From d7c31a1e754b5140eefeeb10c3c3be17f3702452 Mon Sep 17 00:00:00 2001
From: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Date: Tue, 11 Nov 2008 23:27:59 -0300
Subject: V4L/DVB (9601): ttusb_dec: Add NULL pointer validation

Added validation for NULL pointer

Signed-off-by: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/ttusb-dec/ttusb_dec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
index ab33fec8a19f..c1386e9b13d3 100644
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
@@ -1157,6 +1157,12 @@ static int ttusb_dec_alloc_iso_urbs(struct ttusb_dec *dec)
 						ISO_BUF_COUNT),
 					       &dec->iso_dma_handle);
 
+	if (!dec->iso_buffer) {
+		dprintk("%s: pci_alloc_consistent - not enough memory\n",
+			__func__);
+		return -ENOMEM;
+	}
+
 	memset(dec->iso_buffer, 0,
 	       ISO_FRAME_SIZE * (FRAMES_PER_ISO_BUF * ISO_BUF_COUNT));
 
-- 
cgit v1.2.3


From 11eb260a70b992b83fa2d15bb777cda3ee326c05 Mon Sep 17 00:00:00 2001
From: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Date: Tue, 11 Nov 2008 23:30:49 -0300
Subject: V4L/DVB (9602): dvb-ttusb-budget: Add NULL pointer validation

Added validation for NULL pointer

Signed-off-by: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
index 66ab0c6e9783..5faeee3f70bf 100644
--- a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
+++ b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
@@ -808,6 +808,12 @@ static int ttusb_alloc_iso_urbs(struct ttusb *ttusb)
 						 ISO_BUF_COUNT,
 						 &ttusb->iso_dma_handle);
 
+	if (!ttusb->iso_buffer) {
+		dprintk("%s: pci_alloc_consistent - not enough memory\n",
+			__func__);
+		return -ENOMEM;
+	}
+
 	memset(ttusb->iso_buffer, 0,
 	       ISO_FRAME_SIZE * FRAMES_PER_ISO_BUF * ISO_BUF_COUNT);
 
-- 
cgit v1.2.3


From b7ed785b5f6a8dbdbd0cf8688a51c42e35205a4e Mon Sep 17 00:00:00 2001
From: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Date: Tue, 11 Nov 2008 23:37:39 -0300
Subject: V4L/DVB (9603): dvb-ttusb-budget: Add validation for
 ttusb_alloc_iso_urbs

Added validation for ttusb_alloc_iso_urbs

Signed-off-by: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
index 5faeee3f70bf..4a3f2b8ea37d 100644
--- a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
+++ b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
@@ -1665,7 +1665,14 @@ static int ttusb_probe(struct usb_interface *intf, const struct usb_device_id *i
 
 	ttusb_setup_interfaces(ttusb);
 
-	ttusb_alloc_iso_urbs(ttusb);
+	result = ttusb_alloc_iso_urbs(ttusb);
+	if (result < 0) {
+		dprintk("%s: ttusb_alloc_iso_urbs - failed\n", __func__);
+		mutex_unlock(&ttusb->semi2c);
+		kfree(ttusb);
+		return result;
+	}
+
 	if (ttusb_init_controller(ttusb))
 		printk("ttusb_init_controller: error\n");
 
-- 
cgit v1.2.3


From 7935eeae793ff24e2d6053a9df63be71323ad634 Mon Sep 17 00:00:00 2001
From: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Date: Tue, 11 Nov 2008 23:47:57 -0300
Subject: V4L/DVB (9604): ttusb_dec: fix memory leak

Free allocated memory

Signed-off-by: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/ttusb-dec/ttusb_dec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
index c1386e9b13d3..0aa96df80fc2 100644
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
@@ -1260,6 +1260,7 @@ static int ttusb_dec_init_usb(struct ttusb_dec *dec)
 		dec->irq_buffer = usb_buffer_alloc(dec->udev,IRQ_PACKET_SIZE,
 					GFP_ATOMIC, &dec->irq_dma_handle);
 		if(!dec->irq_buffer) {
+			usb_free_urb(dec->irq_urb);
 			return -ENOMEM;
 		}
 		usb_fill_int_urb(dec->irq_urb, dec->udev,dec->irq_pipe,
-- 
cgit v1.2.3


From 4faf1004c32819035c5325879a466f27e189feb5 Mon Sep 17 00:00:00 2001
From: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Date: Tue, 11 Nov 2008 23:56:56 -0300
Subject: V4L/DVB (9605): usb-urb: fix memory leak

Free allocated memory

Signed-off-by: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/dvb-usb/usb-urb.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/media/dvb/dvb-usb/usb-urb.c b/drivers/media/dvb/dvb-usb/usb-urb.c
index 397f51a7b2ad..da93b9e982c0 100644
--- a/drivers/media/dvb/dvb-usb/usb-urb.c
+++ b/drivers/media/dvb/dvb-usb/usb-urb.c
@@ -135,7 +135,7 @@ stream->buf_list[stream->buf_num], (long long)stream->dma_addr[stream->buf_num])
 
 static int usb_bulk_urb_init(struct usb_data_stream *stream)
 {
-	int i;
+	int i, j;
 
 	if ((i = usb_allocate_stream_buffers(stream,stream->props.count,
 					stream->props.u.bulk.buffersize)) < 0)
@@ -143,9 +143,13 @@ static int usb_bulk_urb_init(struct usb_data_stream *stream)
 
 	/* allocate the URBs */
 	for (i = 0; i < stream->props.count; i++) {
-		if ((stream->urb_list[i] = usb_alloc_urb(0,GFP_ATOMIC)) == NULL)
+		stream->urb_list[i] = usb_alloc_urb(0, GFP_ATOMIC);
+		if (!stream->urb_list[i]) {
+			deb_mem("not enough memory for urb_alloc_urb!.\n");
+			for (j = 0; j < i; j++)
+				usb_free_urb(stream->urb_list[i]);
 			return -ENOMEM;
-
+		}
 		usb_fill_bulk_urb( stream->urb_list[i], stream->udev,
 				usb_rcvbulkpipe(stream->udev,stream->props.endpoint),
 				stream->buf_list[i],
@@ -170,9 +174,14 @@ static int usb_isoc_urb_init(struct usb_data_stream *stream)
 	for (i = 0; i < stream->props.count; i++) {
 		struct urb *urb;
 		int frame_offset = 0;
-		if ((stream->urb_list[i] =
-					usb_alloc_urb(stream->props.u.isoc.framesperurb,GFP_ATOMIC)) == NULL)
+
+		stream->urb_list[i] = usb_alloc_urb(stream->props.u.isoc.framesperurb, GFP_ATOMIC);
+		if (!stream->urb_list[i]) {
+			deb_mem("not enough memory for urb_alloc_urb!\n");
+			for (j = 0; j < i; j++)
+				usb_free_urb(stream->urb_list[i]);
 			return -ENOMEM;
+		}
 
 		urb = stream->urb_list[i];
 
-- 
cgit v1.2.3


From df4533af7f45e87a4be470502fa3cea2f6c96da9 Mon Sep 17 00:00:00 2001
From: "Igor M. Liplianin" <liplianin@tut.by>
Date: Tue, 11 Nov 2008 18:09:28 -0300
Subject: V4L/DVB (9608): Fix section mismatch warning for dm1105 during make

--

Signed-off-by: Igor M. Liplianin <liplianin@me.by>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/dm1105/dm1105.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/dvb/dm1105/dm1105.c b/drivers/media/dvb/dm1105/dm1105.c
index 14e627ef6465..c1d92f838ca8 100644
--- a/drivers/media/dvb/dm1105/dm1105.c
+++ b/drivers/media/dvb/dm1105/dm1105.c
@@ -376,7 +376,7 @@ static void dm1105dvb_dma_unmap(struct dm1105dvb *dm1105dvb)
 	pci_free_consistent(dm1105dvb->pdev, 6*DM1105_DMA_BYTES, dm1105dvb->ts_buf, dm1105dvb->dma_addr);
 }
 
-static void __devinit dm1105dvb_enable_irqs(struct dm1105dvb *dm1105dvb)
+static void dm1105dvb_enable_irqs(struct dm1105dvb *dm1105dvb)
 {
 	outb(INTMAK_ALLMASK, dm_io_mem(DM1105_INTMAK));
 	outb(1, dm_io_mem(DM1105_CR));
-- 
cgit v1.2.3


From c41109fc9a13c6af0e4069dd92fdb4c5c8046649 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab@redhat.com>
Date: Sat, 15 Nov 2008 23:44:14 -0300
Subject: V4L/DVB (9627): em28xx: Avoid i2c register error for boards without
 eeprom

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-i2c.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/media/video/em28xx/em28xx-i2c.c b/drivers/media/video/em28xx/em28xx-i2c.c
index 3bab56b997fc..2360c61ddca9 100644
--- a/drivers/media/video/em28xx/em28xx-i2c.c
+++ b/drivers/media/video/em28xx/em28xx-i2c.c
@@ -337,9 +337,9 @@ static int em28xx_i2c_eeprom(struct em28xx *dev, unsigned char *eedata, int len)
 	/* Check if board has eeprom */
 	err = i2c_master_recv(&dev->i2c_client, &buf, 0);
 	if (err < 0) {
-		em28xx_errdev("%s: i2c_master_recv failed! err [%d]\n",
-			__func__, err);
-		return err;
+		em28xx_errdev("board has no eeprom\n");
+		memset(eedata, 0, len);
+		return -ENODEV;
 	}
 
 	buf = 0;
@@ -609,14 +609,16 @@ int em28xx_i2c_register(struct em28xx *dev)
 	dev->i2c_client.adapter = &dev->i2c_adap;
 
 	retval = em28xx_i2c_eeprom(dev, dev->eedata, sizeof(dev->eedata));
-	if (retval < 0) {
+	if ((retval < 0) && (retval != -ENODEV)) {
 		em28xx_errdev("%s: em28xx_i2_eeprom failed! retval [%d]\n",
 			__func__, retval);
+
 		return retval;
 	}
 
 	if (i2c_scan)
 		em28xx_do_i2c_scan(dev);
+
 	return 0;
 }
 
-- 
cgit v1.2.3


From 3fa37deb1a287e100c7db5b4f964784fd664bee9 Mon Sep 17 00:00:00 2001
From: Devin Heitmueller <devin.heitmueller@gmail.com>
Date: Sun, 16 Nov 2008 00:33:32 -0300
Subject: V4L/DVB (9631): Make s2api work for ATSC support

ATSC should be considered a legacy delivery system, or else fields such as
p->u.vsb.modulation do not get populated (resulting in set_frontend failures)

Cc: Steven Toth <stoth@linuxtv.org>
Signed-off-by: Devin Heitmueller <devin.heitmueller@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/dvb-core/dvb_frontend.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 8557bf12cfb4..b38cebe3ac1c 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -934,7 +934,8 @@ void dtv_property_dump(struct dtv_property *tvp)
 int is_legacy_delivery_system(fe_delivery_system_t s)
 {
 	if((s == SYS_UNDEFINED) || (s == SYS_DVBC_ANNEX_AC) ||
-		(s == SYS_DVBC_ANNEX_B) || (s == SYS_DVBT) || (s == SYS_DVBS))
+	   (s == SYS_DVBC_ANNEX_B) || (s == SYS_DVBT) || (s == SYS_DVBS) ||
+	   (s == SYS_ATSC))
 		return 1;
 
 	return 0;
-- 
cgit v1.2.3


From 3f9b46c154da5ec4facca88f82d1820eb329fd3e Mon Sep 17 00:00:00 2001
From: Devin Heitmueller <devin.heitmueller@gmail.com>
Date: Sat, 15 Nov 2008 17:16:11 -0300
Subject: V4L/DVB (9632): make em28xx aux audio input work

The attached patch makes the em28xx auxillary audio input work.
Tested with the HVR-950.

em28xx: make auxillary audio input work

The tuner audio input was working but the aux input wasn't.  Tested with
the HVR-950.

Signed-off-by: Devin Heitmueller <devin.heitmueller@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 5d837c16ee22..038da614a734 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -270,6 +270,8 @@ static int em28xx_set_audio_source(struct em28xx *dev)
 			break;
 		case EM28XX_AMUX_LINE_IN:
 			input = EM28XX_AUDIO_SRC_LINE;
+			video = disable;
+			line  = enable;
 			break;
 		case EM28XX_AMUX_AC97_VIDEO:
 			input = EM28XX_AUDIO_SRC_LINE;
-- 
cgit v1.2.3


From 41286d972530b7a47acb48376d714b6b121a6c22 Mon Sep 17 00:00:00 2001
From: Devin Heitmueller <devin.heitmueller@gmail.com>
Date: Sun, 16 Nov 2008 00:44:52 -0300
Subject: V4L/DVB (9634): Make sure the i2c gate is open before powering down
 tuner

It is not safe to assume that the i2c gate will be open before issuing the
command to power down the tuner.  In fact, many demods only open the gate
long enough to issue the tuning command.

This fix allows power management to work properly for those tuners behind an
i2c gate (in my case the problem was with the HVR-950Q)

Signed-off-by: Devin Heitmueller <devin.heitmueller@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/dvb-core/dvb_frontend.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index b38cebe3ac1c..7a421e9dba5a 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -585,6 +585,8 @@ restart:
 		if (fe->ops.set_voltage)
 			fe->ops.set_voltage(fe, SEC_VOLTAGE_OFF);
 		if (fe->ops.tuner_ops.sleep) {
+			if (fe->ops.i2c_gate_ctrl)
+				fe->ops.i2c_gate_ctrl(fe, 1);
 			fe->ops.tuner_ops.sleep(fe);
 			if (fe->ops.i2c_gate_ctrl)
 				fe->ops.i2c_gate_ctrl(fe, 0);
-- 
cgit v1.2.3


From deaf53e3c8e717169669ee6c2594b5c33d1af93b Mon Sep 17 00:00:00 2001
From: Harvey Harrison <harvey.harrison@gmail.com>
Date: Sat, 15 Nov 2008 01:10:14 -0300
Subject: V4L/DVB (9635): v4l: s2255drv fix firmware test on big-endian

Noticed by sparse:
drivers/media/video/s2255drv.c:2531:6: warning: restricted __le32 degrades to integer

Cc: Dean Anderson <dean@sensoray.com>
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/s2255drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index 5272926db73e..3c3f8cf73108 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -192,7 +192,7 @@ struct s2255_dmaqueue {
 #define S2255_FW_FAILED		3
 #define S2255_FW_DISCONNECTING  4
 
-#define S2255_FW_MARKER         0x22552f2f
+#define S2255_FW_MARKER		cpu_to_le32(0x22552f2f)
 /* 2255 read states */
 #define S2255_READ_IDLE         0
 #define S2255_READ_FRAME        1
-- 
cgit v1.2.3


From 99afb989b05b9fb1c7b3831ce4b7a000b214acdb Mon Sep 17 00:00:00 2001
From: Devin Heitmueller <devin.heitmueller@gmail.com>
Date: Sat, 15 Nov 2008 07:13:07 -0300
Subject: V4L/DVB (9639): Make dib0700 remote control support work with
 firmware v1.20

The format for reading the IR controller changed in firmware 1.20.  It now
provides the events on bulk endpoint 1 instead of using a control request.

Support the new format, providing backward compatibility for users who might
be using older firmware.

Thanks to Patrick Boettcher <patrick.boettcher@desy.de> for providing the
required information on how the version 1.20 firmware works.

Signed-off-by: Devin Heitmueller <devin.heitmueller@gmail.com>
Signed-off-by: Patrick Boettcher <pb@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/dvb-usb/dib0700.h         |   5 +-
 drivers/media/dvb/dvb-usb/dib0700_core.c    |  16 ++++
 drivers/media/dvb/dvb-usb/dib0700_devices.c | 139 +++++++++++++++++++++++++++-
 3 files changed, 158 insertions(+), 2 deletions(-)

diff --git a/drivers/media/dvb/dvb-usb/dib0700.h b/drivers/media/dvb/dvb-usb/dib0700.h
index 739193943c17..8b544fe79b0d 100644
--- a/drivers/media/dvb/dvb-usb/dib0700.h
+++ b/drivers/media/dvb/dvb-usb/dib0700.h
@@ -22,7 +22,7 @@ extern int dvb_usb_dib0700_debug;
 
 #define REQUEST_I2C_READ     0x2
 #define REQUEST_I2C_WRITE    0x3
-#define REQUEST_POLL_RC      0x4
+#define REQUEST_POLL_RC      0x4 /* deprecated in firmware v1.20 */
 #define REQUEST_JUMPRAM      0x8
 #define REQUEST_SET_CLOCK    0xB
 #define REQUEST_SET_GPIO     0xC
@@ -40,11 +40,14 @@ struct dib0700_state {
 	u16 mt2060_if1[2];
 	u8 rc_toggle;
 	u8 rc_counter;
+	u8 rc_func_version;
 	u8 is_dib7000pc;
 	u8 fw_use_new_i2c_api;
 	u8 disable_streaming_master_mode;
 };
 
+extern int dib0700_get_version(struct dvb_usb_device *d, u32 *hwversion,
+			       u32 *romversion, u32 *ramversion, u32 *fwtype);
 extern int dib0700_set_gpio(struct dvb_usb_device *, enum dib07x0_gpios gpio, u8 gpio_dir, u8 gpio_val);
 extern int dib0700_ctrl_clock(struct dvb_usb_device *d, u32 clk_MHz, u8 clock_out_gp3);
 extern int dib0700_ctrl_rd(struct dvb_usb_device *d, u8 *tx, u8 txlen, u8 *rx, u8 rxlen);
diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
index dd53cee3896d..200b215f4d8b 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
@@ -19,6 +19,22 @@ MODULE_PARM_DESC(dvb_usb_dib0700_ir_proto, "set ir protocol (0=NEC, 1=RC5 (defau
 
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
+
+int dib0700_get_version(struct dvb_usb_device *d, u32 *hwversion,
+			u32 *romversion, u32 *ramversion, u32 *fwtype)
+{
+	u8 b[16];
+	int ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
+				  REQUEST_GET_VERSION,
+				  USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+				  b, sizeof(b), USB_CTRL_GET_TIMEOUT);
+	*hwversion  = (b[0] << 24)  | (b[1] << 16)  | (b[2] << 8)  | b[3];
+	*romversion = (b[4] << 24)  | (b[5] << 16)  | (b[6] << 8)  | b[7];
+	*ramversion = (b[8] << 24)  | (b[9] << 16)  | (b[10] << 8) | b[11];
+	*fwtype     = (b[12] << 24) | (b[13] << 16) | (b[14] << 8) | b[15];
+	return ret;
+}
+
 /* expecting rx buffer: request data[0] data[1] ... data[2] */
 static int dib0700_ctrl_wr(struct dvb_usb_device *d, u8 *tx, u8 txlen)
 {
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 0cfccc24b190..f28d3ae59e04 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -38,6 +38,7 @@ static struct mt2060_config bristol_mt2060_config[2] = {
 	}
 };
 
+
 static struct dibx000_agc_config bristol_dib3000p_mt2060_agc_config = {
 	.band_caps = BAND_VHF | BAND_UHF,
 	.setup     = (1 << 8) | (5 << 5) | (0 << 4) | (0 << 3) | (0 << 2) | (2 << 0),
@@ -451,8 +452,13 @@ static u8 rc_request[] = { REQUEST_POLL_RC, 0 };
 
 /* Number of keypresses to ignore before start repeating */
 #define RC_REPEAT_DELAY 2
+#define RC_REPEAT_DELAY_V1_20 5
 
-static int dib0700_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
+
+
+/* Used by firmware versions < 1.20 (deprecated) */
+static int dib0700_rc_query_legacy(struct dvb_usb_device *d, u32 *event,
+				   int *state)
 {
 	u8 key[4];
 	int i;
@@ -529,6 +535,137 @@ static int dib0700_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 	return 0;
 }
 
+/* This is the structure of the RC response packet starting in firmware 1.20 */
+struct dib0700_rc_response {
+	u8 report_id;
+	u8 data_state;
+	u8 system_msb;
+	u8 system_lsb;
+	u8 data;
+	u8 not_data;
+};
+
+/* This supports the new IR response format for firmware v1.20 */
+static int dib0700_rc_query_v1_20(struct dvb_usb_device *d, u32 *event,
+				  int *state)
+{
+	struct dvb_usb_rc_key *keymap = d->props.rc_key_map;
+	struct dib0700_state *st = d->priv;
+	struct dib0700_rc_response poll_reply;
+	u8 buf[6];
+	int i;
+	int status;
+	int actlen;
+	int found = 0;
+
+	/* Set initial results in case we exit the function early */
+	*event = 0;
+	*state = REMOTE_NO_KEY_PRESSED;
+
+	/* Firmware v1.20 provides RC data via bulk endpoint 1 */
+	status = usb_bulk_msg(d->udev, usb_rcvbulkpipe(d->udev, 1), buf,
+			      sizeof(buf), &actlen, 50);
+	if (status < 0) {
+		/* No data available (meaning no key press) */
+		return 0;
+	}
+
+	if (actlen != sizeof(buf)) {
+		/* We didn't get back the 6 byte message we expected */
+		err("Unexpected RC response size [%d]", actlen);
+		return -1;
+	}
+
+	poll_reply.report_id  = buf[0];
+	poll_reply.data_state = buf[1];
+	poll_reply.system_msb = buf[2];
+	poll_reply.system_lsb = buf[3];
+	poll_reply.data       = buf[4];
+	poll_reply.not_data   = buf[5];
+
+	/*
+	info("rid=%02x ds=%02x sm=%02x sl=%02x d=%02x nd=%02x\n",
+	     poll_reply.report_id, poll_reply.data_state,
+	     poll_reply.system_msb, poll_reply.system_lsb,
+	     poll_reply.data, poll_reply.not_data);
+	*/
+
+	if ((poll_reply.data + poll_reply.not_data) != 0xff) {
+		/* Key failed integrity check */
+		err("key failed integrity check: %02x %02x %02x %02x",
+		    poll_reply.system_msb, poll_reply.system_lsb,
+		    poll_reply.data, poll_reply.not_data);
+		return -1;
+	}
+
+	/* Find the key in the map */
+	for (i = 0; i < d->props.rc_key_map_size; i++) {
+		if (keymap[i].custom == poll_reply.system_lsb &&
+		    keymap[i].data == poll_reply.data) {
+			*event = keymap[i].event;
+			found = 1;
+			break;
+		}
+	}
+
+	if (found == 0) {
+		err("Unknown remote controller key: %02x %02x %02x %02x",
+		    poll_reply.system_msb, poll_reply.system_lsb,
+		    poll_reply.data, poll_reply.not_data);
+		d->last_event = 0;
+		return 0;
+	}
+
+	if (poll_reply.data_state == 1) {
+		/* New key hit */
+		st->rc_counter = 0;
+		*event = keymap[i].event;
+		*state = REMOTE_KEY_PRESSED;
+		d->last_event = keymap[i].event;
+	} else if (poll_reply.data_state == 2) {
+		/* Key repeated */
+		st->rc_counter++;
+
+		/* prevents unwanted double hits */
+		if (st->rc_counter > RC_REPEAT_DELAY_V1_20) {
+			*event = d->last_event;
+			*state = REMOTE_KEY_PRESSED;
+			st->rc_counter = RC_REPEAT_DELAY_V1_20;
+		}
+	} else {
+		err("Unknown data state [%d]", poll_reply.data_state);
+	}
+
+	return 0;
+}
+
+static int dib0700_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
+{
+	struct dib0700_state *st = d->priv;
+
+	/* Because some people may have improperly named firmware files,
+	   let's figure out whether to use the new firmware call or the legacy
+	   call based on the firmware version embedded in the file */
+	if (st->rc_func_version == 0) {
+		u32 hwver, romver, ramver, fwtype;
+		int ret = dib0700_get_version(d, &hwver, &romver, &ramver,
+					      &fwtype);
+		if (ret < 0) {
+			err("Could not determine version info");
+			return -1;
+		}
+		if (ramver < 0x10200)
+			st->rc_func_version = 1;
+		else
+			st->rc_func_version = 2;
+	}
+
+	if (st->rc_func_version == 2)
+		return dib0700_rc_query_v1_20(d, event, state);
+	else
+		return dib0700_rc_query_legacy(d, event, state);
+}
+
 static struct dvb_usb_rc_key dib0700_rc_keys[] = {
 	/* Key codes for the tiny Pinnacle remote*/
 	{ 0x07, 0x00, KEY_MUTE },
-- 
cgit v1.2.3


From 625ff1679456d8adb9af0c980394ea3954e727a8 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab@redhat.com>
Date: Tue, 18 Nov 2008 10:23:19 -0300
Subject: V4L/DVB (9645): em28xx: Avoid memory leaks if registration fails

em28xx_init_dev() has some error conditions that are not properly
de-allocating dev var, nor freeing the device number for a future usage.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-video.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index a1ab2ef45578..bca5955339b8 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -1953,8 +1953,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 	errCode = em28xx_config(dev);
 	if (errCode) {
 		em28xx_errdev("error configuring device\n");
-		em28xx_devused &= ~(1<<dev->devno);
-		kfree(dev);
 		return -ENOMEM;
 	}
 
@@ -2088,7 +2086,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 fail_unreg:
 	em28xx_release_resources(dev);
 	mutex_unlock(&dev->lock);
-	kfree(dev);
 	return retval;
 }
 
@@ -2231,8 +2228,12 @@ static int em28xx_usb_probe(struct usb_interface *interface,
 
 	/* allocate device struct */
 	retval = em28xx_init_dev(&dev, udev, nr);
-	if (retval)
+	if (retval) {
+		em28xx_devused &= ~(1<<dev->devno);
+		kfree(dev);
+
 		return retval;
+	}
 
 	em28xx_info("Found %s\n", em28xx_boards[dev->model].name);
 
-- 
cgit v1.2.3


From c4a98793a63c423c9e1af51822325969e23c16d4 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab@redhat.com>
Date: Tue, 18 Nov 2008 14:51:08 -0300
Subject: V4L/DVB (9646): em28xx: avoid allocating/dealocating memory on every
 control urb

Before this patch, every register setup on em28xx were dynamically
allocating a temporary buffer for control URB's to be handled.

To avoid this ping-pong, use, instead a pre-allocated buffer.

Also, be sure that read control URB's also use the buffer, instead of
relying on a stack buffer.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-core.c | 48 +++++++++++++++++---------------
 drivers/media/video/em28xx/em28xx.h      |  5 ++++
 2 files changed, 31 insertions(+), 22 deletions(-)

diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 038da614a734..9551b8ab8c44 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -69,19 +69,29 @@ int em28xx_read_reg_req_len(struct em28xx *dev, u8 req, u16 reg,
 	int ret, byte;
 
 	if (dev->state & DEV_DISCONNECTED)
-		return(-ENODEV);
+		return -ENODEV;
+
+	if (len > URB_MAX_CTRL_SIZE)
+		return -EINVAL;
 
 	em28xx_regdbg("req=%02x, reg=%02x ", req, reg);
 
 	ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
 			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			      0x0000, reg, buf, len, HZ);
+			      0x0000, reg, dev->urb_buf, len, HZ);
+	if (ret < 0) {
+		if (reg_debug)
+			printk(" failed!\n");
+		return ret;
+	}
+
+	if (len)
+		memcpy(buf, dev->urb_buf, len);
 
 	if (reg_debug) {
-		printk(ret < 0 ? " failed!\n" : "%02x values: ", ret);
+		printk("%02x values: ", ret);
 		for (byte = 0; byte < len; byte++)
 			printk(" %02x", (unsigned char)buf[byte]);
-
 		printk("\n");
 	}
 
@@ -104,14 +114,16 @@ int em28xx_read_reg_req(struct em28xx *dev, u8 req, u16 reg)
 
 	ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
 			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			      0x0000, reg, &val, 1, HZ);
+			      0x0000, reg, dev->urb_buf, 1, HZ);
+	if (ret < 0) {
+		printk(" failed!\n");
+		return ret;
+	}
 
-	if (reg_debug)
-		printk(ret < 0 ? " failed!\n" :
-				 "%02x\n", (unsigned char) val);
+	val = dev->urb_buf[0];
 
-	if (ret < 0)
-		return ret;
+	if (reg_debug)
+		printk("%02x\n", (unsigned char) val);
 
 	return val;
 }
@@ -130,19 +142,13 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
 {
 	int ret;
 
-	/*usb_control_msg seems to expect a kmalloced buffer */
-	unsigned char *bufs;
-
 	if (dev->state & DEV_DISCONNECTED)
 		return -ENODEV;
 
-	if (len < 1)
+	if ((len < 1) || (len > URB_MAX_CTRL_SIZE))
 		return -EINVAL;
 
-	bufs = kmalloc(len, GFP_KERNEL);
-
 	em28xx_regdbg("req=%02x reg=%02x:", req, reg);
-
 	if (reg_debug) {
 		int i;
 		for (i = 0; i < len; ++i)
@@ -150,16 +156,14 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
 		printk("\n");
 	}
 
-	if (!bufs)
-		return -ENOMEM;
-	memcpy(bufs, buf, len);
+	memcpy(dev->urb_buf, buf, len);
 	ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), req,
 			      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			      0x0000, reg, bufs, len, HZ);
+			      0x0000, reg, dev->urb_buf, len, HZ);
+
 	if (dev->wait_after_write)
 		msleep(dev->wait_after_write);
 
-	kfree(bufs);
 	return ret;
 }
 
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 82781178e0a3..1adf3d9d9bff 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -102,6 +102,9 @@
 #define EM28XX_MIN_BUF 4
 #define EM28XX_DEF_BUF 8
 
+/*Limits the max URB message size */
+#define URB_MAX_CTRL_SIZE 80
+
 /* Params for validated field */
 #define EM28XX_BOARD_NOT_VALIDATED 1
 #define EM28XX_BOARD_VALIDATED	   0
@@ -451,6 +454,8 @@ struct em28xx {
 	unsigned int *alt_max_pkt_size;	/* array of wMaxPacketSize */
 	struct urb *urb[EM28XX_NUM_BUFS];	/* urb for isoc transfers */
 	char *transfer_buffer[EM28XX_NUM_BUFS];	/* transfer buffers for isoc transfer */
+	char urb_buf[URB_MAX_CTRL_SIZE];	/* urb control msg buffer */
+
 	/* helper funcs that call usb_control_msg */
 	int (*em28xx_write_regs) (struct em28xx *dev, u16 reg,
 					char *buf, int len);
-- 
cgit v1.2.3


From f2a2e4910502e866833732f31ee697d15b3e56fd Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab@redhat.com>
Date: Wed, 19 Nov 2008 06:17:44 -0300
Subject: V4L/DVB (9647): em28xx: void having two concurrent control URB's

Now that we have a polling task for IR, there's a race condition, since
IR can be polling while other operations are being doing. Also, we are
now sharing the same urb_buf for both read and write control urb
operations. So, we need a mutex.

Thanks to Davin Heitmueller <devin.heitmueller@gmail.com> for warning me.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-core.c  | 12 ++++++++++--
 drivers/media/video/em28xx/em28xx-video.c |  1 +
 drivers/media/video/em28xx/em28xx.h       |  1 +
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 9551b8ab8c44..15e2b525310d 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -76,18 +76,22 @@ int em28xx_read_reg_req_len(struct em28xx *dev, u8 req, u16 reg,
 
 	em28xx_regdbg("req=%02x, reg=%02x ", req, reg);
 
+	mutex_lock(&dev->ctrl_urb_lock);
 	ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
 			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			      0x0000, reg, dev->urb_buf, len, HZ);
 	if (ret < 0) {
 		if (reg_debug)
 			printk(" failed!\n");
+		mutex_unlock(&dev->ctrl_urb_lock);
 		return ret;
 	}
 
 	if (len)
 		memcpy(buf, dev->urb_buf, len);
 
+	mutex_unlock(&dev->ctrl_urb_lock);
+
 	if (reg_debug) {
 		printk("%02x values: ", ret);
 		for (byte = 0; byte < len; byte++)
@@ -112,16 +116,18 @@ int em28xx_read_reg_req(struct em28xx *dev, u8 req, u16 reg)
 
 	em28xx_regdbg("req=%02x, reg=%02x:", req, reg);
 
+	mutex_lock(&dev->ctrl_urb_lock);
 	ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
 			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			      0x0000, reg, dev->urb_buf, 1, HZ);
+	val = dev->urb_buf[0];
+	mutex_unlock(&dev->ctrl_urb_lock);
+
 	if (ret < 0) {
 		printk(" failed!\n");
 		return ret;
 	}
 
-	val = dev->urb_buf[0];
-
 	if (reg_debug)
 		printk("%02x\n", (unsigned char) val);
 
@@ -156,10 +162,12 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
 		printk("\n");
 	}
 
+	mutex_lock(&dev->ctrl_urb_lock);
 	memcpy(dev->urb_buf, buf, len);
 	ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), req,
 			      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			      0x0000, reg, dev->urb_buf, len, HZ);
+	mutex_unlock(&dev->ctrl_urb_lock);
 
 	if (dev->wait_after_write)
 		msleep(dev->wait_after_write);
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index bca5955339b8..c32fc7d24a42 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -1936,6 +1936,7 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 
 	dev->udev = udev;
 	mutex_init(&dev->lock);
+	mutex_init(&dev->ctrl_urb_lock);
 	spin_lock_init(&dev->slock);
 	init_waitqueue_head(&dev->open);
 	init_waitqueue_head(&dev->wait_frame);
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 1adf3d9d9bff..5956e9b3062f 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -433,6 +433,7 @@ struct em28xx {
 
 	/* locks */
 	struct mutex lock;
+	struct mutex ctrl_urb_lock;	/* protects urb_buf */
 	/* spinlock_t queue_lock; */
 	struct list_head inqueue, outqueue;
 	wait_queue_head_t open, wait_frame, wait_stream;
-- 
cgit v1.2.3


From cce257109f534b4954a5d04aa4ba6905f4682f93 Mon Sep 17 00:00:00 2001
From: Jose Alberto Reguero <jareguero@telefonica.net>
Date: Thu, 13 Nov 2008 14:14:18 -0300
Subject: V4L/DVB (9664): af9015: don't reconnect device in USB-bus

Don't reconnect device in the USB-bus. Reconnect command was not
executed every time by device firmware and that causes harm.
Reconnection is not needed so remove it.

Signed-off-by: Jose Alberto Reguero <jareguero@telefonica.net>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/dvb-usb/af9015.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index 847d8fdd9ec4..e9ab0249d133 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -681,12 +681,6 @@ static int af9015_download_firmware(struct usb_device *udev,
 		goto error;
 	}
 
-	/* firmware is running, reconnect device in the usb bus */
-	req.cmd = RECONNECT_USB;
-	ret = af9015_rw_udev(udev, &req);
-	if (ret)
-		err("reconnect failed: %d", ret);
-
 error:
 	return ret;
 }
@@ -1208,6 +1202,7 @@ static struct dvb_usb_device_properties af9015_properties[] = {
 		.usb_ctrl = DEVICE_SPECIFIC,
 		.download_firmware = af9015_download_firmware,
 		.firmware = "dvb-usb-af9015.fw",
+		.no_reconnect = 1,
 
 		.size_of_priv = sizeof(struct af9015_state), \
 
@@ -1306,6 +1301,7 @@ static struct dvb_usb_device_properties af9015_properties[] = {
 		.usb_ctrl = DEVICE_SPECIFIC,
 		.download_firmware = af9015_download_firmware,
 		.firmware = "dvb-usb-af9015.fw",
+		.no_reconnect = 1,
 
 		.size_of_priv = sizeof(struct af9015_state), \
 
-- 
cgit v1.2.3


From 818a557eeb9c16a9a2dc93df348b0ff68fbc487f Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab@redhat.com>
Date: Thu, 20 Nov 2008 10:30:26 -0300
Subject: V4L/DVB (9668): em28xx: fix a race condition with hald

Newer versions of hald tries to open it to call QUERYCAP.

Due to the lack of a proper locking, it is possible to open the device
before it finishes initialization.

This patch adds a lock to avoid this risk, and to protect the list of
em28xx devices.

While here, remove the uneeded BKL lock.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-video.c | 128 +++++++++++++++++-------------
 1 file changed, 75 insertions(+), 53 deletions(-)

diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index c32fc7d24a42..90a11b5ac0b1 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -73,6 +73,7 @@ MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
 
 static LIST_HEAD(em28xx_devlist);
+static DEFINE_MUTEX(em28xx_devlist_mutex);
 
 static unsigned int card[]     = {[0 ... (EM28XX_MAXBOARDS - 1)] = UNSET };
 static unsigned int video_nr[] = {[0 ... (EM28XX_MAXBOARDS - 1)] = UNSET };
@@ -1519,7 +1520,7 @@ static int em28xx_v4l2_open(struct inode *inode, struct file *filp)
 	struct em28xx_fh *fh;
 	enum v4l2_buf_type fh_type = 0;
 
-	lock_kernel();
+	mutex_lock(&em28xx_devlist_mutex);
 	list_for_each_entry(h, &em28xx_devlist, devlist) {
 		if (h->vdev->minor == minor) {
 			dev  = h;
@@ -1535,10 +1536,11 @@ static int em28xx_v4l2_open(struct inode *inode, struct file *filp)
 			dev   = h;
 		}
 	}
-	if (NULL == dev) {
-		unlock_kernel();
+	mutex_unlock(&em28xx_devlist_mutex);
+	if (NULL == dev)
 		return -ENODEV;
-	}
+
+	mutex_lock(&dev->lock);
 
 	em28xx_videodbg("open minor=%d type=%s users=%d\n",
 				minor, v4l2_type_names[fh_type], dev->users);
@@ -1547,10 +1549,9 @@ static int em28xx_v4l2_open(struct inode *inode, struct file *filp)
 	fh = kzalloc(sizeof(struct em28xx_fh), GFP_KERNEL);
 	if (!fh) {
 		em28xx_errdev("em28xx-video.c: Out of memory?!\n");
-		unlock_kernel();
+		mutex_unlock(&dev->lock);
 		return -ENOMEM;
 	}
-	mutex_lock(&dev->lock);
 	fh->dev = dev;
 	fh->radio = radio;
 	fh->type = fh_type;
@@ -1584,7 +1585,6 @@ static int em28xx_v4l2_open(struct inode *inode, struct file *filp)
 			sizeof(struct em28xx_buffer), fh);
 
 	mutex_unlock(&dev->lock);
-	unlock_kernel();
 
 	return errCode;
 }
@@ -1871,6 +1871,7 @@ int em28xx_register_extension(struct em28xx_ops *ops)
 {
 	struct em28xx *dev = NULL;
 
+	mutex_lock(&em28xx_devlist_mutex);
 	mutex_lock(&em28xx_extension_devlist_lock);
 	list_add_tail(&ops->next, &em28xx_extension_devlist);
 	list_for_each_entry(dev, &em28xx_devlist, devlist) {
@@ -1879,6 +1880,7 @@ int em28xx_register_extension(struct em28xx_ops *ops)
 	}
 	printk(KERN_INFO "Em28xx: Initialized (%s) extension\n", ops->name);
 	mutex_unlock(&em28xx_extension_devlist_lock);
+	mutex_unlock(&em28xx_devlist_mutex);
 	return 0;
 }
 EXPORT_SYMBOL(em28xx_register_extension);
@@ -1887,6 +1889,7 @@ void em28xx_unregister_extension(struct em28xx_ops *ops)
 {
 	struct em28xx *dev = NULL;
 
+	mutex_lock(&em28xx_devlist_mutex);
 	list_for_each_entry(dev, &em28xx_devlist, devlist) {
 		if (dev)
 			ops->fini(dev);
@@ -1896,6 +1899,7 @@ void em28xx_unregister_extension(struct em28xx_ops *ops)
 	printk(KERN_INFO "Em28xx: Removed (%s) extension\n", ops->name);
 	list_del(&ops->next);
 	mutex_unlock(&em28xx_extension_devlist_lock);
+	mutex_unlock(&em28xx_devlist_mutex);
 }
 EXPORT_SYMBOL(em28xx_unregister_extension);
 
@@ -1921,6 +1925,60 @@ static struct video_device *em28xx_vdev_init(struct em28xx *dev,
 }
 
 
+static int register_analog_devices(struct em28xx *dev)
+{
+	int ret;
+
+	/* allocate and fill video video_device struct */
+	dev->vdev = em28xx_vdev_init(dev, &em28xx_video_template, "video");
+	if (!dev->vdev) {
+		em28xx_errdev("cannot allocate video_device.\n");
+		return -ENODEV;
+	}
+
+	/* register v4l2 video video_device */
+	ret = video_register_device(dev->vdev, VFL_TYPE_GRABBER,
+				       video_nr[dev->devno]);
+	if (ret) {
+		em28xx_errdev("unable to register video device (error=%i).\n",
+			      ret);
+		return ret;
+	}
+
+	/* Allocate and fill vbi video_device struct */
+	dev->vbi_dev = em28xx_vdev_init(dev, &em28xx_video_template, "vbi");
+
+	/* register v4l2 vbi video_device */
+	ret = video_register_device(dev->vbi_dev, VFL_TYPE_VBI,
+					vbi_nr[dev->devno]);
+	if (ret < 0) {
+		em28xx_errdev("unable to register vbi device\n");
+		return ret;
+	}
+
+	if (em28xx_boards[dev->model].radio.type == EM28XX_RADIO) {
+		dev->radio_dev = em28xx_vdev_init(dev, &em28xx_radio_template, "radio");
+		if (!dev->radio_dev) {
+			em28xx_errdev("cannot allocate video_device.\n");
+			return -ENODEV;
+		}
+		ret = video_register_device(dev->radio_dev, VFL_TYPE_RADIO,
+					    radio_nr[dev->devno]);
+		if (ret < 0) {
+			em28xx_errdev("can't register radio device\n");
+			return ret;
+		}
+		em28xx_info("Registered radio device as /dev/radio%d\n",
+			    dev->radio_dev->num);
+	}
+
+	em28xx_info("V4L2 device registered as /dev/video%d and /dev/vbi%d\n",
+				dev->vdev->num, dev->vbi_dev->num);
+
+	return 0;
+}
+
+
 /*
  * em28xx_init_dev()
  * allocates and inits the device structs, registers i2c bus and v4l device
@@ -2000,50 +2058,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 		return errCode;
 	}
 
-	list_add_tail(&dev->devlist, &em28xx_devlist);
-
-	/* allocate and fill video video_device struct */
-	dev->vdev = em28xx_vdev_init(dev, &em28xx_video_template, "video");
-	if (NULL == dev->vdev) {
-		em28xx_errdev("cannot allocate video_device.\n");
-		goto fail_unreg;
-	}
-
-	/* register v4l2 video video_device */
-	retval = video_register_device(dev->vdev, VFL_TYPE_GRABBER,
-				       video_nr[dev->devno]);
-	if (retval) {
-		em28xx_errdev("unable to register video device (error=%i).\n",
-			      retval);
-		goto fail_unreg;
-	}
-
-	/* Allocate and fill vbi video_device struct */
-	dev->vbi_dev = em28xx_vdev_init(dev, &em28xx_video_template, "vbi");
-	/* register v4l2 vbi video_device */
-	if (video_register_device(dev->vbi_dev, VFL_TYPE_VBI,
-					vbi_nr[dev->devno]) < 0) {
-		em28xx_errdev("unable to register vbi device\n");
-		retval = -ENODEV;
-		goto fail_unreg;
-	}
-
-	if (em28xx_boards[dev->model].radio.type == EM28XX_RADIO) {
-		dev->radio_dev = em28xx_vdev_init(dev, &em28xx_radio_template, "radio");
-		if (NULL == dev->radio_dev) {
-			em28xx_errdev("cannot allocate video_device.\n");
-			goto fail_unreg;
-		}
-		retval = video_register_device(dev->radio_dev, VFL_TYPE_RADIO,
-					    radio_nr[dev->devno]);
-		if (retval < 0) {
-			em28xx_errdev("can't register radio device\n");
-			goto fail_unreg;
-		}
-		em28xx_info("Registered radio device as /dev/radio%d\n",
-			    dev->radio_dev->num);
-	}
-
 	/* init video dma queues */
 	INIT_LIST_HEAD(&dev->vidq.active);
 	INIT_LIST_HEAD(&dev->vidq.queued);
@@ -2070,8 +2084,14 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 
 	video_mux(dev, 0);
 
-	em28xx_info("V4L2 device registered as /dev/video%d and /dev/vbi%d\n",
-				dev->vdev->num, dev->vbi_dev->num);
+	mutex_lock(&em28xx_devlist_mutex);
+	list_add_tail(&dev->devlist, &em28xx_devlist);
+	retval = register_analog_devices(dev);
+	if (retval < 0) {
+		em28xx_release_resources(dev);
+		mutex_unlock(&em28xx_devlist_mutex);
+		goto fail_reg_devices;
+	}
 
 	mutex_lock(&em28xx_extension_devlist_lock);
 	if (!list_empty(&em28xx_extension_devlist)) {
@@ -2081,11 +2101,13 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 		}
 	}
 	mutex_unlock(&em28xx_extension_devlist_lock);
+	mutex_unlock(&em28xx_devlist_mutex);
 
 	return 0;
 
 fail_unreg:
 	em28xx_release_resources(dev);
+fail_reg_devices:
 	mutex_unlock(&dev->lock);
 	return retval;
 }
-- 
cgit v1.2.3


From 98522a7be97f2b23451342e36c39f412f0461e24 Mon Sep 17 00:00:00 2001
From: Jean-Francois Moine <moinejf@free.fr>
Date: Tue, 18 Nov 2008 06:33:08 -0300
Subject: V4L/DVB (9689): gspca: Memory leak when disconnect while streaming.

As a side effect, the sd routine stop0 is called on disconnect.
This permits the subdriver to free its resources.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/gspca/conex.c   |  3 +++
 drivers/media/video/gspca/finepix.c |  8 ++++++++
 drivers/media/video/gspca/gspca.c   | 17 ++++++++---------
 drivers/media/video/gspca/gspca.h   |  2 +-
 drivers/media/video/gspca/pac7311.c |  3 +++
 drivers/media/video/gspca/spca501.c |  3 +++
 drivers/media/video/gspca/spca505.c |  4 ++++
 drivers/media/video/gspca/spca561.c |  3 +++
 drivers/media/video/gspca/vc032x.c  |  3 +++
 drivers/media/video/gspca/zc3xx.c   |  3 +++
 10 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index a9d51ba7c57c..de28354ea5ba 100644
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -846,10 +846,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	return 0;
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
 	int retry = 50;
 
+	if (!gspca_dev->present)
+		return;
 	reg_w_val(gspca_dev, 0x0000, 0x00);
 	reg_r(gspca_dev, 0x0002, 1);
 	reg_w_val(gspca_dev, 0x0053, 0x00);
diff --git a/drivers/media/video/gspca/finepix.c b/drivers/media/video/gspca/finepix.c
index 65d3cbfe6b27..607942fd7970 100644
--- a/drivers/media/video/gspca/finepix.c
+++ b/drivers/media/video/gspca/finepix.c
@@ -276,6 +276,12 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 	/* Stop the state machine */
 	if (dev->state != FPIX_NOP)
 		wait_for_completion(&dev->can_close);
+}
+
+/* called on streamoff with alt 0 and disconnect */
+static void sd_stop0(struct gspca_dev *gspca_dev)
+{
+	struct usb_fpix *dev = (struct usb_fpix *) gspca_dev;
 
 	usb_free_urb(dev->control_urb);
 	dev->control_urb = NULL;
@@ -385,6 +391,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 error:
 	/* Free the ressources */
 	sd_stopN(gspca_dev);
+	sd_stop0(gspca_dev);
 	return ret;
 }
 
@@ -425,6 +432,7 @@ static const struct sd_desc sd_desc = {
 	.init = sd_init,
 	.start = sd_start,
 	.stopN = sd_stopN,
+	.stop0 = sd_stop0,
 };
 
 /* -- device connect -- */
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index e48fbfc8ad05..f28d2f4aceac 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -646,15 +646,14 @@ static void gspca_stream_off(struct gspca_dev *gspca_dev)
 {
 	gspca_dev->streaming = 0;
 	atomic_set(&gspca_dev->nevent, 0);
-	if (gspca_dev->present) {
-		if (gspca_dev->sd_desc->stopN)
-			gspca_dev->sd_desc->stopN(gspca_dev);
-		destroy_urbs(gspca_dev);
-		gspca_set_alt0(gspca_dev);
-		if (gspca_dev->sd_desc->stop0)
-			gspca_dev->sd_desc->stop0(gspca_dev);
-		PDEBUG(D_STREAM, "stream off OK");
-	}
+	if (gspca_dev->present
+	    && gspca_dev->sd_desc->stopN)
+		gspca_dev->sd_desc->stopN(gspca_dev);
+	destroy_urbs(gspca_dev);
+	gspca_set_alt0(gspca_dev);
+	if (gspca_dev->sd_desc->stop0)
+		gspca_dev->sd_desc->stop0(gspca_dev);
+	PDEBUG(D_STREAM, "stream off OK");
 }
 
 static void gspca_set_default_mode(struct gspca_dev *gspca_dev)
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index 1d9dc90b4791..c35d7b97112f 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -97,7 +97,7 @@ struct sd_desc {
 	cam_pkt_op pkt_scan;
 /* optional operations */
 	cam_v_op stopN;		/* called on stream off - main alt */
-	cam_v_op stop0;		/* called on stream off - alt 0 */
+	cam_v_op stop0;		/* called on stream off & disconnect - alt 0 */
 	cam_v_op dq_callback;	/* called when a frame has been dequeued */
 	cam_jpg_op get_jcomp;
 	cam_jpg_op set_jcomp;
diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
index e5ff9a6199ef..fbd45e235d97 100644
--- a/drivers/media/video/gspca/pac7311.c
+++ b/drivers/media/video/gspca/pac7311.c
@@ -749,10 +749,13 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 	reg_w(gspca_dev, 0x78, 0x44); /* Bit_0=start stream, Bit_6=LED */
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
+	if (!gspca_dev->present)
+		return;
 	if (sd->sensor == SENSOR_PAC7302) {
 		reg_w(gspca_dev, 0xff, 0x01);
 		reg_w(gspca_dev, 0x78, 0x40);
diff --git a/drivers/media/video/gspca/spca501.c b/drivers/media/video/gspca/spca501.c
index b742f260c7ca..e29954c1c38c 100644
--- a/drivers/media/video/gspca/spca501.c
+++ b/drivers/media/video/gspca/spca501.c
@@ -2022,8 +2022,11 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 	reg_write(gspca_dev->dev, SPCA501_REG_CTLRL, 0x01, 0x00);
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
+	if (!gspca_dev->present)
+		return;
 	reg_write(gspca_dev->dev, SPCA501_REG_CTLRL, 0x05, 0x00);
 }
 
diff --git a/drivers/media/video/gspca/spca505.c b/drivers/media/video/gspca/spca505.c
index b345749213cf..895b9fe4018c 100644
--- a/drivers/media/video/gspca/spca505.c
+++ b/drivers/media/video/gspca/spca505.c
@@ -742,8 +742,12 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 	reg_write(gspca_dev->dev, 0x02, 0x00, 0x00);
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
+	if (!gspca_dev->present)
+		return;
+
 	/* This maybe reset or power control */
 	reg_write(gspca_dev->dev, 0x03, 0x03, 0x20);
 	reg_write(gspca_dev->dev, 0x03, 0x01, 0x0);
diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index 020a03c466c1..c3de4e44123d 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -766,10 +766,13 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 	}
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
+	if (!gspca_dev->present)
+		return;
 	if (sd->chip_revision == Rev012A) {
 		reg_w_val(gspca_dev->dev, 0x8118, 0x29);
 		reg_w_val(gspca_dev->dev, 0x8114, 0x08);
diff --git a/drivers/media/video/gspca/vc032x.c b/drivers/media/video/gspca/vc032x.c
index be46d9232540..17af353ddd1c 100644
--- a/drivers/media/video/gspca/vc032x.c
+++ b/drivers/media/video/gspca/vc032x.c
@@ -1633,10 +1633,13 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 	reg_w(dev, 0xa0, 0x09, 0xb003);
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
 	struct usb_device *dev = gspca_dev->dev;
 
+	if (!gspca_dev->present)
+		return;
 	reg_w(dev, 0x89, 0xffff, 0xffff);
 }
 
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index 8b3101d347c3..0befacf49855 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -7336,10 +7336,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	return 0;
 }
 
+/* called on streamoff with alt 0 and on disconnect */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
+	if (!gspca_dev->present)
+		return;
 	send_unknown(gspca_dev->dev, sd->sensor);
 }
 
-- 
cgit v1.2.3


From 5c4fa002b1c7b40f65fa911ae17a823ec9e26ab2 Mon Sep 17 00:00:00 2001
From: Jean-Francois Moine <moinejf@free.fr>
Date: Tue, 18 Nov 2008 15:52:31 -0300
Subject: V4L/DVB (9690): gspca: Lock the subdrivers via module_get/put.

The previous subdriver protection against rmmod was done via the
file operations table in the device descriptor. On device disconnection
while streaming, the device structure was freed at close time, and the
module_put still used the module name in the freed area.
Now, explicit module get/put are done on open and close.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/gspca/gspca.c | 13 ++++++++++---
 drivers/media/video/gspca/gspca.h |  2 +-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index f28d2f4aceac..a565f3764837 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -874,6 +874,13 @@ static int dev_open(struct inode *inode, struct file *file)
 		ret = -EBUSY;
 		goto out;
 	}
+
+	/* protect the subdriver against rmmod */
+	if (!try_module_get(gspca_dev->module)) {
+		ret = -ENODEV;
+		goto out;
+	}
+
 	gspca_dev->users++;
 
 	/* one more user */
@@ -920,6 +927,7 @@ static int dev_close(struct inode *inode, struct file *file)
 		gspca_dev->memory = GSPCA_MEMORY_NO;
 	}
 	file->private_data = NULL;
+	module_put(gspca_dev->module);
 	mutex_unlock(&gspca_dev->queue_lock);
 
 	PDEBUG(D_STREAM, "close done");
@@ -1870,9 +1878,8 @@ int gspca_dev_probe(struct usb_interface *intf,
 	/* init video stuff */
 	memcpy(&gspca_dev->vdev, &gspca_template, sizeof gspca_template);
 	gspca_dev->vdev.parent = &dev->dev;
-	memcpy(&gspca_dev->fops, &dev_fops, sizeof gspca_dev->fops);
-	gspca_dev->vdev.fops = &gspca_dev->fops;
-	gspca_dev->fops.owner = module;		/* module protection */
+	gspca_dev->vdev.fops = &dev_fops;
+	gspca_dev->module = module;
 	gspca_dev->present = 1;
 	ret = video_register_device(&gspca_dev->vdev,
 				  VFL_TYPE_GRABBER,
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index c35d7b97112f..2ae1ad7c1483 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -121,7 +121,7 @@ struct gspca_frame {
 
 struct gspca_dev {
 	struct video_device vdev;	/* !! must be the first item */
-	struct file_operations fops;
+	struct module *module;		/* subdriver handling the device */
 	struct usb_device *dev;
 	struct kref kref;
 	struct file *capt_file;		/* file doing video capture */
-- 
cgit v1.2.3


From e07a1d8ab20a059fefbfd1558db43701bca560d7 Mon Sep 17 00:00:00 2001
From: Jean-Francois Moine <moinejf@free.fr>
Date: Wed, 19 Nov 2008 06:37:53 -0300
Subject: V4L/DVB (9691): gspca: Move the video device to a separate area.

The video device was part of the gspca device. On device disconnection
while streaming, the device structure is freed at close time.
In this case, the remaining close job on the video device run out of
allocated memory.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/gspca/gspca.c | 28 +++++++++++++---------------
 drivers/media/video/gspca/gspca.h |  2 +-
 2 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index a565f3764837..748a87e82e44 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -862,7 +862,7 @@ static int dev_open(struct inode *inode, struct file *file)
 	int ret;
 
 	PDEBUG(D_STREAM, "%s open", current->comm);
-	gspca_dev = (struct gspca_dev *) video_devdata(file);
+	gspca_dev = video_drvdata(file);
 	if (mutex_lock_interruptible(&gspca_dev->queue_lock))
 		return -ERESTARTSYS;
 	if (!gspca_dev->present) {
@@ -890,10 +890,10 @@ static int dev_open(struct inode *inode, struct file *file)
 #ifdef GSPCA_DEBUG
 	/* activate the v4l2 debug */
 	if (gspca_debug & D_V4L2)
-		gspca_dev->vdev.debug |= V4L2_DEBUG_IOCTL
+		gspca_dev->vdev->debug |= V4L2_DEBUG_IOCTL
 					| V4L2_DEBUG_IOCTL_ARG;
 	else
-		gspca_dev->vdev.debug &= ~(V4L2_DEBUG_IOCTL
+		gspca_dev->vdev->debug &= ~(V4L2_DEBUG_IOCTL
 					| V4L2_DEBUG_IOCTL_ARG);
 #endif
 	ret = 0;
@@ -1755,11 +1755,6 @@ out:
 	return ret;
 }
 
-static void dev_release(struct video_device *vfd)
-{
-	/* nothing */
-}
-
 static struct file_operations dev_fops = {
 	.owner = THIS_MODULE,
 	.open = dev_open,
@@ -1807,7 +1802,7 @@ static struct video_device gspca_template = {
 	.name = "gspca main driver",
 	.fops = &dev_fops,
 	.ioctl_ops = &dev_ioctl_ops,
-	.release = dev_release,		/* mandatory */
+	.release = video_device_release,
 	.minor = -1,
 };
 
@@ -1876,16 +1871,18 @@ int gspca_dev_probe(struct usb_interface *intf,
 	init_waitqueue_head(&gspca_dev->wq);
 
 	/* init video stuff */
-	memcpy(&gspca_dev->vdev, &gspca_template, sizeof gspca_template);
-	gspca_dev->vdev.parent = &dev->dev;
-	gspca_dev->vdev.fops = &dev_fops;
+	gspca_dev->vdev = video_device_alloc();
+	memcpy(gspca_dev->vdev, &gspca_template, sizeof gspca_template);
+	gspca_dev->vdev->parent = &dev->dev;
 	gspca_dev->module = module;
 	gspca_dev->present = 1;
-	ret = video_register_device(&gspca_dev->vdev,
+	video_set_drvdata(gspca_dev->vdev, gspca_dev);
+	ret = video_register_device(gspca_dev->vdev,
 				  VFL_TYPE_GRABBER,
 				  video_nr);
 	if (ret < 0) {
 		err("video_register_device err %d", ret);
+		video_device_release(gspca_dev->vdev);
 		goto out;
 	}
 
@@ -1893,7 +1890,8 @@ int gspca_dev_probe(struct usb_interface *intf,
 	PDEBUG(D_PROBE, "probe ok");
 	return 0;
 out:
-	kref_put(&gspca_dev->kref, gspca_delete);
+	kfree(gspca_dev->usb_buf);
+	kfree(gspca_dev);
 	return ret;
 }
 EXPORT_SYMBOL(gspca_dev_probe);
@@ -1911,7 +1909,7 @@ void gspca_disconnect(struct usb_interface *intf)
 	usb_set_intfdata(intf, NULL);
 
 /* We don't want people trying to open up the device */
-	video_unregister_device(&gspca_dev->vdev);
+	video_unregister_device(gspca_dev->vdev);
 
 	gspca_dev->present = 0;
 	gspca_dev->streaming = 0;
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index 2ae1ad7c1483..d25e8d69373b 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -120,7 +120,7 @@ struct gspca_frame {
 };
 
 struct gspca_dev {
-	struct video_device vdev;	/* !! must be the first item */
+	struct video_device *vdev;
 	struct module *module;		/* subdriver handling the device */
 	struct usb_device *dev;
 	struct kref kref;
-- 
cgit v1.2.3


From 7a8f4ccfd572a11f609439dc6a75165b441641bc Mon Sep 17 00:00:00 2001
From: Michael Krufky <mkrufky@linuxtv.org>
Date: Fri, 21 Nov 2008 17:14:37 -0300
Subject: V4L/DVB (9732): sms1xxx: use new firmware for Hauppauge WinTV
 MiniStick

New firmware image brings enhanced tuning performance.

Firmware is available for download at the following location:
http://www.steventoth.net/linux/sms1xxx

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/dvb/siano/sms-cards.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/dvb/siano/sms-cards.c b/drivers/media/dvb/siano/sms-cards.c
index 6f9b77360440..e98d6caf2c23 100644
--- a/drivers/media/dvb/siano/sms-cards.c
+++ b/drivers/media/dvb/siano/sms-cards.c
@@ -95,7 +95,7 @@ static struct sms_board sms_boards[] = {
 	[SMS1XXX_BOARD_HAUPPAUGE_WINDHAM] = {
 		.name	= "Hauppauge WinTV MiniStick",
 		.type	= SMS_NOVA_B0,
-		.fw[DEVICE_MODE_DVBT_BDA] = "sms1xxx-hcw-55xxx-dvbt-01.fw",
+		.fw[DEVICE_MODE_DVBT_BDA] = "sms1xxx-hcw-55xxx-dvbt-02.fw",
 	},
 };
 
-- 
cgit v1.2.3


From 50f3beb50abe0cc0228363af804e50e710b3e5b0 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab@redhat.com>
Date: Mon, 24 Nov 2008 08:45:57 -0300
Subject: V4L/DVB (9742): em28xx-alsa: implement another locking schema

Instead of using a spinlock, it is better to call the proper pcm stream
locking schema.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-audio.c | 37 ++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 13 deletions(-)

diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index ac3292d7646c..dfac2e042a52 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -75,7 +75,9 @@ static void em28xx_audio_isocirq(struct urb *urb)
 	struct em28xx            *dev = urb->context;
 	int                      i;
 	unsigned int             oldptr;
+#ifdef NO_PCM_LOCK
 	unsigned long            flags;
+#endif
 	int                      period_elapsed = 0;
 	int                      status;
 	unsigned char            *cp;
@@ -96,9 +98,26 @@ static void em28xx_audio_isocirq(struct urb *urb)
 			if (!length)
 				continue;
 
+#ifdef NO_PCM_LOCK
 			spin_lock_irqsave(&dev->adev->slock, flags);
-
+#endif
 			oldptr = dev->adev->hwptr_done_capture;
+			if (oldptr + length >= runtime->buffer_size) {
+				unsigned int cnt =
+				    runtime->buffer_size - oldptr;
+				memcpy(runtime->dma_area + oldptr * stride, cp,
+				       cnt * stride);
+				memcpy(runtime->dma_area, cp + cnt * stride,
+				       length * stride - cnt * stride);
+			} else {
+				memcpy(runtime->dma_area + oldptr * stride, cp,
+				       length * stride);
+			}
+
+#ifndef NO_PCM_LOCK
+			snd_pcm_stream_lock(substream);
+#endif
+
 			dev->adev->hwptr_done_capture += length;
 			if (dev->adev->hwptr_done_capture >=
 			    runtime->buffer_size)
@@ -113,19 +132,11 @@ static void em28xx_audio_isocirq(struct urb *urb)
 				period_elapsed = 1;
 			}
 
+#ifdef NO_PCM_LOCK
 			spin_unlock_irqrestore(&dev->adev->slock, flags);
-
-			if (oldptr + length >= runtime->buffer_size) {
-				unsigned int cnt =
-				    runtime->buffer_size - oldptr;
-				memcpy(runtime->dma_area + oldptr * stride, cp,
-				       cnt * stride);
-				memcpy(runtime->dma_area, cp + cnt * stride,
-				       length * stride - cnt * stride);
-			} else {
-				memcpy(runtime->dma_area + oldptr * stride, cp,
-				       length * stride);
-			}
+#else
+			snd_pcm_stream_unlock(substream);
+#endif
 		}
 		if (period_elapsed)
 			snd_pcm_period_elapsed(substream);
-- 
cgit v1.2.3


From faa3bd2e48e594e9475e92fb84bb6ebe6f62f23b Mon Sep 17 00:00:00 2001
From: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Date: Mon, 24 Nov 2008 09:51:20 -0300
Subject: V4L/DVB (9743): em28xx: fix oops audio

Replaced usb_kill_usb for usb_unlink_usb
(wait until urb to fully stop require USB core to put the calling process to sleep).

Oops:
http://www.kerneloops.org/raw.php?rawid=71799&msgid=

Signed-off-by: Douglas Schilling Landgraf <dougsland@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-audio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index dfac2e042a52..90236bbfe66a 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -62,7 +62,7 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
 
 	dprintk("Stopping isoc\n");
 	for (i = 0; i < EM28XX_AUDIO_BUFS; i++) {
-		usb_kill_urb(dev->adev->urb[i]);
+		usb_unlink_urb(dev->adev->urb[i]);
 		usb_free_urb(dev->adev->urb[i]);
 		dev->adev->urb[i] = NULL;
 	}
-- 
cgit v1.2.3


From 484ab62c5ee805c2bdc405a85a4e64da2722690f Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil@xs4all.nl>
Date: Mon, 24 Nov 2008 09:53:22 -0300
Subject: V4L/DVB (9748): em28xx: fix compile warning

Label fail_unreg is no longer used.

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-video.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 90a11b5ac0b1..610f535a257c 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -2105,8 +2105,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 
 	return 0;
 
-fail_unreg:
-	em28xx_release_resources(dev);
 fail_reg_devices:
 	mutex_unlock(&dev->lock);
 	return retval;
-- 
cgit v1.2.3


From a693b0cdba94f60f7ed43754d2c34151cdd11da5 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab@redhat.com>
Date: Mon, 1 Dec 2008 18:04:14 -0200
Subject: em28xx: remove backward compat macro added on a previous fix

commit 50f3beb50abe0cc0228363af804e50e710b3e5b0 fixed em28xx-alsa
locking schema. However, a backport macro was kept.

This patch removes the macro, since it is not needed for the module
compilation against upstream.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/em28xx/em28xx-audio.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 90236bbfe66a..7a8d49ef646e 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -75,9 +75,6 @@ static void em28xx_audio_isocirq(struct urb *urb)
 	struct em28xx            *dev = urb->context;
 	int                      i;
 	unsigned int             oldptr;
-#ifdef NO_PCM_LOCK
-	unsigned long            flags;
-#endif
 	int                      period_elapsed = 0;
 	int                      status;
 	unsigned char            *cp;
@@ -98,9 +95,6 @@ static void em28xx_audio_isocirq(struct urb *urb)
 			if (!length)
 				continue;
 
-#ifdef NO_PCM_LOCK
-			spin_lock_irqsave(&dev->adev->slock, flags);
-#endif
 			oldptr = dev->adev->hwptr_done_capture;
 			if (oldptr + length >= runtime->buffer_size) {
 				unsigned int cnt =
@@ -114,9 +108,7 @@ static void em28xx_audio_isocirq(struct urb *urb)
 				       length * stride);
 			}
 
-#ifndef NO_PCM_LOCK
 			snd_pcm_stream_lock(substream);
-#endif
 
 			dev->adev->hwptr_done_capture += length;
 			if (dev->adev->hwptr_done_capture >=
@@ -132,11 +124,7 @@ static void em28xx_audio_isocirq(struct urb *urb)
 				period_elapsed = 1;
 			}
 
-#ifdef NO_PCM_LOCK
-			spin_unlock_irqrestore(&dev->adev->slock, flags);
-#else
 			snd_pcm_stream_unlock(substream);
-#endif
 		}
 		if (period_elapsed)
 			snd_pcm_period_elapsed(substream);
-- 
cgit v1.2.3