[media] v4l: Release module if subdev registration fails

If v4l2_device_register_subdev() fails, the reference to the subdev
module taken by the function isn't released. Fix this.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@kernel.org
Acked-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] ngene: Fix CI data transfer regression
Fix CI data transfer regression introduced by previous cleanup.

Signed-off-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] v4l: make sure drivers supply a zeroed struct v4l2_subdev

Some v4l drivers currently don't initialize their struct v4l2_subdev
with zeros, and this is a problem since some of the v4l2 code expects
this. One example is the addition of internal_ops in commit 45f6f84,
after that we are at risk of random oopses with these drivers when code
in v4l2_device_register_subdev tries to dereference sd->internal_ops->*,
as can be shown by the report at http://bugs.launchpad.net/bugs/745213
and analysis of its crash at https://lkml.org/lkml/2011/4/1/168

Use kzalloc within problematic drivers to ensure we have a zeroed struct
v4l2_subdev.

BugLink: http://bugs.launchpad.net/bugs/745213
Cc: <stable@kernel.org>
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] Missing frontend config for LME DM04/QQBOX

Forgot to add the DVB_STV0299/DVB_PLL to config

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] rc_core: avoid kernel oops when rmmod saa7134

The following is a patch to avoid a kernel oops when running rmmod
saa7134 on kernel 2.6.27.1. The change is as suggested by mchehab on
irc.freenode.org

Signed-off-by: Hussam Al-Tayeb <ht990332@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] imon: add conditional locking in change_protocol

The imon_ir_change_protocol function gets called two different ways, one
way is from rc_register_device, for initial protocol selection/setup,
and the other is via a userspace-initiated protocol change request,
either by direct sysfs prodding or by something like ir-keytable.

In the rc_register_device case, the imon context lock is already held,
but when initiated from userspace, it is not, so we must acquire it,
prior to calling send_packet, which requires that the lock is held.

Without this change, there's an easily reproduceable deadlock when
another function calls send_packet (such as either of the display write
fops) after a userspace-initiated change_protocol.

With a lock-debugging-enabled kernel, I was getting this:

[   15.014153] =====================================
[   15.015048] [ BUG: bad unlock balance detected! ]
[   15.015048] -------------------------------------
[   15.015048] ir-keytable/773 is trying to release lock (&ictx->lock) at:
[   15.015048] [<ffffffff814c6297>] mutex_unlock+0xe/0x10
[   15.015048] but there are no more locks to release!
[   15.015048]
[   15.015048] other info that might help us debug this:
[   15.015048] 2 locks held by ir-keytable/773:
[   15.015048]  #0:  (&buffer->mutex){+.+.+.}, at: [<ffffffff8119d400>] sysfs_write_file+0x3c/0x144
[   15.015048]  #1:  (s_active#87){.+.+.+}, at: [<ffffffff8119d4ab>] sysfs_write_file+0xe7/0x144
[   15.015048]
[   15.015048] stack backtrace:
[   15.015048] Pid: 773, comm: ir-keytable Not tainted 2.6.38.4-20.fc15.x86_64.debug #1
[   15.015048] Call Trace:
[   15.015048]  [<ffffffff81089715>] ? print_unlock_inbalance_bug+0xca/0xd5
[   15.015048]  [<ffffffff8108b35c>] ? lock_release_non_nested+0xc1/0x263
[   15.015048]  [<ffffffff814c6297>] ? mutex_unlock+0xe/0x10
[   15.015048]  [<ffffffff814c6297>] ? mutex_unlock+0xe/0x10
[   15.015048]  [<ffffffff8108b67b>] ? lock_release+0x17d/0x1a4
[   15.015048]  [<ffffffff814c6229>] ? __mutex_unlock_slowpath+0xc5/0x125
[   15.015048]  [<ffffffff814c6297>] ? mutex_unlock+0xe/0x10
[   15.015048]  [<ffffffffa02964b6>] ? send_packet+0x1c9/0x264 [imon]
[   15.015048]  [<ffffffff8108b376>] ? lock_release_non_nested+0xdb/0x263
[   15.015048]  [<ffffffffa0296731>] ? imon_ir_change_protocol+0x126/0x15e [imon]
[   15.015048]  [<ffffffffa024a334>] ? store_protocols+0x1c3/0x286 [rc_core]
[   15.015048]  [<ffffffff81326e4e>] ? dev_attr_store+0x20/0x22
[   15.015048]  [<ffffffff8119d4cc>] ? sysfs_write_file+0x108/0x144
...

The original report that led to the investigation was the following:

[ 1679.457305] INFO: task LCDd:8460 blocked for more than 120 seconds.
[ 1679.457307] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 1679.457309] LCDd            D ffff88010fcd89c8     0  8460      1 0x00000000
[ 1679.457312]  ffff8800d5a03b48 0000000000000082 0000000000000000 ffff8800d5a03fd8
[ 1679.457314]  00000000012dcd30 fffffffffffffffd ffff8800d5a03fd8 ffff88010fcd86f0
[ 1679.457316]  ffff8800d5a03fd8 ffff8800d5a03fd8 ffff88010fcd89d0 ffff8800d5a03fd8
[ 1679.457319] Call Trace:
[ 1679.457324]  [<ffffffff810ff1a5>] ? zone_statistics+0x75/0x90
[ 1679.457327]  [<ffffffff810ea907>] ? get_page_from_freelist+0x3c7/0x820
[ 1679.457330]  [<ffffffff813b0a49>] __mutex_lock_slowpath+0x139/0x320
[ 1679.457335]  [<ffffffff813b0c41>] mutex_lock+0x11/0x30
[ 1679.457338]  [<ffffffffa0d54216>] display_open+0x66/0x130 [imon]
[ 1679.457345]  [<ffffffffa01d06c0>] usb_open+0x180/0x310 [usbcore]
[ 1679.457349]  [<ffffffff81143b3b>] chrdev_open+0x1bb/0x2d0
[ 1679.457350]  [<ffffffff8113d93d>] __dentry_open+0x10d/0x370
[ 1679.457352]  [<ffffffff81143980>] ? chrdev_open+0x0/0x2d0
...

Bump the driver version here so its easier to tell if people have this
locking fix or not, and also make locking during probe easier to follow.

CC: stable@kernel.org
Reported-by: Benjamin Hodgetts <ben@xnode.org>
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] rc: show RC_TYPE_OTHER in sysfs

Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] ite-cir: modular build on ppc requires delay.h include

Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] mceusb: add Dell transceiver ID

Add device ID for a Dell-branded, Philips device ID transceiver reported
by an OpenELEC user on their forums.

http://openelec.tv/forum/27-hardware-support/5622-adding-support-for-an-ir-receiver--dell-branded--#5622

Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] media: vb2: correct queue initialization order

q->memory entry is initialized to late, so if allocation of memory buffers
fails, the buffers might not be freed correctly (q->memory is tested in
__vb2_free_mem, which can be called before setting q->memory).

Reported-by: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
CC: Pawel Osciak <pawel@osciak.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] media: vb2: fix incorrect v4l2_buffer->flags handling

Videobuf2 core assumes that driver doesn't set any buffer flags.
This is correct for buffer state flags that videobuf2 manages,
but the other flags like V4L2_BUF_FLAG_{KEY,P,B}FRAME,
V4L2_BUF_FLAG_TIMECODE and V4L2_BUF_FLAG_INPUT should be passed from or to
the driver.

Reported-by: Jonghun Han <jonghun.han@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
CC: Pawel Osciak <pawel@osciak.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] s5p-fimc: Add support for the buffer timestamps and sequence

Add support for buffer timestamps and the sequence number in
the video capture driver.

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] s5p-fimc: Fix bytesperline and plane payload setup

Make sure the sizeimage for 3-planar color formats is
width * height * 3/2 and the bytesperline is same for each
plane in case of a multi-planar format.

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] s5p-fimc: Do not allow changing format after REQBUFS

Protecting the color format with vb2_is_streaming() is not sufficient
as this prevents changing the format only after VIDIOC_STREAMON.
To prevent the color format reconfiguration as soon as buffers
are allocated use vb2_is_busy() instead.
Also make the videobuf queue ops structure static.

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] s5p-fimc: Fix FIMC3 pixel limits on Exynos4

Correct pixel limits for the fourth FIMC entity on Exynos4 SoCs.
FIMC3 only supports the writeback input from the LCD mixer.
Also rename s5pv310 variant to exynos4 which is needed after
renaming s5pv310 series to Exynos4.

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] tda18271: update tda18271c2_rf_cal as per NXP's rev.04 datasheet

Cc: Stefan Sibiga <stefansibiga@yahoo.ca>
Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] tda18271: update tda18271_rf_band as per NXP's rev.04 datasheet

Cc: Stefan Sibiga <stefansibiga@yahoo.ca>
Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] tda18271: fix bad calculation of main post divider byte

R_MPD bit 3 does not depend on analog vs. digital. Just use
(0x7f & pd) directly from the values in the main pll table.

Thanks to Stefan Sibiga for pointing this out.

Cc: Stefan Sibiga <stefansibiga@yahoo.ca>
Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] tda18271: prog_cal and prog_tab variables should be s32, not u8

Fix type of prog_cal and prog_tab variables to avoid any possible
calculation errors.

Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] tda18271: fix calculation bug in tda18271_rf_tracking_filters_init

Misplaced parenthesis cause a calculation bug in
tda18271_rf_tracking_filters_init

Thanks to Stefan Sibiga for pointing this out.

Cc: Stefan Sibiga <stefansibiga@yahoo.ca>
Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: queue: Don't corrupt buf->npages when get_user_pages() fails

get_user_pages() can return a negative error code when it fails. Set
buf->npages to 0 in that case, to prevent isp_video_buffer_cleanup()
from releasing invalid pages.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] v4l: Don't register media entities for subdev device nodes

Subdevs already have their own entity, don't register as second one when
registering the subdev device node.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@maxwell.research.nokia.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: Don't increment node entity use count when poweron fails

When open a device node, all entities part of the same pipeline are
powered on. If one of the entities fails to be powered on, the open
operations fails. In that case the device node entity use count must not
be incremented.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: lane shifter support

To use the lane shifter, set different pixel formats at each end of
the link at the CCDC input.

Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: ccdc: support Y10/12, 8-bit bayer fmts

Add support for 8-bit bayer and 10- and 12-bit grey formats at the CCDC
input. Y12 is truncated to Y10 at the CCDC output.

Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] media: add missing 8-bit bayer formats and Y12

8-bit SGBRG and SRGGB media bus formats are missing, as well as the
12-bit grey format. Add them.

Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] v4l: add V4L2_PIX_FMT_Y12 format

Y12 is a grey-scale format with a depth of 12 bits per pixel stored in
16-bit words.

Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

cx23885: Fix stv0367 Kconfig dependency

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: Use isp xclk defines

Use isp defines for isp xclk selection in isp_set_xclk().

Signed-off-by: Stanimir Varbanov <svarbanov@mm-sol.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: isp: Reset the ISP when the pipeline can't be stopped

When a failure to stop a module in the pipeline is detected, the only
way to recover is to reset the ISP. However, as other users can be using
a different pipeline with other modules, the ISP can't be reset
synchronously with the error detection.

Mark the ISP as needing a reset when a failure to stop a pipeline is
detected, and reset the ISP when the last user releases the last
reference to the ISP.

Modify the omap3isp_pipeline_set_stream() function to record the new ISP
pipeline state only when no error occurs, except when stopping the
pipeline in which case the pipeline is still marked as stopped.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: stat: update struct ispstat_generic_config's comments

struct ispstat_generic_config's comments refers to isph3a_aewb_config,
isph3a_af_config and isphist_config. But those structs have had their
names prefixed with 'omap3'. So, let's update the comments.

Signed-off-by: David Cohen <david.cohen@nokia.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] media: Properly handle link flags in link setup, link notify callback

The link flags were not properly handled in __media_entity_setup_link
which could lead to link_notify callback to be called when the flags are
not modified. Fix this.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: Fix trivial typos

It doesn't get more trivial than these.

Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: resizer: Improved resizer rsz factor formula

Round properly the rsz factor so that we get highest rsz so that the input
width (or height) is highest possible smaller or equal to what the user
asks.

Signed-off-by: Sakari Ailus <sakari.ailus@maxwell.research.nokia.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: resizer: Use 4-tap mode equations when the ratio is <= 512

As the number of phases/taps, used to select the correct equations to
compute the ratio, depends on the ratio, start with the 7-tap mode
equations to compute an approximation of the ratio, and switch to the
4-tap mode equations if the approximation is lower than or equal to 512.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] omap3isp: resizer: Center the crop rectangle

When the crop rectangle needs to be modified to match hardware
requirements, center the resulting rectangle on the requested rectangle
instead of removing pixels from the right and bottom sides only.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] media: Use correct ioctl name in MEDIA_IOC_SETUP_LINK documentation

The documentation incorrectly refers to MEDIA_IOC_ENUM_LINKS, fix it.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] V4L: mx3_camera: select VIDEOBUF2_DMA_CONTIG instead of VIDEOBUF_DMA_CONTIG

Since commit

379fa5d ([media] V4L: mx3_camera: convert to videobuf2)

mx3_camera uses videobuf2, but that commit didn't upgrade the select
resulting in the following build failure:

drivers/built-in.o: In function `mx3_camera_init_videobuf':
clkdev.c:(.text+0x86580): undefined reference to `vb2_dma_contig_memops'
drivers/built-in.o: In function `mx3_camera_probe':
clkdev.c:(.devinit.text+0x3548): undefined reference to `vb2_dma_contig_init_ctx'
clkdev.c:(.devinit.text+0x3578): undefined reference to `vb2_dma_contig_cleanup_ctx'
drivers/built-in.o: In function `mx3_camera_remove':
clkdev.c:(.devexit.text+0x674): undefined reference to `vb2_dma_contig_cleanup_ctx'
make[2]: *** [.tmp_vmlinux1] Error 1
make[1]: *** [sub-make] Error 2
make: *** [all] Error 2

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] V4L: sh_mobile_ceu_camera: fix typos in documentation

Fix a couple of typos and clarify a formula in sh_mobile_ceu driver
documentation.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] sh_mobile_csi2: fix module reloading

If the camera host driver (sh_mobile_ceu_camera.c) is unloaded and then
reloaded, probe will fail, because camera client .set_bus_param() and
.query_bus_param() methods have been set to NULL. Fix this by caching
the original pointers and restoring them on driver-unbind.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] soc-camera: don't dereference I2C client after it has been removed

i2c_unregister_device() frees the I2C client, so, dereferencing it
afterwards is a bug, that leads to Oopses.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] imx074: return a meaningful error code instead of -1

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] soc-camera: fix a recent multi-camera breakage on sh-mobile

With the introduction of CSI2 support on sh-mobile, the host driver
switched to using v4l2_device_call_until_err() with grp_id == 0 to
call subdev operations on the sensor and the CSI2 subdev. However,
this has broken multi-client set ups like the one on migor, because
that way all operations get called on both clients. To fix this add
a grp_id and set it to the client private context.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] v4l2-device: fix a macro definition

v4l2_device_unregister_subdev() wrongly uses "arg..." instead of "## arg"
in its body. Fix it.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] videobuf2: fix an error message

buf->size is not yet initialised in videobuf2-dma-contig at the time of
the error message, use "size."

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] videobuf2: fix core to correctly identify allocation failures

The videobuf2-dma-contig allocator returns an ERR_PTR() on failure, not
a NULL like all other allocators. Fix videobuf2-core to also correctly
recognise those failures.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] cx18: Fix list BUG for IDX stream, triggerable in cx18_probe() error clean up,

If allocating stream buffers for one of the primary streams (e.g. YUV)
failed during card probe, the error path clean up would try to manipulate
the yet unitialized IDX stream structures.  This caused a BUG due to
unitialized list heads.

Detect that case and ignore the uninitialized IDX stream.

Signed-off-by: Andy Walls <awalls@md.metrocast.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] Fix dependencies for Technisat USB2.0 DVB-S/S2

Device is based on STV0903 demod and STV6110x tuner

Signed-off-by: Oleg Roitburd <oroitburd@gmail.com>
Signed-off-by: Patrick Boettcher <pboettcher@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] dib0700: fix possible NULL pointer dereference

Seems like 'adap->fe' test for NULL was meant to be before we dereference
that pointer.

Signed-off-by: Mariusz Kozlowski <mk@lab.zgora.pl>
Signed-off-by: Patrick Boettcher <pboettcher@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] FLEXCOP-PCI: fix __xlate_proc_name-warning for flexcop-pci

This patch fixes the warning about bad names for sys-fs and other kernel-things. The flexcop-pci driver was using '/'-characters in it, which is not good.
This has been fixed in several attempts by several people, but obviously never made it into the kernel.

Signed-off-by: Patrick Boettcher <pboettcher@kernellabs.com>
Cc: Steffen Barszus <steffenbpunkt@googlemail.com>
Cc: Boris Cuber <me@boris64.net>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] DIB0700: fix typo in dib0700_devices.c

Fix typo introduced in b4d6046e841955be9cc49164b03b91c9524f9c2e.

Spotted by Dr. David Alan Gilbert. Thanks for that.

Signed-off-by: Patrick Boettcher <pboettcher@kernellabs.com>
Cc: Dr. David Alan Gilbert <linux@treblig.org>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

Merge branch 'v4l_for_linus' of git://git./linux/kernel/git/mchehab/linux-2.6

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6:
  [media] radio: wl128x: Update registration process with ST
  [media] staging: altera-jtag needs delay.h

Merge branch 'unicore32' of git://git./linux/kernel/git/epip/linux-2.6-unicore32

* 'unicore32' of git://git.kernel.org/pub/scm/linux/kernel/git/epip/linux-2.6-unicore32:
  unicore32 framebuffer fix: get videomemory by __get_free_pages() and make it floatable
  unicore32 core architecture: remove duplicated #include
  unicore32 rtc driver fix: cleanup irq_set_freq and irq_set_state
  unicore32 fix: remove arch-specific futex support
  unicore32 ldscript fix: add cacheline parameter to PERCPU() macro

Merge branch 'hwmon-for-linus' of git://git./linux/kernel/git/groeck/staging

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging:
  hwmon: twl4030-madc-hwmon: add "platform:" prefix for platform modalias

ntp: fix non privileged system time shifting

The ADJ_SETOFFSET bit added in commit 094aa188 ("ntp: Add ADJ_SETOFFSET
mode bit") also introduced a way for any user to change the system time.
Sneaky or buggy calls to adjtimex() could set

    ADJ_OFFSET_SS_READ | ADJ_SETOFFSET

which would result in a successful call to timekeeping_inject_offset().
This patch fixes the issue by adding the capability check.

Signed-off-by: Richard Cochran <richard.cochran@omicron.at>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

rtc-mrst: Fix section types

Fix the following section mismatch warning.

  WARNING: drivers/rtc/built-in.o(.data+0xa0): Section mismatch in reference from the variable vrtc_mrst_platform_driver to the function .init.text:vrtc_mrst_platform_probe()
  The variable vrtc_mrst_platform_driver references the function __init vrtc_mrst_platform_probe()
  If the reference is valid then annotate the variable with __init* or __refdata (see linux/init.h) or name the variable:
    *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console,

Signed-off-by: Major Lee <major_lee@wistron.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

unicore32 framebuffer fix: get videomemory by __get_free_pages() and make it floatable

1. get videomemory by __get_free_pages() in fb-puv3.c
2. remove resource reservation for old fixed UNIGFX_MMAP & UVC_MMAP space
3. remove unused macros: PKUNTIY_UNIGFX_MMAP_BASE, PKUNITY_UNIGFX_MMAP_SIZE,
PKUNITY_UVC_MMAP_BASE, PKUNITY_UVC_MMAP_SIZE and KUSER_UNIGFX_BASE
4. remove unused header linux/vmalloc.h in fb-puv3.h

Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: Arnd Bergmann <arnd@arndb.de>

unicore32 core architecture: remove duplicated #include

Remove duplicated #include('s) in
  arch/unicore32/kernel/traps.c

Signed-off-by: Huang Weiyi <weiyi.huang@gmail.com>
Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

unicore32 rtc driver fix: cleanup irq_set_freq and irq_set_state

Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

unicore32 fix: remove arch-specific futex support

The futex functions in unicore32 are not used and verified,
so just replaced by asm-generic version.

Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: Arnd Bergmann <arnd@arndb.de>

unicore32 ldscript fix: add cacheline parameter to PERCPU() macro

Also, adjust cacheline parameter of RW_DATA_SECTION and EXCEPTION_TABLE

Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: Arnd Bergmann <arnd@arndb.de>

Merge branch 'release' of git://git./linux/kernel/git/aegl/linux-2.6

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] fix build warning: argument 1 of 'irqd_irq_disabled'

[IA64] fix build warning: argument 1 of 'irqd_irq_disabled'

In commit f5e5bf088bd3d30990efb7429aaf9f1e5134ffd6
  ia64: Use irqd_irq_disabled() instead of desc->status access

Thomas forgot to convert from irq to *irq_data.

Add a call to irq_get_irq_data() to fix that.

Signed-off-by: Tony Luck <tony.luck@intel.com>

Merge branch 'for-linus' of git://git./linux/kernel/git/tiwai/sound-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: pcm: fix infinite loop in snd_pcm_update_hw_ptr0()
  ALSA: HDA: Add dock mic quirk for Lenovo Thinkpad X220
  ALSA: ens1371: fix Creative Ectiva support
  ALSA: firewire-speakers: fix hang when unplugging a running device
  ASoC: Fix CODEC device name for Corgi
  ALSA: hda - Fix pin-config of Gigabyte mobo
  ASoC: imx: fix burstsize for DMA
  ASoC: imx: set watermarks for mx2-dma
  ASoC: twl6040: Return -ENOMEM if create_singlethread_workqueue fails
  ASoC: tlv320dac33: Restore L/R DAC power control register
  ASoC: Explicitly say registerless widgets have no register
  ASoC: tlv320dac33: Fix inconsistent spinlock usage

Merge branch 'fix/asoc' into for-linus

ALSA: pcm: fix infinite loop in snd_pcm_update_hw_ptr0()

When period interrupts are disabled, snd_pcm_update_hw_ptr0() compares
the current time against the time estimated for the current hardware
pointer to detect xruns.  The somewhat fuzzy threshold in the while loop
makes it possible that hdelta becomes negative; the comparison being
done with unsigned types then makes the loop go through the entire 263
negative range, and, depending on the value, never reach an unsigned
value that is small enough to stop the loop.  Doing this with interrupts
disabled results in the machine locking up.

To prevent this, ensure that the loop condition uses signed types for
both operands so that the comparison is correctly done.

Many thanks to Kelly Anderson for debugging this.

Reported-by: Nix <nix@esperi.org.uk>
Reported-by: "Christopher K." <c.krooss@googlemail.com>
Reported-and-tested-by: Kelly Anderson <kelly@silka.with-linux.com>
Signed-off-by: Kelly Anderson <kelly@silka.with-linux.com>
[cl: remove unneeded casts; use a temp variable]
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: 2.6.38 <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Merge branch 'merge' of git://git./linux/kernel/git/benh/powerpc

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  kdump: Allow shrinking of kdump region to be overridden
  powerpc/pmac/smp: Remove no-longer needed preempt workaround
  powerpc/smp: Increase vdso_data->processorCount, not just decrease it
  powerpc/smp: Create idle threads on demand and properly reset them
  powerpc/smp: Don't expose per-cpu "cpu_state" array
  powerpc/pmac/smp: Fix CPU hotplug crashes on some machines
  powerpc/smp: Add a smp_ops->bringup_up() done callback
  powerpc/pmac: Rename cpu_state in therm_pm72 to avoid collision
  powerpc/pmac/smp: Properly NAP offlined CPU on G5
  powerpc/pmac/smp: Remove HMT changes for PowerMac offline code
  powerpc/pmac/smp: Consolidate 32-bit and 64-bit PowerMac cpu_die in one file
  powerpc/pmac/smp: Fixup smp_core99_cpu_disable() and use it on 64-bit
  powerpc/pmac/smp: Rename fixup_irqs() to migrate_irqs() and use it on ppc32
  powerpc/pmac/smp: Fix 32-bit PowerMac cpu_die
  powerpc/smp: Remove unused smp_ops->cpu_enable()
  powerpc/smp: Remove unused generic_cpu_enable()
  powerpc/smp: Fix generic_mach_cpu_die()
  powerpc/smp: soft-replugged CPUs must go back to start_secondary
  powerpc: Make decrementer interrupt robust against offlined CPUs

Merge git://git./linux/kernel/git/davem/sparc-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
  sparc32: Pass task_struct to schedule_tail() in ret_from_fork
  apbuart: Depend upon sparc.
  sparc64: Fix section mis-match errors.
  sparc32,leon: Fixed APBUART frequency detection
  sparc32, leon: APBUART driver must use archdata to get IRQ number
  sparc: Hook up syncfs system call.

Merge git://git./linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  appletalk: Fix OOPS in atalk_release().
  mlx4: Fixing bad size of event queue buffer
  mlx4: Fixing use after free
  bonding:typo in comment
  sctp: Pass __GFP_NOWARN to hash table allocation attempts.
  connector: convert to synchronous netlink message processing
  fib: add rtnl locking in ip_fib_net_exit
  atm/solos-pci: Don't flap VCs when carrier state changes
  atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump
  atm/solos-pci: Use VPI.VCI notation uniformly.
  Atheros, atl2: Fix mem leaks in error paths of atl2_set_eeprom
  netdev: fix mtu check when TSO is enabled
  net/usb: Ethernet quirks for the LG-VL600 4G modem
  phylib: phy_attach_direct: phy_init_hw can fail, add cleanup
  bridge: mcast snooping, fix length check of snooped MLDv1/2
  via-ircc: Pass PCI device pointer to dma_{alloc, free}_coherent()
  via-ircc: Use pci_{get, set}_drvdata() instead of static pointer variable
  net: gre: provide multicast mappings for ipv4 and ipv6
  bridge: Fix compilation warning in function br_stp_recalculate_bridge_id()
  net: Fix warnings caused by MAX_SKB_FRAGS change.

kdump: Allow shrinking of kdump region to be overridden

On ppc64 the crashkernel region almost always overlaps an area of firmware.
This works fine except when using the sysfs interface to reduce the kdump
region. If we free the firmware area we are guaranteed to crash.

Rename free_reserved_phys_range to crash_free_reserved_phys_range and make
it a weak function so we can override it.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/pmac/smp: Remove no-longer needed preempt workaround

The generic code properly re-initializes the preempt count in the
idle thread now

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/smp: Increase vdso_data->processorCount, not just decrease it

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/smp: Create idle threads on demand and properly reset them

Instead of creating idle threads at boot for all possible CPUs, we
create them on demand, like x86 or ARM, and we properly call init_idle
to re-initialize an idle thread when a CPU was unplugged and is now
re-plugged.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/smp: Don't expose per-cpu "cpu_state" array

Instead, keep it static, expose an accessor and use that from
the PowerMac code. Avoids easy namespace collisions and will
make it easier to consolidate with other implementations.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/pmac/smp: Fix CPU hotplug crashes on some machines

On some machines that use i2c to synchronize the timebases (such
as PowerMac7,2/7,3 G5 machines), hotplug CPU would crash when
putting back a new CPU online due to the underlying i2c bus being
closed.

This uses the newly added bringup_done() callback to move the close
along with other housekeeping calls, and adds a CPU notifier to
re-open the i2c bus around subsequent hotplug operations

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/smp: Add a smp_ops->bringup_up() done callback

This allows us to stop abusing smp_ops->setup_cpu() for cleanup
tasks that have to take place after the initial boot time CPU
bringup.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/pmac: Rename cpu_state in therm_pm72 to avoid collision

This collides with the cpu_state in our SMP code, use processor_state
instead.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/pmac/smp: Properly NAP offlined CPU on G5

The current code soft-disables, and then goes to NAP mode which
turns interrupts on. That means that if an interrupt occurs, we
will hit the masked interrupt code path which isn't what we want,
as it will return with EE off, which will either get us out of
NAP mode, or fail to enter it (according to spec).

Instead, let's just rely on the fact that it is safe to take
decrementer interrupts on an offline CPU and leave interrupts
enabled. We can also get rid of the special case in asm for
power4_cpu_offline_powersave() and just use power4_idle().

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/pmac/smp: Remove HMT changes for PowerMac offline code

Those instructions do nothing on non-threaded processors such
as 970's used on those machines.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/pmac/smp: Consolidate 32-bit and 64-bit PowerMac cpu_die in one file

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/pmac/smp: Fixup smp_core99_cpu_disable() and use it on 64-bit

Use the generic code, just add the MPIC priority setting,

I don't see any use in mucking around with the decrementer,
as 32-bit will have EE off all along, and 64-bit will be able
to deal with it.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/pmac/smp: Rename fixup_irqs() to migrate_irqs() and use it on ppc32

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/pmac/smp: Fix 32-bit PowerMac cpu_die

Use generic cpu_state, call idle_task_exit() properly, and
remove smp_core99_cpu_die() which isn't useful, the generic
function does the job just fine.

powerpc/smp: Remove unused smp_ops->cpu_enable()

Remove the last remnants of cpu_enable(), everybody uses the normal
__cpu_up() path now

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/smp: Remove unused generic_cpu_enable()

Nobody uses it, besides we should always use the normal __cpu_up
path anyways

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/smp: Fix generic_mach_cpu_die()

This is used by some "soft" hotplug implementations. I needs to
call idle_task_exit() when the CPU is going away, and we remove
the now no-longer needed set_cpu_online() and local_irq_enable()
which are handled by the return to start_secondary

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc/smp: soft-replugged CPUs must go back to start_secondary

Various thing are torn down when a CPU is hot-unplugged. That CPU
is expected to go back to start_secondary when re-plugged to re
initialize everything, such as clock sources, maps, ...

Some implementations just return from cpu_die() callback
in the idle loop when the CPU is "re-plugged". This is not enough.

We fix it using a little asm trampoline which resets the stack
and calls back into start_secondary as if we were all fresh from
boot. The trampoline already existed on ppc64, but we add it for
ppc32

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

powerpc: Make decrementer interrupt robust against offlined CPUs

With some implementations, it is possible that a timer interrupt
occurs every few seconds on an offline CPU. In this case, just
re-arm the decrementer and return immediately

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

appletalk: Fix OOPS in atalk_release().

Commit 60d9f461a20ba59219fdcdc30cbf8e3a4ad3f625 ("appletalk: remove
the BKL") added a dereference of "sk" before checking for NULL in
atalk_release().

Guard the code block completely, rather than partially, with the
NULL check.

Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

[media] radio: wl128x: Update registration process with ST

As underlying ST driver registration API's have changed with
latest 2.6.38-rc8 kernel this patch will update the FM driver
accordingly.

Signed-off-by: Manjunatha Halli <manjunatha_halli@ti.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

[media] staging: altera-jtag needs delay.h

altera-jtag.c needs to include <linux/delay.h> to fix a build error:

drivers/staging/altera-stapl/altera-jtag.c:398: error: implicit declaration of function 'udelay'

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: Igor M. Liplianin <liplianin@netup.ru>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

ALSA: HDA: Add dock mic quirk for Lenovo Thinkpad X220

This quirk is needed for the docking station mic of
Lenovo Thinkpad X220 to function correctly.

BugLink: http://bugs.launchpad.net/bugs/746259
Cc: stable@kernel.org
Tested-by: James Ferguson <james.ferguson@canonical.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

mlx4: Fixing bad size of event queue buffer

We should reduce the number of reserved completion queues from the total
number of entries. Since the queue size is power of two, not reducing the
reserved entries, caused a double queue size, which may lead to allocation
failures in some cases.

Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>

mlx4: Fixing use after free

In case of allocation failure, tried to use the promiscuous QP
entry that was previously freed.
Now freeing this entry only in case we will not put it back to the list
of promiscuous entries.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>

bonding:typo in comment

use accumulates instead of acumulates.

Signed-off-by: Pan Weiping <panweiping3@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Pass task_struct to schedule_tail() in ret_from_fork

We have to pass task_struct of previous process to function
schedule_tail(). Currently in ret_from_fork previous thread_info
is passed:

switch_to: mov %g6, %g3 /* previous thread_info in g6 */

ret_from_fork: call    schedule_tail
                mov    %g3, %o0 /* previous thread_info is passed */

void schedule_tail(struct task_struct *prev);

Signed-off-by: Tkhai Kirill <tkhai@yandex.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

apbuart: Depend upon sparc.

It absolutely needs to be able to get at pdev_archdata members
which are sparc specific.

Signed-off-by: David S. Miller <davem@davemloft.net>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>

sctp: Pass __GFP_NOWARN to hash table allocation attempts.

Like DCCP and other similar pieces of code, there are mechanisms
here to try allocating smaller hash tables if the allocation
fails.  So pass in __GFP_NOWARN like the others do instead of
emitting a scary message.

Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc64: Fix section mis-match errors.

Fix all of the problems spotted by CONFIG_DEBUG_SECTION_MISMATCH under
arch/sparc during a 64-bit defconfig build.

They fall into two categorites:

1) of_device_id is marked as __initdata, and we can never do this
   since these objects sit in the device core data structures way
   past boot.  So even if a driver will never be reloaded, we have
   to keep the device ID table around.

   Mark such cases const instead.

2) The bootmem alloc/free handling code in mdesc.c was not fully
   marked __init as it should be, thus generating a reference
   to free_bootmem_late() (which is __init) from non-__init code.

Signed-off-by: David S. Miller <davem@davemloft.net>

connector: convert to synchronous netlink message processing

Commits 01a16b21 (netlink: kill eff_cap from struct netlink_skb_parms)
and c53fa1ed (netlink: kill loginuid/sessionid/sid members from struct
netlink_skb_parms) removed some members from struct netlink_skb_parms
that depend on the current context, all netlink users are now required
to do synchronous message processing.

connector however queues received messages and processes them in a work
queue, which is not valid anymore. This patch converts connector to do
synchronous message processing by invoking the registered callback handler
directly from the netlink receive function.

In order to avoid invoking the callback with connector locks held, a
reference count is added to struct cn_callback_entry, the reference
is taken when finding a matching callback entry on the device's queue_list
and released after the callback handler has been invoked.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: David S. Miller <davem@davemloft.net>