]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
more .31 patches
authorGreg Kroah-Hartman <gregkh@suse.de>
Wed, 2 Dec 2009 00:12:37 +0000 (16:12 -0800)
committerGreg Kroah-Hartman <gregkh@suse.de>
Wed, 2 Dec 2009 00:12:37 +0000 (16:12 -0800)
19 files changed:
queue-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch [new file with mode: 0644]
queue-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch [new file with mode: 0644]
queue-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch [new file with mode: 0644]
queue-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch [new file with mode: 0644]
queue-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch [new file with mode: 0644]
queue-2.6.31/pps-events-reporting-fix-up.patch [new file with mode: 0644]
queue-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch [new file with mode: 0644]
queue-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch [new file with mode: 0644]
queue-2.6.31/series
queue-2.6.31/tty-cp210x-fix-carrier-handling.patch [new file with mode: 0644]
queue-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch [new file with mode: 0644]
queue-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch [new file with mode: 0644]
queue-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch [new file with mode: 0644]
queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch [new file with mode: 0644]
queue-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch [new file with mode: 0644]
queue-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch [new file with mode: 0644]
queue-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch [new file with mode: 0644]
queue-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch [new file with mode: 0644]
queue-2.6.31/v4l-dvb-13240-firedtv-fix-regression-tuning-fails-due-to-bogus-error-return.patch [deleted file]

diff --git a/queue-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch b/queue-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch
new file mode 100644 (file)
index 0000000..b37fa69
--- /dev/null
@@ -0,0 +1,50 @@
+From 7779d7bed950a7fb1af4f540c2f82a6b81b65901 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Wed, 11 Nov 2009 14:26:34 -0800
+Subject: fs: add missing compat_ptr handling for FS_IOC_RESVSP ioctl
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 7779d7bed950a7fb1af4f540c2f82a6b81b65901 upstream.
+
+For FS_IOC_RESVSP and FS_IOC_RESVSP64 compat_sys_ioctl() uses its
+arg argument as a pointer to userspace. However it is missing a
+a call to compat_ptr() which will do a proper pointer conversion.
+
+This was introduced with 3e63cbb1 "fs: Add new pre-allocation ioctls
+to vfs for compatibility with legacy xfs ioctls".
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Ankit Jain <me@ankitjain.org>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: Arnd Bergmann <arndbergmann@googlemail.com>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/compat_ioctl.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -1800,7 +1800,7 @@ struct space_resv_32 {
+ /* just account for different alignment */
+ static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
+ {
+-      struct space_resv_32    __user *p32 = (void __user *)arg;
++      struct space_resv_32    __user *p32 = compat_ptr(arg);
+       struct space_resv       __user *p = compat_alloc_user_space(sizeof(*p));
+       if (copy_in_user(&p->l_type,    &p32->l_type,   sizeof(s16)) ||
+@@ -2802,7 +2802,7 @@ asmlinkage long compat_sys_ioctl(unsigne
+ #else
+       case FS_IOC_RESVSP:
+       case FS_IOC_RESVSP64:
+-              error = ioctl_preallocate(filp, (void __user *)arg);
++              error = ioctl_preallocate(filp, compat_ptr(arg));
+               goto out_fput;
+ #endif
diff --git a/queue-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch b/queue-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch
new file mode 100644 (file)
index 0000000..f9fc11b
--- /dev/null
@@ -0,0 +1,44 @@
+From e00e431612c3a6e437a01f2129fd3843da0c982a Mon Sep 17 00:00:00 2001
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Date: Wed, 11 Nov 2009 14:26:26 -0800
+Subject: memcg: fix wrong pointer initialization at page migration when memcg is disabled.
+
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+commit e00e431612c3a6e437a01f2129fd3843da0c982a upstream.
+
+Lee Schermerhorn reported that he saw bad pointer dereference in
+mem_cgroup_end_migration() when he disabled memcg by boot option.
+
+memcg's page migration logic works as
+
+       mem_cgroup_prepare_migration(page, &ptr);
+       do page migration
+       mem_cgroup_end_migration(page, ptr);
+
+Now, ptr is not initialized in prepare_migration when memcg is disabled
+by boot option. This causes panic in end_migration. This patch fixes it.
+
+Reported-by: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
+Cc: Balbir Singh <balbir@in.ibm.com>
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Reviewed-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/migrate.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -597,7 +597,7 @@ static int unmap_and_move(new_page_t get
+       struct page *newpage = get_new_page(page, private, &result);
+       int rcu_locked = 0;
+       int charge = 0;
+-      struct mem_cgroup *mem;
++      struct mem_cgroup *mem = NULL;
+       if (!newpage)
+               return -ENOMEM;
diff --git a/queue-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch b/queue-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch
new file mode 100644 (file)
index 0000000..3a9934c
--- /dev/null
@@ -0,0 +1,53 @@
+From cc4a6851466039a8a688c843962a05689059ff3b Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mel@csn.ul.ie>
+Date: Wed, 11 Nov 2009 14:26:14 -0800
+Subject: page allocator: always wake kswapd when restarting an allocation attempt after direct reclaim failed
+
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit cc4a6851466039a8a688c843962a05689059ff3b upstream.
+
+If a direct reclaim makes no forward progress, it considers whether it
+should go OOM or not.  Whether OOM is triggered or not, it may retry the
+allocation afterwards.  In times past, this would always wake kswapd as
+well but currently, kswapd is not woken up after direct reclaim fails.
+For order-0 allocations, this makes little difference but if there is a
+heavy mix of higher-order allocations that direct reclaim is failing for,
+it might mean that kswapd is not rewoken for higher orders as much as it
+did previously.
+
+This patch wakes up kswapd when an allocation is being retried after a
+direct reclaim failure.  It would be expected that kswapd is already
+awake, but this has the effect of telling kswapd to reclaim at the higher
+order as well.
+
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Reviewed-by: Christoph Lameter <cl@linux-foundation.org>
+Reviewed-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1763,6 +1763,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u
+       if (NUMA_BUILD && (gfp_mask & GFP_THISNODE) == GFP_THISNODE)
+               goto nopage;
++restart:
+       wake_all_kswapd(order, zonelist, high_zoneidx);
+       /*
+@@ -1772,7 +1773,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u
+        */
+       alloc_flags = gfp_to_alloc_flags(gfp_mask);
+-restart:
+       /* This is the last chance, in general, before the goto nopage. */
+       page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
+                       high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
diff --git a/queue-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch b/queue-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch
new file mode 100644 (file)
index 0000000..22ba82b
--- /dev/null
@@ -0,0 +1,44 @@
+From 9d0ed60fe9cd1fbf57f755cd27a23ae9114d7210 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mel@csn.ul.ie>
+Date: Wed, 11 Nov 2009 14:26:17 -0800
+Subject: page allocator: Do not allow interrupts to use ALLOC_HARDER
+
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit 9d0ed60fe9cd1fbf57f755cd27a23ae9114d7210 upstream.
+
+Commit 341ce06f69abfafa31b9468410a13dbd60e2b237 ("page allocator:
+calculate the alloc_flags for allocation only once") altered watermark
+logic slightly by allowing rt_tasks that are handling an interrupt to set
+ALLOC_HARDER.  This patch brings the watermark logic more in line with
+2.6.30.
+
+This change results in a reduction of the number high-order GFP_ATOMIC
+allocation failures reported.  See
+http://www.gossamer-threads.com/lists/linux/kernel/1144153
+
+[rientjes@google.com: Spotted the problem]
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Reviewed-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Reviewed-by: Rik van Riel <riel@redhat.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1715,7 +1715,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask)
+                * See also cpuset_zone_allowed() comment in kernel/cpuset.c.
+                */
+               alloc_flags &= ~ALLOC_CPUSET;
+-      } else if (unlikely(rt_task(p)))
++      } else if (unlikely(rt_task(p)) && !in_interrupt())
+               alloc_flags |= ALLOC_HARDER;
+       if (likely(!(gfp_mask & __GFP_NOMEMALLOC))) {
diff --git a/queue-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch b/queue-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch
new file mode 100644 (file)
index 0000000..72e5945
--- /dev/null
@@ -0,0 +1,62 @@
+From 29f12ca32122db98481150be09d35bd72b68045e Mon Sep 17 00:00:00 2001
+From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Date: Wed, 11 Nov 2009 14:26:32 -0800
+Subject: pidns: fix a leak in /proc dentries and inodes with pid namespaces.
+
+From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+
+commit 29f12ca32122db98481150be09d35bd72b68045e upstream.
+
+Daniel Lezcano reported a leak in 'struct pid' and 'struct pid_namespace'
+that is discussed in:
+
+       http://lkml.org/lkml/2009/10/2/159.
+
+To summarize the thread, when container-init is terminated, it sets the
+PF_EXITING flag, zaps other processes in the container and waits to reap
+them.  As a part of reaping, the container-init should flush any /proc
+dentries associated with the processes.  But because the container-init is
+itself exiting and the following PF_EXITING check, the dentries are not
+flushed, resulting in leak in /proc inodes and dentries.
+
+This fix reverts the commit 7766755a2f249e7e0 ("Fix /proc dcache deadlock
+in do_exit") which introduced the check for PF_EXITING.  At the time of
+the commit, shrink_dcache_parent() flushed dentries from other filesystems
+also and could have caused a deadlock which the commit fixed.  But as
+pointed out by Eric Biederman, after commit 0feae5c47aabdde59,
+shrink_dcache_parent() no longer affects other filesystems.  So reverting
+the commit is now safe.
+
+As pointed out by Jan Kara, the leak is not as critical since the
+unclaimed space will be reclaimed under memory pressure or by:
+
+       echo 3 > /proc/sys/vm/drop_caches
+
+But since this check is no longer required, its best to remove it.
+
+Signed-off-by: Sukadev Bhattiprolu <sukadev@us.ibm.com>
+Reported-by: Daniel Lezcano <dlezcano@fr.ibm.com>
+Acked-by: Eric W. Biederman <ebiederm@xmission.com>
+Acked-by: Jan Kara <jack@ucw.cz>
+Cc: Andrea Arcangeli <andrea@cpushare.com>
+Cc: Serge Hallyn <serue@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/base.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2580,8 +2580,7 @@ static void proc_flush_task_mnt(struct v
+       name.len = snprintf(buf, sizeof(buf), "%d", pid);
+       dentry = d_hash_and_lookup(mnt->mnt_root, &name);
+       if (dentry) {
+-              if (!(current->flags & PF_EXITING))
+-                      shrink_dcache_parent(dentry);
++              shrink_dcache_parent(dentry);
+               d_drop(dentry);
+               dput(dentry);
+       }
diff --git a/queue-2.6.31/pps-events-reporting-fix-up.patch b/queue-2.6.31/pps-events-reporting-fix-up.patch
new file mode 100644 (file)
index 0000000..9efa23b
--- /dev/null
@@ -0,0 +1,83 @@
+From 276b282e904f690dc930f9bc946110651f297669 Mon Sep 17 00:00:00 2001
+From: Rodolfo Giometti <giometti@linux.it>
+Date: Wed, 11 Nov 2009 14:26:54 -0800
+Subject: pps: events reporting fix up
+
+From: Rodolfo Giometti <giometti@linux.it>
+
+commit 276b282e904f690dc930f9bc946110651f297669 upstream.
+
+PPS events must be recorded according to PPS's mode settings.
+
+If a process asks for (i.e.) capture-assert events only, when the PPS
+client calls the pps_event() function to save the current PPS event, we
+should verify the event type and then discard unwanted ones.
+
+Also, without this patch userland processes waiting for a specific PPS
+event (assert or clear but not both) may be awakened at wrong time.
+
+Signed-off-by: Rodolfo Giometti <giometti@linux.it>
+Tested-by: William S. Brasher <billb958@door.net>
+Tested-by: Reg Clemens <clemens@dwf.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pps/kapi.c |   20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -271,6 +271,7 @@ void pps_event(int source, struct pps_kt
+ {
+       struct pps_device *pps;
+       unsigned long flags;
++      int captured = 0;
+       if ((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0) {
+               printk(KERN_ERR "pps: unknown event (%x) for source %d\n",
+@@ -293,7 +294,8 @@ void pps_event(int source, struct pps_kt
+       /* Check the event */
+       pps->current_mode = pps->params.mode;
+-      if (event & PPS_CAPTUREASSERT) {
++      if ((event & PPS_CAPTUREASSERT) &
++                      (pps->params.mode & PPS_CAPTUREASSERT)) {
+               /* We have to add an offset? */
+               if (pps->params.mode & PPS_OFFSETASSERT)
+                       pps_add_offset(ts, &pps->params.assert_off_tu);
+@@ -303,8 +305,11 @@ void pps_event(int source, struct pps_kt
+               pps->assert_sequence++;
+               pr_debug("capture assert seq #%u for source %d\n",
+                       pps->assert_sequence, source);
++
++              captured = ~0;
+       }
+-      if (event & PPS_CAPTURECLEAR) {
++      if ((event & PPS_CAPTURECLEAR) &
++                      (pps->params.mode & PPS_CAPTURECLEAR)) {
+               /* We have to add an offset? */
+               if (pps->params.mode & PPS_OFFSETCLEAR)
+                       pps_add_offset(ts, &pps->params.clear_off_tu);
+@@ -314,12 +319,17 @@ void pps_event(int source, struct pps_kt
+               pps->clear_sequence++;
+               pr_debug("capture clear seq #%u for source %d\n",
+                       pps->clear_sequence, source);
++
++              captured = ~0;
+       }
+-      pps->go = ~0;
+-      wake_up_interruptible(&pps->queue);
++      /* Wake up iif captured somthing */
++      if (captured) {
++              pps->go = ~0;
++              wake_up_interruptible(&pps->queue);
+-      kill_fasync(&pps->async_queue, SIGIO, POLL_IN);
++              kill_fasync(&pps->async_queue, SIGIO, POLL_IN);
++      }
+       spin_unlock_irqrestore(&pps->lock, flags);
diff --git a/queue-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch b/queue-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch
new file mode 100644 (file)
index 0000000..45452c0
--- /dev/null
@@ -0,0 +1,42 @@
+From cbf83cc5a29dba480cf1ba1c5e3417a0d4a31410 Mon Sep 17 00:00:00 2001
+From: Rodolfo Giometti <giometti@linux.it>
+Date: Wed, 11 Nov 2009 14:26:52 -0800
+Subject: pps: locking scheme fix up for PPS_GETPARAMS
+
+From: Rodolfo Giometti <giometti@linux.it>
+
+commit cbf83cc5a29dba480cf1ba1c5e3417a0d4a31410 upstream.
+
+Userland programs may read/write PPS parameters at same time and these
+operations may corrupt PPS data.
+
+Signed-off-by: Rodolfo Giometti <giometti@linux.it>
+Tested-by: Reg Clemens <clemens@dwf.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pps/pps.c |   11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -71,9 +71,14 @@ static long pps_cdev_ioctl(struct file *
+       case PPS_GETPARAMS:
+               pr_debug("PPS_GETPARAMS: source %d\n", pps->id);
+-              /* Return current parameters */
+-              err = copy_to_user(uarg, &pps->params,
+-                                              sizeof(struct pps_kparams));
++              spin_lock_irq(&pps->lock);
++
++              /* Get the current parameters */
++              params = pps->params;
++
++              spin_unlock_irq(&pps->lock);
++
++              err = copy_to_user(uarg, &params, sizeof(struct pps_kparams));
+               if (err)
+                       return -EFAULT;
diff --git a/queue-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch b/queue-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch
new file mode 100644 (file)
index 0000000..13cde90
--- /dev/null
@@ -0,0 +1,42 @@
+From bcb3a1676b87effbdeffe8da5c44f63433d158d9 Mon Sep 17 00:00:00 2001
+From: Scott Valentine <svalentine@concentris-systems.com>
+Date: Wed, 11 Nov 2009 14:26:49 -0800
+Subject: rtc: v3020: fix v3020_mmio_read_bit()
+
+From: Scott Valentine <svalentine@concentris-systems.com>
+
+commit bcb3a1676b87effbdeffe8da5c44f63433d158d9 upstream.
+
+v3020_mmio_read_bit() always returns 0 when left_shift > 7.
+
+v3020_mmio_read_bit()'s return type is (unsigned char).  The code returns
+a value masked by (1 << left_shift) that is casted to the return type.  If
+left_shift is larger than 7, the cast will always result in a 0 return
+value.  The problem was discovered with left_shift = 16, and the included
+patch corrects the problem.
+
+The bug was introduced in the last (Apr 3 2009) commit of the file, kernel
+versions 2.6.30 and later.
+
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Paul Gortmaker <p_gortmaker@yahoo.com>
+Cc: Raphael Assenat <raph@8d.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/rtc-v3020.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-v3020.c
++++ b/drivers/rtc/rtc-v3020.c
+@@ -96,7 +96,7 @@ static void v3020_mmio_write_bit(struct 
+ static unsigned char v3020_mmio_read_bit(struct v3020 *chip)
+ {
+-      return readl(chip->ioaddress) & (1 << chip->leftshift);
++      return !!(readl(chip->ioaddress) & (1 << chip->leftshift));
+ }
+ static struct v3020_chip_ops v3020_mmio_ops = {
index a47099b9c1089ea3720ea83733a38e1c66131256..54c41fd3b6e4fb8954c3e6470c914589891c3cb7 100644 (file)
@@ -25,7 +25,23 @@ v4l-dvb-13170-bttv-fix-reversed-polarity-error-when-switching-video-standard.pat
 v4l-dvb-13109-tda18271-fix-signedness-issue-in-tda18271_rf_tracking_filters_init.patch
 v4l-dvb-13107-tda18271-fix-overflow-in-fm-radio-frequency-calculation.patch
 v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch
-v4l-dvb-13240-firedtv-fix-regression-tuning-fails-due-to-bogus-error-return.patch
 v4l-dvb-13079-dib0700-fixed-xc2028-firmware-loading-kernel-oops.patch
 v4l-dvb-13230-s2255drv-don-t-conditionalize-video-buffer-completion-on-waiting-processes.patch
 uids-prevent-tear-down-race.patch
+pps-events-reporting-fix-up.patch
+pps-locking-scheme-fix-up-for-pps_getparams.patch
+rtc-v3020-fix-v3020_mmio_read_bit.patch
+fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch
+memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch
+pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch
+page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch
+page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch
+tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch
+tty-cp210x-fix-carrier-handling.patch
+usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch
+usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch
+usb-option.c-add-support-for-d-link-dwm-162-u5.patch
+usb-cdc_acm-fix-race-condition-when-opening-tty.patch
+usb-xhci-fix-bug-memory-free-after-failed-initialization.patch
+usb-xhci-fix-trb-physical-to-virtual-address-translation.patch
+usb-xhci-fix-scratchpad-deallocation.patch
diff --git a/queue-2.6.31/tty-cp210x-fix-carrier-handling.patch b/queue-2.6.31/tty-cp210x-fix-carrier-handling.patch
new file mode 100644 (file)
index 0000000..eb33552
--- /dev/null
@@ -0,0 +1,84 @@
+From d94c7bd4c1361cab58a21d530078c5673863dcc2 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Wed, 28 Oct 2009 21:12:33 +0100
+Subject: tty: cp210x: Fix carrier handling
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit d94c7bd4c1361cab58a21d530078c5673863dcc2 upstream.
+
+Original discussion:
+http://thread.gmane.org/gmane.linux.usb.general/23217/focus=23248
+or
+http://marc.info/?l=linux-usb&m=125553790714133&w=2
+
+9a68e39d4a701fb3be03cae9b462408664ebd205 broke carrier handling so that a
+cp210x setup which needed the carrier lines set up (non CLOCAL) which did
+not make a call which set the termios bits left the lines down even if
+CLOCAL was not asserted.
+
+Fix this not by reverting but by adding the proper dtr_rts and
+carrier_raised methods. This both sets the modem lines properly and also
+implements the correct blocking semantics for the port as required by
+POSIX.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Reported-by: Karl Hiramoto <karl@hiramoto.org>
+Tested-by:  Karl Hiramoto <karl@hiramoto.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/cp210x.c |   21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -51,6 +51,8 @@ static int cp210x_tiocmset_port(struct u
+ static void cp210x_break_ctl(struct tty_struct *, int);
+ static int cp210x_startup(struct usb_serial *);
+ static void cp210x_disconnect(struct usb_serial *);
++static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
++static int cp210x_carrier_raised(struct usb_serial_port *p);
+ static int debug;
+@@ -144,6 +146,8 @@ static struct usb_serial_driver cp210x_d
+       .tiocmset               = cp210x_tiocmset,
+       .attach                 = cp210x_startup,
+       .disconnect             = cp210x_disconnect,
++      .dtr_rts                = cp210x_dtr_rts,
++      .carrier_raised         = cp210x_carrier_raised
+ };
+ /* Config request types */
+@@ -748,6 +752,14 @@ static int cp210x_tiocmset_port(struct u
+       return cp210x_set_config(port, CP210X_SET_MHS, &control, 2);
+ }
++static void cp210x_dtr_rts(struct usb_serial_port *p, int on)
++{
++      if (on)
++              cp210x_tiocmset_port(p, NULL,  TIOCM_DTR|TIOCM_RTS, 0);
++      else
++              cp210x_tiocmset_port(p, NULL,  0, TIOCM_DTR|TIOCM_RTS);
++}
++
+ static int cp210x_tiocmget (struct tty_struct *tty, struct file *file)
+ {
+       struct usb_serial_port *port = tty->driver_data;
+@@ -770,6 +782,15 @@ static int cp210x_tiocmget (struct tty_s
+       return result;
+ }
++static int cp210x_carrier_raised(struct usb_serial_port *p)
++{
++      unsigned int control;
++      cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1);
++      if (control & CONTROL_DCD)
++              return 1;
++      return 0;
++}
++
+ static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
+ {
+       struct usb_serial_port *port = tty->driver_data;
diff --git a/queue-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch b/queue-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch
new file mode 100644 (file)
index 0000000..c869d18
--- /dev/null
@@ -0,0 +1,42 @@
+From 4175f3e31cc7157669aa66d46dc79de6ae0126ce Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Wed, 28 Oct 2009 21:12:32 +0100
+Subject: tty_port: If we are opened non blocking we still need to raise the carrier
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit 4175f3e31cc7157669aa66d46dc79de6ae0126ce upstream.
+
+Original discussion:
+http://thread.gmane.org/gmane.linux.usb.general/23217/focus=23248
+or
+http://marc.info/?l=linux-usb&m=125553790714133&w=2
+
+The tty_port code inherited a bug common to various drivers it was based
+upon. If the tty is opened O_NONBLOCK we do not wait for the carrier to be
+raised but we must still raise our modem lines if appropriate.
+
+(There is a second question here about whether we should do so if CLOCAL is
+ set but that can wait)
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Reported-by: Karl Hiramoto <karl@hiramoto.org>
+Tested-by:  Karl Hiramoto <karl@hiramoto.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tty_port.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/char/tty_port.c
++++ b/drivers/char/tty_port.c
+@@ -219,6 +219,9 @@ int tty_port_block_til_ready(struct tty_
+          the port has just hung up or is in another error state */
+       if ((filp->f_flags & O_NONBLOCK) ||
+                       (tty->flags & (1 << TTY_IO_ERROR))) {
++              /* Indicate we are open */
++              if (tty->termios->c_cflag & CBAUD)
++                      tty_port_raise_dtr_rts(port);
+               port->flags |= ASYNC_NORMAL_ACTIVE;
+               return 0;
+       }
diff --git a/queue-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch b/queue-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch
new file mode 100644 (file)
index 0000000..e7c52a9
--- /dev/null
@@ -0,0 +1,33 @@
+From 18a77b5d237a67d2c621a46f5271a3b51da1b380 Mon Sep 17 00:00:00 2001
+From: Henry Gebhardt <gebhardt@astro.uni-tuebingen.de>
+Date: Wed, 4 Nov 2009 11:19:28 +0100
+Subject: USB: cdc_acm: Fix race condition when opening tty
+
+From: Henry Gebhardt <gebhardt@astro.uni-tuebingen.de>
+
+commit 18a77b5d237a67d2c621a46f5271a3b51da1b380 upstream.
+
+If acm_rx_tasklet() gets called before tty_port_block_til_ready()
+returns, then bulk IN urbs may not be sent. This fixes it.
+
+Signed-off-by: Henry Gebhardt <gebhardt@astro.uni-tuebingen.de>
+Acked-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -609,9 +609,9 @@ static int acm_tty_open(struct tty_struc
+       acm->throttle = 0;
+-      tasklet_schedule(&acm->urb_task);
+       set_bit(ASYNCB_INITIALIZED, &acm->port.flags);
+       rv = tty_port_block_til_ready(&acm->port, tty, filp);
++      tasklet_schedule(&acm->urb_task);
+ done:
+       mutex_unlock(&acm->mutex);
+ err_out:
diff --git a/queue-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch b/queue-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch
new file mode 100644 (file)
index 0000000..57456e6
--- /dev/null
@@ -0,0 +1,149 @@
+From a1f17a872bc7b1cb7efdd5486a2963e88a536e61 Mon Sep 17 00:00:00 2001
+From: Libin Yang <libin.yang@amd.com>
+Date: Wed, 4 Nov 2009 14:55:18 +0800
+Subject: USB: ohci: quirk AMD prefetch for USB 1.1 ISO transfer
+
+From: Libin Yang <libin.yang@amd.com>
+
+commit a1f17a872bc7b1cb7efdd5486a2963e88a536e61 upstream.
+
+The following patch in the driver is required to avoid USB 1.1 device
+failures that may occur due to requests from USB OHCI controllers may
+be overwritten if the latency for any pending request by the USB
+controller is very long (in the range of milliseconds).
+
+Signed-off-by: Libin Yang <libin.yang@amd.com>
+Cc: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ohci-hcd.c |    5 +++++
+ drivers/usb/host/ohci-pci.c |   20 ++++++++++++++++++++
+ drivers/usb/host/ohci-q.c   |   18 ++++++++++++------
+ drivers/usb/host/ohci.h     |    9 +++++++++
+ 4 files changed, 46 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/host/ohci.h
++++ b/drivers/usb/host/ohci.h
+@@ -402,6 +402,7 @@ struct ohci_hcd {
+ #define       OHCI_QUIRK_FRAME_NO     0x80                    /* no big endian frame_no shift */
+ #define       OHCI_QUIRK_HUB_POWER    0x100                   /* distrust firmware power/oc setup */
+ #define       OHCI_QUIRK_AMD_ISO      0x200                   /* ISO transfers*/
++#define       OHCI_QUIRK_AMD_PREFETCH 0x400                   /* pre-fetch for ISO transfer */
+       // there are also chip quirks/bugs in init logic
+       struct work_struct      nec_work;       /* Worker for NEC quirk */
+@@ -433,6 +434,10 @@ static inline int quirk_amdiso(struct oh
+ {
+       return ohci->flags & OHCI_QUIRK_AMD_ISO;
+ }
++static inline int quirk_amdprefetch(struct ohci_hcd *ohci)
++{
++      return ohci->flags & OHCI_QUIRK_AMD_PREFETCH;
++}
+ #else
+ static inline int quirk_nec(struct ohci_hcd *ohci)
+ {
+@@ -446,6 +451,10 @@ static inline int quirk_amdiso(struct oh
+ {
+       return 0;
+ }
++static inline int quirk_amdprefetch(struct ohci_hcd *ohci)
++{
++      return 0;
++}
+ #endif
+ /* convert between an hcd pointer and the corresponding ohci_hcd */
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -88,6 +88,7 @@ static int ohci_restart (struct ohci_hcd
+ #ifdef CONFIG_PCI
+ static void quirk_amd_pll(int state);
+ static void amd_iso_dev_put(void);
++static void sb800_prefetch(struct ohci_hcd *ohci, int on);
+ #else
+ static inline void quirk_amd_pll(int state)
+ {
+@@ -97,6 +98,10 @@ static inline void amd_iso_dev_put(void)
+ {
+       return;
+ }
++static inline void sb800_prefetch(struct ohci_hcd *ohci, int on)
++{
++      return;
++}
+ #endif
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -177,6 +177,13 @@ static int ohci_quirk_amd700(struct usb_
+               return 0;
+       pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
++
++      /* SB800 needs pre-fetch fix */
++      if ((rev >= 0x40) && (rev <= 0x4f)) {
++              ohci->flags |= OHCI_QUIRK_AMD_PREFETCH;
++              ohci_dbg(ohci, "enabled AMD prefetch quirk\n");
++      }
++
+       if ((rev > 0x3b) || (rev < 0x30)) {
+               pci_dev_put(amd_smbus_dev);
+               amd_smbus_dev = NULL;
+@@ -262,6 +269,19 @@ static void amd_iso_dev_put(void)
+ }
++static void sb800_prefetch(struct ohci_hcd *ohci, int on)
++{
++      struct pci_dev *pdev;
++      u16 misc;
++
++      pdev = to_pci_dev(ohci_to_hcd(ohci)->self.controller);
++      pci_read_config_word(pdev, 0x50, &misc);
++      if (on == 0)
++              pci_write_config_word(pdev, 0x50, misc & 0xfcff);
++      else
++              pci_write_config_word(pdev, 0x50, misc | 0x0300);
++}
++
+ /* List of quirks for OHCI */
+ static const struct pci_device_id ohci_pci_quirks[] = {
+       {
+--- a/drivers/usb/host/ohci-q.c
++++ b/drivers/usb/host/ohci-q.c
+@@ -49,9 +49,12 @@ __acquires(ohci->lock)
+       switch (usb_pipetype (urb->pipe)) {
+       case PIPE_ISOCHRONOUS:
+               ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs--;
+-              if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0
+-                              && quirk_amdiso(ohci))
+-                      quirk_amd_pll(1);
++              if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) {
++                      if (quirk_amdiso(ohci))
++                              quirk_amd_pll(1);
++                      if (quirk_amdprefetch(ohci))
++                              sb800_prefetch(ohci, 0);
++              }
+               break;
+       case PIPE_INTERRUPT:
+               ohci_to_hcd(ohci)->self.bandwidth_int_reqs--;
+@@ -680,9 +683,12 @@ static void td_submit_urb (
+                               data + urb->iso_frame_desc [cnt].offset,
+                               urb->iso_frame_desc [cnt].length, urb, cnt);
+               }
+-              if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0
+-                              && quirk_amdiso(ohci))
+-                      quirk_amd_pll(0);
++              if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) {
++                      if (quirk_amdiso(ohci))
++                              quirk_amd_pll(0);
++                      if (quirk_amdprefetch(ohci))
++                              sb800_prefetch(ohci, 1);
++              }
+               periodic = ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs++ == 0
+                       && ohci_to_hcd(ohci)->self.bandwidth_int_reqs == 0;
+               break;
diff --git a/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch b/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch
new file mode 100644 (file)
index 0000000..353cd02
--- /dev/null
@@ -0,0 +1,44 @@
+From ff854ce0b17161a86b5ae444c6cb0aa221720fab Mon Sep 17 00:00:00 2001
+From: Zhang Le <r0bertz@gentoo.org>
+Date: Wed, 4 Nov 2009 23:22:59 +0800
+Subject: USB: option.c: add support for D-Link DWM-162-U5
+
+From: Zhang Le <r0bertz@gentoo.org>
+
+commit ff854ce0b17161a86b5ae444c6cb0aa221720fab upstream.
+
+Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device
+has 4 interfaces, of which 1 is handled by storage and the other 3 by
+option driver.
+
+The device appears first as CD-only 05c6:2100 device and must be
+switched to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch.
+
+The MessageContent for usb_modeswitch.conf is:
+"55534243e0c26a85000000000000061b000000020000000000000000000000"
+
+Signed-off-by: Zhang Le <r0bertz@gentoo.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -309,6 +309,7 @@ static int  option_resume(struct usb_ser
+ #define DLINK_VENDOR_ID                               0x1186
+ #define DLINK_PRODUCT_DWM_652                 0x3e04
++#define DLINK_PRODUCT_DWM_652_U5              0xce16
+ #define QISDA_VENDOR_ID                               0x1da5
+ #define QISDA_PRODUCT_H21_4512                        0x4512
+@@ -587,6 +588,7 @@ static struct usb_device_id option_ids[]
+       { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+       { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+       { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
++      { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
+       { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
+       { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) },
+       { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) },
diff --git a/queue-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch b/queue-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch
new file mode 100644 (file)
index 0000000..8ccd836
--- /dev/null
@@ -0,0 +1,69 @@
+From fca94748c5136ff390eadc443871b82f1f77dcd6 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 4 Nov 2009 11:35:53 -0500
+Subject: USB: usbmon: fix bug in mon_buff_area_shrink
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit fca94748c5136ff390eadc443871b82f1f77dcd6 upstream.
+
+This patch (as1299b) fixes a bug in an error-handling path of usbmon's
+binary interface.  The storage area for URB data is divided into
+fixed-size blocks.  If an URB's data can't be copied, the area
+reserved for it should be decreased to the size of the truncated
+information (rounded up to a block boundary).  Rounding up the amount
+to be removed and subtracting it from the reserved size is definitely
+the wrong thing to do.
+
+Also, when the data for an isochronous URB can't be copied, we can
+still copy the isoc packet descriptors.  In fact the current code does
+copy the descriptors, but then sets the capture length to 0 so they
+remain inaccessible.  The capture length should be reduced to the
+length of the descriptors, not set to 0.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: Pete Zaitcev <zaitcev@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/mon/mon_bin.c |   11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -350,12 +350,12 @@ static unsigned int mon_buff_area_alloc_
+ /*
+  * Return a few (kilo-)bytes to the head of the buffer.
+- * This is used if a DMA fetch fails.
++ * This is used if a data fetch fails.
+  */
+ static void mon_buff_area_shrink(struct mon_reader_bin *rp, unsigned int size)
+ {
+-      size = (size + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
++      /* size &= ~(PKT_ALIGN-1);  -- we're called with aligned size */
+       rp->b_cnt -= size;
+       if (rp->b_in < size)
+               rp->b_in += rp->b_size;
+@@ -442,6 +442,7 @@ static void mon_bin_event(struct mon_rea
+       unsigned int urb_length;
+       unsigned int offset;
+       unsigned int length;
++      unsigned int delta;
+       unsigned int ndesc, lendesc;
+       unsigned char dir;
+       struct mon_bin_hdr *ep;
+@@ -546,8 +547,10 @@ static void mon_bin_event(struct mon_rea
+       if (length != 0) {
+               ep->flag_data = mon_bin_get_data(rp, offset, urb, length);
+               if (ep->flag_data != 0) {       /* Yes, it's 0x00, not '0' */
+-                      ep->len_cap = 0;
+-                      mon_buff_area_shrink(rp, length);
++                      delta = (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
++                      ep->len_cap -= length;
++                      delta -= (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
++                      mon_buff_area_shrink(rp, delta);
+               }
+       } else {
+               ep->flag_data = data_tag;
diff --git a/queue-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch b/queue-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch
new file mode 100644 (file)
index 0000000..9854d1b
--- /dev/null
@@ -0,0 +1,37 @@
+From d94c05e33d9212ee67b8d4998f984cc71df8168b Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Tue, 3 Nov 2009 22:02:22 -0800
+Subject: USB: xhci: Fix bug memory free after failed initialization.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit d94c05e33d9212ee67b8d4998f984cc71df8168b upstream.
+
+If the xHCI driver fails during the memory initialization, xhci->ir_set
+may not be a valid pointer.  Check that it points to valid DMA'able memory
+before writing to that address during the memory freeing process.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-mem.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -756,9 +756,11 @@ void xhci_mem_cleanup(struct xhci_hcd *x
+       int i;
+       /* Free the Event Ring Segment Table and the actual Event Ring */
+-      xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
+-      xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
+-      xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
++      if (xhci->ir_set) {
++              xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
++              xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
++              xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
++      }
+       size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
+       if (xhci->erst.entries)
+               pci_free_consistent(pdev, size,
diff --git a/queue-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch b/queue-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch
new file mode 100644 (file)
index 0000000..3e65c08
--- /dev/null
@@ -0,0 +1,35 @@
+From 5294bea40666db5c5d6c336b8e4e55d69fa576ca Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Wed, 4 Nov 2009 11:22:19 -0800
+Subject: USB: xhci: Fix scratchpad deallocation.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 5294bea40666db5c5d6c336b8e4e55d69fa576ca upstream.
+
+The scratchpad_free() function uses xhci->page_size to free some memory
+with pci_free_consistent().  However, the page_size is set to zero before
+the call, causing kernel oopses on driver unload.  Call scratchpad_free()
+before setting xhci->page_size to zero.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Acked-by: John Youn <John.Youn@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-mem.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -797,9 +797,9 @@ void xhci_mem_cleanup(struct xhci_hcd *x
+                               xhci->dcbaa, xhci->dcbaa->dma);
+       xhci->dcbaa = NULL;
++      scratchpad_free(xhci);
+       xhci->page_size = 0;
+       xhci->page_shift = 0;
+-      scratchpad_free(xhci);
+ }
+ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
diff --git a/queue-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch b/queue-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch
new file mode 100644 (file)
index 0000000..d39526b
--- /dev/null
@@ -0,0 +1,63 @@
+From 2fa88daa6f299bfb83672c3b525d786ad03b4735 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Tue, 3 Nov 2009 22:02:24 -0800
+Subject: USB: xhci: Fix TRB physical to virtual address translation.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 2fa88daa6f299bfb83672c3b525d786ad03b4735 upstream.
+
+The trb_in_td() function in the xHCI driver is supposed to translate a
+physical transfer buffer request (TRB) into a virtual pointer to the ring
+segment that TRB is in.
+
+Unfortunately, a mistake in this function may cause endless loops as the
+driver searches through the linked list of ring segments over and over
+again.  Fix a couple bugs that may lead to loops or bad output:
+
+1. Bail out if we get a NULL pointer when translating the segment's
+private structure and the starting DMA address of the segment chunk.  If
+this happens, we've been handed a starting TRB pointer from a different
+ring.
+
+2. Make sure the function works when there's multiple segments in the
+ring.  In the while loop to search through the ring segments, use the
+current segment variable (cur_seg), rather than the starting segment
+variable (start_seg) that is passed in.
+
+3. Stop searching the ring if we've run through all the segments in the
+ring.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-ring.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -822,9 +822,11 @@ static struct xhci_segment *trb_in_td(
+       cur_seg = start_seg;
+       do {
++              if (start_dma == 0)
++                      return 0;
+               /* We may get an event for a Link TRB in the middle of a TD */
+               end_seg_dma = xhci_trb_virt_to_dma(cur_seg,
+-                              &start_seg->trbs[TRBS_PER_SEGMENT - 1]);
++                              &cur_seg->trbs[TRBS_PER_SEGMENT - 1]);
+               /* If the end TRB isn't in this segment, this is set to 0 */
+               end_trb_dma = xhci_trb_virt_to_dma(cur_seg, end_trb);
+@@ -851,8 +853,9 @@ static struct xhci_segment *trb_in_td(
+               }
+               cur_seg = cur_seg->next;
+               start_dma = xhci_trb_virt_to_dma(cur_seg, &cur_seg->trbs[0]);
+-      } while (1);
++      } while (cur_seg != start_seg);
++      return 0;
+ }
+ /*
diff --git a/queue-2.6.31/v4l-dvb-13240-firedtv-fix-regression-tuning-fails-due-to-bogus-error-return.patch b/queue-2.6.31/v4l-dvb-13240-firedtv-fix-regression-tuning-fails-due-to-bogus-error-return.patch
deleted file mode 100644 (file)
index 6cc5ac6..0000000
+++ /dev/null
@@ -1,43 +0,0 @@
-From dcff9cfe432c74b382cea327509ede2e114b1615 Mon Sep 17 00:00:00 2001
-From: Stefan Richter <stefanr@s5r6.in-berlin.de>
-Date: Sat, 17 Oct 2009 17:46:25 -0300
-Subject: V4L/DVB (13240): firedtv: fix regression: tuning fails due to bogus error return
-
-From: Stefan Richter <stefanr@s5r6.in-berlin.de>
-
-commit dcff9cfe432c74b382cea327509ede2e114b1615 upstream.
-
-Since 2.6.32(-rc1), DVB core checks the return value of
-dvb_frontend_ops.set_frontend.  Now it becomes apparent that firedtv
-always returned a bogus value from its set_frontend method.
-
-Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
-Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/media/dvb/firewire/firedtv-fe.c |    8 +-------
- 1 file changed, 1 insertion(+), 7 deletions(-)
-
---- a/drivers/media/dvb/firewire/firedtv-fe.c
-+++ b/drivers/media/dvb/firewire/firedtv-fe.c
-@@ -141,18 +141,12 @@ static int fdtv_read_uncorrected_blocks(
-       return -EOPNOTSUPP;
- }
--#define ACCEPTED 0x9
--
- static int fdtv_set_frontend(struct dvb_frontend *fe,
-                            struct dvb_frontend_parameters *params)
- {
-       struct firedtv *fdtv = fe->sec_priv;
--      /* FIXME: avc_tuner_dsd never returns ACCEPTED. Check status? */
--      if (avc_tuner_dsd(fdtv, params) != ACCEPTED)
--              return -EINVAL;
--      else
--              return 0; /* not sure of this... */
-+      return avc_tuner_dsd(fdtv, params);
- }
- static int fdtv_get_frontend(struct dvb_frontend *fe,