Right now the composite sound input doesn't work on AverTV 307 because of
the wrong mux setup.  The composite sound is routed via an external
4channel multiplexer controlled by GPIO, while the code assumes an internal
multiplexer instead.

Presumably this was a copy/paste error, and noone have ever tested the
functionality.

With the attached patch it works properly, which gives me an ability to
finally watch the cable TV under linux.
Signed-off-by: NStas Sergeev <stsp@aknet.ru>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Acked-by: NNickolay V. Shmyrev <nshmyrev@yandex.ru>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Due to a documentation bug (the type mask is 3 bits long, not 2) the wrong
frame types were filled in: the B and P frame types were swapped.

This bug also hid a second bug: when a capture is stopped a last entry is
written into the pgm index buffer with internal type 0, denoting the end
of the program. This entry wasn't ignored, instead it was accidentally
returned to the caller as a P frame.
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

static function dvb_net_sec declares input arg "pkt" as u8. However, the
same argument at dvb_net_sec_callback is defined as "const u8". When
calling dvb_net_sec, this is casted as just "u8".

gcc 4.2.1 generates a warning about that:

  CC [M]  drivers/media/dvb/dvb-core/dvb_net.o
drivers/media/dvb/dvb-core/dvb_net.c: In function "dvb_net_sec_callback":
drivers/media/dvb/dvb-core/dvb_net.c:905: warning: passing argument 2 of
		"dvb_net_sec" discards qualifiers from pointer target type
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Git changeset 6bdcc6e6 dropped the
stand-alone lgh06xf module, whose functionality was absorbed into the
dvb-pll module. However, there was a minor difference between the code
in lgh06xf and dvb-pll, which caused a regression in b2c2-flexcop
devices using the LG-H06xF NIM.

dvb-pll will probe for the presence of an i2c pll chip by performing a
single byte read, the lgh06xf driver did not do this. Unfortunately, the
code in flexcop-i2c.c does not currently support 1 byte or 0 byte reads
as a probe.  Such probes with the current code will always fail.

In order to work around this problem, and restore proper functionality
of the Airstar HD5000 device, this hack was created to make the probe
appear to succeed.  The single byte read in dvb_pll_attach is the only
place where such a probe would ever occur, so this change is safe, and
will not affect any other devices.

Of course, if one knew how to actually perform the read operation, it
would be better to go that route.  In the meantime, however, we must
apply this workaround, in order to prevent the regression that causes
tuning to fail on the Airstar HD5000 ATSC device.

Thanks to Jarod Wilson, who had originally reported this regression, and
to Geoffrey Hausheer, whose original workaround patch led us to find the
actual cause of the problem.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Cc: Geoffrey Hausheer <inli3epy93n@phracturedblue.com>
Acked-by: NJarod Wilson <jwilson@redhat.com>
Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

the pwc driver has a disconnect method that waits for user space to
close the device. This opens up an opportunity for a DoS attack,
blocking the USB subsystem and making khubd's task busy wait in
kernel space. This patch shifts freeing resources to close if an opened
device is disconnected.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
CC: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

If, in em28xx_usb_probe() the memory allocation
	dev->alt_max_pkt_size = kmalloc(32*
						dev->num_alt,GFP_KERNEL);
fails, then we'll bail out and return -ENOMEM.
The problem is that in that case we don't free the storage allocated
to 'dev', thus causing a memory leak.

This patch fixes the leak by freeing 'dev' before we return -ENOMEM.
This fixes Coverity bug #647.
Signed-off-by: NJesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJonathan Corbet <corbet@lwn.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Configuring the OLPC camera requires something over 150 register
writes.  Unfortunately, querying the CAFE i2c controller too
soon after a write causes the hardware to flake.  The problem had
been "solved" with an msleep() call, but, between the number of
registers and how msleep() behaves, that resulted in a 3-second
delay on camera initialization.  Instead, we hand-code a wait for
the completion interrupt which avoids reading the status registers.
Signed-off-by: NJonathan Corbet <corbet@lwn.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NChris Ball <cjb@laptop.org>
Signed-off-by: NJonathan Corbet <corbet@lwn.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The tuner maximum frequency wasn't being set, while the minimum 
frequency was set to what the maximum should have been.

If a future patch were to enforce these limits, dvb-pll would be 
effectively broken.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

ivtv: fix VIDIOC_S_FBUF support: new OSD values where never actually set.

The values set with VIDIOC_S_FBUF were not actually used until the next
VIDIOC_S_FMT. Fixed.
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The fcv1236d support patch was created before the "dvb: remove static
dependencies on dvb-pll" patch was applied, but the fcv1236d patch didn't
get merged until after the fact.

struct dvb_pll_fcv1236d can become static.
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

This patch:
- adds a missing error check and
- removes an error check that could never be true

Both spotted by the Coverity checker.
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Acked-by: NLuca Olivetti <luca@ventoso.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

This patch removes the useless tuner field and avoids a double free of 
the tuner (either mt2060 or qt1010).
Signed-off-by: NLuca Olivetti <luca@ventoso.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

While decoding (MPEG or YUV) is active or when VBI output is in use, then
do not clear the VBI output of the saa7127. Only after the last user is
gone can we clear it.

This fixes the case where playback was stopped, another channel was chosen
and playback was restarted, while /dev/vbi16 was used to set the WSS
(widescreen) setting. Without this fix the WSS was reset on every stop
instead of just keeping the last value.
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

First try polling for the result of a mailbox command, then
switch to a test/sleep loop. Also reduce the sleep time from 10 ms
to 1 ms. Improves the responsiveness of the mailbox handling.
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Pausing a decoder followed by a Play command would do nothing. Fixed.
Pausing a decoder running at non-standard speed following by a Continue
would reset the speed to 100%. Fixed.
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

s_register was assigning the return code to (unsigned)reg->val, rather than
errCode, which it what it would return.  Except reg->val can't be < 0, so it
would never actually return an error.

g_register never actually put the value it read into reg->val.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Various gpio and mux settings for the Osprey 440 weren't correct.  Fix them
and provide some documentation about how the gpios work.

The osprey eeprom routine wasn't run for the 440, add it.  It was also crap,
re-written to be better.

Add the Osprey 440 to the Bt878 ALSA driver's whitelist.  Currently the sample
rate is fixed at 32kHz, as the driver doesn't support different rates for
digital input mode, though the card can select the rate from 32, 44.1, or 48
kHz via gpio.

Setting the audio gain via ALSA isn't supported yet; a userspace tool that
programs the X9221 via i2c-dev must be used.

The Bt878 digital audio format isn't programmed correctly for the CS5331A ADC
used, resulting in extremely garbled sound.  That is fixed in a followup
patch.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

When raw capture was turned off, the current capturing frame (v4l_grab_frame)
wasn't reset to NO_GRAB_ACTIVE.  If capture was turned back on, the driver
would think this frame was currently being captured, and wait for it to
complete before starting a new frame.  The hardware on the other hand would
not be actively capturing a frame.  The result was the driver would wait
forever for v4l_grab_frame to be captured.

Some calls to zr36057_set_memgrab(0) were missing spin-locks, which have been
added.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Acked-by: NRonald S. Bultje <rbultje@ronald.bitfreak.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Add support for the UYVY and the other big endian output formats.  The
driver was naming formats based on the host endianess.  This is different
that all the other drivers appear to work and not what software appears
to expect.

Use ARRAY_SIZE() to find the the size of the zoran_formats array.

Change the way the driver handles setting the video format register.  Rather
than use some if and switch statements to set to register by looking at the
format id, the format list simply has a field with the proper bits to set.

Adds a bit of ifdef to make a driver without V4L1 support more possible.
Also create a macro for defining formats that handles vl41 and/or vl42
support to avoid repeated ifdefs in the format list.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Acked-by: NRonald S. Bultje <rbultje@ronald.bitfreak.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The driver was returning the size of the (fixed) buffer it allocated as the
sizeimage field in the v4l2 pixel format, rather than the actual size of the
image.  For example, a 192x128 YUYV image is 49152 bytes but the driver would
always return 131072 bytes since if that was the size of the v4l buffer.

This violates the v4l2 spec, which says that sizeimage should be the actual
size of the image for uncompressed formats.  It also caused mplayer to crash.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Acked-by: NRonald S. Bultje <rbultje@ronald.bitfreak.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

During uncompressed capture, the poll() function was looking the wrong frame.
It was using the frame the driver was going to capture into next (pend_tail),
when it should have been looking at the next frame to be de-queued with
DQBUF/SYNC (sync_tail).

It also wasn't looking in the right spot.  It was looking at the file handle's
copy of the buffer status, rather than the driver core copy.  The interrupt
routine marks frames as done in the driver core copy, the file handle copy
isn't updated.  So even if poll() looked at the right frame, it would never
see it transition to done and return POLLIN.

The compressed capture code has this same problem, looking in fh->jpg_buffers
when it should have used zr->jpg_buffers.

There was some logic to detect when there was no current capture in process
nor any frames queued and try to return an error, which ends up being a bad
idea.  It's possible to call select() from one thread while no capture is in
process, or no frames queued, and then start a capture or queue frames from
another thread.

The buffer state variables are protected by a spin lock, which the code wasn't
acquiring.  That is fixed too.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Acked-by: NRonald S. Bultje <rbultje@ronald.bitfreak.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The zr36067 driver doesn't make a distinction between the different sub-types
of NTSC, PAL, or SECAM norms.  For example, when the enum std ioctl returns
the PAL standard it returns PAL_BG|PAL_DK|PAL_H|PAL_I.

When setting the norm, it required the bitmask to match exactly the set of
norms used during the enumeration.  If just one norm was specified, for
example PAL_BG or NTSC_M, it would fail.  This violates the V4L2 spec,
"VIDIOC_S_STD accepts *one* or more flags..."

The key thing to realize is that V4L2_STD_PAL is not one bit, it is multiple
bits.  It's ok to call S_STD with any *one* of those bits, but the driver was
requiring *all* of them.

This fixes the S_STD function so that it will accept any set of one or more
PAL norms as PAL, and the same for NTSC and SECAM.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Acked-by: NRonald S. Bultje <rbultje@ronald.bitfreak.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

State struct was never freed.
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The drivers reads the PCI subsystem ID into its state structure, but it's
never used anywhere.
Signed-off-by: NTrent Piepho <xyzzy@speakeasy.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The patch adds checking of kthread_run return code and issues a message
if it fails.
Signed-off-by: NCyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

If v4l2_ctrl_next is called without the V4L2_CTRL_FLAG_NEXT_CTRL then it 
should check whether the passed control ID is valid and return 0 if it 
isn't. Otherwise a for-loop over the control IDs will never end.
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The VBI DMA is handled in a special way and is marked with a bit.
However, that bit was set at the wrong time and could be cleared
by mistake if a PCM (or other) DMA request would arrive before the
VBI DMA was completed. So on completion of the VBI DMA the driver
no longer knew that that DMA transfer was for VBI data. And this
in turn caused havoc with the card's DMA engine.
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>