578 are outdated. The patch has been created with the following command without manual edits: git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \ drivers/media/ include/media|while read i; do i=$i perl -e ' open(F,"< $ENV{i}"); $a=join("", <F>); $a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m && $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m; close(F); open(F, "> $ENV{i}"); print F $a; close(F);'; done Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
* [media] mceusb: remove pointless mce_flush_rx_buffer functionSean Young2016-11-231-46/+31
| | | | | | | | | | This function just submits the urb much like mceusb_dev_resume; removing it simplifies mce_request_packet. Also add missing usb_kill_urb to mce_dev_probe. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: remove useless debug messageSean Young2016-11-231-20/+1
| | | | | | | | Such debug message has a logic to track the IR status, but it doesn't provide much info. So, get rid of it. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] rc: don't break long linesMauro Carvalho Chehab2016-10-211-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to the 80-cols restrictions, and latter due to checkpatch warnings, several strings were broken into multiple lines. This is not considered a good practice anymore, as it makes harder to grep for strings at the source code. As we're right now fixing other drivers due to KERN_CONT, we need to be able to identify what printk strings don't end with a "\n". It is a way easier to detect those if we don't break long lines. So, join those continuation lines. The patch was generated via the script below, and manually adjusted if needed. </script> use Text::Tabs; while (<>) { if ($next ne "") { $c=$_; if ($c =~ /^\s+\"(.*)/) { $c2=$1; $next =~ s/\"\n$//; $n = expand($next); $funpos = index($n, '('); $pos = index($c2, '",'); if ($funpos && $pos > 0) { $s1 = substr $c2, 0, $pos + 2; $s2 = ' ' x ($funpos + 1) . substr $c2, $pos + 2; $s2 =~ s/^\s+//; $s2 = ' ' x ($funpos + 1) . $s2 if ($s2 ne ""); print unexpand("$next$s1\n"); print unexpand("$s2\n") if ($s2 ne ""); } else { print "$next$c2\n"; } $next=""; next; } else { print $next; } $next=""; } else { if (m/\"$/) { if (!m/\\n\"$/) { $next=$_; next; } } } print $_; } </script> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] rc: make s_tx_carrier consistentSean Young2016-07-151-1/+1
| | | | | | | LIRC_SET_SEND_CARRIER should return 0 on success or -errno. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] rc: make s_tx_mask consistentSean Young2016-07-151-0/+6
| | | | | | | | | When s_tx_mask is given an invalid bitmask, the number of transmitters should be returned. See the LIRC_SET_TRANSMITTER_MASK lirc ioctl documentation. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
* [media] mceusb: add support for SMK eHome receiverOlli Salonen2016-05-071-0/+3
| | | | | | | | Add USB ID of SMK RXX6000 series IR receiver. Often branded as Lenovo receiver. Signed-off-by: Olli Salonen <olli.salonen@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
* [media] mceusb: add support for Adaptec eHome receiverOlli Salonen2016-05-071-0/+3
| | | | | | | New USB ID for Adaptec eHome receiver in some HP laptops. Signed-off-by: Olli Salonen <olli.salonen@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
* [media] mceusb: use %*ph for small buffer dumpsMauro Carvalho Chehab2016-03-101-3/+2
| | | | | | | | | It makes the printk cleaner. As a side efect, it also fixes those smatch warnings: drivers/media/rc/mceusb.c:590 mceusb_dev_printdata() warn: argument 6 to %02x specifier has type 'char' drivers/media/rc/mceusb.c:590 mceusb_dev_printdata() warn: argument 7 to %02x specifier has type 'char' Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
* [media] mceusb: fix usbdev leakAlexey Khoroshilov2014-09-231-5/+6
| | | | | | | | | | | | | | mceusb_init_rc_dev() does usb_get_dev(), but there is no any usb_put_dev() in the driver. The patch tries to straighten logic. It moves usb_get_dev() directly to mceusb_dev_probe() and adds usb_put_dev() to an error path and to mceusb_dev_disconnect(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
* [media] mceusb: add support for more cx231xx devicesMatthias Schwarzott2014-09-231-0/+4
| | | | | | | | | | | | Add support for the si2161-based cx231xx devices: [2040:b138] Hauppauge WinTV HVR-900-H (model 111xxx) [2040:b139] Hauppauge WinTV HVR-901-H (model 1114xx) They're similar to the already supported: [2040:b130] Hauppauge WinTV 930C-HD (model 1113xx) Signed-off-by: Matthias Schwarzott <zzam@gentoo.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
* [media] mceusb: select default keytable based on vendorMauro Carvalho Chehab2014-07-271-6/+17
| | | | | | | | | | | | | | | | Some vendors have their on keymap table that are used on all (or almost all) models for that vendor. So, instead of specifying the keymap table per USB ID, let's use the Vendor ID's table by default. At the end, this will mean less code to be added when newer devices for those vendors are added. Of course, if rc_map is specified per board, it takes precedence. Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
* [media] mceusb: add support for newer cx231xx devicesMauro Carvalho Chehab2014-07-271-0/+8
| | | | | | | | | | | | Add support for the si2165-based cx231xx devices: [2013:025e] PCTV QuatroStick 522e [2013:0259] PCTV QuatroStick 521e [2040:b131] Hauppauge WinTV 930C-HD (model 1114xx) They're similar to the already supported: [2040:b130] Hauppauge WinTV 930C-HD (model 1113xx) Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
* [media] rc-core: remove protocol arraysDavid Härdeman2014-07-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | The basic API of rc-core used to be: dev = rc_allocate_device(); dev->x = a; dev->y = b; dev->z = c; rc_register_device(); which is a pretty common pattern in the kernel, after the introduction of protocol arrays the API looks something like: dev = rc_allocate_device(); dev->x = a; rc_set_allowed_protocols(dev, RC_BIT_X); dev->z = c; rc_register_device(); There's no real need for the protocols to be an array, so change it back to be consistent (and in preparation for the following patches). [m.chehab@samsung.com: added missing changes at some files] Signed-off-by: David Härdeman <david@hardeman.nu> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
* [media] fix mceusb endpoint type identification/handlingMatt DeVillier2014-05-251-30/+35
| | | | | | | | | | | | | | Change the I/O endpoint handling of the mceusb driver to respect the endpoint type reported by device (bulk/interrupt), rather than treating all endpoints as type interrupt, which breaks devices using bulk endpoints when connected to a xhci controller. Accordingly, change the function calls to initialize an endpoint's transfer pipe and urb handlers to use the correct function based on the endpoint type. [m.chehab@samsung.com: Fix merge conflicts and compilation breakage] Signed-off-by: Matt DeVillier <matt.devillier@gmail.com> Tested-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
* [media] rc: abstract access to allowed/enabled protocolsJames Hogan2014-03-111-1/+1
| | | | | | | | | | | The allowed and enabled protocol masks need to be expanded to be per filter type in order to support wakeup filter protocol selection. To ease that process abstract access to the rc_dev::allowed_protos and rc_dev::enabled_protocols members with inline functions. Signed-off-by: James Hogan <james.hogan@imgtec.com> Reviewed-by: Antti Seppälä <a.seppala@gmail.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
* [media] mceusb: improve error loggingSean Young2014-02-041-97/+85
| | | | | | | | | | | | A number of recent bug reports involve usb_submit_urb() failing which was only reported with debug parameter on. In addition, remove custom debug function. [m.chehab@samsung.com: patch rebased, as one of the patches on this series need changes] Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
* [media] mceusb: Add Hauppauge WinTV-HVR-930C HDMatthias Schwarzott2013-12-101-0/+10
| | | | | | | | | | | | | Add usb id of Hauppauge WinTV-HVR-930C HD to mceusb RC driver. This device has no IR transmitter (according to eeprom content decoded by tveeprom). Set the rc mapping to Hauppauge, every key of the deliviered remote control works correctly. [m.chehab@samsung.com: fix merge conflicts and unmangled whitespace] Signed-off-by: Matthias Schwarzott <zzam@gentoo.org> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
OpenPOWER on IntegriCloud