V4L/DVB (6644): xc2028: use correct offset into scode firmware

When validating and loading SCODE firmware we need to take into account the
two-byte size header before each entry.

Signed-off-by: Chris Pascoe <c.pascoe@itee.uq.edu.au>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

diff --git a/drivers/media/video/tuner-xc2028.c b/drivers/media/video/tuner-xc2028.c
index 3edf5be..fbaab68 100644 (file)
--- a/drivers/media/video/tuner-xc2028.c
+++ b/drivers/media/video/tuner-xc2028.c
@@ -565,9 +565,17 @@ static int load_scode(struct dvb_frontend *fe, unsigned int type,
 
        p = priv->firm[pos].ptr;
 
-       if ((priv->firm[pos].size != 12 * 16) || (scode >= 16))
+       /* 16 SCODE entries per file; each SCODE entry is 12 bytes and
+        * has a 2-byte size header in the firmware format. */
+       if (priv->firm[pos].size != 14 * 16 || scode >= 16 ||
+           le16_to_cpu(*(__u16 *)(p + 14 * scode)) != 12)
                return -EINVAL;
 
+       tuner_info("Loading SCODE for type=");
+       dump_firm_type(priv->firm[pos].type);
+       printk("(%x), id %016llx.\n", priv->firm[pos].type,
+              (unsigned long long)*id);
+
        if (priv->firm_version < 0x0202)
                rc = send_seq(priv, {0x20, 0x00, 0x00, 0x00});
        else
@@ -575,7 +583,7 @@ static int load_scode(struct dvb_frontend *fe, unsigned int type,
        if (rc < 0)
                return -EIO;
 
-       rc = i2c_send(priv, p + 12 * scode, 12);
+       rc = i2c_send(priv, p + 14 * scode + 2, 12);
        if (rc < 0)
                return -EIO;