Commit message: V4L/DVB (9624): CVE-2008-5033: fix OOPS on tvaudio when controlling bass/treble

This bug were supposed to be fixed by 5ba2f67afb02c5302b2898949ed6fc3b3d37dcf1,
where a call to NULL happens.

Not all tvaudio chips allow controlling bass/treble. So, the driver
has a table with a flag to indicate if the chip does support it.

Unfortunately, the handling of this logic were broken for a very long
time (probably since the first module version). Due to that, an OOPS
were generated for devices that don't support bass/treble.

This were the resulting OOPS message before the patch, with debug messages
enabled:

tvaudio' 1-005b: VIDIOC_S_CTRL
BUG: unable to handle kernel NULL pointer dereference at 00000000
IP: [<00000000>]
*pde = 22fda067 *pte = 00000000
Oops: 0000 [#1] SMP
Modules linked in: snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_hwdep snd soundcore tuner_simple tuner_types tea5767 tuner
tvaudio bttv bridgebnep rfcomm l2cap bluetooth it87 hwmon_vid hwmon fuse sunrpc ipt_REJECT
nf_conntrack_ipv4 iptable_filter ip_tables ip6t_REJECT xt_tcpudp nf_conntrack_ipv6 xt_state nf_conntrack
ip6table_filter ip6_tables x_tables ipv6 dm_mirrordm_multipath dm_mod configfs videodev v4l1_compat
ir_common 8139cp compat_ioctl32 v4l2_common 8139too videobuf_dma_sg videobuf_core mii btcx_risc tveeprom
i915 button snd_page_alloc serio_raw drm pcspkr i2c_algo_bit i2c_i801 i2c_core iTCO_wdt
iTCO_vendor_support sr_mod cdrom sg ata_generic pata_acpi ata_piix libata sd_mod scsi_mod ext3 jbdmbcache
uhci_hcd ohci_hcd ehci_hcd [last unloaded: soundcore]

Pid: 15413, comm: qv4l2 Not tainted (2.6.25.14-108.fc9.i686 #1)
EIP: 0060:[<00000000>] EFLAGS: 00210246 CPU: 0
EIP is at 0x0
EAX: 00008000 EBX: ebd21600 ECX: e2fd9ec4 EDX: 00200046
ESI: f8c0f0c4 EDI: f8c0f0c4 EBP: e2fd9d50 ESP: e2fd9d2c
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process qv4l2 (pid: 15413, ti=e2fd9000 task=ebe44000 task.ti=e2fd9000)
Stack: f8c0c6ae e2ff2a00 00000d00 e2fd9ec4 ebc4e000 e2fd9d5c f8c0c448 00000000
       f899c12a e2fd9d5c f899c154 e2fd9d68 e2fd9d80 c0560185 e2fd9d88 f8f3e1d8
       f8f3e1dc ebc4e034 f8f3e18c e2fd9ec4 00000000 e2fd9d90 f899c286 c008561c
Call Trace:
 [<f8c0c6ae>] ? chip_command+0x266/0x4b6 [tvaudio]
 [<f8c0c448>] ? chip_command+0x0/0x4b6 [tvaudio]
 [<f899c12a>] ? i2c_cmd+0x0/0x2f [i2c_core]
 [<f899c154>] ? i2c_cmd+0x2a/0x2f [i2c_core]
 [<c0560185>] ? device_for_each_child+0x21/0x49
 [<f899c286>] ? i2c_clients_command+0x1c/0x1e [i2c_core]
 [<f8f283d8>] ? bttv_call_i2c_clients+0x14/0x16 [bttv]
 [<f8f23601>] ? bttv_s_ctrl+0x1bc/0x313 [bttv]
 [<f8f23445>] ? bttv_s_ctrl+0x0/0x313 [bttv]
 [<f8b6096d>] ? __video_do_ioctl+0x1f84/0x3726 [videodev]
 [<c05abb4e>] ? sock_aio_write+0x100/0x10d
 [<c041b23e>] ? kmap_atomic_prot+0x1dd/0x1df
 [<c043a0c9>] ? enqueue_hrtimer+0xc2/0xcd
 [<c04f4fa4>] ? copy_from_user+0x39/0x121
 [<f8b622b9>] ? __video_ioctl2+0x1aa/0x24a [videodev]
 [<c04054fd>] ? do_notify_resume+0x768/0x795
 [<c043c0f7>] ? getnstimeofday+0x34/0xd1
 [<c0437b77>] ? autoremove_wake_function+0x0/0x33
 [<f8b62368>] ? video_ioctl2+0xf/0x13 [videodev]
 [<c048c6f0>] ? vfs_ioctl+0x50/0x69
 [<c048c942>] ? do_vfs_ioctl+0x239/0x24c
 [<c048c995>] ? sys_ioctl+0x40/0x5b
 [<c0405bf2>] ? syscall_call+0x7/0xb
 [<c0620000>] ? cpuid4_cache_sysfs_exit+0x3d/0x69
 =======================
Code:  Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:e2fd9d2c

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
CVE: CVE-2008-5033
CWE: CWE-399
Vulnerability description: The chip_command function in drivers/media/video/tvaudio.c in the Linux kernel 2.6.25.x before 2.6.25.19, 2.6.26.x before 2.6.26.7, and 2.6.27.x before 2.6.27.3 allows attackers to cause a denial of service (NULL function pointer dereference and OOPS) via unknown vectors.

Project: linux-2.6

static int ta8874z_checkit(struct CHIPSTATE *chip)
{
	int rc;
	rc = chip_read(chip);
	return ((rc & 0x1f) == 0x1f) ? 1 : 0;
}

Project: linux-2.6

static int chip_read2(struct CHIPSTATE *chip, int subaddr)
{
	unsigned char write[1];
	unsigned char read[1];
	struct i2c_msg msgs[2] = {
		{ chip->c->addr, 0,        1, write },
		{ chip->c->addr, I2C_M_RD, 1, read  }
	};
	write[0] = subaddr;

	if (2 != i2c_transfer(chip->c->adapter,msgs,2)) {
		v4l_warn(chip->c, "%s: I/O error (read2)\n", chip->c->name);
		return -1;
	}
	v4l_dbg(1, debug, chip->c, "%s: chip_read2: reg%d=0x%x\n",
		chip->c->name, subaddr,read[0]);
	return read[0];
}

Project: linux-2.6

static int chip_read(struct CHIPSTATE *chip)
{
	unsigned char buffer;

	if (1 != i2c_master_recv(chip->c,&buffer,1)) {
		v4l_warn(chip->c, "%s: I/O error (read)\n",
		chip->c->name);
		return -1;
	}
	v4l_dbg(1, debug, chip->c, "%s: chip_read: 0x%x\n",chip->c->name, buffer);
	return buffer;
}

Project: linux-2.6

static void tda8425_setmode(struct CHIPSTATE *chip, int mode)
{
	int s1 = chip->shadow.bytes[TDA8425_S1+1] & 0xe1;

	if (mode & V4L2_TUNER_MODE_LANG1) {
		s1 |= TDA8425_S1_ML_SOUND_A;
		s1 |= TDA8425_S1_STEREO_PSEUDO;

	} else if (mode & V4L2_TUNER_MODE_LANG2) {
		s1 |= TDA8425_S1_ML_SOUND_B;
		s1 |= TDA8425_S1_STEREO_PSEUDO;

	} else {
		s1 |= TDA8425_S1_ML_STEREO;

		if (mode & V4L2_TUNER_MODE_MONO)
			s1 |= TDA8425_S1_STEREO_MONO;
		if (mode & V4L2_TUNER_MODE_STEREO)
			s1 |= TDA8425_S1_STEREO_SPATIAL;
	}
	chip_write(chip,TDA8425_S1,s1);
}

Project: linux-2.6

static int tda8425_shift10(int val) { return (val >> 10) | 0xc0; }

Project: linux-2.6

static int chip_command(struct i2c_client *client,
			unsigned int cmd, void *arg)
{
	struct CHIPSTATE *chip = i2c_get_clientdata(client);
	struct CHIPDESC  *desc = chip->desc;

	if (debug > 0) {
		v4l_i2c_print_ioctl(chip->c, cmd);
		printk("\n");
	}

	switch (cmd) {
	case AUDC_SET_RADIO:
		chip->radio = 1;
		chip->watch_stereo = 0;
		/* del_timer(&chip->wt); */
		break;
	/* --- v4l ioctls --- */
	/* take care: bttv does userspace copying, we'll get a
	kernel pointer here... */
	case VIDIOC_QUERYCTRL:
	{
		struct v4l2_queryctrl *qc = arg;

		switch (qc->id) {
			case V4L2_CID_AUDIO_MUTE:
				break;
			case V4L2_CID_AUDIO_VOLUME:
			case V4L2_CID_AUDIO_BALANCE:
				if (!(desc->flags & CHIP_HAS_VOLUME))
					return -EINVAL;
				break;
			case V4L2_CID_AUDIO_BASS:
			case V4L2_CID_AUDIO_TREBLE:
				if (!(desc->flags & CHIP_HAS_BASSTREBLE))
					return -EINVAL;
				break;
			default:
				return -EINVAL;
		}
		return v4l2_ctrl_query_fill_std(qc);
	}
	case VIDIOC_S_CTRL:
		return tvaudio_set_ctrl(chip, arg);

	case VIDIOC_G_CTRL:
		return tvaudio_get_ctrl(chip, arg);
	case VIDIOC_INT_G_AUDIO_ROUTING:
	{
		struct v4l2_routing *rt = arg;

		rt->input = chip->input;
		rt->output = 0;
		break;
	}
	case VIDIOC_INT_S_AUDIO_ROUTING:
	{
		struct v4l2_routing *rt = arg;

		if (!(desc->flags & CHIP_HAS_INPUTSEL) || rt->input >= 4)
				return -EINVAL;
		/* There are four inputs: tuner, radio, extern and intern. */
		chip->input = rt->input;
		if (chip->muted)
			break;
		chip_write_masked(chip, desc->inputreg,
				desc->inputmap[chip->input], desc->inputmask);
		break;
	}
	case VIDIOC_S_TUNER:
	{
		struct v4l2_tuner *vt = arg;
		int mode = 0;

		if (chip->radio)
			break;
		switch (vt->audmode) {
		case V4L2_TUNER_MODE_MONO:
		case V4L2_TUNER_MODE_STEREO:
		case V4L2_TUNER_MODE_LANG1:
		case V4L2_TUNER_MODE_LANG2:
			mode = vt->audmode;
			break;
		case V4L2_TUNER_MODE_LANG1_LANG2:
			mode = V4L2_TUNER_MODE_STEREO;
			break;
		default:
			return -EINVAL;
		}
		chip->audmode = vt->audmode;

		if (desc->setmode && mode) {
			chip->watch_stereo = 0;
			/* del_timer(&chip->wt); */
			chip->mode = mode;
			desc->setmode(chip, mode);
		}
		break;
	}
	case VIDIOC_G_TUNER:
	{
		struct v4l2_tuner *vt = arg;
		int mode = V4L2_TUNER_MODE_MONO;

		if (chip->radio)
			break;
		vt->audmode = chip->audmode;
		vt->rxsubchans = 0;
		vt->capability = V4L2_TUNER_CAP_STEREO |
			V4L2_TUNER_CAP_LANG1 | V4L2_TUNER_CAP_LANG2;

		if (desc->getmode)
			mode = desc->getmode(chip);

		if (mode & V4L2_TUNER_MODE_MONO)
			vt->rxsubchans |= V4L2_TUNER_SUB_MONO;
		if (mode & V4L2_TUNER_MODE_STEREO)
			vt->rxsubchans |= V4L2_TUNER_SUB_STEREO;
		/* Note: for SAP it should be mono/lang2 or stereo/lang2.
		   When this module is converted fully to v4l2, then this
		   should change for those chips that can detect SAP. */
		if (mode & V4L2_TUNER_MODE_LANG1)
			vt->rxsubchans = V4L2_TUNER_SUB_LANG1 |
					 V4L2_TUNER_SUB_LANG2;
		break;
	}
	case VIDIOC_S_STD:
		chip->radio = 0;
		break;
	case VIDIOC_S_FREQUENCY:
		chip->mode = 0; /* automatic */

		/* For chips that provide getmode and setmode, and doesn't
		   automatically follows the stereo carrier, a kthread is
		   created to set the audio standard. In this case, when then
		   the video channel is changed, tvaudio starts on MONO mode.
		   After waiting for 2 seconds, the kernel thread is called,
		   to follow whatever audio standard is pointed by the
		   audio carrier.
		 */
		if (chip->thread) {
			desc->setmode(chip,V4L2_TUNER_MODE_MONO);
			if (chip->prevmode != V4L2_TUNER_MODE_MONO)
				chip->prevmode = -1; /* reset previous mode */
			mod_timer(&chip->wt, jiffies+msecs_to_jiffies(2000));
		}
		break;

	case VIDIOC_G_CHIP_IDENT:
		return v4l2_chip_ident_i2c_client(client, arg, V4L2_IDENT_TVAUDIO, 0);
	}
	return 0;
}

Project: linux-2.6

static int tea6300_shift10(int val) { return val >> 10; }

Project: linux-2.6

static int chip_probe(struct i2c_client *client, const struct i2c_device_id *id)
{
	struct CHIPSTATE *chip;
	struct CHIPDESC  *desc;

	if (debug) {
		printk(KERN_INFO "tvaudio: TV audio decoder + audio/video mux driver\n");
		printk(KERN_INFO "tvaudio: known chips: ");
		for (desc = chiplist; desc->name != NULL; desc++)
			printk("%s%s", (desc == chiplist) ? "" : ", ", desc->name);
		printk("\n");
	}

	chip = kzalloc(sizeof(*chip),GFP_KERNEL);
	if (!chip)
		return -ENOMEM;
	chip->c = client;
	i2c_set_clientdata(client, chip);

	/* find description for the chip */
	v4l_dbg(1, debug, client, "chip found @ 0x%x\n", client->addr<<1);
	for (desc = chiplist; desc->name != NULL; desc++) {
		if (0 == *(desc->insmodopt))
			continue;
		if (client->addr < desc->addr_lo ||
		    client->addr > desc->addr_hi)
			continue;
		if (desc->checkit && !desc->checkit(chip))
			continue;
		break;
	}
	if (desc->name == NULL) {
		v4l_dbg(1, debug, client, "no matching chip description found\n");
		kfree(chip);
		return -EIO;
	}
	v4l_info(client, "%s found @ 0x%x (%s)\n", desc->name, client->addr<<1, client->adapter->name);
	if (desc->flags) {
		v4l_dbg(1, debug, client, "matches:%s%s%s.\n",
			(desc->flags & CHIP_HAS_VOLUME)     ? " volume"      : "",
			(desc->flags & CHIP_HAS_BASSTREBLE) ? " bass/treble" : "",
			(desc->flags & CHIP_HAS_INPUTSEL)   ? " audiomux"    : "");
	}

	/* fill required data structures */
	if (!id)
		strlcpy(client->name, desc->name, I2C_NAME_SIZE);
	chip->desc = desc;
	chip->shadow.count = desc->registers+1;
	chip->prevmode = -1;
	chip->audmode = V4L2_TUNER_MODE_LANG1;

	/* initialization  */
	if (desc->initialize != NULL)
		desc->initialize(chip);
	else
		chip_cmd(chip,"init",&desc->init);

	if (desc->flags & CHIP_HAS_VOLUME) {
		if (!desc->volfunc) {
			/* This shouldn't be happen. Warn user, but keep working
			   without volume controls
			 */
			v4l_info(chip->c, "volume callback undefined!\n");
			desc->flags &= ~CHIP_HAS_VOLUME;
		} else {
			chip->left  = desc->leftinit  ? desc->leftinit  : 65535;
			chip->right = desc->rightinit ? desc->rightinit : 65535;
			chip_write(chip, desc->leftreg,
				   desc->volfunc(chip->left));
			chip_write(chip, desc->rightreg,
				   desc->volfunc(chip->right));
		}
	}
	if (desc->flags & CHIP_HAS_BASSTREBLE) {
		if (!desc->bassfunc || !desc->treblefunc) {
			/* This shouldn't be happen. Warn user, but keep working
			   without bass/treble controls
			 */
			v4l_info(chip->c, "bass/treble callbacks undefined!\n");
			desc->flags &= ~CHIP_HAS_BASSTREBLE;
		} else {
			chip->treble = desc->trebleinit ?
						desc->trebleinit : 32768;
			chip->bass   = desc->bassinit   ?
						desc->bassinit   : 32768;
			chip_write(chip, desc->bassreg,
				   desc->bassfunc(chip->bass));
			chip_write(chip, desc->treblereg,
				   desc->treblefunc(chip->treble));
		}
	}

	chip->thread = NULL;
	if (desc->flags & CHIP_NEED_CHECKMODE) {
		if (!desc->getmode || !desc->setmode) {
			/* This shouldn't be happen. Warn user, but keep working
			   without kthread
			 */
			v4l_info(chip->c, "set/get mode callbacks undefined!\n");
			return 0;
		}
		/* start async thread */
		init_timer(&chip->wt);
		chip->wt.function = chip_thread_wake;
		chip->wt.data     = (unsigned long)chip;
		chip->thread = kthread_run(chip_thread, chip, chip->c->name);
		if (IS_ERR(chip->thread)) {
			v4l_warn(chip->c, "%s: failed to create kthread\n",
			       chip->c->name);
			chip->thread = NULL;
		}
	}
	return 0;
}

Project: linux-2.6

static void chip_thread_wake(unsigned long data)
{
	struct CHIPSTATE *chip = (struct CHIPSTATE*)data;
	wake_up_process(chip->thread);
}

Project: linux-2.6

static int tda9874a_setup(struct CHIPSTATE *chip)
{
	chip_write(chip, TDA9874A_AGCGR, 0x00); /* 0 dB */
	chip_write(chip, TDA9874A_GCONR, tda9874a_GCONR);
	chip_write(chip, TDA9874A_MSR, (tda9874a_mode) ? 0x03:0x02);
	if(tda9874a_dic == 0x11) {
		chip_write(chip, TDA9874A_FMMR, 0x80);
	} else { /* dic == 0x07 */
		chip_cmd(chip,"tda9874_modelist",&tda9874a_modelist[tda9874a_STD].cmd);
		chip_write(chip, TDA9874A_FMMR, 0x00);
	}
	chip_write(chip, TDA9874A_C1OLAR, 0x00); /* 0 dB */
	chip_write(chip, TDA9874A_C2OLAR, 0x00); /* 0 dB */
	chip_write(chip, TDA9874A_NCONR, tda9874a_NCONR);
	chip_write(chip, TDA9874A_NOLAR, 0x00); /* 0 dB */
	/* Note: If signal quality is poor you may want to change NICAM */
	/* error limit registers (NLELR and NUELR) to some greater values. */
	/* Then the sound would remain stereo, but won't be so clear. */
	chip_write(chip, TDA9874A_NLELR, 0x14); /* default */
	chip_write(chip, TDA9874A_NUELR, 0x50); /* default */

	if(tda9874a_dic == 0x11) {
		chip_write(chip, TDA9874A_AMCONR, 0xf9);
		chip_write(chip, TDA9874A_SDACOSR, (tda9874a_mode) ? 0x81:0x80);
		chip_write(chip, TDA9874A_AOSR, 0x80);
		chip_write(chip, TDA9874A_MDACOSR, (tda9874a_mode) ? 0x82:0x80);
		chip_write(chip, TDA9874A_ESP, tda9874a_ESP);
	} else { /* dic == 0x07 */
		chip_write(chip, TDA9874A_AMCONR, 0xfb);
		chip_write(chip, TDA9874A_SDACOSR, (tda9874a_mode) ? 0x81:0x80);
		chip_write(chip, TDA9874A_AOSR, 0x00); /* or 0x10 */
	}
	v4l_dbg(1, debug, chip->c, "tda9874a_setup(): %s [0x%02X].\n",
		tda9874a_modelist[tda9874a_STD].name,tda9874a_STD);
	return 1;
}

Project: linux-2.6

static int tvaudio_set_ctrl(struct CHIPSTATE *chip,
			    struct v4l2_control *ctrl)
{
	struct CHIPDESC *desc = chip->desc;

	switch (ctrl->id) {
	case V4L2_CID_AUDIO_MUTE:
		if (ctrl->value < 0 || ctrl->value >= 2)
			return -ERANGE;
		chip->muted = ctrl->value;
		if (chip->muted)
			chip_write_masked(chip,desc->inputreg,desc->inputmute,desc->inputmask);
		else
			chip_write_masked(chip,desc->inputreg,
					desc->inputmap[chip->input],desc->inputmask);
		return 0;
	case V4L2_CID_AUDIO_VOLUME:
	{
		int volume,balance;

		if (!(desc->flags & CHIP_HAS_VOLUME))
			break;

		volume = max(chip->left,chip->right);
		if (volume)
			balance=(32768*min(chip->left,chip->right))/volume;
		else
			balance=32768;

		volume=ctrl->value;
		chip->left = (min(65536 - balance,32768) * volume) / 32768;
		chip->right = (min(balance,volume *(__u16)32768)) / 32768;

		chip_write(chip,desc->leftreg,desc->volfunc(chip->left));
		chip_write(chip,desc->rightreg,desc->volfunc(chip->right));

		return 0;
	}
	case V4L2_CID_AUDIO_BALANCE:
	{
		int volume, balance;
		if (!(desc->flags & CHIP_HAS_VOLUME))
			break;

		volume = max(chip->left,chip->right);
		balance = ctrl->value;

		chip_write(chip,desc->leftreg,desc->volfunc(chip->left));
		chip_write(chip,desc->rightreg,desc->volfunc(chip->right));

		return 0;
	}
	case V4L2_CID_AUDIO_BASS:
		if (!(desc->flags & CHIP_HAS_BASSTREBLE))
			break;
		chip->bass = ctrl->value;
		chip_write(chip,desc->bassreg,desc->bassfunc(chip->bass));

		return 0;
	case V4L2_CID_AUDIO_TREBLE:
		if (!(desc->flags & CHIP_HAS_BASSTREBLE))
			break;
		chip->treble = ctrl->value;
		chip_write(chip,desc->treblereg,desc->treblefunc(chip->treble));

		return 0;
	}
	return -EINVAL;
}

Project: linux-2.6

static int tda9855_volume(int val) { return val/0x2e8+0x27; }

Project: linux-2.6

static void tda985x_setmode(struct CHIPSTATE *chip, int mode)
{
	int update = 1;
	int c6 = chip->shadow.bytes[TDA985x_C6+1] & 0x3f;

	switch (mode) {
	case V4L2_TUNER_MODE_MONO:
		c6 |= TDA985x_MONO;
		break;
	case V4L2_TUNER_MODE_STEREO:
		c6 |= TDA985x_STEREO;
		break;
	case V4L2_TUNER_MODE_LANG1:
		c6 |= TDA985x_SAP;
		break;
	default:
		update = 0;
	}
	if (update)
		chip_write(chip,TDA985x_C6,c6);
}

Project: linux-2.6

static int tda9873_getmode(struct CHIPSTATE *chip)
{
	int val,mode;

	val = chip_read(chip);
	mode = V4L2_TUNER_MODE_MONO;
	if (val & TDA9873_STEREO)
		mode |= V4L2_TUNER_MODE_STEREO;
	if (val & TDA9873_DUAL)
		mode |= V4L2_TUNER_MODE_LANG1 | V4L2_TUNER_MODE_LANG2;
	v4l_dbg(1, debug, chip->c, "tda9873_getmode(): raw chip read: %d, return: %d\n",
		val, mode);
	return mode;
}

Project: linux-2.6

static int tda9873_checkit(struct CHIPSTATE *chip)
{
	int rc;

	if (-1 == (rc = chip_read2(chip,254)))
		return 0;
	return (rc & ~0x1f) == 0x80;
}

Project: linux-2.6

static int tda9874a_checkit(struct CHIPSTATE *chip)
{
	int dic,sic;	/* device id. and software id. codes */

	if(-1 == (dic = chip_read2(chip,TDA9874A_DIC)))
		return 0;
	if(-1 == (sic = chip_read2(chip,TDA9874A_SIC)))
		return 0;

	v4l_dbg(1, debug, chip->c, "tda9874a_checkit(): DIC=0x%X, SIC=0x%X.\n", dic, sic);

	if((dic == 0x11)||(dic == 0x07)) {
		v4l_info(chip->c, "found tda9874%s.\n", (dic == 0x11) ? "a":"h");
		tda9874a_dic = dic;	/* remember device id. */
		return 1;
	}
	return 0;	/* not found */
}

Project: linux-2.6

static int tda9840_getmode(struct CHIPSTATE *chip)
{
	int val, mode;

	val = chip_read(chip);
	mode = V4L2_TUNER_MODE_MONO;
	if (val & TDA9840_DS_DUAL)
		mode |= V4L2_TUNER_MODE_LANG1 | V4L2_TUNER_MODE_LANG2;
	if (val & TDA9840_ST_STEREO)
		mode |= V4L2_TUNER_MODE_STEREO;

	v4l_dbg(1, debug, chip->c, "tda9840_getmode(): raw chip read: %d, return: %d\n",
		val, mode);
	return mode;
}

Project: linux-2.6

static int tda9855_bass(int val)   { return val/0xccc+0x06; }

Project: linux-2.6

static int chip_cmd(struct CHIPSTATE *chip, char *name, audiocmd *cmd)
{
	int i;

	if (0 == cmd->count)
		return 0;

	if (cmd->count + cmd->bytes[0] - 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
		v4l_info(chip->c,
			 "Tried to access a non-existent register range: %d to %d\n",
			 cmd->bytes[0] + 1, cmd->bytes[0] + cmd->count - 1);
		return -EINVAL;
	}

	/* FIXME: it seems that the shadow bytes are wrong bellow !*/

	/* update our shadow register set; print bytes if (debug > 0) */
	v4l_dbg(1, debug, chip->c, "%s: chip_cmd(%s): reg=%d, data:",
		chip->c->name, name,cmd->bytes[0]);
	for (i = 1; i < cmd->count; i++) {
		if (debug)
			printk(" 0x%x",cmd->bytes[i]);
		chip->shadow.bytes[i+cmd->bytes[0]] = cmd->bytes[i];
	}
	if (debug)
		printk("\n");

	/* send data to the chip */
	if (cmd->count != i2c_master_send(chip->c,cmd->bytes,cmd->count)) {
		v4l_warn(chip->c, "%s: I/O error (%s)\n", chip->c->name, name);
		return -1;
	}
	return 0;
}

Project: linux-2.6

static int tda8425_initialize(struct CHIPSTATE *chip)
{
	struct CHIPDESC *desc = chip->desc;
	int inputmap[4] = { /* tuner	*/ TDA8425_S1_CH2, /* radio  */ TDA8425_S1_CH1,
			    /* extern	*/ TDA8425_S1_CH1, /* intern */ TDA8425_S1_OFF};

	if (chip->c->adapter->id == I2C_HW_B_RIVA) {
		memcpy (desc->inputmap, inputmap, sizeof (inputmap));
	}
	return 0;
}

Project: linux-2.6

static int tea6320_initialize(struct CHIPSTATE * chip)
{
	chip_write(chip, TEA6320_FFR, 0x3f);
	chip_write(chip, TEA6320_FFL, 0x3f);
	chip_write(chip, TEA6320_FRR, 0x3f);
	chip_write(chip, TEA6320_FRL, 0x3f);

	return 0;
}

Project: linux-2.6

static int tda8425_shift12(int val) { return (val >> 12) | 0xf0; }

Project: linux-2.6

static int chip_remove(struct i2c_client *client)
{
	struct CHIPSTATE *chip = i2c_get_clientdata(client);

	del_timer_sync(&chip->wt);
	if (chip->thread) {
		/* shutdown async thread */
		kthread_stop(chip->thread);
		chip->thread = NULL;
	}

	kfree(chip);
	return 0;
}

Project: linux-2.6

static int tda9840_checkit(struct CHIPSTATE *chip)
{
	int rc;
	rc = chip_read(chip);
	/* lower 5 bits should be 0 */
	return ((rc & 0x1f) == 0) ? 1 : 0;
}

Project: linux-2.6

static int chip_thread(void *data)
{
	struct CHIPSTATE *chip = data;
	struct CHIPDESC  *desc = chip->desc;
	int mode;

	v4l_dbg(1, debug, chip->c, "%s: thread started\n", chip->c->name);
	set_freezable();
	for (;;) {
		set_current_state(TASK_INTERRUPTIBLE);
		if (!kthread_should_stop())
			schedule();
		set_current_state(TASK_RUNNING);
		try_to_freeze();
		if (kthread_should_stop())
			break;
		v4l_dbg(1, debug, chip->c, "%s: thread wakeup\n", chip->c->name);

		/* don't do anything for radio or if mode != auto */
		if (chip->radio || chip->mode != 0)
			continue;

		/* have a look what's going on */
		mode = desc->getmode(chip);
		if (mode == chip->prevmode)
			continue;

		/* chip detected a new audio mode - set it */
		v4l_dbg(1, debug, chip->c, "%s: thread checkmode\n",
			chip->c->name);

		chip->prevmode = mode;

		if (mode & V4L2_TUNER_MODE_STEREO)
			desc->setmode(chip, V4L2_TUNER_MODE_STEREO);
		if (mode & V4L2_TUNER_MODE_LANG1_LANG2)
			desc->setmode(chip, V4L2_TUNER_MODE_STEREO);
		else if (mode & V4L2_TUNER_MODE_LANG1)
			desc->setmode(chip, V4L2_TUNER_MODE_LANG1);
		else if (mode & V4L2_TUNER_MODE_LANG2)
			desc->setmode(chip, V4L2_TUNER_MODE_LANG2);
		else
			desc->setmode(chip, V4L2_TUNER_MODE_MONO);

		/* schedule next check */
		mod_timer(&chip->wt, jiffies+msecs_to_jiffies(2000));
	}

	v4l_dbg(1, debug, chip->c, "%s: thread exiting\n", chip->c->name);
	return 0;
}

Project: linux-2.6

static void tda9873_setmode(struct CHIPSTATE *chip, int mode)
{
	int sw_data  = chip->shadow.bytes[TDA9873_SW+1] & ~ TDA9873_TR_MASK;
	/*	int adj_data = chip->shadow.bytes[TDA9873_AD+1] ; */

	if ((sw_data & TDA9873_INP_MASK) != TDA9873_INTERNAL) {
		v4l_dbg(1, debug, chip->c, "tda9873_setmode(): external input\n");
		return;
	}

	v4l_dbg(1, debug, chip->c, "tda9873_setmode(): chip->shadow.bytes[%d] = %d\n", TDA9873_SW+1, chip->shadow.bytes[TDA9873_SW+1]);
	v4l_dbg(1, debug, chip->c, "tda9873_setmode(): sw_data  = %d\n", sw_data);

	switch (mode) {
	case V4L2_TUNER_MODE_MONO:
		sw_data |= TDA9873_TR_MONO;
		break;
	case V4L2_TUNER_MODE_STEREO:
		sw_data |= TDA9873_TR_STEREO;
		break;
	case V4L2_TUNER_MODE_LANG1:
		sw_data |= TDA9873_TR_DUALA;
		break;
	case V4L2_TUNER_MODE_LANG2:
		sw_data |= TDA9873_TR_DUALB;
		break;
	default:
		chip->mode = 0;
		return;
	}

	chip_write(chip, TDA9873_SW, sw_data);
	v4l_dbg(1, debug, chip->c, "tda9873_setmode(): req. mode %d; chip_write: %d\n",
		mode, sw_data);
}

Project: linux-2.6

static int tvaudio_get_ctrl(struct CHIPSTATE *chip,
			    struct v4l2_control *ctrl)
{
	struct CHIPDESC *desc = chip->desc;

	switch (ctrl->id) {
	case V4L2_CID_AUDIO_MUTE:
		ctrl->value=chip->muted;
		return 0;
	case V4L2_CID_AUDIO_VOLUME:
		if (!(desc->flags & CHIP_HAS_VOLUME))
			break;
		ctrl->value = max(chip->left,chip->right);
		return 0;
	case V4L2_CID_AUDIO_BALANCE:
	{
		int volume;
		if (!(desc->flags & CHIP_HAS_VOLUME))
			break;
		volume = max(chip->left,chip->right);
		if (volume)
			ctrl->value=(32768*min(chip->left,chip->right))/volume;
		else
			ctrl->value=32768;
		return 0;
	}
	case V4L2_CID_AUDIO_BASS:
		if (!(desc->flags & CHIP_HAS_BASSTREBLE))
			break;
		ctrl->value = chip->bass;
		return 0;
	case V4L2_CID_AUDIO_TREBLE:
		if (!(desc->flags & CHIP_HAS_BASSTREBLE))
			break;
		ctrl->value = chip->treble;
		return 0;
	}
	return -EINVAL;
}

Project: linux-2.6

static int chip_write(struct CHIPSTATE *chip, int subaddr, int val)
{
	unsigned char buffer[2];

	if (subaddr < 0) {
		v4l_dbg(1, debug, chip->c, "%s: chip_write: 0x%x\n",
			chip->c->name, val);
		chip->shadow.bytes[1] = val;
		buffer[0] = val;
		if (1 != i2c_master_send(chip->c,buffer,1)) {
			v4l_warn(chip->c, "%s: I/O error (write 0x%x)\n",
				chip->c->name, val);
			return -1;
		}
	} else {
		if (subaddr + 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
			v4l_info(chip->c,
				"Tried to access a non-existent register: %d\n",
				subaddr);
			return -EINVAL;
		}

		v4l_dbg(1, debug, chip->c, "%s: chip_write: reg%d=0x%x\n",
			chip->c->name, subaddr, val);
		chip->shadow.bytes[subaddr+1] = val;
		buffer[0] = subaddr;
		buffer[1] = val;
		if (2 != i2c_master_send(chip->c,buffer,2)) {
			v4l_warn(chip->c, "%s: I/O error (write reg%d=0x%x)\n",
			chip->c->name, subaddr, val);
			return -1;
		}
	}
	return 0;
}

Project: linux-2.6

static int chip_write_masked(struct CHIPSTATE *chip,
			     int subaddr, int val, int mask)
{
	if (mask != 0) {
		if (subaddr < 0) {
			val = (chip->shadow.bytes[1] & ~mask) | (val & mask);
		} else {
			if (subaddr + 1 >= ARRAY_SIZE(chip->shadow.bytes)) {
				v4l_info(chip->c,
					"Tried to access a non-existent register: %d\n",
					subaddr);
				return -EINVAL;
			}

			val = (chip->shadow.bytes[subaddr+1] & ~mask) | (val & mask);
		}
	}
	return chip_write(chip, subaddr, val);
}

Project: linux-2.6

static int  tda985x_getmode(struct CHIPSTATE *chip)
{
	int mode;

	mode = ((TDA985x_STP | TDA985x_SAPP) &
		chip_read(chip)) >> 4;
	/* Add mono mode regardless of SAP and stereo */
	/* Allows forced mono */
	return mode | V4L2_TUNER_MODE_MONO;
}

Project: linux-2.6

static void tda9874a_setmode(struct CHIPSTATE *chip, int mode)
{
	/* Disable/enable NICAM auto-muting (based on DSR.RSSF status bit). */
	/* If auto-muting is disabled, we can hear a signal of degrading quality. */
	if(tda9874a_mode) {
		if(chip->shadow.bytes[MAXREGS-2] & 0x20) /* DSR.RSSF=1 */
			tda9874a_NCONR &= 0xfe; /* enable */
		else
			tda9874a_NCONR |= 0x01; /* disable */
		chip_write(chip, TDA9874A_NCONR, tda9874a_NCONR);
	}

	/* Note: TDA9874A supports automatic FM dematrixing (FMMR register)
	 * and has auto-select function for audio output (AOSR register).
	 * Old TDA9874H doesn't support these features.
	 * TDA9874A also has additional mono output pin (OUTM), which
	 * on same (all?) tv-cards is not used, anyway (as well as MONOIN).
	 */
	if(tda9874a_dic == 0x11) {
		int aosr = 0x80;
		int mdacosr = (tda9874a_mode) ? 0x82:0x80;

		switch(mode) {
		case V4L2_TUNER_MODE_MONO:
		case V4L2_TUNER_MODE_STEREO:
			break;
		case V4L2_TUNER_MODE_LANG1:
			aosr = 0x80; /* auto-select, dual A/A */
			mdacosr = (tda9874a_mode) ? 0x82:0x80;
			break;
		case V4L2_TUNER_MODE_LANG2:
			aosr = 0xa0; /* auto-select, dual B/B */
			mdacosr = (tda9874a_mode) ? 0x83:0x81;
			break;
		default:
			chip->mode = 0;
			return;
		}
		chip_write(chip, TDA9874A_AOSR, aosr);
		chip_write(chip, TDA9874A_MDACOSR, mdacosr);

		v4l_dbg(1, debug, chip->c, "tda9874a_setmode(): req. mode %d; AOSR=0x%X, MDACOSR=0x%X.\n",
			mode, aosr, mdacosr);

	} else { /* dic == 0x07 */
		int fmmr,aosr;

		switch(mode) {
		case V4L2_TUNER_MODE_MONO:
			fmmr = 0x00; /* mono */
			aosr = 0x10; /* A/A */
			break;
		case V4L2_TUNER_MODE_STEREO:
			if(tda9874a_mode) {
				fmmr = 0x00;
				aosr = 0x00; /* handled by NICAM auto-mute */
			} else {
				fmmr = (tda9874a_ESP == 1) ? 0x05 : 0x04; /* stereo */
				aosr = 0x00;
			}
			break;
		case V4L2_TUNER_MODE_LANG1:
			fmmr = 0x02; /* dual */
			aosr = 0x10; /* dual A/A */
			break;
		case V4L2_TUNER_MODE_LANG2:
			fmmr = 0x02; /* dual */
			aosr = 0x20; /* dual B/B */
			break;
		default:
			chip->mode = 0;
			return;
		}
		chip_write(chip, TDA9874A_FMMR, fmmr);
		chip_write(chip, TDA9874A_AOSR, aosr);

		v4l_dbg(1, debug, chip->c, "tda9874a_setmode(): req. mode %d; FMMR=0x%X, AOSR=0x%X.\n",
			mode, fmmr, aosr);
	}
}

Project: linux-2.6

static int ta8874z_getmode(struct CHIPSTATE *chip)
{
	int val, mode;

	val = chip_read(chip);
	mode = V4L2_TUNER_MODE_MONO;
	if (val & TA8874Z_B1){
		mode |= V4L2_TUNER_MODE_LANG1 | V4L2_TUNER_MODE_LANG2;
	}else if (!(val & TA8874Z_B0)){
		mode |= V4L2_TUNER_MODE_STEREO;
	}
	/* v4l_dbg(1, debug, chip->c, "ta8874z_getmode(): raw chip read: 0x%02x, return: 0x%02x\n", val, mode); */
	return mode;
}

Project: linux-2.6

static int tda9874a_initialize(struct CHIPSTATE *chip)
{
	if (tda9874a_SIF > 2)
		tda9874a_SIF = 1;
	if (tda9874a_STD >= ARRAY_SIZE(tda9874a_modelist))
		tda9874a_STD = 0;
	if(tda9874a_AMSEL > 1)
		tda9874a_AMSEL = 0;

	if(tda9874a_SIF == 1)
		tda9874a_GCONR = 0xc0;	/* sound IF input 1 */
	else
		tda9874a_GCONR = 0xc1;	/* sound IF input 2 */

	tda9874a_ESP = tda9874a_STD;
	tda9874a_mode = (tda9874a_STD < 5) ? 0 : 1;

	if(tda9874a_AMSEL == 0)
		tda9874a_NCONR = 0x01; /* auto-mute: analog mono input */
	else
		tda9874a_NCONR = 0x05; /* auto-mute: 1st carrier FM or AM */

	tda9874a_setup(chip);
	return 0;
}

Project: linux-2.6

static int tea6300_shift12(int val) { return val >> 12; }

Project: linux-2.6

static int tea6320_volume(int val) { return (val / (65535/(63-12)) + 12) & 0x3f; }

Project: linux-2.6

static void tda9840_setmode(struct CHIPSTATE *chip, int mode)
{
	int update = 1;
	int t = chip->shadow.bytes[TDA9840_SW + 1] & ~0x7e;

	switch (mode) {
	case V4L2_TUNER_MODE_MONO:
		t |= TDA9840_MONO;
		break;
	case V4L2_TUNER_MODE_STEREO:
		t |= TDA9840_STEREO;
		break;
	case V4L2_TUNER_MODE_LANG1:
		t |= TDA9840_DUALA;
		break;
	case V4L2_TUNER_MODE_LANG2:
		t |= TDA9840_DUALB;
		break;
	default:
		update = 0;
	}

	if (update)
		chip_write(chip, TDA9840_SW, t);
}

Project: linux-2.6

static int tda9874a_getmode(struct CHIPSTATE *chip)
{
	int dsr,nsr,mode;
	int necr; /* just for debugging */

	mode = V4L2_TUNER_MODE_MONO;

	if(-1 == (dsr = chip_read2(chip,TDA9874A_DSR)))
		return mode;
	if(-1 == (nsr = chip_read2(chip,TDA9874A_NSR)))
		return mode;
	if(-1 == (necr = chip_read2(chip,TDA9874A_NECR)))
		return mode;

	/* need to store dsr/nsr somewhere */
	chip->shadow.bytes[MAXREGS-2] = dsr;
	chip->shadow.bytes[MAXREGS-1] = nsr;

	if(tda9874a_mode) {
		/* Note: DSR.RSSF and DSR.AMSTAT bits are also checked.
		 * If NICAM auto-muting is enabled, DSR.AMSTAT=1 indicates
		 * that sound has (temporarily) switched from NICAM to
		 * mono FM (or AM) on 1st sound carrier due to high NICAM bit
		 * error count. So in fact there is no stereo in this case :-(
		 * But changing the mode to V4L2_TUNER_MODE_MONO would switch
		 * external 4052 multiplexer in audio_hook().
		 */
		if(nsr & 0x02) /* NSR.S/MB=1 */
			mode |= V4L2_TUNER_MODE_STEREO;
		if(nsr & 0x01) /* NSR.D/SB=1 */
			mode |= V4L2_TUNER_MODE_LANG1 | V4L2_TUNER_MODE_LANG2;
	} else {
		if(dsr & 0x02) /* DSR.IDSTE=1 */
			mode |= V4L2_TUNER_MODE_STEREO;
		if(dsr & 0x04) /* DSR.IDDUA=1 */
			mode |= V4L2_TUNER_MODE_LANG1 | V4L2_TUNER_MODE_LANG2;
	}

	v4l_dbg(1, debug, chip->c, "tda9874a_getmode(): DSR=0x%X, NSR=0x%X, NECR=0x%X, return: %d.\n",
		 dsr, nsr, necr, mode);
	return mode;
}

Project: linux-2.6

static int tea6320_shift11(int val) { return val >> 11; }

Project: linux-2.6

static int chip_legacy_probe(struct i2c_adapter *adap)
{
	/* don't attach on saa7146 based cards,
	   because dedicated drivers are used */
	if ((adap->id == I2C_HW_SAA7146))
		return 0;
	if (adap->class & I2C_CLASS_TV_ANALOG)
		return 1;
	return 0;
}

Project: linux-2.6

static void ta8874z_setmode(struct CHIPSTATE *chip, int mode)
{
	int update = 1;
	audiocmd *t = NULL;
	v4l_dbg(1, debug, chip->c, "ta8874z_setmode(): mode: 0x%02x\n", mode);

	switch(mode){
	case V4L2_TUNER_MODE_MONO:
		t = &ta8874z_mono;
		break;
	case V4L2_TUNER_MODE_STEREO:
		t = &ta8874z_stereo;
		break;
	case V4L2_TUNER_MODE_LANG1:
		t = &ta8874z_main;
		break;
	case V4L2_TUNER_MODE_LANG2:
		t = &ta8874z_sub;
		break;
	default:
		update = 0;
	}

	if(update)
		chip_cmd(chip, "TA8874Z", t);
}

Project: linux-2.6

static int tda9855_treble(int val) { return (val/0x1c71+0x3)<<1; }