From: Greg Kroah-Hartman Date: Wed, 2 Dec 2009 00:12:37 +0000 (-0800) Subject: more .31 patches X-Git-Tag: v2.6.31.7~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8fae922a5a8484fff6beff62be4bfbb70e377cae;p=thirdparty%2Fkernel%2Fstable-queue.git more .31 patches --- diff --git a/queue-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch b/queue-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch new file mode 100644 index 00000000000..b37fa6963e4 --- /dev/null +++ b/queue-2.6.31/fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch @@ -0,0 +1,50 @@ +From 7779d7bed950a7fb1af4f540c2f82a6b81b65901 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Wed, 11 Nov 2009 14:26:34 -0800 +Subject: fs: add missing compat_ptr handling for FS_IOC_RESVSP ioctl + +From: Heiko Carstens + +commit 7779d7bed950a7fb1af4f540c2f82a6b81b65901 upstream. + +For FS_IOC_RESVSP and FS_IOC_RESVSP64 compat_sys_ioctl() uses its +arg argument as a pointer to userspace. However it is missing a +a call to compat_ptr() which will do a proper pointer conversion. + +This was introduced with 3e63cbb1 "fs: Add new pre-allocation ioctls +to vfs for compatibility with legacy xfs ioctls". + +Signed-off-by: Heiko Carstens +Cc: Ankit Jain +Acked-by: Christoph Hellwig +Cc: Al Viro +Acked-by: Arnd Bergmann +Acked-by: David S. Miller +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/compat_ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -1800,7 +1800,7 @@ struct space_resv_32 { + /* just account for different alignment */ + static int compat_ioctl_preallocate(struct file *file, unsigned long arg) + { +- struct space_resv_32 __user *p32 = (void __user *)arg; ++ struct space_resv_32 __user *p32 = compat_ptr(arg); + struct space_resv __user *p = compat_alloc_user_space(sizeof(*p)); + + if (copy_in_user(&p->l_type, &p32->l_type, sizeof(s16)) || +@@ -2802,7 +2802,7 @@ asmlinkage long compat_sys_ioctl(unsigne + #else + case FS_IOC_RESVSP: + case FS_IOC_RESVSP64: +- error = ioctl_preallocate(filp, (void __user *)arg); ++ error = ioctl_preallocate(filp, compat_ptr(arg)); + goto out_fput; + #endif + diff --git a/queue-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch b/queue-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch new file mode 100644 index 00000000000..f9fc11bc73c --- /dev/null +++ b/queue-2.6.31/memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch @@ -0,0 +1,44 @@ +From e00e431612c3a6e437a01f2129fd3843da0c982a Mon Sep 17 00:00:00 2001 +From: KAMEZAWA Hiroyuki +Date: Wed, 11 Nov 2009 14:26:26 -0800 +Subject: memcg: fix wrong pointer initialization at page migration when memcg is disabled. + +From: KAMEZAWA Hiroyuki + +commit e00e431612c3a6e437a01f2129fd3843da0c982a upstream. + +Lee Schermerhorn reported that he saw bad pointer dereference in +mem_cgroup_end_migration() when he disabled memcg by boot option. + +memcg's page migration logic works as + + mem_cgroup_prepare_migration(page, &ptr); + do page migration + mem_cgroup_end_migration(page, ptr); + +Now, ptr is not initialized in prepare_migration when memcg is disabled +by boot option. This causes panic in end_migration. This patch fixes it. + +Reported-by: Lee Schermerhorn +Cc: Balbir Singh +Signed-off-by: KAMEZAWA Hiroyuki +Reviewed-by: Daisuke Nishimura +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/migrate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -597,7 +597,7 @@ static int unmap_and_move(new_page_t get + struct page *newpage = get_new_page(page, private, &result); + int rcu_locked = 0; + int charge = 0; +- struct mem_cgroup *mem; ++ struct mem_cgroup *mem = NULL; + + if (!newpage) + return -ENOMEM; diff --git a/queue-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch b/queue-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch new file mode 100644 index 00000000000..3a9934c6d3d --- /dev/null +++ b/queue-2.6.31/page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch @@ -0,0 +1,53 @@ +From cc4a6851466039a8a688c843962a05689059ff3b Mon Sep 17 00:00:00 2001 +From: Mel Gorman +Date: Wed, 11 Nov 2009 14:26:14 -0800 +Subject: page allocator: always wake kswapd when restarting an allocation attempt after direct reclaim failed + +From: Mel Gorman + +commit cc4a6851466039a8a688c843962a05689059ff3b upstream. + +If a direct reclaim makes no forward progress, it considers whether it +should go OOM or not. Whether OOM is triggered or not, it may retry the +allocation afterwards. In times past, this would always wake kswapd as +well but currently, kswapd is not woken up after direct reclaim fails. +For order-0 allocations, this makes little difference but if there is a +heavy mix of higher-order allocations that direct reclaim is failing for, +it might mean that kswapd is not rewoken for higher orders as much as it +did previously. + +This patch wakes up kswapd when an allocation is being retried after a +direct reclaim failure. It would be expected that kswapd is already +awake, but this has the effect of telling kswapd to reclaim at the higher +order as well. + +Signed-off-by: Mel Gorman +Reviewed-by: Christoph Lameter +Reviewed-by: Pekka Enberg +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1763,6 +1763,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u + if (NUMA_BUILD && (gfp_mask & GFP_THISNODE) == GFP_THISNODE) + goto nopage; + ++restart: + wake_all_kswapd(order, zonelist, high_zoneidx); + + /* +@@ -1772,7 +1773,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u + */ + alloc_flags = gfp_to_alloc_flags(gfp_mask); + +-restart: + /* This is the last chance, in general, before the goto nopage. */ + page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist, + high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS, diff --git a/queue-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch b/queue-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch new file mode 100644 index 00000000000..22ba82b74a4 --- /dev/null +++ b/queue-2.6.31/page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch @@ -0,0 +1,44 @@ +From 9d0ed60fe9cd1fbf57f755cd27a23ae9114d7210 Mon Sep 17 00:00:00 2001 +From: Mel Gorman +Date: Wed, 11 Nov 2009 14:26:17 -0800 +Subject: page allocator: Do not allow interrupts to use ALLOC_HARDER + +From: Mel Gorman + +commit 9d0ed60fe9cd1fbf57f755cd27a23ae9114d7210 upstream. + +Commit 341ce06f69abfafa31b9468410a13dbd60e2b237 ("page allocator: +calculate the alloc_flags for allocation only once") altered watermark +logic slightly by allowing rt_tasks that are handling an interrupt to set +ALLOC_HARDER. This patch brings the watermark logic more in line with +2.6.30. + +This change results in a reduction of the number high-order GFP_ATOMIC +allocation failures reported. See +http://www.gossamer-threads.com/lists/linux/kernel/1144153 + +[rientjes@google.com: Spotted the problem] +Signed-off-by: Mel Gorman +Reviewed-by: Pekka Enberg +Reviewed-by: Rik van Riel +Reviewed-by: KOSAKI Motohiro +Cc: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1715,7 +1715,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask) + * See also cpuset_zone_allowed() comment in kernel/cpuset.c. + */ + alloc_flags &= ~ALLOC_CPUSET; +- } else if (unlikely(rt_task(p))) ++ } else if (unlikely(rt_task(p)) && !in_interrupt()) + alloc_flags |= ALLOC_HARDER; + + if (likely(!(gfp_mask & __GFP_NOMEMALLOC))) { diff --git a/queue-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch b/queue-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch new file mode 100644 index 00000000000..72e5945061f --- /dev/null +++ b/queue-2.6.31/pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch @@ -0,0 +1,62 @@ +From 29f12ca32122db98481150be09d35bd72b68045e Mon Sep 17 00:00:00 2001 +From: Sukadev Bhattiprolu +Date: Wed, 11 Nov 2009 14:26:32 -0800 +Subject: pidns: fix a leak in /proc dentries and inodes with pid namespaces. + +From: Sukadev Bhattiprolu + +commit 29f12ca32122db98481150be09d35bd72b68045e upstream. + +Daniel Lezcano reported a leak in 'struct pid' and 'struct pid_namespace' +that is discussed in: + + http://lkml.org/lkml/2009/10/2/159. + +To summarize the thread, when container-init is terminated, it sets the +PF_EXITING flag, zaps other processes in the container and waits to reap +them. As a part of reaping, the container-init should flush any /proc +dentries associated with the processes. But because the container-init is +itself exiting and the following PF_EXITING check, the dentries are not +flushed, resulting in leak in /proc inodes and dentries. + +This fix reverts the commit 7766755a2f249e7e0 ("Fix /proc dcache deadlock +in do_exit") which introduced the check for PF_EXITING. At the time of +the commit, shrink_dcache_parent() flushed dentries from other filesystems +also and could have caused a deadlock which the commit fixed. But as +pointed out by Eric Biederman, after commit 0feae5c47aabdde59, +shrink_dcache_parent() no longer affects other filesystems. So reverting +the commit is now safe. + +As pointed out by Jan Kara, the leak is not as critical since the +unclaimed space will be reclaimed under memory pressure or by: + + echo 3 > /proc/sys/vm/drop_caches + +But since this check is no longer required, its best to remove it. + +Signed-off-by: Sukadev Bhattiprolu +Reported-by: Daniel Lezcano +Acked-by: Eric W. Biederman +Acked-by: Jan Kara +Cc: Andrea Arcangeli +Cc: Serge Hallyn +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -2580,8 +2580,7 @@ static void proc_flush_task_mnt(struct v + name.len = snprintf(buf, sizeof(buf), "%d", pid); + dentry = d_hash_and_lookup(mnt->mnt_root, &name); + if (dentry) { +- if (!(current->flags & PF_EXITING)) +- shrink_dcache_parent(dentry); ++ shrink_dcache_parent(dentry); + d_drop(dentry); + dput(dentry); + } diff --git a/queue-2.6.31/pps-events-reporting-fix-up.patch b/queue-2.6.31/pps-events-reporting-fix-up.patch new file mode 100644 index 00000000000..9efa23b4cbe --- /dev/null +++ b/queue-2.6.31/pps-events-reporting-fix-up.patch @@ -0,0 +1,83 @@ +From 276b282e904f690dc930f9bc946110651f297669 Mon Sep 17 00:00:00 2001 +From: Rodolfo Giometti +Date: Wed, 11 Nov 2009 14:26:54 -0800 +Subject: pps: events reporting fix up + +From: Rodolfo Giometti + +commit 276b282e904f690dc930f9bc946110651f297669 upstream. + +PPS events must be recorded according to PPS's mode settings. + +If a process asks for (i.e.) capture-assert events only, when the PPS +client calls the pps_event() function to save the current PPS event, we +should verify the event type and then discard unwanted ones. + +Also, without this patch userland processes waiting for a specific PPS +event (assert or clear but not both) may be awakened at wrong time. + +Signed-off-by: Rodolfo Giometti +Tested-by: William S. Brasher +Tested-by: Reg Clemens +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pps/kapi.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/pps/kapi.c ++++ b/drivers/pps/kapi.c +@@ -271,6 +271,7 @@ void pps_event(int source, struct pps_kt + { + struct pps_device *pps; + unsigned long flags; ++ int captured = 0; + + if ((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0) { + printk(KERN_ERR "pps: unknown event (%x) for source %d\n", +@@ -293,7 +294,8 @@ void pps_event(int source, struct pps_kt + + /* Check the event */ + pps->current_mode = pps->params.mode; +- if (event & PPS_CAPTUREASSERT) { ++ if ((event & PPS_CAPTUREASSERT) & ++ (pps->params.mode & PPS_CAPTUREASSERT)) { + /* We have to add an offset? */ + if (pps->params.mode & PPS_OFFSETASSERT) + pps_add_offset(ts, &pps->params.assert_off_tu); +@@ -303,8 +305,11 @@ void pps_event(int source, struct pps_kt + pps->assert_sequence++; + pr_debug("capture assert seq #%u for source %d\n", + pps->assert_sequence, source); ++ ++ captured = ~0; + } +- if (event & PPS_CAPTURECLEAR) { ++ if ((event & PPS_CAPTURECLEAR) & ++ (pps->params.mode & PPS_CAPTURECLEAR)) { + /* We have to add an offset? */ + if (pps->params.mode & PPS_OFFSETCLEAR) + pps_add_offset(ts, &pps->params.clear_off_tu); +@@ -314,12 +319,17 @@ void pps_event(int source, struct pps_kt + pps->clear_sequence++; + pr_debug("capture clear seq #%u for source %d\n", + pps->clear_sequence, source); ++ ++ captured = ~0; + } + +- pps->go = ~0; +- wake_up_interruptible(&pps->queue); ++ /* Wake up iif captured somthing */ ++ if (captured) { ++ pps->go = ~0; ++ wake_up_interruptible(&pps->queue); + +- kill_fasync(&pps->async_queue, SIGIO, POLL_IN); ++ kill_fasync(&pps->async_queue, SIGIO, POLL_IN); ++ } + + spin_unlock_irqrestore(&pps->lock, flags); + diff --git a/queue-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch b/queue-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch new file mode 100644 index 00000000000..45452c03315 --- /dev/null +++ b/queue-2.6.31/pps-locking-scheme-fix-up-for-pps_getparams.patch @@ -0,0 +1,42 @@ +From cbf83cc5a29dba480cf1ba1c5e3417a0d4a31410 Mon Sep 17 00:00:00 2001 +From: Rodolfo Giometti +Date: Wed, 11 Nov 2009 14:26:52 -0800 +Subject: pps: locking scheme fix up for PPS_GETPARAMS + +From: Rodolfo Giometti + +commit cbf83cc5a29dba480cf1ba1c5e3417a0d4a31410 upstream. + +Userland programs may read/write PPS parameters at same time and these +operations may corrupt PPS data. + +Signed-off-by: Rodolfo Giometti +Tested-by: Reg Clemens +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pps/pps.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/pps/pps.c ++++ b/drivers/pps/pps.c +@@ -71,9 +71,14 @@ static long pps_cdev_ioctl(struct file * + case PPS_GETPARAMS: + pr_debug("PPS_GETPARAMS: source %d\n", pps->id); + +- /* Return current parameters */ +- err = copy_to_user(uarg, &pps->params, +- sizeof(struct pps_kparams)); ++ spin_lock_irq(&pps->lock); ++ ++ /* Get the current parameters */ ++ params = pps->params; ++ ++ spin_unlock_irq(&pps->lock); ++ ++ err = copy_to_user(uarg, ¶ms, sizeof(struct pps_kparams)); + if (err) + return -EFAULT; + diff --git a/queue-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch b/queue-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch new file mode 100644 index 00000000000..13cde90a2fc --- /dev/null +++ b/queue-2.6.31/rtc-v3020-fix-v3020_mmio_read_bit.patch @@ -0,0 +1,42 @@ +From bcb3a1676b87effbdeffe8da5c44f63433d158d9 Mon Sep 17 00:00:00 2001 +From: Scott Valentine +Date: Wed, 11 Nov 2009 14:26:49 -0800 +Subject: rtc: v3020: fix v3020_mmio_read_bit() + +From: Scott Valentine + +commit bcb3a1676b87effbdeffe8da5c44f63433d158d9 upstream. + +v3020_mmio_read_bit() always returns 0 when left_shift > 7. + +v3020_mmio_read_bit()'s return type is (unsigned char). The code returns +a value masked by (1 << left_shift) that is casted to the return type. If +left_shift is larger than 7, the cast will always result in a 0 return +value. The problem was discovered with left_shift = 16, and the included +patch corrects the problem. + +The bug was introduced in the last (Apr 3 2009) commit of the file, kernel +versions 2.6.30 and later. + +Cc: Alessandro Zummo +Cc: Paul Gortmaker +Cc: Raphael Assenat +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-v3020.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-v3020.c ++++ b/drivers/rtc/rtc-v3020.c +@@ -96,7 +96,7 @@ static void v3020_mmio_write_bit(struct + + static unsigned char v3020_mmio_read_bit(struct v3020 *chip) + { +- return readl(chip->ioaddress) & (1 << chip->leftshift); ++ return !!(readl(chip->ioaddress) & (1 << chip->leftshift)); + } + + static struct v3020_chip_ops v3020_mmio_ops = { diff --git a/queue-2.6.31/series b/queue-2.6.31/series index a47099b9c10..54c41fd3b6e 100644 --- a/queue-2.6.31/series +++ b/queue-2.6.31/series @@ -25,7 +25,23 @@ v4l-dvb-13170-bttv-fix-reversed-polarity-error-when-switching-video-standard.pat v4l-dvb-13109-tda18271-fix-signedness-issue-in-tda18271_rf_tracking_filters_init.patch v4l-dvb-13107-tda18271-fix-overflow-in-fm-radio-frequency-calculation.patch v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch -v4l-dvb-13240-firedtv-fix-regression-tuning-fails-due-to-bogus-error-return.patch v4l-dvb-13079-dib0700-fixed-xc2028-firmware-loading-kernel-oops.patch v4l-dvb-13230-s2255drv-don-t-conditionalize-video-buffer-completion-on-waiting-processes.patch uids-prevent-tear-down-race.patch +pps-events-reporting-fix-up.patch +pps-locking-scheme-fix-up-for-pps_getparams.patch +rtc-v3020-fix-v3020_mmio_read_bit.patch +fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch +memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch +pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch +page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch +page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch +tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch +tty-cp210x-fix-carrier-handling.patch +usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch +usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch +usb-option.c-add-support-for-d-link-dwm-162-u5.patch +usb-cdc_acm-fix-race-condition-when-opening-tty.patch +usb-xhci-fix-bug-memory-free-after-failed-initialization.patch +usb-xhci-fix-trb-physical-to-virtual-address-translation.patch +usb-xhci-fix-scratchpad-deallocation.patch diff --git a/queue-2.6.31/tty-cp210x-fix-carrier-handling.patch b/queue-2.6.31/tty-cp210x-fix-carrier-handling.patch new file mode 100644 index 00000000000..eb335523828 --- /dev/null +++ b/queue-2.6.31/tty-cp210x-fix-carrier-handling.patch @@ -0,0 +1,84 @@ +From d94c7bd4c1361cab58a21d530078c5673863dcc2 Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Wed, 28 Oct 2009 21:12:33 +0100 +Subject: tty: cp210x: Fix carrier handling + +From: Alan Cox + +commit d94c7bd4c1361cab58a21d530078c5673863dcc2 upstream. + +Original discussion: +http://thread.gmane.org/gmane.linux.usb.general/23217/focus=23248 +or +http://marc.info/?l=linux-usb&m=125553790714133&w=2 + +9a68e39d4a701fb3be03cae9b462408664ebd205 broke carrier handling so that a +cp210x setup which needed the carrier lines set up (non CLOCAL) which did +not make a call which set the termios bits left the lines down even if +CLOCAL was not asserted. + +Fix this not by reverting but by adding the proper dtr_rts and +carrier_raised methods. This both sets the modem lines properly and also +implements the correct blocking semantics for the port as required by +POSIX. + +Signed-off-by: Alan Cox +Reported-by: Karl Hiramoto +Tested-by: Karl Hiramoto +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -51,6 +51,8 @@ static int cp210x_tiocmset_port(struct u + static void cp210x_break_ctl(struct tty_struct *, int); + static int cp210x_startup(struct usb_serial *); + static void cp210x_disconnect(struct usb_serial *); ++static void cp210x_dtr_rts(struct usb_serial_port *p, int on); ++static int cp210x_carrier_raised(struct usb_serial_port *p); + + static int debug; + +@@ -144,6 +146,8 @@ static struct usb_serial_driver cp210x_d + .tiocmset = cp210x_tiocmset, + .attach = cp210x_startup, + .disconnect = cp210x_disconnect, ++ .dtr_rts = cp210x_dtr_rts, ++ .carrier_raised = cp210x_carrier_raised + }; + + /* Config request types */ +@@ -748,6 +752,14 @@ static int cp210x_tiocmset_port(struct u + return cp210x_set_config(port, CP210X_SET_MHS, &control, 2); + } + ++static void cp210x_dtr_rts(struct usb_serial_port *p, int on) ++{ ++ if (on) ++ cp210x_tiocmset_port(p, NULL, TIOCM_DTR|TIOCM_RTS, 0); ++ else ++ cp210x_tiocmset_port(p, NULL, 0, TIOCM_DTR|TIOCM_RTS); ++} ++ + static int cp210x_tiocmget (struct tty_struct *tty, struct file *file) + { + struct usb_serial_port *port = tty->driver_data; +@@ -770,6 +782,15 @@ static int cp210x_tiocmget (struct tty_s + return result; + } + ++static int cp210x_carrier_raised(struct usb_serial_port *p) ++{ ++ unsigned int control; ++ cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1); ++ if (control & CONTROL_DCD) ++ return 1; ++ return 0; ++} ++ + static void cp210x_break_ctl (struct tty_struct *tty, int break_state) + { + struct usb_serial_port *port = tty->driver_data; diff --git a/queue-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch b/queue-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch new file mode 100644 index 00000000000..c869d184aff --- /dev/null +++ b/queue-2.6.31/tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch @@ -0,0 +1,42 @@ +From 4175f3e31cc7157669aa66d46dc79de6ae0126ce Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Wed, 28 Oct 2009 21:12:32 +0100 +Subject: tty_port: If we are opened non blocking we still need to raise the carrier + +From: Alan Cox + +commit 4175f3e31cc7157669aa66d46dc79de6ae0126ce upstream. + +Original discussion: +http://thread.gmane.org/gmane.linux.usb.general/23217/focus=23248 +or +http://marc.info/?l=linux-usb&m=125553790714133&w=2 + +The tty_port code inherited a bug common to various drivers it was based +upon. If the tty is opened O_NONBLOCK we do not wait for the carrier to be +raised but we must still raise our modem lines if appropriate. + +(There is a second question here about whether we should do so if CLOCAL is + set but that can wait) + +Signed-off-by: Alan Cox +Reported-by: Karl Hiramoto +Tested-by: Karl Hiramoto +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/tty_port.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/char/tty_port.c ++++ b/drivers/char/tty_port.c +@@ -219,6 +219,9 @@ int tty_port_block_til_ready(struct tty_ + the port has just hung up or is in another error state */ + if ((filp->f_flags & O_NONBLOCK) || + (tty->flags & (1 << TTY_IO_ERROR))) { ++ /* Indicate we are open */ ++ if (tty->termios->c_cflag & CBAUD) ++ tty_port_raise_dtr_rts(port); + port->flags |= ASYNC_NORMAL_ACTIVE; + return 0; + } diff --git a/queue-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch b/queue-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch new file mode 100644 index 00000000000..e7c52a9724a --- /dev/null +++ b/queue-2.6.31/usb-cdc_acm-fix-race-condition-when-opening-tty.patch @@ -0,0 +1,33 @@ +From 18a77b5d237a67d2c621a46f5271a3b51da1b380 Mon Sep 17 00:00:00 2001 +From: Henry Gebhardt +Date: Wed, 4 Nov 2009 11:19:28 +0100 +Subject: USB: cdc_acm: Fix race condition when opening tty + +From: Henry Gebhardt + +commit 18a77b5d237a67d2c621a46f5271a3b51da1b380 upstream. + +If acm_rx_tasklet() gets called before tty_port_block_til_ready() +returns, then bulk IN urbs may not be sent. This fixes it. + +Signed-off-by: Henry Gebhardt +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -609,9 +609,9 @@ static int acm_tty_open(struct tty_struc + + acm->throttle = 0; + +- tasklet_schedule(&acm->urb_task); + set_bit(ASYNCB_INITIALIZED, &acm->port.flags); + rv = tty_port_block_til_ready(&acm->port, tty, filp); ++ tasklet_schedule(&acm->urb_task); + done: + mutex_unlock(&acm->mutex); + err_out: diff --git a/queue-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch b/queue-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch new file mode 100644 index 00000000000..57456e68f77 --- /dev/null +++ b/queue-2.6.31/usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch @@ -0,0 +1,149 @@ +From a1f17a872bc7b1cb7efdd5486a2963e88a536e61 Mon Sep 17 00:00:00 2001 +From: Libin Yang +Date: Wed, 4 Nov 2009 14:55:18 +0800 +Subject: USB: ohci: quirk AMD prefetch for USB 1.1 ISO transfer + +From: Libin Yang + +commit a1f17a872bc7b1cb7efdd5486a2963e88a536e61 upstream. + +The following patch in the driver is required to avoid USB 1.1 device +failures that may occur due to requests from USB OHCI controllers may +be overwritten if the latency for any pending request by the USB +controller is very long (in the range of milliseconds). + +Signed-off-by: Libin Yang +Cc: David Brownell +Cc: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ohci-hcd.c | 5 +++++ + drivers/usb/host/ohci-pci.c | 20 ++++++++++++++++++++ + drivers/usb/host/ohci-q.c | 18 ++++++++++++------ + drivers/usb/host/ohci.h | 9 +++++++++ + 4 files changed, 46 insertions(+), 6 deletions(-) + +--- a/drivers/usb/host/ohci.h ++++ b/drivers/usb/host/ohci.h +@@ -402,6 +402,7 @@ struct ohci_hcd { + #define OHCI_QUIRK_FRAME_NO 0x80 /* no big endian frame_no shift */ + #define OHCI_QUIRK_HUB_POWER 0x100 /* distrust firmware power/oc setup */ + #define OHCI_QUIRK_AMD_ISO 0x200 /* ISO transfers*/ ++#define OHCI_QUIRK_AMD_PREFETCH 0x400 /* pre-fetch for ISO transfer */ + // there are also chip quirks/bugs in init logic + + struct work_struct nec_work; /* Worker for NEC quirk */ +@@ -433,6 +434,10 @@ static inline int quirk_amdiso(struct oh + { + return ohci->flags & OHCI_QUIRK_AMD_ISO; + } ++static inline int quirk_amdprefetch(struct ohci_hcd *ohci) ++{ ++ return ohci->flags & OHCI_QUIRK_AMD_PREFETCH; ++} + #else + static inline int quirk_nec(struct ohci_hcd *ohci) + { +@@ -446,6 +451,10 @@ static inline int quirk_amdiso(struct oh + { + return 0; + } ++static inline int quirk_amdprefetch(struct ohci_hcd *ohci) ++{ ++ return 0; ++} + #endif + + /* convert between an hcd pointer and the corresponding ohci_hcd */ +--- a/drivers/usb/host/ohci-hcd.c ++++ b/drivers/usb/host/ohci-hcd.c +@@ -88,6 +88,7 @@ static int ohci_restart (struct ohci_hcd + #ifdef CONFIG_PCI + static void quirk_amd_pll(int state); + static void amd_iso_dev_put(void); ++static void sb800_prefetch(struct ohci_hcd *ohci, int on); + #else + static inline void quirk_amd_pll(int state) + { +@@ -97,6 +98,10 @@ static inline void amd_iso_dev_put(void) + { + return; + } ++static inline void sb800_prefetch(struct ohci_hcd *ohci, int on) ++{ ++ return; ++} + #endif + + +--- a/drivers/usb/host/ohci-pci.c ++++ b/drivers/usb/host/ohci-pci.c +@@ -177,6 +177,13 @@ static int ohci_quirk_amd700(struct usb_ + return 0; + + pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev); ++ ++ /* SB800 needs pre-fetch fix */ ++ if ((rev >= 0x40) && (rev <= 0x4f)) { ++ ohci->flags |= OHCI_QUIRK_AMD_PREFETCH; ++ ohci_dbg(ohci, "enabled AMD prefetch quirk\n"); ++ } ++ + if ((rev > 0x3b) || (rev < 0x30)) { + pci_dev_put(amd_smbus_dev); + amd_smbus_dev = NULL; +@@ -262,6 +269,19 @@ static void amd_iso_dev_put(void) + + } + ++static void sb800_prefetch(struct ohci_hcd *ohci, int on) ++{ ++ struct pci_dev *pdev; ++ u16 misc; ++ ++ pdev = to_pci_dev(ohci_to_hcd(ohci)->self.controller); ++ pci_read_config_word(pdev, 0x50, &misc); ++ if (on == 0) ++ pci_write_config_word(pdev, 0x50, misc & 0xfcff); ++ else ++ pci_write_config_word(pdev, 0x50, misc | 0x0300); ++} ++ + /* List of quirks for OHCI */ + static const struct pci_device_id ohci_pci_quirks[] = { + { +--- a/drivers/usb/host/ohci-q.c ++++ b/drivers/usb/host/ohci-q.c +@@ -49,9 +49,12 @@ __acquires(ohci->lock) + switch (usb_pipetype (urb->pipe)) { + case PIPE_ISOCHRONOUS: + ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs--; +- if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0 +- && quirk_amdiso(ohci)) +- quirk_amd_pll(1); ++ if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) { ++ if (quirk_amdiso(ohci)) ++ quirk_amd_pll(1); ++ if (quirk_amdprefetch(ohci)) ++ sb800_prefetch(ohci, 0); ++ } + break; + case PIPE_INTERRUPT: + ohci_to_hcd(ohci)->self.bandwidth_int_reqs--; +@@ -680,9 +683,12 @@ static void td_submit_urb ( + data + urb->iso_frame_desc [cnt].offset, + urb->iso_frame_desc [cnt].length, urb, cnt); + } +- if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0 +- && quirk_amdiso(ohci)) +- quirk_amd_pll(0); ++ if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) { ++ if (quirk_amdiso(ohci)) ++ quirk_amd_pll(0); ++ if (quirk_amdprefetch(ohci)) ++ sb800_prefetch(ohci, 1); ++ } + periodic = ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs++ == 0 + && ohci_to_hcd(ohci)->self.bandwidth_int_reqs == 0; + break; diff --git a/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch b/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch new file mode 100644 index 00000000000..353cd02cf90 --- /dev/null +++ b/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch @@ -0,0 +1,44 @@ +From ff854ce0b17161a86b5ae444c6cb0aa221720fab Mon Sep 17 00:00:00 2001 +From: Zhang Le +Date: Wed, 4 Nov 2009 23:22:59 +0800 +Subject: USB: option.c: add support for D-Link DWM-162-U5 + +From: Zhang Le + +commit ff854ce0b17161a86b5ae444c6cb0aa221720fab upstream. + +Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device +has 4 interfaces, of which 1 is handled by storage and the other 3 by +option driver. + +The device appears first as CD-only 05c6:2100 device and must be +switched to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch. + +The MessageContent for usb_modeswitch.conf is: +"55534243e0c26a85000000000000061b000000020000000000000000000000" + +Signed-off-by: Zhang Le +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -309,6 +309,7 @@ static int option_resume(struct usb_ser + + #define DLINK_VENDOR_ID 0x1186 + #define DLINK_PRODUCT_DWM_652 0x3e04 ++#define DLINK_PRODUCT_DWM_652_U5 0xce16 + + #define QISDA_VENDOR_ID 0x1da5 + #define QISDA_PRODUCT_H21_4512 0x4512 +@@ -587,6 +588,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, + { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) }, ++ { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */ + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) }, + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) }, + { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) }, diff --git a/queue-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch b/queue-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch new file mode 100644 index 00000000000..8ccd83673a7 --- /dev/null +++ b/queue-2.6.31/usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch @@ -0,0 +1,69 @@ +From fca94748c5136ff390eadc443871b82f1f77dcd6 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 4 Nov 2009 11:35:53 -0500 +Subject: USB: usbmon: fix bug in mon_buff_area_shrink + +From: Alan Stern + +commit fca94748c5136ff390eadc443871b82f1f77dcd6 upstream. + +This patch (as1299b) fixes a bug in an error-handling path of usbmon's +binary interface. The storage area for URB data is divided into +fixed-size blocks. If an URB's data can't be copied, the area +reserved for it should be decreased to the size of the truncated +information (rounded up to a block boundary). Rounding up the amount +to be removed and subtracting it from the reserved size is definitely +the wrong thing to do. + +Also, when the data for an isochronous URB can't be copied, we can +still copy the isoc packet descriptors. In fact the current code does +copy the descriptors, but then sets the capture length to 0 so they +remain inaccessible. The capture length should be reduced to the +length of the descriptors, not set to 0. + +Signed-off-by: Alan Stern +Acked-by: Pete Zaitcev +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/mon/mon_bin.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/usb/mon/mon_bin.c ++++ b/drivers/usb/mon/mon_bin.c +@@ -350,12 +350,12 @@ static unsigned int mon_buff_area_alloc_ + + /* + * Return a few (kilo-)bytes to the head of the buffer. +- * This is used if a DMA fetch fails. ++ * This is used if a data fetch fails. + */ + static void mon_buff_area_shrink(struct mon_reader_bin *rp, unsigned int size) + { + +- size = (size + PKT_ALIGN-1) & ~(PKT_ALIGN-1); ++ /* size &= ~(PKT_ALIGN-1); -- we're called with aligned size */ + rp->b_cnt -= size; + if (rp->b_in < size) + rp->b_in += rp->b_size; +@@ -442,6 +442,7 @@ static void mon_bin_event(struct mon_rea + unsigned int urb_length; + unsigned int offset; + unsigned int length; ++ unsigned int delta; + unsigned int ndesc, lendesc; + unsigned char dir; + struct mon_bin_hdr *ep; +@@ -546,8 +547,10 @@ static void mon_bin_event(struct mon_rea + if (length != 0) { + ep->flag_data = mon_bin_get_data(rp, offset, urb, length); + if (ep->flag_data != 0) { /* Yes, it's 0x00, not '0' */ +- ep->len_cap = 0; +- mon_buff_area_shrink(rp, length); ++ delta = (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1); ++ ep->len_cap -= length; ++ delta -= (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1); ++ mon_buff_area_shrink(rp, delta); + } + } else { + ep->flag_data = data_tag; diff --git a/queue-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch b/queue-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch new file mode 100644 index 00000000000..9854d1ba829 --- /dev/null +++ b/queue-2.6.31/usb-xhci-fix-bug-memory-free-after-failed-initialization.patch @@ -0,0 +1,37 @@ +From d94c05e33d9212ee67b8d4998f984cc71df8168b Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Tue, 3 Nov 2009 22:02:22 -0800 +Subject: USB: xhci: Fix bug memory free after failed initialization. + +From: Sarah Sharp + +commit d94c05e33d9212ee67b8d4998f984cc71df8168b upstream. + +If the xHCI driver fails during the memory initialization, xhci->ir_set +may not be a valid pointer. Check that it points to valid DMA'able memory +before writing to that address during the memory freeing process. + +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -756,9 +756,11 @@ void xhci_mem_cleanup(struct xhci_hcd *x + int i; + + /* Free the Event Ring Segment Table and the actual Event Ring */ +- xhci_writel(xhci, 0, &xhci->ir_set->erst_size); +- xhci_write_64(xhci, 0, &xhci->ir_set->erst_base); +- xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue); ++ if (xhci->ir_set) { ++ xhci_writel(xhci, 0, &xhci->ir_set->erst_size); ++ xhci_write_64(xhci, 0, &xhci->ir_set->erst_base); ++ xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue); ++ } + size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries); + if (xhci->erst.entries) + pci_free_consistent(pdev, size, diff --git a/queue-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch b/queue-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch new file mode 100644 index 00000000000..3e65c08597a --- /dev/null +++ b/queue-2.6.31/usb-xhci-fix-scratchpad-deallocation.patch @@ -0,0 +1,35 @@ +From 5294bea40666db5c5d6c336b8e4e55d69fa576ca Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Wed, 4 Nov 2009 11:22:19 -0800 +Subject: USB: xhci: Fix scratchpad deallocation. + +From: Sarah Sharp + +commit 5294bea40666db5c5d6c336b8e4e55d69fa576ca upstream. + +The scratchpad_free() function uses xhci->page_size to free some memory +with pci_free_consistent(). However, the page_size is set to zero before +the call, causing kernel oopses on driver unload. Call scratchpad_free() +before setting xhci->page_size to zero. + +Signed-off-by: Sarah Sharp +Acked-by: John Youn +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-mem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -797,9 +797,9 @@ void xhci_mem_cleanup(struct xhci_hcd *x + xhci->dcbaa, xhci->dcbaa->dma); + xhci->dcbaa = NULL; + ++ scratchpad_free(xhci); + xhci->page_size = 0; + xhci->page_shift = 0; +- scratchpad_free(xhci); + } + + int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) diff --git a/queue-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch b/queue-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch new file mode 100644 index 00000000000..d39526b670b --- /dev/null +++ b/queue-2.6.31/usb-xhci-fix-trb-physical-to-virtual-address-translation.patch @@ -0,0 +1,63 @@ +From 2fa88daa6f299bfb83672c3b525d786ad03b4735 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp +Date: Tue, 3 Nov 2009 22:02:24 -0800 +Subject: USB: xhci: Fix TRB physical to virtual address translation. + +From: Sarah Sharp + +commit 2fa88daa6f299bfb83672c3b525d786ad03b4735 upstream. + +The trb_in_td() function in the xHCI driver is supposed to translate a +physical transfer buffer request (TRB) into a virtual pointer to the ring +segment that TRB is in. + +Unfortunately, a mistake in this function may cause endless loops as the +driver searches through the linked list of ring segments over and over +again. Fix a couple bugs that may lead to loops or bad output: + +1. Bail out if we get a NULL pointer when translating the segment's +private structure and the starting DMA address of the segment chunk. If +this happens, we've been handed a starting TRB pointer from a different +ring. + +2. Make sure the function works when there's multiple segments in the +ring. In the while loop to search through the ring segments, use the +current segment variable (cur_seg), rather than the starting segment +variable (start_seg) that is passed in. + +3. Stop searching the ring if we've run through all the segments in the +ring. + +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -822,9 +822,11 @@ static struct xhci_segment *trb_in_td( + cur_seg = start_seg; + + do { ++ if (start_dma == 0) ++ return 0; + /* We may get an event for a Link TRB in the middle of a TD */ + end_seg_dma = xhci_trb_virt_to_dma(cur_seg, +- &start_seg->trbs[TRBS_PER_SEGMENT - 1]); ++ &cur_seg->trbs[TRBS_PER_SEGMENT - 1]); + /* If the end TRB isn't in this segment, this is set to 0 */ + end_trb_dma = xhci_trb_virt_to_dma(cur_seg, end_trb); + +@@ -851,8 +853,9 @@ static struct xhci_segment *trb_in_td( + } + cur_seg = cur_seg->next; + start_dma = xhci_trb_virt_to_dma(cur_seg, &cur_seg->trbs[0]); +- } while (1); ++ } while (cur_seg != start_seg); + ++ return 0; + } + + /* diff --git a/queue-2.6.31/v4l-dvb-13240-firedtv-fix-regression-tuning-fails-due-to-bogus-error-return.patch b/queue-2.6.31/v4l-dvb-13240-firedtv-fix-regression-tuning-fails-due-to-bogus-error-return.patch deleted file mode 100644 index 6cc5ac6dea4..00000000000 --- a/queue-2.6.31/v4l-dvb-13240-firedtv-fix-regression-tuning-fails-due-to-bogus-error-return.patch +++ /dev/null @@ -1,43 +0,0 @@ -From dcff9cfe432c74b382cea327509ede2e114b1615 Mon Sep 17 00:00:00 2001 -From: Stefan Richter -Date: Sat, 17 Oct 2009 17:46:25 -0300 -Subject: V4L/DVB (13240): firedtv: fix regression: tuning fails due to bogus error return - -From: Stefan Richter - -commit dcff9cfe432c74b382cea327509ede2e114b1615 upstream. - -Since 2.6.32(-rc1), DVB core checks the return value of -dvb_frontend_ops.set_frontend. Now it becomes apparent that firedtv -always returned a bogus value from its set_frontend method. - -Signed-off-by: Stefan Richter -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/media/dvb/firewire/firedtv-fe.c | 8 +------- - 1 file changed, 1 insertion(+), 7 deletions(-) - ---- a/drivers/media/dvb/firewire/firedtv-fe.c -+++ b/drivers/media/dvb/firewire/firedtv-fe.c -@@ -141,18 +141,12 @@ static int fdtv_read_uncorrected_blocks( - return -EOPNOTSUPP; - } - --#define ACCEPTED 0x9 -- - static int fdtv_set_frontend(struct dvb_frontend *fe, - struct dvb_frontend_parameters *params) - { - struct firedtv *fdtv = fe->sec_priv; - -- /* FIXME: avc_tuner_dsd never returns ACCEPTED. Check status? */ -- if (avc_tuner_dsd(fdtv, params) != ACCEPTED) -- return -EINVAL; -- else -- return 0; /* not sure of this... */ -+ return avc_tuner_dsd(fdtv, params); - } - - static int fdtv_get_frontend(struct dvb_frontend *fe,