Rename struct sms_msg_data4 to sms_msg_data5 and increase the size of
its msg_data array from 4 to 5 elements. Notice that at some point
the 5th element of msg_data is being accessed in function
smscore_load_firmware_family2():
1006 trigger_msg->msg_data[4] = 4; /* Task ID */
Also, there is no need for the object _trigger_msg_ of type struct
sms_msg_data *, when _msg_ can be used, directly. Notice that msg_data
in struct sms_msg_data is a one-element array, which causes multiple
out-of-bounds warnings when accessing beyond its first element
in function smscore_load_firmware_family2():
992 struct sms_msg_data *trigger_msg =
993 (struct sms_msg_data *) msg;
994
995 pr_debug("sending MSG_SMS_SWDOWNLOAD_TRIGGER_REQ\n");
996 SMS_INIT_MSG(&msg->x_msg_header,
997 MSG_SMS_SWDOWNLOAD_TRIGGER_REQ,
998 sizeof(struct sms_msg_hdr) +
999 sizeof(u32) * 5);
1000
1001 trigger_msg->msg_data[0] = firmware->start_address;
1002 /* Entry point */
1003 trigger_msg->msg_data[1] = 6; /* Priority */
1004 trigger_msg->msg_data[2] = 0x200; /* Stack size */
1005 trigger_msg->msg_data[3] = 0; /* Parameter */
1006 trigger_msg->msg_data[4] = 4; /* Task ID */
even when enough dynamic memory is allocated for _msg_:
929 /* PAGE_SIZE buffer shall be enough and dma aligned */
930 msg = kmalloc(PAGE_SIZE, GFP_KERNEL | coredev->gfp_buf_flags);
but as _msg_ is casted to (struct sms_msg_data *):
992 struct sms_msg_data *trigger_msg =
993 (struct sms_msg_data *) msg;
the out-of-bounds warnings are actually valid and should be addressed.
Fix this by declaring object _msg_ of type struct sms_msg_data5 *,
which contains a 5-elements array, instead of just 4. And use
_msg_ directly, instead of creating object trigger_msg.
This helps with the ongoing efforts to enable -Warray-bounds by fixing
the following warnings:
CC [M] drivers/media/common/siano/smscoreapi.o
drivers/media/common/siano/smscoreapi.c: In function ‘smscore_load_firmware_family2’:
drivers/media/common/siano/smscoreapi.c:1003:24: warning: array subscript 1 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds]
1003 | trigger_msg->msg_data[1] = 6; /* Priority */
| ~~~~~~~~~~~~~~~~~~~~~^~~
In file included from drivers/media/common/siano/smscoreapi.c:12:
drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’
619 | u32 msg_data[1];
| ^~~~~~~~
drivers/media/common/siano/smscoreapi.c:1004:24: warning: array subscript 2 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds]
1004 | trigger_msg->msg_data[2] = 0x200; /* Stack size */
| ~~~~~~~~~~~~~~~~~~~~~^~~
In file included from drivers/media/common/siano/smscoreapi.c:12:
drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’
619 | u32 msg_data[1];
| ^~~~~~~~
drivers/media/common/siano/smscoreapi.c:1005:24: warning: array subscript 3 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds]
1005 | trigger_msg->msg_data[3] = 0; /* Parameter */
| ~~~~~~~~~~~~~~~~~~~~~^~~
In file included from drivers/media/common/siano/smscoreapi.c:12:
drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’
619 | u32 msg_data[1];
| ^~~~~~~~
drivers/media/common/siano/smscoreapi.c:1006:24: warning: array subscript 4 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds]
1006 | trigger_msg->msg_data[4] = 4; /* Task ID */
| ~~~~~~~~~~~~~~~~~~~~~^~~
In file included from drivers/media/common/siano/smscoreapi.c:12:
drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’
619 | u32 msg_data[1];
| ^~~~~~~~
Fixes: 018b0c6f8a ("[media] siano: make load firmware logic to work with newer firmwares")
Co-developed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Use the mutex api instead of renaming the calls for this
driver.
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Macros MSG_SMS_ENBALE_TS_INTERFACE_REQ and MSG_SMS_ENBALE_TS_INTERFACE_RES
contain a spelling mistake. Fix these by replacing ENBALE with ENABLE.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Based on 1 normalized pattern(s):
this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license version 2 as
published by the free software foundation software distributed under
the license is distributed on an as is basis without warranty of any
kind either express or implied see the gnu general public license
for more details
extracted by the scancode license scanner the SPDX license identifier
GPL-2.0-only
has been chosen to replace the boilerplate/reference in 3 file(s).
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Richard Fontana <rfontana@redhat.com>
Reviewed-by: Alexios Zavras <alexios.zavras@intel.com>
Reviewed-by: Steve Winslow <swinslow@gmail.com>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190528170026.802279667@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The implementation of strscpy() is more robust and safer.
That's now the recommended way to copy NUL terminated strings.
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Right now, the Siano's core uses GFP_DMA for both USB and
SDIO variants of the driver. There's no reason to use it
for USB. So, pass GFP_DMA as a parameter during sms core
register.
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Right now, at siano driver, all places where devpath is
defined has sizeof(devpath) == 32. So, there's no practical
risc of going past devpath array anywhere.
Still, code changes might cause troubles. It also confuses
Coverity:
CID 139059 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)
9. fixed_size_dest: You might overrun the 32-character
fixed-size string entry->devpath by copying devpath
without checking the length.
10. parameter_as_source: Note: This defect has an
elevated risk because the source argument
is a parameter of the current function.
So, explicitly limit strcmp() and strcpy() to ensure that the
devpath size (32) will be respected.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
On some architectures such as arm64, siano chip based TV-tuner
USB devices are not recognized correctly due to coherent memory
allocation failure with the following error:
[ 663.556135] usbcore: deregistering interface driver smsusb
[ 683.624809] smsusb:smsusb_probe: board id=18, interface number 0
[ 683.633530] smsusb:smsusb_init_device: smscore_register_device(...) failed, rc -12
[ 683.641501] smsusb:smsusb_probe: Device initialized with return code -12
[ 683.652978] smsusb: probe of 1-1:1.0 failed with error -12
This is caused by dma_alloc_coherent(NULL, ...) returning NULL in
smscoreapi.c.
To fix this error, allocate the buffer memory for the USB devices
via kmalloc() and let the USB core do the DMA mapping and free.
Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
The Siano driver doesn't use kernel-doc markups. While it
would be wanderful to convert to use it, it is probably
not worth the time.
So, instead of solving all problems there, just make
sure that it won't produce dozens of warnings.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
The script “checkpatch.pl” pointed information out like the following.
Comparison to NULL could be written !…
Thus fix the affected source code places.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Replace the specification of a data structure by a pointer dereference
as the parameter for the operator "sizeof" to make the corresponding size
determination a bit safer according to the Linux coding style convention.
This issue was detected by using the Coccinelle software.
[mchehab@s-opensoure.com: merge similar patches into one]
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Omit an extra message for a memory allocation failure in this function.
This issue was detected by using the Coccinelle software.
[mchehab@s-opensource.com: fold several similar patches into one]
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Drop the FSF's postal address from the source code files that typically
contain mostly the license text. Of the 628 removed instances, 578 are
outdated.
The patch has been created with the following command without manual edits:
git grep -l "675 Mass Ave\|59 Temple Place\|51 Franklin St" -- \
drivers/media/ include/media|while read i; do i=$i perl -e '
open(F,"< $ENV{i}");
$a=join("", <F>);
$a =~ s/[ \t]*\*\n.*You should.*\n.*along with.*\n.*(\n.*USA.*$)?\n//m
&& $a =~ s/(^.*)Or, (point your browser to) /$1To obtain the license, $2\n$1/m;
close(F);
open(F, "> $ENV{i}");
print F $a;
close(F);'; done
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
We need to initialize the media controller earlier, as the core
will call the smsdvb hotplug during register time. Ok, this is
an async operation, so, when the module is not loaded, the media
controller works.
However, if the module is already loaded, nothing will be
registered at the media controller, as it will load too late.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
All siano modules have a sms_dbg parameter. Now that we're using
the standard pr_debug() macro, we can get rid of it.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
On most cases, sms_info() should actually be pr_debug(), but,
on other places, it should be pr_info().
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
There's no reason to use a macro here. Just replace everything,
and let those debug messages to be activated via dynamic printk.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Originally, sms_err() would be also displaying the line where
the error occurs, but the messages are clear enough. Also,
the function is always printed. So, no need for it.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Instead of defining its own set of printk functions, let's
use the common Kernel debug logic provided by pr_foo functions.
As a first step, let's just define the existing macros as the
Kernel ones.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Instead of allocating a var to store 0 and just return it,
change the code to return 0 directly.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
drivers/media/common/siano/smsdvb-main.c:47:5: warning: symbol 'sms_to_guard_interval_table' was not declared. Should it be static?
drivers/media/common/siano/smsdvb-main.c:54:5: warning: symbol 'sms_to_code_rate_table' was not declared. Should it be static?
drivers/media/common/siano/smsdvb-main.c:63:5: warning: symbol 'sms_to_hierarchy_table' was not declared. Should it be static?
drivers/media/common/siano/smsdvb-main.c:70:5: warning: symbol 'sms_to_modulation_table' was not declared. Should it be static?
drivers/media/common/siano/smscoreapi.c:925:35: warning: cast to restricted __le32
drivers/media/common/siano/smscoreapi.c:926:28: warning: cast to restricted __le32
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
At this bugzilla and similar ones:
https://bugzilla.kernel.org/show_bug.cgi?id=60645
Those debug messages were seen as errors, but they're just debug
data, and are OK to appear on sms1100 and sms2270. Re-tag them
to appear only if debug is enabled.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Tested-by: André Roth <neolynx@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Ensure release_firmware is called if kmalloc fails.
[mchehab@redhat.com: patch unmangled and converted from -p2 to -p1]
Signed-off-by: Roberto Alcantara <roberto@eletronica.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
If firmware load fails, report it as an error.
Signed-off-by: Roberto Alcantara <roberto@eletronica.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
As reported by Dan Carpenter:
FYI, there are new smatch warnings show up in
tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next master
head: da17d7bda957ae4697b6abc0793f74fb9b50b58f
commit: 4c3bdb5e2f [media] siano: better debug send/receive messages
drivers/media/common/siano/smscoreapi.c:396 smscore_translate_msg() error: buffer overflow 'siano_msgs' 401 <= 401
While it is almost impossible for this error to happen in
practice, as it would require the siano's firmware to return
an special invalid answer to a message request, fixing it
is trivial. So, let's do it.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/common/siano/smsdvb-debugfs.c:51:6: warning: no previous prototype for 'smsdvb_print_dvb_stats' [-Wmissing-prototypes]
drivers/media/common/siano/smsdvb-debugfs.c:154:6: warning: no previous prototype for 'smsdvb_print_isdb_stats' [-Wmissing-prototypes]
drivers/media/common/siano/smsdvb-debugfs.c:244:6: warning: no previous prototype for 'smsdvb_print_isdb_stats_ex' [-Wmissing-prototypes]
drivers/media/common/siano/smscoreapi.c:832:5: warning: no previous prototype for 'smscore_configure_board' [-Wmissing-prototypes]
drivers/media/common/siano/smscoreapi.c:1301:5: warning: no previous prototype for 'smscore_init_device' [-Wmissing-prototypes]
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Fix all other remaining checkpatch.pl compliants on the Siano driver,
except for the 80-cols (soft) limit. Those are harder to fix, and
probably not worth to do right now.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Remove the remaining CamelCase checkpatch.pl compliants.
There are still a few left, but those are due to USB and
DVB APIs.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
It is almost impossible to see a compliant with checkpatch.pl
on those Siano drivers, as there are simply too much violations
on it. So, now that a big change was done, the better is to
cleanup the checkpatch compliants.
Let's first replace all CammelCase symbols found at smscoreapi.h
using camel_case namespace. That removed 144 checkpatch.pl
compliants on this file. Of course, the other files need to be
fixed accordingly.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
There are too many firmwares there. As we need to add
MODULE_FIMWARE() macros, the better is to define their names
on just one place and use the macros for both cards/device type
tables and MODULE_FIRMWARE().
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
When the driver is tuned into chanel, and it is removed/reinserted,
the message stream data may be arriving during device probe:
[ 5680.162004] smscore_set_device_mode: set device mode to 6
[ 5680.162267] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.162391] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.162641] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.162891] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.163016] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.163266] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.163516] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.163640] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.163891] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.164016] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.164265] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.164515] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.164519] smscore_onresponse: Firmware id 6 prots 0x40 ver 8.1
[ 5680.164766] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.166018] smscore_onresponse: message MSG_SMS_DVBT_BDA_DATA(693) not handled.
[ 5680.166438] DVB: registering new adapter (Siano Rio Digital Receiver)
Instead of complaining, just silently discard those messages, instead of
complaining.
A proper fix is to put the device on suspend/power down mode when the module
is removed.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
sms_debug() and sms_info() already adds a '\n' at the printed
strings. No need to add more.
That helps to cleanup stuff like:
[ 4868.205648] smscore_onresponse: message not handled.
[ 4868.205898] smscore_onresponse: message not handled.
and:
[ 5467.959769] smscore_onresponse:
data rate 143069 bytes/secs
While here, provides the message name, when the message is not
handled by the smsmdtv core.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Put this function earlier in the code, to avoid the need of
defining a function stub.
No functional changes.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
There is an special lookup code that is called when
SMS_BOARD_UNKNOWN. The logic there is bogus and will cause
an oops, as .type is SMS_UNKNOWN_TYPE (-1).
As the code would do:
return smscore_fw_lkup[type][mode];
That would mean that it would try to go past the
smscore_fw_lkup table.
So, just remove that bogus code, simplifying the logic.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Instead of using a global default_mode, passed via modprobe
parameter, use the one defined inside the cards struct.
That will prevent the need of manually specify it for each
board, except, of course, if the user wants to do something
different, on boards that accept multiple types.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
There are two ways to specify firmware for siano devices: a
per-device ID and a per-device type.
The per-device type logic is currently made by a 11x9 string
table, sparsely filled. It is very hard to read the table at
the source code, as there are too much "none" filling there
("none" there is a way to tell NULL).
Instead of using such problematic table, convert it into an
easy to read table, where the unused values will be defaulted
to NULL.
While here, also simplifies a little bit the logic and print
a message if an user-selected mode doesn't exist.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Currently, every time a message is sent or received, the endiannes
need to be fixed on big endian machines. This is currently done
on every call to the send API, and on every msg reception logic.
Instead of doing that, move it to the send/receive functions.
That simplifies the logic and avoids the risk of forgetting to
fix it somewhere.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Some cleanups at smscoreapi. Most are just CodingStyle.
Also, use kzalloc when allocating a new buffer, as it initializes
the allocated space with zero.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Don't keep in the dark: report the firmware file name after
lookup. That helps to debug what's happening when a firmware is not
found.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
There are new firmwares for sms2xxx devices. Change the firmware
load logic to handle those newer firmwares and devices.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
As there are some changes that seem to be firmware-dependent,
we need to store the firmware version, as we don't want to break
support for existing cards that use a legacy (and sometimes
custom) firmware.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Board #0 is an existing one. Instead of initializing the driver
with it, use a different value to detect if board is unknown.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Instead of printing a message for some random messages, print
it for all sent/received ones. That helps a lot to debug
what's going on.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
The same GPIO config struct was declared twice at the
driver, with different names and different macros:
struct smscore_config_gpio
struct smscore_config_gpio
Remove the one that uses CamelCase and fix the references to
its attributes/macros.
No functional changes.
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Gustavo A. R. Silva