18 files changed, 98 insertions, 28 deletions

diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index ccbd39a38c46..c545039287ad 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -356,6 +356,8 @@ config DVB_USB_LME2510
         select DVB_TDA826X if !DVB_FE_CUSTOMISE
         select DVB_STV0288 if !DVB_FE_CUSTOMISE
         select DVB_IX2505V if !DVB_FE_CUSTOMISE
+        select DVB_STV0299 if !DVB_FE_CUSTOMISE
+        select DVB_PLL if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the LME DM04/QQBOX DVB-S USB2.0 .
 
diff --git a/drivers/media/dvb/ngene/ngene-core.c b/drivers/media/dvb/ngene/ngene-core.c
index ccc2d1af49d4..6927c726ce35 100644
--- a/drivers/media/dvb/ngene/ngene-core.c
+++ b/drivers/media/dvb/ngene/ngene-core.c
@@ -1520,6 +1520,7 @@ static int init_channel(struct ngene_channel *chan)
         if (dev->ci.en && (io & NGENE_IO_TSOUT)) {
                 dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1);
                 set_transfer(chan, 1);
+                chan->dev->channel[2].DataFormatFlags = DF_SWAP32;
                 set_transfer(&chan->dev->channel[2], 1);
                 dvb_register_device(adapter, &chan->ci_dev,
                                     &ngene_dvbdev_ci, (void *) chan,
diff --git a/drivers/media/radio/saa7706h.c b/drivers/media/radio/saa7706h.c
index 585680ffbfb6..b1193dfc5087 100644
--- a/drivers/media/radio/saa7706h.c
+++ b/drivers/media/radio/saa7706h.c
@@ -376,7 +376,7 @@ static int __devinit saa7706h_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%02x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         sd = &state->sd;
diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
index 7c0d77751f6e..0991e1973678 100644
--- a/drivers/media/radio/tef6862.c
+++ b/drivers/media/radio/tef6862.c
@@ -176,7 +176,7 @@ static int __devinit tef6862_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%02x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct tef6862_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tef6862_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         state->freq = TEF6862_LO_FREQ;
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index ebd68edf5b24..8fc0f081b470 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -46,7 +46,7 @@
 #define MOD_AUTHOR      "Jarod Wilson <jarod@wilsonet.com>"
 #define MOD_DESC        "Driver for SoundGraph iMON MultiMedia IR/Display"
 #define MOD_NAME        "imon"
-#define MOD_VERSION     "0.9.2"
+#define MOD_VERSION     "0.9.3"
 
 #define DISPLAY_MINOR_BASE      144
 #define DEVICE_NAME     "lcd%d"
@@ -460,8 +460,9 @@ static int display_close(struct inode *inode, struct file *file)
 }
 
 /**
- * Sends a packet to the device -- this function must be called
- * with ictx->lock held.
+ * Sends a packet to the device -- this function must be called with
+ * ictx->lock held, or its unlock/lock sequence while waiting for tx
+ * to complete can/will lead to a deadlock.
  */
 static int send_packet(struct imon_context *ictx)
 {
@@ -991,12 +992,21 @@ static void imon_touch_display_timeout(unsigned long data)
  * the iMON remotes, and those used by the Windows MCE remotes (which is
  * really just RC-6), but only one or the other at a time, as the signals
  * are decoded onboard the receiver.
+ *
+ * This function gets called two different ways, one way is from
+ * rc_register_device, for initial protocol selection/setup, and the other is
+ * via a userspace-initiated protocol change request, either by direct sysfs
+ * prodding or by something like ir-keytable. In the rc_register_device case,
+ * the imon context lock is already held, but when initiated from userspace,
+ * it is not, so we must acquire it prior to calling send_packet, which
+ * requires that the lock is held.
  */
 static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
 {
         int retval;
         struct imon_context *ictx = rc->priv;
         struct device *dev = ictx->dev;
+        bool unlock = false;
         unsigned char ir_proto_packet[] = {
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86 };
 
@@ -1029,6 +1039,11 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
 
         memcpy(ictx->usb_tx_buf, &ir_proto_packet, sizeof(ir_proto_packet));
 
+        if (!mutex_is_locked(&ictx->lock)) {
+                unlock = true;
+                mutex_lock(&ictx->lock);
+        }
+
         retval = send_packet(ictx);
         if (retval)
                 goto out;
@@ -1037,6 +1052,9 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
         ictx->pad_mouse = false;
 
 out:
+        if (unlock)
+                mutex_unlock(&ictx->lock);
+
         return retval;
 }
 
@@ -2134,6 +2152,7 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf)
                 goto rdev_setup_failed;
         }
 
+        mutex_unlock(&ictx->lock);
         return ictx;
 
 rdev_setup_failed:
@@ -2205,6 +2224,7 @@ static struct imon_context *imon_init_intf1(struct usb_interface *intf,
                 goto urb_submit_failed;
         }
 
+        mutex_unlock(&ictx->lock);
         return ictx;
 
 urb_submit_failed:
@@ -2299,6 +2319,8 @@ static int __devinit imon_probe(struct usb_interface *interface,
         usb_set_intfdata(interface, ictx);
 
         if (ifnum == 0) {
+                mutex_lock(&ictx->lock);
+
                 if (product == 0xffdc && ictx->rf_device) {
                         sysfs_err = sysfs_create_group(&interface->dev.kobj,
                                                        &imon_rf_attr_group);
@@ -2309,13 +2331,14 @@ static int __devinit imon_probe(struct usb_interface *interface,
 
                 if (ictx->display_supported)
                         imon_init_display(ictx, interface);
+
+                mutex_unlock(&ictx->lock);
         }
 
         dev_info(dev, "iMON device (%04x:%04x, intf%d) on "
                  "usb<%d:%d> initialized\n", vendor, product, ifnum,
                  usbdev->bus->busnum, usbdev->devnum);
 
-        mutex_unlock(&ictx->lock);
         mutex_unlock(&driver_lock);
 
         return 0;
diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
index accaf6c9789a..43908a70bd8b 100644
--- a/drivers/media/rc/ite-cir.c
+++ b/drivers/media/rc/ite-cir.c
@@ -36,6 +36,7 @@
 #include <linux/io.h>
 #include <linux/interrupt.h>
 #include <linux/sched.h>
+#include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/input.h>
 #include <linux/bitops.h>
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 044fb7a382d6..0c273ec465c9 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -220,6 +220,8 @@ static struct usb_device_id mceusb_dev_table[] = {
         { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
         /* Philips/Spinel plus IR transceiver for ASUS */
         { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
+        /* Philips IR transceiver (Dell branded) */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x2093) },
         /* Realtek MCE IR Receiver and card reader */
         { USB_DEVICE(VENDOR_REALTEK, 0x0161),
           .driver_info = MULTIFUNCTION },
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index f53f9c68d38d..a2706648e365 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -707,7 +707,8 @@ static void ir_close(struct input_dev *idev)
 {
         struct rc_dev *rdev = input_get_drvdata(idev);
 
-        rdev->close(rdev);
+         if (rdev)
+                rdev->close(rdev);
 }
 
 /* class for /sys/class/rc */
@@ -733,6 +734,7 @@ static struct {
         { RC_TYPE_SONY,         "sony"          },
         { RC_TYPE_RC5_SZ,       "rc-5-sz"       },
         { RC_TYPE_LIRC,         "lirc"          },
+        { RC_TYPE_OTHER,        "other"         },
 };
 
 #define PROTO_NONE      "none"
diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index c820e2f53527..3f442003623d 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -524,7 +524,7 @@ void cx88_ir_irq(struct cx88_core *core)
         for (todo = 32; todo > 0; todo -= bits) {
                 ev.pulse = samples & 0x80000000 ? false : true;
                 bits = min(todo, 32U - fls(ev.pulse ? samples : ~samples));
-                ev.duration = (bits * NSEC_PER_SEC) / (1000 * ir_samplerate);
+                ev.duration = (bits * (NSEC_PER_SEC / 1000)) / ir_samplerate;
                 ir_raw_event_store_with_filter(ir->dev, &ev);
                 samples <<= bits;
         }
diff --git a/drivers/media/video/m52790.c b/drivers/media/video/m52790.c
index 5e1c9a81984c..303ffa7df4ac 100644
--- a/drivers/media/video/m52790.c
+++ b/drivers/media/video/m52790.c
@@ -174,7 +174,7 @@ static int m52790_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct m52790_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct m52790_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 3973f9a94753..ddb4c091dedc 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -136,11 +136,50 @@ unsigned long soc_camera_apply_sensor_flags(struct soc_camera_link *icl,
 }
 EXPORT_SYMBOL(soc_camera_apply_sensor_flags);
 
+#define pixfmtstr(x) (x) & 0xff, ((x) >> 8) & 0xff, ((x) >> 16) & 0xff, \
+        ((x) >> 24) & 0xff
+
+static int soc_camera_try_fmt(struct soc_camera_device *icd,
+                              struct v4l2_format *f)
+{
+        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
+        struct v4l2_pix_format *pix = &f->fmt.pix;
+        int ret;
+
+        dev_dbg(&icd->dev, "TRY_FMT(%c%c%c%c, %ux%u)\n",
+                pixfmtstr(pix->pixelformat), pix->width, pix->height);
+
+        pix->bytesperline = 0;
+        pix->sizeimage = 0;
+
+        ret = ici->ops->try_fmt(icd, f);
+        if (ret < 0)
+                return ret;
+
+        if (!pix->sizeimage) {
+                if (!pix->bytesperline) {
+                        const struct soc_camera_format_xlate *xlate;
+
+                        xlate = soc_camera_xlate_by_fourcc(icd, pix->pixelformat);
+                        if (!xlate)
+                                return -EINVAL;
+
+                        ret = soc_mbus_bytes_per_line(pix->width,
+                                                      xlate->host_fmt);
+                        if (ret > 0)
+                                pix->bytesperline = ret;
+                }
+                if (pix->bytesperline)
+                        pix->sizeimage = pix->bytesperline * pix->height;
+        }
+
+        return 0;
+}
+
 static int soc_camera_try_fmt_vid_cap(struct file *file, void *priv,
                                       struct v4l2_format *f)
 {
         struct soc_camera_device *icd = file->private_data;
-        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 
         WARN_ON(priv != file->private_data);
 
@@ -149,7 +188,7 @@ static int soc_camera_try_fmt_vid_cap(struct file *file, void *priv,
                 return -EINVAL;
 
         /* limit format to hardware capabilities */
-        return ici->ops->try_fmt(icd, f);
+        return soc_camera_try_fmt(icd, f);
 }
 
 static int soc_camera_enum_input(struct file *file, void *priv,
@@ -362,9 +401,6 @@ static void soc_camera_free_user_formats(struct soc_camera_device *icd)
         icd->user_formats = NULL;
 }
 
-#define pixfmtstr(x) (x) & 0xff, ((x) >> 8) & 0xff, ((x) >> 16) & 0xff, \
-        ((x) >> 24) & 0xff
-
 /* Called with .vb_lock held, or from the first open(2), see comment there */
 static int soc_camera_set_fmt(struct soc_camera_device *icd,
                               struct v4l2_format *f)
@@ -377,7 +413,7 @@ static int soc_camera_set_fmt(struct soc_camera_device *icd,
                 pixfmtstr(pix->pixelformat), pix->width, pix->height);
 
         /* We always call try_fmt() before set_fmt() or set_crop() */
-        ret = ici->ops->try_fmt(icd, f);
+        ret = soc_camera_try_fmt(icd, f);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/media/video/tda9840.c b/drivers/media/video/tda9840.c
index 5d4cf3b3d435..22fa8202d5ca 100644
--- a/drivers/media/video/tda9840.c
+++ b/drivers/media/video/tda9840.c
@@ -171,7 +171,7 @@ static int tda9840_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
+        sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
         if (sd == NULL)
                 return -ENOMEM;
         v4l2_i2c_subdev_init(sd, client, &tda9840_ops);
diff --git a/drivers/media/video/tea6415c.c b/drivers/media/video/tea6415c.c
index 19621ed523ec..827425c5b866 100644
--- a/drivers/media/video/tea6415c.c
+++ b/drivers/media/video/tea6415c.c
@@ -152,7 +152,7 @@ static int tea6415c_probe(struct i2c_client *client,
 
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
-        sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
+        sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
         if (sd == NULL)
                 return -ENOMEM;
         v4l2_i2c_subdev_init(sd, client, &tea6415c_ops);
diff --git a/drivers/media/video/tea6420.c b/drivers/media/video/tea6420.c
index 5ea840401f21..f350b6c24500 100644
--- a/drivers/media/video/tea6420.c
+++ b/drivers/media/video/tea6420.c
@@ -125,7 +125,7 @@ static int tea6420_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
+        sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
         if (sd == NULL)
                 return -ENOMEM;
         v4l2_i2c_subdev_init(sd, client, &tea6420_ops);
diff --git a/drivers/media/video/upd64031a.c b/drivers/media/video/upd64031a.c
index f8138c75be8b..1aab96a88203 100644
--- a/drivers/media/video/upd64031a.c
+++ b/drivers/media/video/upd64031a.c
@@ -230,7 +230,7 @@ static int upd64031a_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         sd = &state->sd;
diff --git a/drivers/media/video/upd64083.c b/drivers/media/video/upd64083.c
index 28e0e6b6ca84..9bbe61700fd5 100644
--- a/drivers/media/video/upd64083.c
+++ b/drivers/media/video/upd64083.c
@@ -202,7 +202,7 @@ static int upd64083_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct upd64083_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct upd64083_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         sd = &state->sd;
diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c
index 5aeaf876ba9b..4aae501f02d0 100644
--- a/drivers/media/video/v4l2-device.c
+++ b/drivers/media/video/v4l2-device.c
@@ -155,8 +155,10 @@ int v4l2_device_register_subdev(struct v4l2_device *v4l2_dev,
         sd->v4l2_dev = v4l2_dev;
         if (sd->internal_ops && sd->internal_ops->registered) {
                 err = sd->internal_ops->registered(sd);
-                if (err)
+                if (err) {
+                        module_put(sd->owner);
                         return err;
+                }
         }
 
         /* This just returns 0 if either of the two args is NULL */
@@ -164,6 +166,7 @@ int v4l2_device_register_subdev(struct v4l2_device *v4l2_dev,
         if (err) {
                 if (sd->internal_ops && sd->internal_ops->unregistered)
                         sd->internal_ops->unregistered(sd);
+                module_put(sd->owner);
                 return err;
         }
 
diff --git a/drivers/media/video/v4l2-subdev.c b/drivers/media/video/v4l2-subdev.c
index 0b8064490676..812729ebf09e 100644
--- a/drivers/media/video/v4l2-subdev.c
+++ b/drivers/media/video/v4l2-subdev.c
@@ -155,25 +155,25 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg)
 
         switch (cmd) {
         case VIDIOC_QUERYCTRL:
-                return v4l2_subdev_queryctrl(sd, arg);
+                return v4l2_queryctrl(sd->ctrl_handler, arg);
 
         case VIDIOC_QUERYMENU:
-                return v4l2_subdev_querymenu(sd, arg);
+                return v4l2_querymenu(sd->ctrl_handler, arg);
 
         case VIDIOC_G_CTRL:
-                return v4l2_subdev_g_ctrl(sd, arg);
+                return v4l2_g_ctrl(sd->ctrl_handler, arg);
 
         case VIDIOC_S_CTRL:
-                return v4l2_subdev_s_ctrl(sd, arg);
+                return v4l2_s_ctrl(sd->ctrl_handler, arg);
 
         case VIDIOC_G_EXT_CTRLS:
-                return v4l2_subdev_g_ext_ctrls(sd, arg);
+                return v4l2_g_ext_ctrls(sd->ctrl_handler, arg);
 
         case VIDIOC_S_EXT_CTRLS:
-                return v4l2_subdev_s_ext_ctrls(sd, arg);
+                return v4l2_s_ext_ctrls(sd->ctrl_handler, arg);
 
         case VIDIOC_TRY_EXT_CTRLS:
-                return v4l2_subdev_try_ext_ctrls(sd, arg);
+                return v4l2_try_ext_ctrls(sd->ctrl_handler, arg);
 
         case VIDIOC_DQEVENT:
                 if (!(sd->flags & V4L2_SUBDEV_FL_HAS_EVENTS))