From: Greg Kroah-Hartman Date: Tue, 19 Oct 2010 21:06:42 +0000 (-0700) Subject: .35 patches X-Git-Tag: v2.6.27.55~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f723613a96f0227ff64e74bfd1116885d8bb2e2a;p=thirdparty%2Fkernel%2Fstable-queue.git .35 patches --- diff --git a/queue-2.6.35/acpi-invoke-dsdt-corruption-workaround-on-all-toshiba-satellite.patch b/queue-2.6.35/acpi-invoke-dsdt-corruption-workaround-on-all-toshiba-satellite.patch new file mode 100644 index 00000000000..9fbeba54b02 --- /dev/null +++ b/queue-2.6.35/acpi-invoke-dsdt-corruption-workaround-on-all-toshiba-satellite.patch @@ -0,0 +1,50 @@ +From 100cf87788c0e9104f6fb1b0ff5f72f73fbbbea3 Mon Sep 17 00:00:00 2001 +From: Len Brown +Date: Tue, 28 Sep 2010 22:57:02 -0400 +Subject: ACPI: invoke DSDT corruption workaround on all Toshiba Satellite + +From: Len Brown + +commit 100cf87788c0e9104f6fb1b0ff5f72f73fbbbea3 upstream. + +Our list of Toshiba Satellite models that require this workaround +is growing -- so invoke the workaround for the entire product line. + +https://bugzilla.kernel.org/show_bug.cgi?id=14679 + +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/bus.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -80,23 +80,15 @@ static int set_copy_dsdt(const struct dm + + static struct dmi_system_id dsdt_dmi_table[] __initdata = { + /* +- * Insyde BIOS on some TOSHIBA machines corrupt the DSDT. ++ * Invoke DSDT corruption work-around on all Toshiba Satellite. + * https://bugzilla.kernel.org/show_bug.cgi?id=14679 + */ + { + .callback = set_copy_dsdt, +- .ident = "TOSHIBA Satellite A505", ++ .ident = "TOSHIBA Satellite", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), +- DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A505"), +- }, +- }, +- { +- .callback = set_copy_dsdt, +- .ident = "TOSHIBA Satellite L505D", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), +- DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L505D"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Satellite"), + }, + }, + {} diff --git a/queue-2.6.35/ahci-fix-module-refcount-breakage-introduced-by-libahci-split.patch b/queue-2.6.35/ahci-fix-module-refcount-breakage-introduced-by-libahci-split.patch new file mode 100644 index 00000000000..a4585bf408e --- /dev/null +++ b/queue-2.6.35/ahci-fix-module-refcount-breakage-introduced-by-libahci-split.patch @@ -0,0 +1,126 @@ +From fad16e7a7f67eef8d33f8ad58850db89382b09ce Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 21 Sep 2010 09:25:48 +0200 +Subject: ahci: fix module refcount breakage introduced by libahci split + +From: Tejun Heo + +commit fad16e7a7f67eef8d33f8ad58850db89382b09ce upstream. + +libata depends on scsi_host_template for module reference counting and +sht's should be owned by each low level driver. During libahci split, +the sht was left with libahci.ko leaving the actual low level drivers +not reference counted. This made ahci and ahci_platform always +unloadable even while they're being actively used. + +Fix it by defining AHCI_SHT() macro in ahci.h and defining a sht for +each low level ahci driver. + +stable: only applicable to 2.6.35. + +Signed-off-by: Tejun Heo +Reported-by: Pedro Francisco +Tested-by: Michael Tokarev +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 4 ++++ + drivers/ata/ahci.h | 12 +++++++++++- + drivers/ata/ahci_platform.c | 6 +++++- + drivers/ata/libahci.c | 16 ++++------------ + 4 files changed, 24 insertions(+), 14 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -89,6 +89,10 @@ static int ahci_pci_device_suspend(struc + static int ahci_pci_device_resume(struct pci_dev *pdev); + #endif + ++static struct scsi_host_template ahci_sht = { ++ AHCI_SHT("ahci"), ++}; ++ + static struct ata_port_operations ahci_vt8251_ops = { + .inherits = &ahci_ops, + .hardreset = ahci_vt8251_hardreset, +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -297,7 +297,17 @@ struct ahci_host_priv { + + extern int ahci_ignore_sss; + +-extern struct scsi_host_template ahci_sht; ++extern struct device_attribute *ahci_shost_attrs[]; ++extern struct device_attribute *ahci_sdev_attrs[]; ++ ++#define AHCI_SHT(drv_name) \ ++ ATA_NCQ_SHT(drv_name), \ ++ .can_queue = AHCI_MAX_CMDS - 1, \ ++ .sg_tablesize = AHCI_MAX_SG, \ ++ .dma_boundary = AHCI_DMA_BOUNDARY, \ ++ .shost_attrs = ahci_shost_attrs, \ ++ .sdev_attrs = ahci_sdev_attrs ++ + extern struct ata_port_operations ahci_ops; + + void ahci_save_initial_config(struct device *dev, +--- a/drivers/ata/ahci_platform.c ++++ b/drivers/ata/ahci_platform.c +@@ -23,6 +23,10 @@ + #include + #include "ahci.h" + ++static struct scsi_host_template ahci_platform_sht = { ++ AHCI_SHT("ahci_platform"), ++}; ++ + static int __init ahci_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -140,7 +144,7 @@ static int __init ahci_probe(struct plat + ahci_print_info(host, "platform"); + + rc = ata_host_activate(host, irq, ahci_interrupt, IRQF_SHARED, +- &ahci_sht); ++ &ahci_platform_sht); + if (rc) + goto err0; + +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -121,7 +121,7 @@ static DEVICE_ATTR(ahci_port_cmd, S_IRUG + static DEVICE_ATTR(em_buffer, S_IWUSR | S_IRUGO, + ahci_read_em_buffer, ahci_store_em_buffer); + +-static struct device_attribute *ahci_shost_attrs[] = { ++struct device_attribute *ahci_shost_attrs[] = { + &dev_attr_link_power_management_policy, + &dev_attr_em_message_type, + &dev_attr_em_message, +@@ -132,22 +132,14 @@ static struct device_attribute *ahci_sho + &dev_attr_em_buffer, + NULL + }; ++EXPORT_SYMBOL_GPL(ahci_shost_attrs); + +-static struct device_attribute *ahci_sdev_attrs[] = { ++struct device_attribute *ahci_sdev_attrs[] = { + &dev_attr_sw_activity, + &dev_attr_unload_heads, + NULL + }; +- +-struct scsi_host_template ahci_sht = { +- ATA_NCQ_SHT("ahci"), +- .can_queue = AHCI_MAX_CMDS - 1, +- .sg_tablesize = AHCI_MAX_SG, +- .dma_boundary = AHCI_DMA_BOUNDARY, +- .shost_attrs = ahci_shost_attrs, +- .sdev_attrs = ahci_sdev_attrs, +-}; +-EXPORT_SYMBOL_GPL(ahci_sht); ++EXPORT_SYMBOL_GPL(ahci_sdev_attrs); + + struct ata_port_operations ahci_ops = { + .inherits = &sata_pmp_port_ops, diff --git a/queue-2.6.35/alsa-hda-add-dell-latitude-e6400-model-quirk.patch b/queue-2.6.35/alsa-hda-add-dell-latitude-e6400-model-quirk.patch new file mode 100644 index 00000000000..d80c6e607a7 --- /dev/null +++ b/queue-2.6.35/alsa-hda-add-dell-latitude-e6400-model-quirk.patch @@ -0,0 +1,31 @@ +From 0f9f1ee9d1412d45a22bfd69dfd4d4324b506e9e Mon Sep 17 00:00:00 2001 +From: Luke Yelavich +Date: Tue, 21 Sep 2010 17:05:46 +1000 +Subject: ALSA: hda - Add Dell Latitude E6400 model quirk + +From: Luke Yelavich + +commit 0f9f1ee9d1412d45a22bfd69dfd4d4324b506e9e upstream. + +BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/643891 + +Set the Dell Latitude E6400 (1028:0233) SSID to use AD1984_DELL_DESKTOP + +Signed-off-by: Luke Yelavich +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_analog.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_analog.c ++++ b/sound/pci/hda/patch_analog.c +@@ -3641,6 +3641,7 @@ static struct snd_pci_quirk ad1984_cfg_t + /* Lenovo Thinkpad T61/X61 */ + SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo Thinkpad", AD1984_THINKPAD), + SND_PCI_QUIRK(0x1028, 0x0214, "Dell T3400", AD1984_DELL_DESKTOP), ++ SND_PCI_QUIRK(0x1028, 0x0233, "Dell Latitude E6400", AD1984_DELL_DESKTOP), + {} + }; + diff --git a/queue-2.6.35/alsa-oxygen-fix-analog-capture-on-claro-halo-cards.patch b/queue-2.6.35/alsa-oxygen-fix-analog-capture-on-claro-halo-cards.patch new file mode 100644 index 00000000000..744db1c93c7 --- /dev/null +++ b/queue-2.6.35/alsa-oxygen-fix-analog-capture-on-claro-halo-cards.patch @@ -0,0 +1,35 @@ +From 0873a5ae747847ee55a63db409dff3476e45bcd9 Mon Sep 17 00:00:00 2001 +From: Erik J. Staab +Date: Wed, 22 Sep 2010 11:07:41 +0200 +Subject: ALSA: oxygen: fix analog capture on Claro halo cards + +From: Erik J. Staab + +commit 0873a5ae747847ee55a63db409dff3476e45bcd9 upstream. + +On the HT-Omega Claro halo card, the ADC data must be captured from the +second I2S input. Using the default first input, which isn't connected +to anything, would result in silence. + +Signed-off-by: Erik J. Staab +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/oxygen.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/oxygen/oxygen.c ++++ b/sound/pci/oxygen/oxygen.c +@@ -543,6 +543,10 @@ static int __devinit get_oxygen_model(st + chip->model.suspend = claro_suspend; + chip->model.resume = claro_resume; + chip->model.set_adc_params = set_ak5385_params; ++ chip->model.device_config = PLAYBACK_0_TO_I2S | ++ PLAYBACK_1_TO_SPDIF | ++ CAPTURE_0_FROM_I2S_2 | ++ CAPTURE_1_FROM_SPDIF; + break; + } + if (id->driver_data == MODEL_MERIDIAN || diff --git a/queue-2.6.35/alsa-prevent-heap-corruption-in-snd_ctl_new.patch b/queue-2.6.35/alsa-prevent-heap-corruption-in-snd_ctl_new.patch new file mode 100644 index 00000000000..2e307a356e6 --- /dev/null +++ b/queue-2.6.35/alsa-prevent-heap-corruption-in-snd_ctl_new.patch @@ -0,0 +1,48 @@ +From 5591bf07225523600450edd9e6ad258bb877b779 Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg +Date: Tue, 28 Sep 2010 14:18:20 -0400 +Subject: ALSA: prevent heap corruption in snd_ctl_new() + +From: Dan Rosenberg + +commit 5591bf07225523600450edd9e6ad258bb877b779 upstream. + +The snd_ctl_new() function in sound/core/control.c allocates space for a +snd_kcontrol struct by performing arithmetic operations on a +user-provided size without checking for integer overflow. If a user +provides a large enough size, an overflow will occur, the allocated +chunk will be too small, and a second user-influenced value will be +written repeatedly past the bounds of this chunk. This code is +reachable by unprivileged users who have permission to open +a /dev/snd/controlC* device (on many distros, this is group "audio") via +the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls. + +Signed-off-by: Dan Rosenberg +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/control.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -31,6 +31,7 @@ + + /* max number of user-defined controls */ + #define MAX_USER_CONTROLS 32 ++#define MAX_CONTROL_COUNT 1028 + + struct snd_kctl_ioctl { + struct list_head list; /* list of all ioctls */ +@@ -195,6 +196,10 @@ static struct snd_kcontrol *snd_ctl_new( + + if (snd_BUG_ON(!control || !control->count)) + return NULL; ++ ++ if (control->count > MAX_CONTROL_COUNT) ++ return NULL; ++ + kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL); + if (kctl == NULL) { + snd_printk(KERN_ERR "Cannot allocate control instance\n"); diff --git a/queue-2.6.35/alsa-rawmidi-fix-oops-use-after-free-when-unloading-a-driver-module.patch b/queue-2.6.35/alsa-rawmidi-fix-oops-use-after-free-when-unloading-a-driver-module.patch new file mode 100644 index 00000000000..039361ffeef --- /dev/null +++ b/queue-2.6.35/alsa-rawmidi-fix-oops-use-after-free-when-unloading-a-driver-module.patch @@ -0,0 +1,44 @@ +From aa73aec6c385e2c797ac25cc7ccf0318031de7c8 Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Fri, 15 Oct 2010 12:06:18 +0200 +Subject: ALSA: rawmidi: fix oops (use after free) when unloading a driver module + +From: Clemens Ladisch + +commit aa73aec6c385e2c797ac25cc7ccf0318031de7c8 upstream. + +When a driver module is unloaded and the last still open file is a raw +MIDI device, the card and its devices will be actually freed in the +snd_card_file_remove() call when that file is closed. Afterwards, rmidi +and rmidi->card point into freed memory, so the module pointer is likely +to be garbage. +(This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.) + +Signed-off-by: Clemens Ladisch +Reported-by: Krzysztof Foltman +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/rawmidi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct in + { + struct snd_rawmidi_file *rfile; + struct snd_rawmidi *rmidi; ++ struct module *module; + + rfile = file->private_data; + rmidi = rfile->rmidi; + rawmidi_release_priv(rfile); + kfree(rfile); ++ module = rmidi->card->module; + snd_card_file_remove(rmidi->card, file); +- module_put(rmidi->card->module); ++ module_put(module); + return 0; + } + diff --git a/queue-2.6.35/alsa-sound-pci-rme9652-prevent-reading-uninitialized-stack-memory.patch b/queue-2.6.35/alsa-sound-pci-rme9652-prevent-reading-uninitialized-stack-memory.patch new file mode 100644 index 00000000000..66825102089 --- /dev/null +++ b/queue-2.6.35/alsa-sound-pci-rme9652-prevent-reading-uninitialized-stack-memory.patch @@ -0,0 +1,45 @@ +From e68d3b316ab7b02a074edc4f770e6a746390cb7d Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg +Date: Sat, 25 Sep 2010 11:07:27 -0400 +Subject: ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory + +From: Dan Rosenberg + +commit e68d3b316ab7b02a074edc4f770e6a746390cb7d upstream. + +The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and +SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow +unprivileged users to read uninitialized kernel stack memory, because +several fields of the hdsp{m}_config_info structs declared on the stack +are not altered or zeroed before being copied back to the user. This +patch takes care of it. + +Signed-off-by: Dan Rosenberg +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/rme9652/hdsp.c | 1 + + sound/pci/rme9652/hdspm.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/sound/pci/rme9652/hdsp.c ++++ b/sound/pci/rme9652/hdsp.c +@@ -4609,6 +4609,7 @@ static int snd_hdsp_hwdep_ioctl(struct s + if (err < 0) + return err; + ++ memset(&info, 0, sizeof(info)); + spin_lock_irqsave(&hdsp->lock, flags); + info.pref_sync_ref = (unsigned char)hdsp_pref_sync_ref(hdsp); + info.wordclock_sync_check = (unsigned char)hdsp_wc_sync_check(hdsp); +--- a/sound/pci/rme9652/hdspm.c ++++ b/sound/pci/rme9652/hdspm.c +@@ -4127,6 +4127,7 @@ static int snd_hdspm_hwdep_ioctl(struct + + case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO: + ++ memset(&info, 0, sizeof(info)); + spin_lock_irq(&hdspm->lock); + info.pref_sync_ref = hdspm_pref_sync_ref(hdspm); + info.wordclock_sync_check = hdspm_wc_sync_check(hdspm); diff --git a/queue-2.6.35/arm-6395-1-vexpress-set-bit-22-in-the-pl310-cache-controller-auxctlr-register.patch b/queue-2.6.35/arm-6395-1-vexpress-set-bit-22-in-the-pl310-cache-controller-auxctlr-register.patch new file mode 100644 index 00000000000..785264bb0c7 --- /dev/null +++ b/queue-2.6.35/arm-6395-1-vexpress-set-bit-22-in-the-pl310-cache-controller-auxctlr-register.patch @@ -0,0 +1,39 @@ +From 1a8e41cd672f894bbd74874eac601e6cedf838fb Mon Sep 17 00:00:00 2001 +From: Catalin Marinas +Date: Thu, 16 Sep 2010 17:57:17 +0100 +Subject: ARM: 6395/1: VExpress: Set bit 22 in the PL310 (cache controller) AuxCtlr register + +From: Catalin Marinas + +commit 1a8e41cd672f894bbd74874eac601e6cedf838fb upstream. + +Clearing bit 22 in the PL310 Auxiliary Control register (shared +attribute override enable) has the side effect of transforming Normal +Shared Non-cacheable reads into Cacheable no-allocate reads. + +Coherent DMA buffers in Linux always have a Cacheable alias via the +kernel linear mapping and the processor can speculatively load cache +lines into the PL310 controller. With bit 22 cleared, Non-cacheable +reads would unexpectedly hit such cache lines leading to buffer +corruption. + +Cc: Nicolas Pitre +Signed-off-by: Catalin Marinas +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-vexpress/ct-ca9x4.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-vexpress/ct-ca9x4.c ++++ b/arch/arm/mach-vexpress/ct-ca9x4.c +@@ -225,7 +225,7 @@ static void ct_ca9x4_init(void) + int i; + + #ifdef CONFIG_CACHE_L2X0 +- l2x0_init(MMIO_P2V(CT_CA9X4_L2CC), 0x00000000, 0xfe0fffff); ++ l2x0_init(MMIO_P2V(CT_CA9X4_L2CC), 0x00400000, 0xfe0fffff); + #endif + + clkdev_add_table(lookups, ARRAY_SIZE(lookups)); diff --git a/queue-2.6.35/arm-6400-1-at91-fix-arch_gettimeoffset-fallout.patch b/queue-2.6.35/arm-6400-1-at91-fix-arch_gettimeoffset-fallout.patch new file mode 100644 index 00000000000..d58808f7ed1 --- /dev/null +++ b/queue-2.6.35/arm-6400-1-at91-fix-arch_gettimeoffset-fallout.patch @@ -0,0 +1,33 @@ +From 79e27dc0677b969e2d53b76fa0fa58467cce946a Mon Sep 17 00:00:00 2001 +From: Peter Korsgaard +Date: Sat, 18 Sep 2010 19:55:10 +0100 +Subject: ARM: 6400/1: at91: fix arch_gettimeoffset fallout + +From: Peter Korsgaard + +commit 79e27dc0677b969e2d53b76fa0fa58467cce946a upstream. + +5cfc8ee0bb51 (ARM: convert arm to arch_gettimeoffset()) marked all of +at91 AND at91x40 as needing ARCH_USES_GETTIMEOFFSET, and hence no high +res timer support / accurate clock_gettime() - But only at91x40 needs it. + +Signed-off-by: Peter Korsgaard +Acked-by: John Stultz +Acked-by: Jean-Christophe PLAGNIOL-VILLARD +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -273,7 +273,6 @@ config ARCH_AT91 + bool "Atmel AT91" + select ARCH_REQUIRE_GPIOLIB + select HAVE_CLK +- select ARCH_USES_GETTIMEOFFSET + help + This enables support for systems based on the Atmel AT91RM9200, + AT91SAM9 and AT91CAP9 processors. diff --git a/queue-2.6.35/drm-radeon-kms-avivo-cursor-workaround-applies-to-evergreen-as-well.patch b/queue-2.6.35/drm-radeon-kms-avivo-cursor-workaround-applies-to-evergreen-as-well.patch new file mode 100644 index 00000000000..ab1d246b42d --- /dev/null +++ b/queue-2.6.35/drm-radeon-kms-avivo-cursor-workaround-applies-to-evergreen-as-well.patch @@ -0,0 +1,71 @@ +From 6a2a11dbea5db417d200d38dda53c30a2e5603e0 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 14 Oct 2010 17:14:57 -0400 +Subject: drm/radeon/kms: avivo cursor workaround applies to evergreen as well + +From: Alex Deucher + +commit 6a2a11dbea5db417d200d38dda53c30a2e5603e0 upstream. + +Fixes cursor corruption in certain cases. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_cursor.c | 28 ++++++++++++---------------- + 1 file changed, 12 insertions(+), 16 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_cursor.c ++++ b/drivers/gpu/drm/radeon/radeon_cursor.c +@@ -203,6 +203,7 @@ int radeon_crtc_cursor_move(struct drm_c + struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); + struct radeon_device *rdev = crtc->dev->dev_private; + int xorigin = 0, yorigin = 0; ++ int w = radeon_crtc->cursor_width; + + if (x < 0) + xorigin = -x + 1; +@@ -213,22 +214,7 @@ int radeon_crtc_cursor_move(struct drm_c + if (yorigin >= CURSOR_HEIGHT) + yorigin = CURSOR_HEIGHT - 1; + +- radeon_lock_cursor(crtc, true); +- if (ASIC_IS_DCE4(rdev)) { +- /* cursors are offset into the total surface */ +- x += crtc->x; +- y += crtc->y; +- DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y); +- +- /* XXX: check if evergreen has the same issues as avivo chips */ +- WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, +- ((xorigin ? 0 : x) << 16) | +- (yorigin ? 0 : y)); +- WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin); +- WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset, +- ((radeon_crtc->cursor_width - 1) << 16) | (radeon_crtc->cursor_height - 1)); +- } else if (ASIC_IS_AVIVO(rdev)) { +- int w = radeon_crtc->cursor_width; ++ if (ASIC_IS_AVIVO(rdev)) { + int i = 0; + struct drm_crtc *crtc_p; + +@@ -260,7 +246,17 @@ int radeon_crtc_cursor_move(struct drm_c + if (w <= 0) + w = 1; + } ++ } + ++ radeon_lock_cursor(crtc, true); ++ if (ASIC_IS_DCE4(rdev)) { ++ WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, ++ ((xorigin ? 0 : x) << 16) | ++ (yorigin ? 0 : y)); ++ WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin); ++ WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset, ++ ((w - 1) << 16) | (radeon_crtc->cursor_height - 1)); ++ } else if (ASIC_IS_AVIVO(rdev)) { + WREG32(AVIVO_D1CUR_POSITION + radeon_crtc->crtc_offset, + ((xorigin ? 0 : x) << 16) | + (yorigin ? 0 : y)); diff --git a/queue-2.6.35/drm-radeon-kms-fix-bad-cast-shift-in-evergreen.c.patch b/queue-2.6.35/drm-radeon-kms-fix-bad-cast-shift-in-evergreen.c.patch new file mode 100644 index 00000000000..8174f18b737 --- /dev/null +++ b/queue-2.6.35/drm-radeon-kms-fix-bad-cast-shift-in-evergreen.c.patch @@ -0,0 +1,35 @@ +From d31dba58480c3cdd458f449261d72ecd15287792 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 11 Oct 2010 12:41:32 -0400 +Subject: drm/radeon/kms: fix bad cast/shift in evergreen.c + +From: Alex Deucher + +commit d31dba58480c3cdd458f449261d72ecd15287792 upstream. + +Missing parens. + +fixes: +https://bugs.freedesktop.org/show_bug.cgi?id=30718 + +Reported-by: Dave Gilbert +Signed-off-by: Alex Deucher +Reviewed-by: Matt Turner +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/evergreen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -1120,7 +1120,7 @@ static void evergreen_gpu_init(struct ra + + WREG32(RCU_IND_INDEX, 0x203); + efuse_straps_3 = RREG32(RCU_IND_DATA); +- efuse_box_bit_127_124 = (u8)(efuse_straps_3 & 0xF0000000) >> 28; ++ efuse_box_bit_127_124 = (u8)((efuse_straps_3 & 0xF0000000) >> 28); + + switch(efuse_box_bit_127_124) { + case 0x0: diff --git a/queue-2.6.35/hid-hidraw-fix-a-null-pointer-dereference-in-hidraw_ioctl.patch b/queue-2.6.35/hid-hidraw-fix-a-null-pointer-dereference-in-hidraw_ioctl.patch new file mode 100644 index 00000000000..44a401529f2 --- /dev/null +++ b/queue-2.6.35/hid-hidraw-fix-a-null-pointer-dereference-in-hidraw_ioctl.patch @@ -0,0 +1,46 @@ +From d20d5ffab92f00188f360c44c791a5ffb988247c Mon Sep 17 00:00:00 2001 +From: Antonio Ospite +Date: Tue, 5 Oct 2010 17:20:16 +0200 +Subject: HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl + +From: Antonio Ospite + +commit d20d5ffab92f00188f360c44c791a5ffb988247c upstream. + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 +IP: [] hidraw_ioctl+0xfc/0x32c [hid] +[...] + +This is reproducible by disconnecting the device while userspace does +ioctl in a loop and doesn't check return values in order to exit the +loop. + +Signed-off-by: Antonio Ospite +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hidraw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -246,6 +246,10 @@ static long hidraw_ioctl(struct file *fi + + mutex_lock(&minors_lock); + dev = hidraw_table[minor]; ++ if (!dev) { ++ ret = -ENODEV; ++ goto out; ++ } + + switch (cmd) { + case HIDIOCGRDESCSIZE: +@@ -319,6 +323,7 @@ static long hidraw_ioctl(struct file *fi + + ret = -ENOTTY; + } ++out: + mutex_unlock(&minors_lock); + return ret; + } diff --git a/queue-2.6.35/hid-hidraw-fix-a-null-pointer-dereference-in-hidraw_write.patch b/queue-2.6.35/hid-hidraw-fix-a-null-pointer-dereference-in-hidraw_write.patch new file mode 100644 index 00000000000..ffdd8a7eac7 --- /dev/null +++ b/queue-2.6.35/hid-hidraw-fix-a-null-pointer-dereference-in-hidraw_write.patch @@ -0,0 +1,40 @@ +From e42dee9a99a3ecd32b5c027e8f7411fb5bc11eb6 Mon Sep 17 00:00:00 2001 +From: Antonio Ospite +Date: Tue, 5 Oct 2010 17:20:17 +0200 +Subject: HID: hidraw, fix a NULL pointer dereference in hidraw_write + +From: Antonio Ospite + +commit e42dee9a99a3ecd32b5c027e8f7411fb5bc11eb6 upstream. + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 +IP: [] hidraw_write+0x3b/0x116 [hid] +[...] + +This is reproducible by disconnecting the device while userspace writes +to dev node in a loop and doesn't check return values in order to exit +the loop. + +Signed-off-by: Antonio Ospite +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hidraw.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -111,6 +111,12 @@ static ssize_t hidraw_write(struct file + int ret = 0; + + mutex_lock(&minors_lock); ++ ++ if (!hidraw_table[minor]) { ++ ret = -ENODEV; ++ goto out; ++ } ++ + dev = hidraw_table[minor]->hid; + + if (!dev->hid_output_raw_report) { diff --git a/queue-2.6.35/hwmon-lis3-fix-oops-with-null-platform-data.patch b/queue-2.6.35/hwmon-lis3-fix-oops-with-null-platform-data.patch new file mode 100644 index 00000000000..4eb5600308e --- /dev/null +++ b/queue-2.6.35/hwmon-lis3-fix-oops-with-null-platform-data.patch @@ -0,0 +1,41 @@ +From f7c77a3dc4683659b6f0d1b6cbc82b6253d095e0 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 23 Sep 2010 10:01:11 -0700 +Subject: hwmon: (lis3) Fix Oops with NULL platform data + +From: Takashi Iwai + +commit f7c77a3dc4683659b6f0d1b6cbc82b6253d095e0 upstream. + +The recent addition of threaded irq handler causes a NULL dereference +when used with hp_accel driver, which has NULL pdata. + +Acked-by: Samu Onkalo +Signed-off-by: Takashi Iwai +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lis3lv02d.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/lis3lv02d.c ++++ b/drivers/hwmon/lis3lv02d.c +@@ -277,7 +277,7 @@ static irqreturn_t lis302dl_interrupt(in + wake_up_interruptible(&lis3_dev.misc_wait); + kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN); + out: +- if (lis3_dev.whoami == WAI_8B && lis3_dev.idev && ++ if (lis3_dev.pdata && lis3_dev.whoami == WAI_8B && lis3_dev.idev && + lis3_dev.idev->input->users) + return IRQ_WAKE_THREAD; + return IRQ_HANDLED; +@@ -718,7 +718,7 @@ int lis3lv02d_init_device(struct lis3lv0 + * io-apic is not configurable (and generates a warning) but I keep it + * in case of support for other hardware. + */ +- if (dev->whoami == WAI_8B) ++ if (dev->pdata && dev->whoami == WAI_8B) + thread_fn = lis302dl_interrupt_thread1_8b; + else + thread_fn = NULL; diff --git a/queue-2.6.35/lib-list_sort-do-not-pass-bad-pointers-to-cmp-callback.patch b/queue-2.6.35/lib-list_sort-do-not-pass-bad-pointers-to-cmp-callback.patch new file mode 100644 index 00000000000..ac29d9ddb38 --- /dev/null +++ b/queue-2.6.35/lib-list_sort-do-not-pass-bad-pointers-to-cmp-callback.patch @@ -0,0 +1,38 @@ +From f015ac3edd84ad72f88e08a4d83c56c360aae404 Mon Sep 17 00:00:00 2001 +From: Don Mullis +Date: Thu, 30 Sep 2010 15:15:32 -0700 +Subject: lib/list_sort: do not pass bad pointers to cmp callback + +From: Don Mullis + +commit f015ac3edd84ad72f88e08a4d83c56c360aae404 upstream. + +If the original list is a POT in length, the first callback from line 73 +will pass a==b both pointing to the original list_head. This is dangerous +because the 'list_sort()' user can use 'container_of()' and accesses the +"containing" object, which does not necessary exist for the list head. So +the user can access RAM which does not belong to him. If this is a write +access, we can end up with memory corruption. + +Signed-off-by: Don Mullis +Tested-by: Artem Bityutskiy +Signed-off-by: Artem Bityutskiy +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/list_sort.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/list_sort.c ++++ b/lib/list_sort.c +@@ -70,7 +70,7 @@ static void merge_and_restore_back_links + * element comparison is needed, so the client's cmp() + * routine can invoke cond_resched() periodically. + */ +- (*cmp)(priv, tail, tail); ++ (*cmp)(priv, tail->next, tail->next); + + tail->next->prev = tail; + tail = tail->next; diff --git a/queue-2.6.35/modules-fix-module_bug_list-list-corruption-race.patch b/queue-2.6.35/modules-fix-module_bug_list-list-corruption-race.patch new file mode 100644 index 00000000000..5b647016428 --- /dev/null +++ b/queue-2.6.35/modules-fix-module_bug_list-list-corruption-race.patch @@ -0,0 +1,251 @@ +From 5336377d6225959624146629ce3fc88ee8ecda3d Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Tue, 5 Oct 2010 11:29:27 -0700 +Subject: modules: Fix module_bug_list list corruption race + +From: Linus Torvalds + +commit 5336377d6225959624146629ce3fc88ee8ecda3d upstream. + +With all the recent module loading cleanups, we've minimized the code +that sits under module_mutex, fixing various deadlocks and making it +possible to do most of the module loading in parallel. + +However, that whole conversion totally missed the rather obscure code +that adds a new module to the list for BUG() handling. That code was +doubly obscure because (a) the code itself lives in lib/bugs.c (for +dubious reasons) and (b) it gets called from the architecture-specific +"module_finalize()" rather than from generic code. + +Calling it from arch-specific code makes no sense what-so-ever to begin +with, and is now actively wrong since that code isn't protected by the +module loading lock any more. + +So this commit moves the "module_bug_{finalize,cleanup}()" calls away +from the arch-specific code, and into the generic code - and in the +process protects it with the module_mutex so that the list operations +are now safe. + +Future fixups: + - move the module list handling code into kernel/module.c where it + belongs. + - get rid of 'module_bug_list' and just use the regular list of modules + (called 'modules' - imagine that) that we already create and maintain + for other reasons. + +Reported-and-tested-by: Thomas Gleixner +Cc: Rusty Russell +Cc: Adrian Bunk +Cc: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/avr32/kernel/module.c | 3 +-- + arch/h8300/kernel/module.c | 3 +-- + arch/mn10300/kernel/module.c | 3 +-- + arch/parisc/kernel/module.c | 3 +-- + arch/powerpc/kernel/module.c | 5 ----- + arch/s390/kernel/module.c | 3 +-- + arch/sh/kernel/module.c | 2 -- + arch/x86/kernel/module.c | 3 +-- + include/linux/module.h | 5 ++--- + kernel/module.c | 4 ++++ + lib/bug.c | 6 ++---- + 11 files changed, 14 insertions(+), 26 deletions(-) + +--- a/arch/avr32/kernel/module.c ++++ b/arch/avr32/kernel/module.c +@@ -314,10 +314,9 @@ int module_finalize(const Elf_Ehdr *hdr, + vfree(module->arch.syminfo); + module->arch.syminfo = NULL; + +- return module_bug_finalize(hdr, sechdrs, module); ++ return 0; + } + + void module_arch_cleanup(struct module *module) + { +- module_bug_cleanup(module); + } +--- a/arch/h8300/kernel/module.c ++++ b/arch/h8300/kernel/module.c +@@ -112,10 +112,9 @@ int module_finalize(const Elf_Ehdr *hdr, + const Elf_Shdr *sechdrs, + struct module *me) + { +- return module_bug_finalize(hdr, sechdrs, me); ++ return 0; + } + + void module_arch_cleanup(struct module *mod) + { +- module_bug_cleanup(mod); + } +--- a/arch/mn10300/kernel/module.c ++++ b/arch/mn10300/kernel/module.c +@@ -206,7 +206,7 @@ int module_finalize(const Elf_Ehdr *hdr, + const Elf_Shdr *sechdrs, + struct module *me) + { +- return module_bug_finalize(hdr, sechdrs, me); ++ return 0; + } + + /* +@@ -214,5 +214,4 @@ int module_finalize(const Elf_Ehdr *hdr, + */ + void module_arch_cleanup(struct module *mod) + { +- module_bug_cleanup(mod); + } +--- a/arch/parisc/kernel/module.c ++++ b/arch/parisc/kernel/module.c +@@ -941,11 +941,10 @@ int module_finalize(const Elf_Ehdr *hdr, + nsyms = newptr - (Elf_Sym *)symhdr->sh_addr; + DEBUGP("NEW num_symtab %lu\n", nsyms); + symhdr->sh_size = nsyms * sizeof(Elf_Sym); +- return module_bug_finalize(hdr, sechdrs, me); ++ return 0; + } + + void module_arch_cleanup(struct module *mod) + { + deregister_unwind_table(mod); +- module_bug_cleanup(mod); + } +--- a/arch/powerpc/kernel/module.c ++++ b/arch/powerpc/kernel/module.c +@@ -65,10 +65,6 @@ int module_finalize(const Elf_Ehdr *hdr, + const Elf_Shdr *sect; + int err; + +- err = module_bug_finalize(hdr, sechdrs, me); +- if (err) +- return err; +- + /* Apply feature fixups */ + sect = find_section(hdr, sechdrs, "__ftr_fixup"); + if (sect != NULL) +@@ -101,5 +97,4 @@ int module_finalize(const Elf_Ehdr *hdr, + + void module_arch_cleanup(struct module *mod) + { +- module_bug_cleanup(mod); + } +--- a/arch/s390/kernel/module.c ++++ b/arch/s390/kernel/module.c +@@ -407,10 +407,9 @@ int module_finalize(const Elf_Ehdr *hdr, + { + vfree(me->arch.syminfo); + me->arch.syminfo = NULL; +- return module_bug_finalize(hdr, sechdrs, me); ++ return 0; + } + + void module_arch_cleanup(struct module *mod) + { +- module_bug_cleanup(mod); + } +--- a/arch/sh/kernel/module.c ++++ b/arch/sh/kernel/module.c +@@ -149,13 +149,11 @@ int module_finalize(const Elf_Ehdr *hdr, + int ret = 0; + + ret |= module_dwarf_finalize(hdr, sechdrs, me); +- ret |= module_bug_finalize(hdr, sechdrs, me); + + return ret; + } + + void module_arch_cleanup(struct module *mod) + { +- module_bug_cleanup(mod); + module_dwarf_cleanup(mod); + } +--- a/arch/x86/kernel/module.c ++++ b/arch/x86/kernel/module.c +@@ -239,11 +239,10 @@ int module_finalize(const Elf_Ehdr *hdr, + apply_paravirt(pseg, pseg + para->sh_size); + } + +- return module_bug_finalize(hdr, sechdrs, me); ++ return 0; + } + + void module_arch_cleanup(struct module *mod) + { + alternatives_smp_module_del(mod); +- module_bug_cleanup(mod); + } +--- a/include/linux/module.h ++++ b/include/linux/module.h +@@ -686,17 +686,16 @@ extern int module_sysfs_initialized; + + + #ifdef CONFIG_GENERIC_BUG +-int module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *, ++void module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *, + struct module *); + void module_bug_cleanup(struct module *); + + #else /* !CONFIG_GENERIC_BUG */ + +-static inline int module_bug_finalize(const Elf_Ehdr *hdr, ++static inline void module_bug_finalize(const Elf_Ehdr *hdr, + const Elf_Shdr *sechdrs, + struct module *mod) + { +- return 0; + } + static inline void module_bug_cleanup(struct module *mod) {} + #endif /* CONFIG_GENERIC_BUG */ +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1533,6 +1533,7 @@ static int __unlink_module(void *_mod) + { + struct module *mod = _mod; + list_del(&mod->list); ++ module_bug_cleanup(mod); + return 0; + } + +@@ -2538,6 +2539,7 @@ static noinline struct module *load_modu + if (err < 0) + goto ddebug; + ++ module_bug_finalize(info.hdr, info.sechdrs, mod); + list_add_rcu(&mod->list, &modules); + mutex_unlock(&module_mutex); + +@@ -2564,6 +2566,8 @@ static noinline struct module *load_modu + mutex_lock(&module_mutex); + /* Unlink carefully: kallsyms could be walking list. */ + list_del_rcu(&mod->list); ++ module_bug_cleanup(mod); ++ + ddebug: + dynamic_debug_remove(debug); + unlock: +--- a/lib/bug.c ++++ b/lib/bug.c +@@ -72,8 +72,8 @@ static const struct bug_entry *module_fi + return NULL; + } + +-int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs, +- struct module *mod) ++void module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs, ++ struct module *mod) + { + char *secstrings; + unsigned int i; +@@ -97,8 +97,6 @@ int module_bug_finalize(const Elf_Ehdr * + * could potentially lead to deadlock and thus be counter-productive. + */ + list_add(&mod->bug_list, &module_bug_list); +- +- return 0; + } + + void module_bug_cleanup(struct module *mod) diff --git a/queue-2.6.35/oprofile-add-support-for-intel-cpu-family-6-model-29.patch b/queue-2.6.35/oprofile-add-support-for-intel-cpu-family-6-model-29.patch new file mode 100644 index 00000000000..460db13488a --- /dev/null +++ b/queue-2.6.35/oprofile-add-support-for-intel-cpu-family-6-model-29.patch @@ -0,0 +1,39 @@ +From bb7ab785ad05a97a2c9ffb3a06547ed39f3133e8 Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Tue, 21 Sep 2010 03:26:35 -0400 +Subject: oprofile: Add Support for Intel CPU Family 6 / Model 29 + +From: Jiri Olsa + +commit bb7ab785ad05a97a2c9ffb3a06547ed39f3133e8 upstream. + +This patch adds CPU type detection for dunnington processor (Family 6 +/ Model 29) to be identified as core 2 family cpu type (wikipedia +source). + +I tested oprofile on Intel(R) Xeon(R) CPU E7440 reporting itself as +model 29, and it runs without an issue. + +Spec: + + http://www.intel.com/Assets/en_US/PDF/specupdate/320336.pdf + +Signed-off-by: Jiri Olsa +Acked-by: Andi Kleen +Signed-off-by: Robert Richter +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/oprofile/nmi_int.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/oprofile/nmi_int.c ++++ b/arch/x86/oprofile/nmi_int.c +@@ -674,6 +674,7 @@ static int __init ppro_init(char **cpu_t + case 0x0f: + case 0x16: + case 0x17: ++ case 0x1d: + *cpu_type = "i386/core_2"; + break; + case 0x1a: diff --git a/queue-2.6.35/oprofile-arm-release-resources-on-failure.patch b/queue-2.6.35/oprofile-arm-release-resources-on-failure.patch new file mode 100644 index 00000000000..1872c9a34f9 --- /dev/null +++ b/queue-2.6.35/oprofile-arm-release-resources-on-failure.patch @@ -0,0 +1,61 @@ +From 98d943b02f6f1b57787ff1aa6f34d019a407e3ee Mon Sep 17 00:00:00 2001 +From: Robert Richter +Date: Wed, 29 Sep 2010 16:52:25 +0200 +Subject: oprofile, ARM: Release resources on failure + +From: Robert Richter + +commit 98d943b02f6f1b57787ff1aa6f34d019a407e3ee upstream. + +This patch fixes a resource leak on failure, where the +oprofilefs and some counters may not released properly. + +Signed-off-by: Robert Richter +Acked-by: Will Deacon +Cc: linux-arm-kernel@lists.infradead.org +LKML-Reference: <20100929145225.GJ13563@erda.amd.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/oprofile/common.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/arm/oprofile/common.c ++++ b/arch/arm/oprofile/common.c +@@ -102,6 +102,7 @@ static int op_create_counter(int cpu, in + if (IS_ERR(pevent)) { + ret = PTR_ERR(pevent); + } else if (pevent->state != PERF_EVENT_STATE_ACTIVE) { ++ perf_event_release_kernel(pevent); + pr_warning("oprofile: failed to enable event %d " + "on CPU %d\n", event, cpu); + ret = -EBUSY; +@@ -365,6 +366,7 @@ int __init oprofile_arch_init(struct opr + ret = init_driverfs(); + if (ret) { + kfree(counter_config); ++ counter_config = NULL; + return ret; + } + +@@ -402,7 +404,6 @@ void oprofile_arch_exit(void) + struct perf_event *event; + + if (*perf_events) { +- exit_driverfs(); + for_each_possible_cpu(cpu) { + for (id = 0; id < perf_num_counters; ++id) { + event = perf_events[cpu][id]; +@@ -413,8 +414,10 @@ void oprofile_arch_exit(void) + } + } + +- if (counter_config) ++ if (counter_config) { + kfree(counter_config); ++ exit_driverfs(); ++ } + } + #else + int __init oprofile_arch_init(struct oprofile_operations *ops) diff --git a/queue-2.6.35/rdma-cxgb3-turn-off-rx-coalescing-for-iwarp-connections.patch b/queue-2.6.35/rdma-cxgb3-turn-off-rx-coalescing-for-iwarp-connections.patch new file mode 100644 index 00000000000..0c2ab641a79 --- /dev/null +++ b/queue-2.6.35/rdma-cxgb3-turn-off-rx-coalescing-for-iwarp-connections.patch @@ -0,0 +1,47 @@ +From bec658ff31453a5726b1c188674d587a5d40c482 Mon Sep 17 00:00:00 2001 +From: Steve Wise +Date: Sat, 18 Sep 2010 19:38:21 -0500 +Subject: RDMA/cxgb3: Turn off RX coalescing for iWARP connections + +From: Steve Wise + +commit bec658ff31453a5726b1c188674d587a5d40c482 upstream. + +The HW by default has RX coalescing on. For iWARP connections, this +causes a 100ms delay in connection establishement due to the ingress +MPA Start message being stalled in HW. So explicitly turn RX +coalescing off when setting up iWARP connections. + +This was causing very bad performance for NP64 gather operations using +Open MPI, due to the way it sets up connections on larger jobs. + +Signed-off-by: Steve Wise +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/cxgb3/iwch_cm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c ++++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c +@@ -463,7 +463,8 @@ static int send_connect(struct iwch_ep * + V_MSS_IDX(mtu_idx) | + V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx); + opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10); +- opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor); ++ opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) | ++ V_CONG_CONTROL_FLAVOR(cong_flavor); + skb->priority = CPL_PRIORITY_SETUP; + set_arp_failure_handler(skb, act_open_req_arp_failure); + +@@ -1280,7 +1281,8 @@ static void accept_cr(struct iwch_ep *ep + V_MSS_IDX(mtu_idx) | + V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx); + opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10); +- opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor); ++ opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) | ++ V_CONG_CONTROL_FLAVOR(cong_flavor); + + rpl = cplhdr(skb); + rpl->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD)); diff --git a/queue-2.6.35/usb-fix-bug-in-initialization-of-interface-minor-numbers.patch b/queue-2.6.35/usb-fix-bug-in-initialization-of-interface-minor-numbers.patch new file mode 100644 index 00000000000..ff60a84dac3 --- /dev/null +++ b/queue-2.6.35/usb-fix-bug-in-initialization-of-interface-minor-numbers.patch @@ -0,0 +1,118 @@ +From 0026e00523a85b90a92a93ddf6660939ecef3e54 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 21 Sep 2010 15:01:53 -0400 +Subject: USB: fix bug in initialization of interface minor numbers + +From: Alan Stern + +commit 0026e00523a85b90a92a93ddf6660939ecef3e54 upstream. + +Recent changes in the usbhid layer exposed a bug in usbcore. If +CONFIG_USB_DYNAMIC_MINORS is enabled then an interface may be assigned +a minor number of 0. However interfaces that aren't registered as USB +class devices also have their minor number set to 0, during +initialization. As a result usb_find_interface() may return the +wrong interface, leading to a crash. + +This patch (as1418) fixes the problem by initializing every +interface's minor number to -1. It also cleans up the +usb_register_dev() function, which besides being somewhat awkwardly +written, does not unwind completely on all its error paths. + +Signed-off-by: Alan Stern +Tested-by: Philip J. Turmel +Tested-by: Gabriel Craciunescu +Tested-by: Alex Riesen +Tested-by: Matthias Bayer +CC: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/file.c | 35 ++++++++++++++++------------------- + drivers/usb/core/message.c | 1 + + 2 files changed, 17 insertions(+), 19 deletions(-) + +--- a/drivers/usb/core/file.c ++++ b/drivers/usb/core/file.c +@@ -159,9 +159,9 @@ void usb_major_cleanup(void) + int usb_register_dev(struct usb_interface *intf, + struct usb_class_driver *class_driver) + { +- int retval = -EINVAL; ++ int retval; + int minor_base = class_driver->minor_base; +- int minor = 0; ++ int minor; + char name[20]; + char *temp; + +@@ -173,12 +173,17 @@ int usb_register_dev(struct usb_interfac + */ + minor_base = 0; + #endif +- intf->minor = -1; +- +- dbg ("looking for a minor, starting at %d", minor_base); + + if (class_driver->fops == NULL) +- goto exit; ++ return -EINVAL; ++ if (intf->minor >= 0) ++ return -EADDRINUSE; ++ ++ retval = init_usb_class(); ++ if (retval) ++ return retval; ++ ++ dev_dbg(&intf->dev, "looking for a minor, starting at %d", minor_base); + + down_write(&minor_rwsem); + for (minor = minor_base; minor < MAX_USB_MINORS; ++minor) { +@@ -186,20 +191,12 @@ int usb_register_dev(struct usb_interfac + continue; + + usb_minors[minor] = class_driver->fops; +- +- retval = 0; ++ intf->minor = minor; + break; + } + up_write(&minor_rwsem); +- +- if (retval) +- goto exit; +- +- retval = init_usb_class(); +- if (retval) +- goto exit; +- +- intf->minor = minor; ++ if (intf->minor < 0) ++ return -EXFULL; + + /* create a usb class device for this usb interface */ + snprintf(name, sizeof(name), class_driver->name, minor - minor_base); +@@ -213,11 +210,11 @@ int usb_register_dev(struct usb_interfac + "%s", temp); + if (IS_ERR(intf->usb_dev)) { + down_write(&minor_rwsem); +- usb_minors[intf->minor] = NULL; ++ usb_minors[minor] = NULL; ++ intf->minor = -1; + up_write(&minor_rwsem); + retval = PTR_ERR(intf->usb_dev); + } +-exit: + return retval; + } + EXPORT_SYMBOL_GPL(usb_register_dev); +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1802,6 +1802,7 @@ free_interfaces: + intf->dev.groups = usb_interface_groups; + intf->dev.dma_mask = dev->dev.dma_mask; + INIT_WORK(&intf->reset_ws, __usb_queue_reset_device); ++ intf->minor = -1; + device_initialize(&intf->dev); + dev_set_name(&intf->dev, "%d-%s:%d.%d", + dev->bus->busnum, dev->devpath, diff --git a/queue-2.6.35/usb-musb-gadget-fix-kernel-panic-if-using-out-ep-with-fifo_txrx-style.patch b/queue-2.6.35/usb-musb-gadget-fix-kernel-panic-if-using-out-ep-with-fifo_txrx-style.patch new file mode 100644 index 00000000000..9461a90ef3e --- /dev/null +++ b/queue-2.6.35/usb-musb-gadget-fix-kernel-panic-if-using-out-ep-with-fifo_txrx-style.patch @@ -0,0 +1,146 @@ +From bd2e74d657fc7d514881cc2117e323790b257914 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Mon, 20 Sep 2010 10:32:01 +0300 +Subject: usb: musb: gadget: fix kernel panic if using out ep with FIFO_TXRX style + +From: Ming Lei + +commit bd2e74d657fc7d514881cc2117e323790b257914 upstream. + +For shared fifo hw endpoint(with FIFO_TXRX style), only ep_in +field of musb_hw_ep is intialized in musb_g_init_endpoints, and +ep_out is not initialized, but musb_g_rx and rxstate may access +ep_out field of musb_hw_ep by the method below: + + musb_ep = &musb->endpoints[epnum].ep_out + +which can cause the kernel panic[1] below, this patch fixes the issue +by getting 'musb_ep' from '&musb->endpoints[epnum].ep_in' for shared fifo +endpoint. + +[1], kernel panic +[root@OMAP3EVM /]# musb_interrupt 1583: ** IRQ peripheral usb0008 tx0000 rx4000 +musb_stage0_irq 460: <== Power=f0, DevCtl=99, int_usb=0x8 +musb_g_rx 772: <== (null), rxcsr 4007 ffffffe8 +musb_g_rx 786: iso overrun on ffffffe8 +Unable to handle kernel NULL pointer dereference at virtual address 00000008 +pgd = c0004000 +[00000008] *pgd=00000000 +Internal error: Oops: 17 [#1] PREEMPT +last sysfs file: /sys/devices/platform/musb_hdrc/usb1/usb_device/usbdev1.1/dev +Modules linked in: g_zero +CPU: 0 Tainted: G W (2.6.35-rc6-gkh-wl+ #92) +PC is at musb_g_rx+0xfc/0x2ec +LR is at vprintk+0x3f4/0x458 +pc : [] lr : [] psr: 20000193 +sp : c760bd78 ip : c03c9d70 fp : c760bdbc +r10: 00000000 r9 : fa0ab1e0 r8 : 0000000e +r7 : c7e80158 r6 : ffffffe8 r5 : 00000001 r4 : 00004003 +r3 : 00010003 r2 : c760bcd8 r1 : c03cd030 r0 : 0000002e +Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel +Control: 10c5387d Table: 8778c019 DAC: 00000017 +Process kmemleak (pid: 421, stack limit = 0xc760a2e8) +Stack: (0xc760bd78 to 0xc760c000) +bd60: ffffffe8 c04b1b58 +bd80: ffffffe8 c7c01ac0 00000000 c7e80d24 c0084238 00000001 00000001 c7e80158 +bda0: 0000000e 00000008 00000099 000000f0 c760be04 c760bdc0 c02bcd68 c02c06b4 +bdc0: 00000099 00000008 00004000 c760bdd8 c03cc4f8 00000000 00000002 c7e80158 +bde0: c7d2e300 60000193 c760a000 0000005c 00000000 00000000 c760be24 c760be08 +be00: c02bcecc c02bc1ac c7d2e300 c7d2e300 0000005c c760a000 c760be54 c760be28 +be20: c00ad698 c02bce6c 00000000 c7d2e300 c067c258 0000005c c067c294 00000001 +be40: c760a000 00000000 c760be74 c760be58 c00af984 c00ad5fc 0000005c 00000000 +be60: 00000000 00000002 c760be8c c760be78 c0039080 c00af8d0 ffffffff fa200000 +be80: c760beec c760be90 c0039b6c c003900c 00000001 00000000 c7d1e240 00000000 +bea0: 00000000 c068bae8 00000000 60000013 00000001 00000000 00000000 c760beec +bec0: c0064ecc c760bed8 c00ff7d0 c003a0a8 60000013 ffffffff 00000000 c068bae8 +bee0: c760bf24 c760bef0 c00ff7d0 c0064ec4 00000001 00000000 c00ff700 00000000 +bf00: c0087f00 00000000 60000013 c0d76a70 c0e23795 00000001 c760bf4c c760bf28 +bf20: c00ffdd8 c00ff70c c068bb08 c068bae8 60000013 c0100938 c068bb30 00000000 +bf40: c760bf84 c760bf50 c010014c c00ffd84 00000001 00000000 c010000c 00012c00 +bf60: c7c33f04 00012c00 c7c33f04 00000000 c0100938 00000000 c760bf9c c760bf88 +bf80: c01009a8 c0100018 c760bfa8 c7c33f04 c760bff4 c760bfa0 c0088000 c0100944 +bfa0: c760bf98 00000000 00000000 00000001 dead4ead ffffffff ffffffff c08ba2bc +bfc0: 00000000 c049e7fa 00000000 c0087f70 c760bfd0 c760bfd0 c7c33f04 c0087f70 +bfe0: c006f5e8 00000013 00000000 c760bff8 c006f5e8 c0087f7c 7f0004ff df2000ff +Backtrace: +[] (musb_g_rx+0x0/0x2ec) from [] (musb_interrupt+0xbc8/0xcc0) +[] (musb_interrupt+0x0/0xcc0) from [] (generic_interrupt+0x6c/0x84) +[] (generic_interrupt+0x0/0x84) from [] (handle_IRQ_event+0xa8/0x1ec) + r7:c760a000 r6:0000005c r5:c7d2e300 r4:c7d2e300 +[] (handle_IRQ_event+0x0/0x1ec) from [] (handle_level_irq+0xc0/0x13c) +[] (handle_level_irq+0x0/0x13c) from [] (asm_do_IRQ+0x80/0xa0) + r7:00000002 r6:00000000 r5:00000000 r4:0000005c +[] (asm_do_IRQ+0x0/0xa0) from [] (__irq_svc+0x4c/0xb4) +Exception stack(0xc760be90 to 0xc760bed8) +be80: 00000001 00000000 c7d1e240 00000000 +bea0: 00000000 c068bae8 00000000 60000013 00000001 00000000 00000000 c760beec +bec0: c0064ecc c760bed8 c00ff7d0 c003a0a8 60000013 ffffffff + r5:fa200000 r4:ffffffff +[] (sub_preempt_count+0x0/0x100) from [] (find_and_get_object+0xd0/0x110) + r5:c068bae8 r4:00000000 +[] (find_and_get_object+0x0/0x110) from [] (scan_block+0x60/0x104) + r8:00000001 r7:c0e23795 r6:c0d76a70 r5:60000013 r4:00000000 +[] (scan_block+0x0/0x104) from [] (kmemleak_scan+0x140/0x484) +[] (kmemleak_scan+0x0/0x484) from [] (kmemleak_scan_thread+0x70/0xcc) + r8:00000000 r7:c0100938 r6:00000000 r5:c7c33f04 r4:00012c00 +[] (kmemleak_scan_thread+0x0/0xcc) from [] (kthread+0x90/0x98) + r5:c7c33f04 r4:c760bfa8 +[] (kthread+0x0/0x98) from [] (do_exit+0x0/0x684) + r7:00000013 r6:c006f5e8 r5:c0087f70 r4:c7c33f04 +Code: e3002312 e58d6000 e2833e16 eb0422d5 (e5963020) +---[ end trace f3d5e96f75c297b7 ]--- + +Signed-off-by: Ming Lei +Reviewed-by: Sergei Shtylyov +Cc: David Brownell +Cc: Anand Gadiyar +Cc: Mike Frysinger +Cc: Sergei Shtylyov +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_gadget.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -568,11 +568,19 @@ static void rxstate(struct musb *musb, s + { + const u8 epnum = req->epnum; + struct usb_request *request = &req->request; +- struct musb_ep *musb_ep = &musb->endpoints[epnum].ep_out; ++ struct musb_ep *musb_ep; + void __iomem *epio = musb->endpoints[epnum].regs; + unsigned fifo_count = 0; +- u16 len = musb_ep->packet_sz; ++ u16 len; + u16 csr = musb_readw(epio, MUSB_RXCSR); ++ struct musb_hw_ep *hw_ep = &musb->endpoints[epnum]; ++ ++ if (hw_ep->is_shared_fifo) ++ musb_ep = &hw_ep->ep_in; ++ else ++ musb_ep = &hw_ep->ep_out; ++ ++ len = musb_ep->packet_sz; + + /* We shouldn't get here while DMA is active, but we do... */ + if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) { +@@ -740,9 +748,15 @@ void musb_g_rx(struct musb *musb, u8 epn + u16 csr; + struct usb_request *request; + void __iomem *mbase = musb->mregs; +- struct musb_ep *musb_ep = &musb->endpoints[epnum].ep_out; ++ struct musb_ep *musb_ep; + void __iomem *epio = musb->endpoints[epnum].regs; + struct dma_channel *dma; ++ struct musb_hw_ep *hw_ep = &musb->endpoints[epnum]; ++ ++ if (hw_ep->is_shared_fifo) ++ musb_ep = &hw_ep->ep_in; ++ else ++ musb_ep = &hw_ep->ep_out; + + musb_ep_select(mbase, epnum); + diff --git a/queue-2.6.35/usb-musb-gadget-restart-request-on-clearing-endpoint-halt.patch b/queue-2.6.35/usb-musb-gadget-restart-request-on-clearing-endpoint-halt.patch new file mode 100644 index 00000000000..b2477f62ccd --- /dev/null +++ b/queue-2.6.35/usb-musb-gadget-restart-request-on-clearing-endpoint-halt.patch @@ -0,0 +1,70 @@ +From a666e3e6098a9f56310e4ec2705f1dad124a34b5 Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Sat, 11 Sep 2010 13:23:12 -0500 +Subject: usb: musb: gadget: restart request on clearing endpoint halt + +From: Sergei Shtylyov + +commit a666e3e6098a9f56310e4ec2705f1dad124a34b5 upstream. + +Commit 46034dca515bc4ddca0399ae58106d1f5f0d809f (USB: musb_gadget_ep0: stop +abusing musb_gadget_set_halt()) forgot to restart a queued request after +clearing the endpoint halt feature. This results in a couple of USB resets +while enumerating the file-backed storage gadget due to CSW packet not being +sent for the MODE SENSE(10) command. + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_gadget.c | 2 +- + drivers/usb/musb/musb_gadget.h | 2 ++ + drivers/usb/musb/musb_gadget_ep0.c | 9 +++++++++ + 3 files changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -1095,7 +1095,7 @@ struct free_record { + /* + * Context: controller locked, IRQs blocked. + */ +-static void musb_ep_restart(struct musb *musb, struct musb_request *req) ++void musb_ep_restart(struct musb *musb, struct musb_request *req) + { + DBG(3, "<== %s request %p len %u on hw_ep%d\n", + req->tx ? "TX/IN" : "RX/OUT", +--- a/drivers/usb/musb/musb_gadget.h ++++ b/drivers/usb/musb/musb_gadget.h +@@ -105,4 +105,6 @@ extern void musb_gadget_cleanup(struct m + + extern void musb_g_giveback(struct musb_ep *, struct usb_request *, int); + ++extern void musb_ep_restart(struct musb *, struct musb_request *); ++ + #endif /* __MUSB_GADGET_H */ +--- a/drivers/usb/musb/musb_gadget_ep0.c ++++ b/drivers/usb/musb/musb_gadget_ep0.c +@@ -261,6 +261,7 @@ __acquires(musb->lock) + ctrlrequest->wIndex & 0x0f; + struct musb_ep *musb_ep; + struct musb_hw_ep *ep; ++ struct musb_request *request; + void __iomem *regs; + int is_in; + u16 csr; +@@ -302,6 +303,14 @@ __acquires(musb->lock) + musb_writew(regs, MUSB_RXCSR, csr); + } + ++ /* Maybe start the first request in the queue */ ++ request = to_musb_request( ++ next_request(musb_ep)); ++ if (!musb_ep->busy && request) { ++ DBG(3, "restarting the request\n"); ++ musb_ep_restart(musb, request); ++ } ++ + /* select ep0 again */ + musb_ep_select(mbase, 0); + } break; diff --git a/queue-2.6.35/v4l-dvb-gspca-main-fix-a-crash-of-some-webcams-on-arm-arch.patch b/queue-2.6.35/v4l-dvb-gspca-main-fix-a-crash-of-some-webcams-on-arm-arch.patch new file mode 100644 index 00000000000..c50c3a30220 --- /dev/null +++ b/queue-2.6.35/v4l-dvb-gspca-main-fix-a-crash-of-some-webcams-on-arm-arch.patch @@ -0,0 +1,40 @@ +From 882787ff8fdeb0be790547ee9b22b281095e95da Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Fri, 3 Sep 2010 06:57:19 -0300 +Subject: V4L/DVB: gspca - main: Fix a crash of some webcams on ARM arch +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jason Wang + +commit 882787ff8fdeb0be790547ee9b22b281095e95da upstream. + +When plugging some webcams on ARM, the system crashes. +This is because we alloc buffer for an urb through usb_buffer_alloc, +the alloced buffer is already in DMA coherent region, so we should +set the flag of this urb to URB_NO_TRANSFER_DMA_MAP, otherwise when +we submit this urb, the hcd core will handle this address as an +non-DMA address and call dma_map_single/sg to map it. On arm +architecture, dma_map_single a DMA coherent address will be catched +by a BUG_ON(). + +Signed-off-by: Jason Wang +Signed-off-by: Jean-François Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/gspca.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/video/gspca/gspca.c ++++ b/drivers/media/video/gspca/gspca.c +@@ -223,6 +223,7 @@ static int alloc_and_submit_int_urb(stru + usb_rcvintpipe(dev, ep->bEndpointAddress), + buffer, buffer_len, + int_irq, (void *)gspca_dev, interval); ++ urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + gspca_dev->int_urb = urb; + ret = usb_submit_urb(urb, GFP_KERNEL); + if (ret < 0) { diff --git a/queue-2.6.35/v4l-dvb-gspca-sn9c20x-bad-transfer-size-of-bayer-images.patch b/queue-2.6.35/v4l-dvb-gspca-sn9c20x-bad-transfer-size-of-bayer-images.patch new file mode 100644 index 00000000000..1360ef1c3a9 --- /dev/null +++ b/queue-2.6.35/v4l-dvb-gspca-sn9c20x-bad-transfer-size-of-bayer-images.patch @@ -0,0 +1,33 @@ +From 04d174e99a6eca2f62b56c10ae1d7d0499d83e9d Mon Sep 17 00:00:00 2001 +From: Jean-François Moine +Date: Mon, 13 Sep 2010 05:22:37 -0300 +Subject: V4L/DVB: gspca - sn9c20x: Bad transfer size of Bayer images + +From: Jean-François Moine + +commit 04d174e99a6eca2f62b56c10ae1d7d0499d83e9d upstream. + +As the end of frame marker does not contain any pixel, it must not be +transferred. + +Reported-by: Ivo Jager +Signed-off-by: Jean-François Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/sn9c20x.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/video/gspca/sn9c20x.c ++++ b/drivers/media/video/gspca/sn9c20x.c +@@ -2368,8 +2368,7 @@ static void sd_pkt_scan(struct gspca_dev + (data[33] << 10); + avg_lum >>= 9; + atomic_set(&sd->avg_lum, avg_lum); +- gspca_frame_add(gspca_dev, LAST_PACKET, +- data, len); ++ gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0); + return; + } + if (gspca_dev->last_packet_type == LAST_PACKET) { diff --git a/queue-2.6.35/x86-cpu-after-uncapping-cpuid-re-run-cpu-feature-detection.patch b/queue-2.6.35/x86-cpu-after-uncapping-cpuid-re-run-cpu-feature-detection.patch new file mode 100644 index 00000000000..0177860a202 --- /dev/null +++ b/queue-2.6.35/x86-cpu-after-uncapping-cpuid-re-run-cpu-feature-detection.patch @@ -0,0 +1,55 @@ +From d900329e20f4476db6461752accebcf7935a8055 Mon Sep 17 00:00:00 2001 +From: H. Peter Anvin +Date: Tue, 28 Sep 2010 15:35:01 -0700 +Subject: x86, cpu: After uncapping CPUID, re-run CPU feature detection + +From: H. Peter Anvin + +commit d900329e20f4476db6461752accebcf7935a8055 upstream. + +After uncapping the CPUID level, we need to also re-run the CPU +feature detection code. + +This resolves kernel bugzilla 16322. + +Reported-by: boris64 +LKML-Reference: +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/common.c | 2 +- + arch/x86/kernel/cpu/cpu.h | 1 + + arch/x86/kernel/cpu/intel.c | 1 + + 3 files changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -537,7 +537,7 @@ void __cpuinit cpu_detect(struct cpuinfo + } + } + +-static void __cpuinit get_cpu_cap(struct cpuinfo_x86 *c) ++void __cpuinit get_cpu_cap(struct cpuinfo_x86 *c) + { + u32 tfms, xlvl; + u32 ebx; +--- a/arch/x86/kernel/cpu/cpu.h ++++ b/arch/x86/kernel/cpu/cpu.h +@@ -33,5 +33,6 @@ extern const struct cpu_dev *const __x86 + *const __x86_cpu_dev_end[]; + + extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c); ++extern void get_cpu_cap(struct cpuinfo_x86 *c); + + #endif +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -39,6 +39,7 @@ static void __cpuinit early_init_intel(s + misc_enable &= ~MSR_IA32_MISC_ENABLE_LIMIT_CPUID; + wrmsrl(MSR_IA32_MISC_ENABLE, misc_enable); + c->cpuid_level = cpuid_eax(0); ++ get_cpu_cap(c); + } + } +