21 files changed, 103 insertions, 37 deletions
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 939d1e512974..a6724019c66f 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -1299,7 +1299,7 @@ set_tvnorm(struct bttv *btv, unsigned int norm)
        tvnorm = &bttv_tvnorms[norm];
-        if (!memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap,
+        if (memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap,
                    sizeof (tvnorm->cropcap))) {
                bttv_crop_reset(&btv->crop[0], norm);
                btv->crop[1] = btv->crop[0]; /* current = default */
@@ -3800,11 +3800,34 @@ bttv_irq_next_video(struct bttv *btv, struct bttv_buffer_set *set)
                if (!V4L2_FIELD_HAS_BOTH(item->vb.field) &&
                    (item->vb.queue.next != &btv->capture)) {
                        item = list_entry(item->vb.queue.next, struct bttv_buffer, vb.queue);
+                        /* Mike Isely <isely@pobox.com> - Only check
+                         * and set up the bottom field in the logic
+                         * below.  Don't ever do the top field.  This
+                         * of course means that if we set up the
+                         * bottom field in the above code that we'll
+                         * actually skip a field.  But that's OK.
+                         * Having processed only a single buffer this
+                         * time, then the next time around the first
+                         * available buffer should be for a top field.
+                         * That will then cause us here to set up a
+                         * top then a bottom field in the normal way.
+                         * The alternative to this understanding is
+                         * that we set up the second available buffer
+                         * as a top field, but that's out of order
+                         * since this driver always processes the top
+                         * field first - the effect will be the two
+                         * buffers being returned in the wrong order,
+                         * with the second buffer also being delayed
+                         * by one field time (owing to the fifo nature
+                         * of videobuf).  Worse still, we'll be stuck
+                         * doing fields out of order now every time
+                         * until something else causes a field to be
+                         * dropped.  By effectively forcing a field to
+                         * drop this way then we always get back into
+                         * sync within a single frame time.  (Out of
+                         * order fields can screw up deinterlacing
+                         * algorithms.) */
                        if (!V4L2_FIELD_HAS_BOTH(item->vb.field)) {
-                                if (NULL == set->top &&
-                                    V4L2_FIELD_TOP == item->vb.field) {
-                                        set->top = item;
-                                }
                                if (NULL == set->bottom &&
                                    V4L2_FIELD_BOTTOM == item->vb.field) {
                                        set->bottom = item;
diff --git a/drivers/media/video/davinci/vpif_display.c b/drivers/media/video/davinci/vpif_display.c
index c015da813dda..d14cfb200ed0 100644
--- a/drivers/media/video/davinci/vpif_display.c
+++ b/drivers/media/video/davinci/vpif_display.c
@@ -1426,7 +1426,6 @@ static __init int vpif_probe(struct platform_device *pdev)
        struct vpif_display_config *config;
        int i, j = 0, k, q, m, err = 0;
        struct i2c_adapter *i2c_adap;
-        struct vpif_config *config;
        struct common_obj *common;
        struct channel_obj *ch;
        struct video_device *vfd;
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 7bd8a70f0a0b..ac947aecb9c3 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -383,6 +383,11 @@ static int snd_em28xx_hw_capture_free(struct snd_pcm_substream *substream)
 static int snd_em28xx_prepare(struct snd_pcm_substream *substream)
 {
+        struct em28xx *dev = snd_pcm_substream_chip(substream);
+        dev->adev.hwptr_done_capture = 0;
+        dev->adev.capture_transfer_done = 0;
        return 0;
 }
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index bdb249bd9d5d..c0fd5c6feeac 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -1584,8 +1584,8 @@ struct em28xx_board em28xx_boards[] = {
        [EM2870_BOARD_REDDO_DVB_C_USB_BOX] = {
                .name          = "Reddo DVB-C USB TV Box",
                .tuner_type    = TUNER_ABSENT,
+                .tuner_gpio    = reddo_dvb_c_usb_box,
                .has_dvb       = 1,
-                .dvb_gpio      = reddo_dvb_c_usb_box,
        },
 };
 const unsigned int em28xx_bcount = ARRAY_SIZE(em28xx_boards);
diff --git a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
index 59400e858965..a27afeb6f39b 100644
--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
@@ -35,12 +35,25 @@ static
    const
        struct dmi_system_id s5k4aa_vflip_dmi_table[] = {
        {
+                .ident = "BRUNEINIT",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "BRUNENIT"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "BRUNENIT"),
+                        DMI_MATCH(DMI_BOARD_VERSION, "00030D0000000001")
+                }
+        }, {
                .ident = "Fujitsu-Siemens Amilo Xa 2528",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xa 2528")
                }
        }, {
+                .ident = "Fujitsu-Siemens Amilo Xi 2528",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 2528")
+                }
+        }, {
                .ident = "Fujitsu-Siemens Amilo Xi 2550",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
@@ -57,6 +70,13 @@ static
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
                        DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
+                        DMI_MATCH(DMI_BIOS_DATE, "12/02/2008")
+                }
+        }, {
+                .ident = "MSI GX700",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
                        DMI_MATCH(DMI_BIOS_DATE, "07/26/2007")
                }
        }, {
diff --git a/drivers/media/video/gspca/mr97310a.c b/drivers/media/video/gspca/mr97310a.c
index 140c8f320e47..f8328b9efae5 100644
--- a/drivers/media/video/gspca/mr97310a.c
+++ b/drivers/media/video/gspca/mr97310a.c
@@ -483,7 +483,7 @@ static int start_cif_cam(struct gspca_dev *gspca_dev)
                data[3] = 0x2c;                    /* reg 2, H size/8 */
                data[4] = 0x48;                    /* reg 3, V size/4 */
                data[6] = 0x06;                    /* reg 5, H start  */
-                data[8] = 0x06 + sd->sensor_type;  /* reg 7, V start  */
+                data[8] = 0x06 - sd->sensor_type;  /* reg 7, V start  */
                break;
        }
        err_code = mr_write(gspca_dev, 11);
diff --git a/drivers/media/video/gspca/ov519.c b/drivers/media/video/gspca/ov519.c
index 2f6e135d94bc..a5c190e93799 100644
--- a/drivers/media/video/gspca/ov519.c
+++ b/drivers/media/video/gspca/ov519.c
@@ -2919,7 +2919,7 @@ static void ov518_pkt_scan(struct gspca_dev *gspca_dev,
        /* A false positive here is likely, until OVT gives me
         * the definitive SOF/EOF format */
        if ((!(data[0] | data[1] | data[2] | data[3] | data[5])) && data[6]) {
-                gspca_frame_add(gspca_dev, LAST_PACKET, frame, data, 0);
+                frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame, data, 0);
                gspca_frame_add(gspca_dev, FIRST_PACKET, frame, data, 0);
                sd->packet_nr = 0;
        }
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx.c b/drivers/media/video/gspca/stv06xx/stv06xx.c
index 65489d6b0d89..bfae63f5584c 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx.c
+++ b/drivers/media/video/gspca/stv06xx/stv06xx.c
@@ -394,7 +394,8 @@ frame_data:
                        PDEBUG(D_PACK, "End of frame detected");
                        /* Complete the last frame (if any) */
-                        gspca_frame_add(gspca_dev, LAST_PACKET, frame, data, 0);
+                        frame = gspca_frame_add(gspca_dev, LAST_PACKET,
+                                                frame, data, 0);
                        if (chunk_len)
                                PDEBUG(D_ERR, "Chunk length is "
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 5f37952c75cf..72802291e812 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -28,6 +28,7 @@
 #include <linux/moduleparam.h>
 #include <linux/mutex.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 #include <linux/time.h>
 #include <linux/version.h>
 #include <linux/videodev2.h>
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index dff2e5e2d8c6..7db82bdf6f31 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -17,6 +17,7 @@
 #include <linux/clk.h>
 #include <linux/vmalloc.h>
 #include <linux/interrupt.h>
+#include <linux/sched.h>
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 6952e9602d5d..51b683c63b70 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -26,6 +26,7 @@
 #include <linux/device.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/sched.h>
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
@@ -1432,7 +1433,9 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
                icd->sense = &sense;
        cam_f.fmt.pix.pixelformat = cam_fmt->fourcc;
-        ret = v4l2_subdev_call(sd, video, s_fmt, f);
+        ret = v4l2_subdev_call(sd, video, s_fmt, &cam_f);
+        cam_f.fmt.pix.pixelformat = pix->pixelformat;
+        *pix = cam_f.fmt.pix;
        icd->sense = NULL;
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index 9e3262c0ba37..2c0bb06cab3b 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -598,11 +598,6 @@ static int s2255_got_frame(struct s2255_dev *dev, int chn, int jpgsize)
        buf = list_entry(dma_q->active.next,
                         struct s2255_buffer, vb.queue);
-        if (!waitqueue_active(&buf->vb.done)) {
-                /* no one active */
-                rc = -1;
-                goto unlock;
-        }
        list_del(&buf->vb.queue);
        do_gettimeofday(&buf->vb.ts);
        dprintk(100, "[%p/%d] wakeup\n", buf, buf->vb.i);
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 71145bff94fa..09013229d4aa 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -3428,6 +3428,7 @@ struct saa7134_board saa7134_boards[] = {
                .tuner_config   = 3,
                .mpeg           = SAA7134_MPEG_DVB,
                .ts_type        = SAA7134_MPEG_TS_SERIAL,
+                .ts_force_val   = 1,
                .gpiomask       = 0x0800100, /* GPIO 21 is an INPUT */
                .inputs         = {{
                        .name = name_tv,
diff --git a/drivers/media/video/saa7134/saa7134-ts.c b/drivers/media/video/saa7134/saa7134-ts.c
index 3fa652279ac0..03488ba4c99c 100644
--- a/drivers/media/video/saa7134/saa7134-ts.c
+++ b/drivers/media/video/saa7134/saa7134-ts.c
@@ -262,11 +262,13 @@ int saa7134_ts_start(struct saa7134_dev *dev)
        switch (saa7134_boards[dev->board].ts_type) {
        case SAA7134_MPEG_TS_PARALLEL:
                saa_writeb(SAA7134_TS_SERIAL0, 0x40);
-                saa_writeb(SAA7134_TS_PARALLEL, 0xec);
+                saa_writeb(SAA7134_TS_PARALLEL, 0xec |
+                        (saa7134_boards[dev->board].ts_force_val << 4));
                break;
        case SAA7134_MPEG_TS_SERIAL:
                saa_writeb(SAA7134_TS_SERIAL0, 0xd8);
-                saa_writeb(SAA7134_TS_PARALLEL, 0x6c);
+                saa_writeb(SAA7134_TS_PARALLEL, 0x6c |
+                        (saa7134_boards[dev->board].ts_force_val << 4));
                saa_writeb(SAA7134_TS_PARALLEL_SERIAL, 0xbc);
                saa_writeb(SAA7134_TS_SERIAL1, 0x02);
                break;
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index 6ee3e9b7769e..f8697d46ff5f 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -360,6 +360,7 @@ struct saa7134_board {
        enum saa7134_mpeg_type  mpeg;
        enum saa7134_mpeg_ts_type ts_type;
        unsigned int            vid_port_opts;
+        unsigned int            ts_force_val:1;
 };
 #define card_has_radio(dev)   (NULL != saa7134_boards[dev->board].radio.name)
diff --git a/drivers/media/video/saa7164/saa7164-cmd.c b/drivers/media/video/saa7164/saa7164-cmd.c
index c45966edc0cf..9c1d3ac43869 100644
--- a/drivers/media/video/saa7164/saa7164-cmd.c
+++ b/drivers/media/video/saa7164/saa7164-cmd.c
@@ -347,7 +347,7 @@ int saa7164_cmd_send(struct saa7164_dev *dev, u8 id, tmComResCmd_t command,
        /* Prepare some basic command/response structures */
        memset(&command_t, 0, sizeof(command_t));
-        memset(&response_t, 0, sizeof(&response_t));
+        memset(&response_t, 0, sizeof(response_t));
        pcommand_t = &command_t;
        presponse_t = &response_t;
        command_t.id = id;
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 65ac474c517a..9c8b7c7b89ee 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -31,6 +31,7 @@
 #include <linux/platform_device.h>
 #include <linux/videodev2.h>
 #include <linux/pm_runtime.h>
+#include <linux/sched.h>
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
@@ -1173,8 +1174,8 @@ static int get_scales(struct soc_camera_device *icd,
        width_in = scale_up(cam->ceu_rect.width, *scale_h);
        height_in = scale_up(cam->ceu_rect.height, *scale_v);
-        *scale_h = calc_generic_scale(cam->ceu_rect.width, icd->user_width);
+        *scale_h = calc_generic_scale(width_in, icd->user_width);
-        *scale_v = calc_generic_scale(cam->ceu_rect.height, icd->user_height);
+        *scale_v = calc_generic_scale(height_in, icd->user_height);
        return 0;
 }
@@ -1723,11 +1724,12 @@ static int __devinit sh_mobile_ceu_probe(struct platform_device *pdev)
        err = soc_camera_host_register(&pcdev->ici);
        if (err)
-                goto exit_free_irq;
+                goto exit_free_clk;
        return 0;
-exit_free_irq:
+exit_free_clk:
+        pm_runtime_disable(&pdev->dev);
        free_irq(pcdev->irq, pcdev);
 exit_release_mem:
        if (platform_get_resource(pdev, IORESOURCE_MEM, 1))
@@ -1747,6 +1749,7 @@ static int __devexit sh_mobile_ceu_remove(struct platform_device *pdev)
                                        struct sh_mobile_ceu_dev, ici);
        soc_camera_host_unregister(soc_host);
+        pm_runtime_disable(&pdev->dev);
        free_irq(pcdev->irq, pcdev);
        if (platform_get_resource(pdev, IORESOURCE_MEM, 1))
                dma_release_declared_memory(&pdev->dev);
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 59aa7a3694c2..95fdeb23c2c1 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -1097,6 +1097,13 @@ static int default_s_crop(struct soc_camera_device *icd, struct v4l2_crop *a)
        return v4l2_subdev_call(sd, video, s_crop, a);
 }
+static void soc_camera_device_init(struct device *dev, void *pdata)
+{
+        dev->platform_data      = pdata;
+        dev->bus                = &soc_camera_bus_type;
+        dev->release            = dummy_release;
+}
 int soc_camera_host_register(struct soc_camera_host *ici)
 {
        struct soc_camera_host *ix;
@@ -1158,15 +1165,19 @@ void soc_camera_host_unregister(struct soc_camera_host *ici)
        list_for_each_entry(icd, &devices, list) {
                if (icd->iface == ici->nr) {
+                        void *pdata = icd->dev.platform_data;
                        /* The bus->remove will be called */
                        device_unregister(&icd->dev);
-                        /* Not before device_unregister(), .remove
+                        /*
-                         * needs parent to call ici->ops->remove() */
+                         * Not before device_unregister(), .remove
-                        icd->dev.parent = NULL;
+                         * needs parent to call ici->ops->remove().
+                         * If the host module is loaded again, device_register()
-                        /* If the host module is loaded again, device_register()
+                         * would complain "already initialised," since 2.6.32
-                         * would complain "already initialised" */
+                         * this is also needed to prevent use-after-free of the
-                        memset(&icd->dev.kobj, 0, sizeof(icd->dev.kobj));
+                         * device private data.
+                         */
+                        memset(&icd->dev, 0, sizeof(icd->dev));
+                        soc_camera_device_init(&icd->dev, pdata);
                }
        }
@@ -1198,10 +1209,7 @@ static int soc_camera_device_register(struct soc_camera_device *icd)
                 * man, stay reasonable... */
                return -ENOMEM;
-        icd->devnum = num;
+        icd->devnum             = num;
-        icd->dev.bus = &soc_camera_bus_type;
-        icd->dev.release        = dummy_release;
        icd->use_count          = 0;
        icd->host_priv          = NULL;
        mutex_init(&icd->video_lock);
@@ -1309,12 +1317,13 @@ static int __devinit soc_camera_pdrv_probe(struct platform_device *pdev)
        icd->iface = icl->bus_id;
        icd->pdev = &pdev->dev;
        platform_set_drvdata(pdev, icd);
-        icd->dev.platform_data = icl;
        ret = soc_camera_device_register(icd);
        if (ret < 0)
                goto escdevreg;
+        soc_camera_device_init(&icd->dev, icl);
        icd->user_width         = DEFAULT_WIDTH;
        icd->user_height        = DEFAULT_HEIGHT;
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index c3225a561748..1b89735e62fd 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -348,7 +348,7 @@ static void uvc_ctrl_set_zoom(struct uvc_control_mapping *mapping,
        __s32 value, __u8 *data)
 {
        data[0] = value == 0 ? 0 : (value > 0) ? 1 : 0xff;
-        data[2] = min(abs(value), 0xff);
+        data[2] = min((int)abs(value), 0xff);
 }
 static struct uvc_control_mapping uvc_ctrl_mappings[] = {
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index f960e8ea4f17..a6e41d12b221 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -90,7 +90,8 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
                ctrl->dwMaxVideoFrameSize =
                        frame->dwMaxVideoFrameBufferSize;
-        if (stream->dev->quirks & UVC_QUIRK_FIX_BANDWIDTH &&
+        if (!(format->flags & UVC_FMT_FLAG_COMPRESSED) &&
+            stream->dev->quirks & UVC_QUIRK_FIX_BANDWIDTH &&
            stream->intf->num_altsetting > 1) {
                u32 interval;
                u32 bandwidth;
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index 635ffc7b0391..c3065c4bcba9 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -19,6 +19,7 @@
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/dma-mapping.h>
+#include <linux/sched.h>
 #include <media/videobuf-dma-contig.h>
 struct videobuf_dma_contig_memory {