From: Greg Kroah-Hartman Date: Thu, 29 Jul 2010 22:36:08 +0000 (-0700) Subject: .33 patches X-Git-Tag: v2.6.27.49~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f97470802ad82f07fadc14a2c5f23609ff787f87;p=thirdparty%2Fkernel%2Fstable-queue.git .33 patches --- diff --git a/queue-2.6.33/3c503-fix-irq-probing.patch b/queue-2.6.33/3c503-fix-irq-probing.patch new file mode 100644 index 00000000000..93c9673aea4 --- /dev/null +++ b/queue-2.6.33/3c503-fix-irq-probing.patch @@ -0,0 +1,105 @@ +From b0cf4dfb7cd21556efd9a6a67edcba0840b4d98d Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Wed, 7 Apr 2010 20:55:47 -0700 +Subject: 3c503: Fix IRQ probing + +From: Ben Hutchings + +commit b0cf4dfb7cd21556efd9a6a67edcba0840b4d98d upstream. + +The driver attempts to select an IRQ for the NIC automatically by +testing which of the supported IRQs are available and then probing +each available IRQ with probe_irq_{on,off}(). There are obvious race +conditions here, besides which: +1. The test for availability is done by passing a NULL handler, which + now always returns -EINVAL, thus the device cannot be opened: + +2. probe_irq_off() will report only the first ISA IRQ handled, + potentially leading to a false negative. + +There was another bug that meant it ignored all error codes from +request_irq() except -EBUSY, so it would 'succeed' despite this +(possibly causing conflicts with other ISA devices). This was fixed +by ab08999d6029bb2c79c16be5405d63d2bedbdfea 'WARNING: some +request_irq() failures ignored in el2_open()', which exposed bug 1. + +This patch: +1. Replaces the use of probe_irq_{on,off}() with a real interrupt handler +2. Adds a delay before checking the interrupt-seen flag +3. Disables interrupts on all failure paths +4. Distinguishes error codes from the second request_irq() call, + consistently with the first + +Compile-tested only. + +Signed-off-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/3c503.c | 42 ++++++++++++++++++++++++++++++------------ + 1 file changed, 30 insertions(+), 12 deletions(-) + +--- a/drivers/net/3c503.c ++++ b/drivers/net/3c503.c +@@ -380,6 +380,12 @@ out: + return retval; + } + ++static irqreturn_t el2_probe_interrupt(int irq, void *seen) ++{ ++ *(bool *)seen = true; ++ return IRQ_HANDLED; ++} ++ + static int + el2_open(struct net_device *dev) + { +@@ -391,23 +397,35 @@ el2_open(struct net_device *dev) + + outb(EGACFR_NORM, E33G_GACFR); /* Enable RAM and interrupts. */ + do { +- retval = request_irq(*irqp, NULL, 0, "bogus", dev); +- if (retval >= 0) { ++ bool seen; ++ ++ retval = request_irq(*irqp, el2_probe_interrupt, 0, ++ dev->name, &seen); ++ if (retval == -EBUSY) ++ continue; ++ if (retval < 0) ++ goto err_disable; ++ + /* Twinkle the interrupt, and check if it's seen. */ +- unsigned long cookie = probe_irq_on(); ++ seen = false; ++ smp_wmb(); + outb_p(0x04 << ((*irqp == 9) ? 2 : *irqp), E33G_IDCFR); + outb_p(0x00, E33G_IDCFR); +- if (*irqp == probe_irq_off(cookie) && /* It's a good IRQ line! */ +- ((retval = request_irq(dev->irq = *irqp, +- eip_interrupt, 0, +- dev->name, dev)) == 0)) +- break; +- } else { +- if (retval != -EBUSY) +- return retval; +- } ++ msleep(1); ++ free_irq(*irqp, el2_probe_interrupt); ++ if (!seen) ++ continue; ++ ++ retval = request_irq(dev->irq = *irqp, eip_interrupt, 0, ++ dev->name, dev); ++ if (retval == -EBUSY) ++ continue; ++ if (retval < 0) ++ goto err_disable; + } while (*++irqp); ++ + if (*irqp == 0) { ++ err_disable: + outb(EGACFR_IRQOFF, E33G_GACFR); /* disable interrupts. */ + return -EAGAIN; + } diff --git a/queue-2.6.33/alsa-echoaudio-fix-guru-meditation-00000005.48454c50.patch b/queue-2.6.33/alsa-echoaudio-fix-guru-meditation-00000005.48454c50.patch new file mode 100644 index 00000000000..a48e854e376 --- /dev/null +++ b/queue-2.6.33/alsa-echoaudio-fix-guru-meditation-00000005.48454c50.patch @@ -0,0 +1,42 @@ +From b721e68bdc5b39c51bf6a1469f8d3663fbe03243 Mon Sep 17 00:00:00 2001 +From: Giuliano Pochini +Date: Wed, 17 Feb 2010 00:57:44 +0100 +Subject: ALSA: Echoaudio, fix Guru Meditation #00000005.48454C50 + +From: Giuliano Pochini + +commit b721e68bdc5b39c51bf6a1469f8d3663fbe03243 upstream. + +This patch fixes a division by zero error in the irq handler. + +There is a small window between the hw_params() callback and when +runtime->frame_bits is set by ALSA middle layer. When another substream is +already running, if an interrupt is delivered during that window the irq +handler calls pcm_pointer() which does a division by zero. The patch below +makes the irq handler skip substreams that are initialized but not started +yet. Cc to Clemens Ladisch because he proposed an alternate fix. + +For more information, please read the original thread in the linux-kernel +mailing list: http://lkml.org/lkml/2010/2/2/187 + +Signed-off-by: Giuliano Pochini +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/echoaudio/echoaudio.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/pci/echoaudio/echoaudio.c ++++ b/sound/pci/echoaudio/echoaudio.c +@@ -1821,7 +1821,9 @@ static irqreturn_t snd_echo_interrupt(in + /* The hardware doesn't tell us which substream caused the irq, + thus we have to check all running substreams. */ + for (ss = 0; ss < DSP_MAXPIPES; ss++) { +- if ((substream = chip->substream[ss])) { ++ substream = chip->substream[ss]; ++ if (substream && ((struct audiopipe *)substream->runtime-> ++ private_data)->state == PIPE_STATE_STARTED) { + period = pcm_pointer(substream) / + substream->runtime->period_size; + if (period != chip->last_period[ss]) { diff --git a/queue-2.6.33/ath5k-initialize-ah-ah_current_channel.patch b/queue-2.6.33/ath5k-initialize-ah-ah_current_channel.patch new file mode 100644 index 00000000000..ff496a7e061 --- /dev/null +++ b/queue-2.6.33/ath5k-initialize-ah-ah_current_channel.patch @@ -0,0 +1,91 @@ +From b6855772f4a22c4fbdd4fcaceff5c8a527035123 Mon Sep 17 00:00:00 2001 +From: Bob Copeland +Date: Fri, 18 Jun 2010 13:15:23 -0400 +Subject: ath5k: initialize ah->ah_current_channel + +From: Bob Copeland + +commit b6855772f4a22c4fbdd4fcaceff5c8a527035123 upstream. + +ath5k assumes ah_current_channel is always a valid pointer in +several places, but a newly created interface may not have a +channel. To avoid null pointer dereferences, set it up to point +to the first available channel until later reconfigured. + +This fixes the following oops: +$ rmmod ath5k +$ insmod ath5k +$ iw phy0 set distance 11000 + +BUG: unable to handle kernel NULL pointer dereference at 00000006 +IP: [] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] +*pde = 00000000 +Oops: 0000 [#1] +last sysfs file: /sys/devices/pci0000:00/0000:00:0e.0/ieee80211/phy0/index +Modules linked in: usbhid option usb_storage usbserial usblp evdev lm90 +scx200_acb i2c_algo_bit i2c_dev i2c_core via_rhine ohci_hcd ne2k_pci +8390 leds_alix2 xt_IMQ imq nf_nat_tftp nf_conntrack_tftp nf_nat_irc nf_cc + +Pid: 1597, comm: iw Not tainted (2.6.32.14 #8) +EIP: 0060:[] EFLAGS: 00010296 CPU: 0 +EIP is at ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] +EAX: 000000c2 EBX: 00000000 ECX: ffffffff EDX: c12d2080 +ESI: 00000019 EDI: cf8c0000 EBP: d0a30edc ESP: cfa09bf4 + DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 +Process iw (pid: 1597, ti=cfa09000 task=cf88a000 task.ti=cfa09000) +Stack: + d0a34f35 d0a353f8 d0a30edc 000000fe cf8c0000 00000000 1900063d cfa8c9e0 +<0> cfa8c9e8 cfa8c0c0 cfa8c000 d0a27f0c 199d84b4 cfa8c200 00000010 d09bfdc7 +<0> 00000000 00000000 ffffffff d08e0d28 cf9263c0 00000001 cfa09cc4 00000000 +Call Trace: + [] ? ath5k_hw_attach+0xc8c/0x3c10 [ath5k] + [] ? __ieee80211_request_smps+0x1347/0x1580 [mac80211] + [] ? nl80211_send_scan_start+0x7b8/0x4520 [cfg80211] + [] ? nla_parse+0x59/0xc0 + [] ? genl_rcv_msg+0x169/0x1a0 + [] ? genl_rcv_msg+0x0/0x1a0 + [] ? netlink_rcv_skb+0x38/0x90 + [] ? genl_rcv+0x19/0x30 + [] ? netlink_unicast+0x1b3/0x220 + [] ? netlink_sendmsg+0x26e/0x290 + [] ? sock_sendmsg+0xbe/0xf0 + [] ? autoremove_wake_function+0x0/0x50 + [] ? __alloc_pages_nodemask+0x106/0x530 + [] ? do_lookup+0x53/0x1b0 + [] ? __link_path_walk+0x9b9/0x9e0 + [] ? verify_iovec+0x50/0x90 + [] ? sys_sendmsg+0x1e1/0x270 + [] ? find_get_page+0x10/0x50 + [] ? filemap_fault+0x5f/0x370 + [] ? __do_fault+0x319/0x370 + [] ? sys_socketcall+0x244/0x290 + [] ? do_page_fault+0x1ec/0x270 + [] ? do_page_fault+0x0/0x270 + [] ? syscall_call+0x7/0xb +Code: 00 b8 fe 00 00 00 b9 f8 53 a3 d0 89 5c 24 14 89 7c 24 10 89 44 24 +0c 89 6c 24 08 89 4c 24 04 c7 04 24 35 4f a3 d0 e8 7c 30 60 f0 <0f> b7 +43 06 ba 06 00 00 00 a8 10 75 0e 83 e0 20 83 f8 01 19 d2 +EIP: [] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] SS:ESP +0068:cfa09bf4 +CR2: 0000000000000006 +---[ end trace 54f73d6b10ceb87b ]--- + +Reported-by: Steve Brown +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/attach.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/ath/ath5k/attach.c ++++ b/drivers/net/wireless/ath/ath5k/attach.c +@@ -123,6 +123,7 @@ int ath5k_hw_attach(struct ath5k_softc * + ah->ah_cw_min = AR5K_TUNE_CWMIN; + ah->ah_limit_tx_retries = AR5K_INIT_TX_RETRY; + ah->ah_software_retry = false; ++ ah->ah_current_channel = &sc->channels[0]; + + /* + * Find the mac version diff --git a/queue-2.6.33/cxgb3-fix-linkup-issue.patch b/queue-2.6.33/cxgb3-fix-linkup-issue.patch new file mode 100644 index 00000000000..22e2d9d85ad --- /dev/null +++ b/queue-2.6.33/cxgb3-fix-linkup-issue.patch @@ -0,0 +1,35 @@ +From 9441cad99b4b09d6b627351c2d282833868c116c Mon Sep 17 00:00:00 2001 +From: Hiroshi Shimamoto +Date: Mon, 19 Apr 2010 15:32:20 +0000 +Subject: cxgb3: fix linkup issue + +From: Hiroshi Shimamoto + +commit 9441cad99b4b09d6b627351c2d282833868c116c upstream. + +I encountered an issue that not to link up on cxgb3 fabric. +I bisected and found that this regression was introduced by +0f07c4ee8c800923ae7918c231532a9256233eed. + +Correct to pass phy_addr to cphy_init() at t3_xaui_direct_phy_prep(). + +Signed-off-by: Hiroshi Shimamoto +Acked-by: Divy Le Ray +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/cxgb3/ael1002.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/cxgb3/ael1002.c ++++ b/drivers/net/cxgb3/ael1002.c +@@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops = + int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter, + int phy_addr, const struct mdio_ops *mdio_ops) + { +- cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops, ++ cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops, + SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP, + "10GBASE-CX4"); + return 0; diff --git a/queue-2.6.33/ecryptfs-bugfix-for-error-related-to-ecryptfs_hash_buckets.patch b/queue-2.6.33/ecryptfs-bugfix-for-error-related-to-ecryptfs_hash_buckets.patch new file mode 100644 index 00000000000..19c4e7fae99 --- /dev/null +++ b/queue-2.6.33/ecryptfs-bugfix-for-error-related-to-ecryptfs_hash_buckets.patch @@ -0,0 +1,75 @@ +From a6f80fb7b5986fda663d94079d3bba0937a6b6ff Mon Sep 17 00:00:00 2001 +From: Andre Osterhues +Date: Tue, 13 Jul 2010 15:59:17 -0500 +Subject: ecryptfs: Bugfix for error related to ecryptfs_hash_buckets + +From: Andre Osterhues + +commit a6f80fb7b5986fda663d94079d3bba0937a6b6ff upstream. + +The function ecryptfs_uid_hash wrongly assumes that the +second parameter to hash_long() is the number of hash +buckets instead of the number of hash bits. +This patch fixes that and renames the variable +ecryptfs_hash_buckets to ecryptfs_hash_bits to make it +clearer. + +Fixes: CVE-2010-2492 + +Signed-off-by: Andre Osterhues +Signed-off-by: Tyler Hicks +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ecryptfs/messaging.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/fs/ecryptfs/messaging.c ++++ b/fs/ecryptfs/messaging.c +@@ -30,9 +30,9 @@ static struct mutex ecryptfs_msg_ctx_lis + + static struct hlist_head *ecryptfs_daemon_hash; + struct mutex ecryptfs_daemon_hash_mux; +-static int ecryptfs_hash_buckets; ++static int ecryptfs_hash_bits; + #define ecryptfs_uid_hash(uid) \ +- hash_long((unsigned long)uid, ecryptfs_hash_buckets) ++ hash_long((unsigned long)uid, ecryptfs_hash_bits) + + static u32 ecryptfs_msg_counter; + static struct ecryptfs_msg_ctx *ecryptfs_msg_ctx_arr; +@@ -485,18 +485,19 @@ int ecryptfs_init_messaging(void) + } + mutex_init(&ecryptfs_daemon_hash_mux); + mutex_lock(&ecryptfs_daemon_hash_mux); +- ecryptfs_hash_buckets = 1; +- while (ecryptfs_number_of_users >> ecryptfs_hash_buckets) +- ecryptfs_hash_buckets++; ++ ecryptfs_hash_bits = 1; ++ while (ecryptfs_number_of_users >> ecryptfs_hash_bits) ++ ecryptfs_hash_bits++; + ecryptfs_daemon_hash = kmalloc((sizeof(struct hlist_head) +- * ecryptfs_hash_buckets), GFP_KERNEL); ++ * (1 << ecryptfs_hash_bits)), ++ GFP_KERNEL); + if (!ecryptfs_daemon_hash) { + rc = -ENOMEM; + printk(KERN_ERR "%s: Failed to allocate memory\n", __func__); + mutex_unlock(&ecryptfs_daemon_hash_mux); + goto out; + } +- for (i = 0; i < ecryptfs_hash_buckets; i++) ++ for (i = 0; i < (1 << ecryptfs_hash_bits); i++) + INIT_HLIST_HEAD(&ecryptfs_daemon_hash[i]); + mutex_unlock(&ecryptfs_daemon_hash_mux); + ecryptfs_msg_ctx_arr = kmalloc((sizeof(struct ecryptfs_msg_ctx) +@@ -553,7 +554,7 @@ void ecryptfs_release_messaging(void) + int i; + + mutex_lock(&ecryptfs_daemon_hash_mux); +- for (i = 0; i < ecryptfs_hash_buckets; i++) { ++ for (i = 0; i < (1 << ecryptfs_hash_bits); i++) { + int rc; + + hlist_for_each_entry(daemon, elem, diff --git a/queue-2.6.33/fix-spinaphore-down_spin.patch b/queue-2.6.33/fix-spinaphore-down_spin.patch new file mode 100644 index 00000000000..a4d27a28e4c --- /dev/null +++ b/queue-2.6.33/fix-spinaphore-down_spin.patch @@ -0,0 +1,38 @@ +From b70f4e85bfc4d7000036355b714a92d5c574f1be Mon Sep 17 00:00:00 2001 +From: Tony Luck +Date: Wed, 30 Jun 2010 10:46:16 -0700 +Subject: [IA64] Fix spinaphore down_spin() + +From: Tony Luck + +commit b70f4e85bfc4d7000036355b714a92d5c574f1be upstream. + +Typo in down_spin() meant it only read the low 32 bits of the +"serve" value, instead of the full 64 bits. This results in the +system hanging when the values in ticket/serve get larger than +32-bits. A big enough system running the right test can hit this +in a just a few hours. + +Broken since 883a3acf5b0d4782ac35981227a0d094e8b44850 + [IA64] Re-implement spinaphores using ticket lock concepts + +Reported via IRC by Bjorn Helgaas + +Signed-off-by: Tony Luck +Signed-off-by: Greg Kroah-Hartman + +--- + arch/ia64/mm/tlb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/ia64/mm/tlb.c ++++ b/arch/ia64/mm/tlb.c +@@ -120,7 +120,7 @@ static inline void down_spin(struct spin + ia64_invala(); + + for (;;) { +- asm volatile ("ld4.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory"); ++ asm volatile ("ld8.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory"); + if (time_before(t, serve)) + return; + cpu_relax(); diff --git a/queue-2.6.33/forcedeth-fix-tx-limit2-flag-check.patch b/queue-2.6.33/forcedeth-fix-tx-limit2-flag-check.patch new file mode 100644 index 00000000000..b62e572ddea --- /dev/null +++ b/queue-2.6.33/forcedeth-fix-tx-limit2-flag-check.patch @@ -0,0 +1,37 @@ +From 5c659322a904a7cc0265e7b183372b9bdebec6db Mon Sep 17 00:00:00 2001 +From: Ayaz Abdulla +Date: Tue, 13 Apr 2010 18:49:51 -0700 +Subject: forcedeth: fix tx limit2 flag check + +From: Ayaz Abdulla + +commit 5c659322a904a7cc0265e7b183372b9bdebec6db upstream. + +This is a fix for bug 572201 @ bugs.debian.org + +This patch fixes the TX_LIMIT feature flag. The previous logic check +for TX_LIMIT2 also took into account a device that only had TX_LIMIT +set. + +Reported-by: Stephen Mulcahu +Reported-by: Ben Huchings +Signed-off-by: Ayaz Abdulla +Signed-off-by: David S. Miller +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/forcedeth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/forcedeth.c ++++ b/drivers/net/forcedeth.c +@@ -5900,7 +5900,7 @@ static int __devinit nv_probe(struct pci + /* Limit the number of tx's outstanding for hw bug */ + if (id->driver_data & DEV_NEED_TX_LIMIT) { + np->tx_limit = 1; +- if ((id->driver_data & DEV_NEED_TX_LIMIT2) && ++ if (((id->driver_data & DEV_NEED_TX_LIMIT2) == DEV_NEED_TX_LIMIT2) && + pci_dev->revision >= 0xA2) + np->tx_limit = 0; + } diff --git a/queue-2.6.33/input-rx51-keymap-fix-recent-compile-breakage.patch b/queue-2.6.33/input-rx51-keymap-fix-recent-compile-breakage.patch new file mode 100644 index 00000000000..3dfc83bc3b1 --- /dev/null +++ b/queue-2.6.33/input-rx51-keymap-fix-recent-compile-breakage.patch @@ -0,0 +1,37 @@ +From 2e65a2075cc740b485ab203430bdf3459d5551b6 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Mon, 26 Jul 2010 01:12:37 -0700 +Subject: Input: RX51 keymap - fix recent compile breakage + +From: Dmitry Torokhov + +commit 2e65a2075cc740b485ab203430bdf3459d5551b6 upstream. + +Commit 3fea60261e73 ("Input: twl40300-keypad - fix handling of "all +ground" rows") broke compilation as I managed to use non-existent +keycodes. + +Reported-by: Arjan van de Ven +Signed-off-by: Dmitry Torokhov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/board-rx51-peripherals.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mach-omap2/board-rx51-peripherals.c ++++ b/arch/arm/mach-omap2/board-rx51-peripherals.c +@@ -192,10 +192,10 @@ static int board_keymap[] = { + KEY(4, 4, KEY_LEFTCTRL), + KEY(4, 5, KEY_RIGHTALT), + KEY(4, 6, KEY_LEFTSHIFT), +- KEY(4, 8, KEY_10), ++ KEY(4, 8, KEY_F10), + + KEY(5, 0, KEY_Y), +- KEY(5, 8, KEY_11), ++ KEY(5, 8, KEY_F11), + + KEY(6, 0, KEY_U), + diff --git a/queue-2.6.33/iwlagn-verify-flow-id-in-compressed-ba-packet.patch b/queue-2.6.33/iwlagn-verify-flow-id-in-compressed-ba-packet.patch new file mode 100644 index 00000000000..5eb7e6465c9 --- /dev/null +++ b/queue-2.6.33/iwlagn-verify-flow-id-in-compressed-ba-packet.patch @@ -0,0 +1,44 @@ +From b561e8274f75831ee87e4ea378cbb1f9f050a51a Mon Sep 17 00:00:00 2001 +From: Shanyu Zhao +Date: Tue, 1 Jun 2010 17:13:58 -0700 +Subject: iwlagn: verify flow id in compressed BA packet + +From: Shanyu Zhao + +commit b561e8274f75831ee87e4ea378cbb1f9f050a51a upstream. + +The flow id (scd_flow) in a compressed BA packet should match the txq_id +of the queue from which the aggregated packets were sent. However, in +some hardware like the 1000 series, sometimes the flow id is 0 for the +txq_id (10 to 19). This can cause the annoying message: +[ 2213.306191] iwlagn 0000:01:00.0: Received BA when not expected +[ 2213.310178] iwlagn 0000:01:00.0: Read index for DMA queue txq id (0), +index 5, is out of range [0-256] 7 7. + +And even worse, if agg->wait_for_ba is true when the bad BA is arriving, +this can cause system hang due to NULL pointer dereference because the +code is operating in a wrong tx queue! + +Signed-off-by: Shanyu Zhao +Signed-off-by: Pradeep Kulkarni +Signed-off-by: Reinette Chatre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-tx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/iwl-tx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c +@@ -1553,6 +1553,11 @@ void iwl_rx_reply_compressed_ba(struct i + sta_id = ba_resp->sta_id; + tid = ba_resp->tid; + agg = &priv->stations[sta_id].tid[tid].agg; ++ if (unlikely(agg->txq_id != scd_flow)) { ++ IWL_ERR(priv, "BA scd_flow %d does not match txq_id %d\n", ++ scd_flow, agg->txq_id); ++ return; ++ } + + /* Find index just before block-ack window */ + index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd); diff --git a/queue-2.6.33/kbuild-fix-modpost-segfault.patch b/queue-2.6.33/kbuild-fix-modpost-segfault.patch new file mode 100644 index 00000000000..f7d94cffd23 --- /dev/null +++ b/queue-2.6.33/kbuild-fix-modpost-segfault.patch @@ -0,0 +1,50 @@ +From 1c938663d58b5b2965976a6f54cc51b5d6f691aa Mon Sep 17 00:00:00 2001 +From: Krzysztof Halasa +Date: Fri, 11 Jun 2010 01:08:20 +0200 +Subject: kbuild: Fix modpost segfault +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Halasa + +commit 1c938663d58b5b2965976a6f54cc51b5d6f691aa upstream. + +Alan writes: + +> program: /home/alan/GitTrees/linux-2.6-mid-ref/scripts/mod/modpost -o +> Module.symvers -S vmlinux.o +> +> Program received signal SIGSEGV, Segmentation fault. + +It just hit me. +It's the offset calculation in reloc_location() which overflows: + return (void *)elf->hdr + sechdrs[section].sh_offset + + (r->r_offset - sechdrs[section].sh_addr); + +E.g. for the first rodata r entry: +r->r_offset < sechdrs[section].sh_addr +and the expression in the parenthesis produces 0xFFFFFFE0 or something +equally wise. + +Reported-by: Alan +Signed-off-by: Krzysztof Hałasa +Tested-by: Alan +Signed-off-by: Michal Marek +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/mod/modpost.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1318,7 +1318,7 @@ static unsigned int *reloc_location(stru + int section = sechdr->sh_info; + + return (void *)elf->hdr + sechdrs[section].sh_offset + +- (r->r_offset - sechdrs[section].sh_addr); ++ r->r_offset - sechdrs[section].sh_addr; + } + + static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r) diff --git a/queue-2.6.33/mac80211-fix-supported-rates-ie-if-ap-doesn-t-give-us-it-s-rates.patch b/queue-2.6.33/mac80211-fix-supported-rates-ie-if-ap-doesn-t-give-us-it-s-rates.patch new file mode 100644 index 00000000000..dc7a3c9c569 --- /dev/null +++ b/queue-2.6.33/mac80211-fix-supported-rates-ie-if-ap-doesn-t-give-us-it-s-rates.patch @@ -0,0 +1,55 @@ +From 76f273640134f3eb8257179cd5b3bc6ba5fe4a96 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 28 Apr 2010 17:03:15 +0200 +Subject: mac80211: fix supported rates IE if AP doesn't give us it's rates + +From: Stanislaw Gruszka + +commit 76f273640134f3eb8257179cd5b3bc6ba5fe4a96 upstream. + +If AP do not provide us supported rates before assiociation, send +all rates we are supporting instead of empty information element. + +v1 -> v2: Add comment. + +Signed-off-by: Stanislaw Gruszka +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mlme.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -270,12 +270,6 @@ static void ieee80211_send_assoc(struct + if (wk->bss->wmm_used) + wmm = 1; + +- /* get all rates supported by the device and the AP as +- * some APs don't like getting a superset of their rates +- * in the association request (e.g. D-Link DAP 1353 in +- * b-only mode) */ +- rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates); +- + if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) && + (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT)) + capab |= WLAN_CAPABILITY_SPECTRUM_MGMT; +@@ -310,6 +304,17 @@ static void ieee80211_send_assoc(struct + *pos++ = wk->ssid_len; + memcpy(pos, wk->ssid, wk->ssid_len); + ++ if (wk->bss->supp_rates_len) { ++ /* get all rates supported by the device and the AP as ++ * some APs don't like getting a superset of their rates ++ * in the association request (e.g. D-Link DAP 1353 in ++ * b-only mode) */ ++ rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates); ++ } else { ++ rates = ~0; ++ rates_len = sband->n_bitrates; ++ } ++ + /* add all rates which were marked to be used above */ + supp_rates_len = rates_len; + if (supp_rates_len > 8) diff --git a/queue-2.6.33/mips-fpu-emulator-allow-cause-bits-of-fcsr-to-be-writeable-by-ctc1.patch b/queue-2.6.33/mips-fpu-emulator-allow-cause-bits-of-fcsr-to-be-writeable-by-ctc1.patch new file mode 100644 index 00000000000..5358fb2b3b0 --- /dev/null +++ b/queue-2.6.33/mips-fpu-emulator-allow-cause-bits-of-fcsr-to-be-writeable-by-ctc1.patch @@ -0,0 +1,104 @@ +From 95e8f634d7a3ea5af40ec3fa42c8a152fd3a0624 Mon Sep 17 00:00:00 2001 +From: Shane McDonald +Date: Thu, 6 May 2010 23:26:57 -0600 +Subject: MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1 + +From: Shane McDonald + +commit 95e8f634d7a3ea5af40ec3fa42c8a152fd3a0624 upstream. + + In the FPU emulator code of the MIPS, the Cause bits of the FCSR register + are not currently writeable by the ctc1 instruction. In odd corner cases, + this can cause problems. For example, a case existed where a divide-by-zero + exception was generated by the FPU, and the signal handler attempted to + restore the FPU registers to their state before the exception occurred. In + this particular setup, writing the old value to the FCSR register would + cause another divide-by-zero exception to occur immediately. The solution + is to change the ctc1 instruction emulator code to allow the Cause bits of + the FCSR register to be writeable. This is the behaviour of the hardware + that the code is emulating. + + This problem was found by Shane McDonald, but the credit for the fix goes + to Kevin Kissell. In Kevin's words: + + I submit that the bug is indeed in that ctc_op: case of the emulator. The + Cause bits (17:12) are supposed to be writable by that instruction, but the + CTC1 emulation won't let them be updated by the instruction. I think that + actually if you just completely removed lines 387-388 [...] things would + work a good deal better. At least, it would be a more accurate emulation of + the architecturally defined FPU. If I wanted to be really, really pedantic + (which I sometimes do), I'd also protect the reserved bits that aren't + necessarily writable. + +Signed-off-by: Shane McDonald +To: anemo@mba.ocn.ne.jp +To: kevink@paralogos.com +To: sshtylyov@mvista.com +Patchwork: http://patchwork.linux-mips.org/patch/1205/ +Signed-off-by: Ralf Baechle +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + +--- + +--- + arch/mips/include/asm/mipsregs.h | 9 ++++++++- + arch/mips/math-emu/cp1emu.c | 15 +++++++++++---- + 2 files changed, 19 insertions(+), 5 deletions(-) + +--- a/arch/mips/include/asm/mipsregs.h ++++ b/arch/mips/include/asm/mipsregs.h +@@ -135,6 +135,12 @@ + #define FPU_CSR_COND7 0x80000000 /* $fcc7 */ + + /* ++ * Bits 18 - 20 of the FPU Status Register will be read as 0, ++ * and should be written as zero. ++ */ ++#define FPU_CSR_RSVD 0x001c0000 ++ ++/* + * X the exception cause indicator + * E the exception enable + * S the sticky/flag bit +@@ -161,7 +167,8 @@ + #define FPU_CSR_UDF_S 0x00000008 + #define FPU_CSR_INE_S 0x00000004 + +-/* rounding mode */ ++/* Bits 0 and 1 of FPU Status Register specify the rounding mode */ ++#define FPU_CSR_RM 0x00000003 + #define FPU_CSR_RN 0x0 /* nearest */ + #define FPU_CSR_RZ 0x1 /* towards zero */ + #define FPU_CSR_RU 0x2 /* towards +Infinity */ +--- a/arch/mips/math-emu/cp1emu.c ++++ b/arch/mips/math-emu/cp1emu.c +@@ -78,6 +78,9 @@ DEFINE_PER_CPU(struct mips_fpu_emulator_ + #define FPCREG_RID 0 /* $0 = revision id */ + #define FPCREG_CSR 31 /* $31 = csr */ + ++/* Determine rounding mode from the RM bits of the FCSR */ ++#define modeindex(v) ((v) & FPU_CSR_RM) ++ + /* Convert Mips rounding mode (0..3) to IEEE library modes. */ + static const unsigned char ieee_rm[4] = { + [FPU_CSR_RN] = IEEE754_RN, +@@ -384,10 +387,14 @@ static int cop1Emulate(struct pt_regs *x + (void *) (xcp->cp0_epc), + MIPSInst_RT(ir), value); + #endif +- value &= (FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03); +- ctx->fcr31 &= ~(FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03); +- /* convert to ieee library modes */ +- ctx->fcr31 |= (value & ~0x3) | ieee_rm[value & 0x3]; ++ ++ /* ++ * Don't write reserved bits, ++ * and convert to ieee library modes ++ */ ++ ctx->fcr31 = (value & ++ ~(FPU_CSR_RSVD | FPU_CSR_RM)) | ++ ieee_rm[modeindex(value)]; + } + if ((ctx->fcr31 >> 5) & ctx->fcr31 & FPU_CSR_ALL_E) { + return SIGFPE; diff --git a/queue-2.6.33/series b/queue-2.6.33/series index a7a77663444..a0b19b9131b 100644 --- a/queue-2.6.33/series +++ b/queue-2.6.33/series @@ -118,3 +118,23 @@ libertas-sdio-8686-set-ecsi-bit-for-1-bit-transfers.patch dm9000-fix-bug-spinlock-recursion.patch firmware_class-fix-memory-leak-free-allocated-pages.patch revert-remove-rwsem-lock-from-cpufreq_gov_stop-call-second-call-site.patch +alsa-echoaudio-fix-guru-meditation-00000005.48454c50.patch +v4l-dvb-dvb-core-fix-ule-decapsulation-bug.patch +v4l-dvb-fusionhdtv-use-quick-reads-for-i2c-ir-device-probing.patch +forcedeth-fix-tx-limit2-flag-check.patch +staging-rtl8192su-add-support-for-belkin-f5d8053-v6.patch +mips-fpu-emulator-allow-cause-bits-of-fcsr-to-be-writeable-by-ctc1.patch +v4l-dvb-budget-select-correct-frontends.patch +3c503-fix-irq-probing.patch +cxgb3-fix-linkup-issue.patch +mac80211-fix-supported-rates-ie-if-ap-doesn-t-give-us-it-s-rates.patch +v4l-dvb-uvcvideo-add-support-for-unbranded-arkmicro-18ec-3290-webcams.patch +v4l-dvb-uvcvideo-add-support-for-packard-bell-easynote-mx52-integrated-webcam.patch +v4l-dvb-uvcvideo-add-support-for-v4l2_pix_fmt_y16.patch +iwlagn-verify-flow-id-in-compressed-ba-packet.patch +kbuild-fix-modpost-segfault.patch +fix-spinaphore-down_spin.patch +ecryptfs-bugfix-for-error-related-to-ecryptfs_hash_buckets.patch +ath5k-initialize-ah-ah_current_channel.patch +input-rx51-keymap-fix-recent-compile-breakage.patch +v4l-dvb-13830-uvcvideo-add-another-yuyv-format-guid-for-isight-cameras.patch diff --git a/queue-2.6.33/staging-rtl8192su-add-support-for-belkin-f5d8053-v6.patch b/queue-2.6.33/staging-rtl8192su-add-support-for-belkin-f5d8053-v6.patch new file mode 100644 index 00000000000..11f8d2ad874 --- /dev/null +++ b/queue-2.6.33/staging-rtl8192su-add-support-for-belkin-f5d8053-v6.patch @@ -0,0 +1,31 @@ +From d615da093eb0f691a73a754589e2a4a24a6f1ca7 Mon Sep 17 00:00:00 2001 +From: Richard Airlie +Date: Mon, 5 Apr 2010 22:22:46 +0100 +Subject: staging: rtl8192su: add Support for Belkin F5D8053 v6 + +From: Richard Airlie + +commit d615da093eb0f691a73a754589e2a4a24a6f1ca7 upstream. + +Please find attached a patch which adds the device ID for the Belkin +F5D8053 v6 to the rtl8192su driver. I've tested this in 2.6.34-rc3 +(Ubuntu 9.10 amd64) and the network adapter is working flawlessly. + +Signed-off-by: Richard Airlie +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8192su/r8192U_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/rtl8192su/r8192U_core.c ++++ b/drivers/staging/rtl8192su/r8192U_core.c +@@ -118,6 +118,7 @@ static struct usb_device_id rtl8192_usb_ + {USB_DEVICE(0x07aa, 0x0043)}, + /* Belkin */ + {USB_DEVICE(0x050d, 0x805E)}, ++ {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */ + /* Sitecom */ + {USB_DEVICE(0x0df6, 0x0031)}, + {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */ diff --git a/queue-2.6.33/v4l-dvb-13830-uvcvideo-add-another-yuyv-format-guid-for-isight-cameras.patch b/queue-2.6.33/v4l-dvb-13830-uvcvideo-add-another-yuyv-format-guid-for-isight-cameras.patch new file mode 100644 index 00000000000..d375ae79719 --- /dev/null +++ b/queue-2.6.33/v4l-dvb-13830-uvcvideo-add-another-yuyv-format-guid-for-isight-cameras.patch @@ -0,0 +1,53 @@ +From 68f194e027ecfbbc8d5515bc40787e542eed59e9 Mon Sep 17 00:00:00 2001 +From: Daniel Ritz +Date: Sat, 12 Dec 2009 14:57:17 -0300 +Subject: V4L/DVB (13830): uvcvideo: add another YUYV format GUID for iSight cameras + +From: Daniel Ritz + +commit 68f194e027ecfbbc8d5515bc40787e542eed59e9 upstream. + +For some unknown reason, on a MacBookPro5,3 the iSight sometimes report +a different video format GUID. This patch add the other (wrong) GUID to +the format table, making the iSight work always w/o other problems. + +What it should report: 32595559-0000-0010-8000-00aa00389b71 +What it often reports: 32595559-0000-0010-8000-000000389b71 + +Signed-off-by: Daniel Ritz +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Cc: Leann Ogasawara +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/uvc/uvc_driver.c | 5 +++++ + drivers/media/video/uvc/uvcvideo.h | 3 +++ + 2 files changed, 8 insertions(+) + +--- a/drivers/media/video/uvc/uvc_driver.c ++++ b/drivers/media/video/uvc/uvc_driver.c +@@ -59,6 +59,11 @@ static struct uvc_format_desc uvc_fmts[] + .fcc = V4L2_PIX_FMT_YUYV, + }, + { ++ .name = "YUV 4:2:2 (YUYV)", ++ .guid = UVC_GUID_FORMAT_YUY2_ISIGHT, ++ .fcc = V4L2_PIX_FMT_YUYV, ++ }, ++ { + .name = "YUV 4:2:0 (NV12)", + .guid = UVC_GUID_FORMAT_NV12, + .fcc = V4L2_PIX_FMT_NV12, +--- a/drivers/media/video/uvc/uvcvideo.h ++++ b/drivers/media/video/uvc/uvcvideo.h +@@ -113,6 +113,9 @@ struct uvc_xu_control { + #define UVC_GUID_FORMAT_YUY2 \ + { 'Y', 'U', 'Y', '2', 0x00, 0x00, 0x10, 0x00, \ + 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71} ++#define UVC_GUID_FORMAT_YUY2_ISIGHT \ ++ { 'Y', 'U', 'Y', '2', 0x00, 0x00, 0x10, 0x00, \ ++ 0x80, 0x00, 0x00, 0x00, 0x00, 0x38, 0x9b, 0x71} + #define UVC_GUID_FORMAT_NV12 \ + { 'N', 'V', '1', '2', 0x00, 0x00, 0x10, 0x00, \ + 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71} diff --git a/queue-2.6.33/v4l-dvb-budget-select-correct-frontends.patch b/queue-2.6.33/v4l-dvb-budget-select-correct-frontends.patch new file mode 100644 index 00000000000..101fbd58820 --- /dev/null +++ b/queue-2.6.33/v4l-dvb-budget-select-correct-frontends.patch @@ -0,0 +1,38 @@ +From d46b36e7f927772bb72524dc9f1e384e3cb4a975 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Sat, 15 May 2010 13:45:37 -0300 +Subject: V4L/DVB: budget: Select correct frontends + +From: Ben Hutchings + +commit d46b36e7f927772bb72524dc9f1e384e3cb4a975 upstream. + +Update the Kconfig selections to match the code. + +Signed-off-by: Ben Hutchings +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/ttpci/Kconfig | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb/ttpci/Kconfig ++++ b/drivers/media/dvb/ttpci/Kconfig +@@ -68,13 +68,14 @@ config DVB_BUDGET + select DVB_VES1820 if !DVB_FE_CUSTOMISE + select DVB_L64781 if !DVB_FE_CUSTOMISE + select DVB_TDA8083 if !DVB_FE_CUSTOMISE +- select DVB_TDA10021 if !DVB_FE_CUSTOMISE +- select DVB_TDA10023 if !DVB_FE_CUSTOMISE + select DVB_S5H1420 if !DVB_FE_CUSTOMISE + select DVB_TDA10086 if !DVB_FE_CUSTOMISE + select DVB_TDA826X if !DVB_FE_CUSTOMISE + select DVB_LNBP21 if !DVB_FE_CUSTOMISE + select DVB_TDA1004X if !DVB_FE_CUSTOMISE ++ select DVB_ISL6423 if !DVB_FE_CUSTOMISE ++ select DVB_STV090x if !DVB_FE_CUSTOMISE ++ select DVB_STV6110x if !DVB_FE_CUSTOMISE + help + Support for simple SAA7146 based DVB cards (so called Budget- + or Nova-PCI cards) without onboard MPEG2 decoder, and without diff --git a/queue-2.6.33/v4l-dvb-dvb-core-fix-ule-decapsulation-bug.patch b/queue-2.6.33/v4l-dvb-dvb-core-fix-ule-decapsulation-bug.patch new file mode 100644 index 00000000000..3c39717f109 --- /dev/null +++ b/queue-2.6.33/v4l-dvb-dvb-core-fix-ule-decapsulation-bug.patch @@ -0,0 +1,78 @@ +From 5c331fc8c19e181bffab46e9d18e1637cdc47170 Mon Sep 17 00:00:00 2001 +From: Ang Way Chuang +Date: Thu, 27 May 2010 02:02:09 -0300 +Subject: V4L/DVB: dvb-core: Fix ULE decapsulation bug + +From: Ang Way Chuang + +commit 5c331fc8c19e181bffab46e9d18e1637cdc47170 upstream. + +Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed +into the remaining bytes of a MPEG2-TS frame + +ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation +code has a bug that incorrectly treats ULE SNDU packed into the +remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer +field on the subsequent MPEG2-TS frame. + +Signed-off-by: Ang Way Chuang +Acked-by: Jarod Wilson +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/dvb-core/dvb_net.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/media/dvb/dvb-core/dvb_net.c ++++ b/drivers/media/dvb/dvb-core/dvb_net.c +@@ -350,6 +350,7 @@ static void dvb_net_ule( struct net_devi + const u8 *ts, *ts_end, *from_where = NULL; + u8 ts_remain = 0, how_much = 0, new_ts = 1; + struct ethhdr *ethh = NULL; ++ bool error = false; + + #ifdef ULE_DEBUG + /* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */ +@@ -459,10 +460,16 @@ static void dvb_net_ule( struct net_devi + + /* Drop partly decoded SNDU, reset state, resync on PUSI. */ + if (priv->ule_skb) { +- dev_kfree_skb( priv->ule_skb ); ++ error = true; ++ dev_kfree_skb(priv->ule_skb); ++ } ++ ++ if (error || priv->ule_sndu_remain) { + dev->stats.rx_errors++; + dev->stats.rx_frame_errors++; ++ error = false; + } ++ + reset_ule(priv); + priv->need_pusi = 1; + continue; +@@ -534,6 +541,7 @@ static void dvb_net_ule( struct net_devi + from_where += 2; + } + ++ priv->ule_sndu_remain = priv->ule_sndu_len + 2; + /* + * State of current TS: + * ts_remain (remaining bytes in the current TS cell) +@@ -543,6 +551,7 @@ static void dvb_net_ule( struct net_devi + */ + switch (ts_remain) { + case 1: ++ priv->ule_sndu_remain--; + priv->ule_sndu_type = from_where[0] << 8; + priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */ + ts_remain -= 1; from_where += 1; +@@ -556,6 +565,7 @@ static void dvb_net_ule( struct net_devi + default: /* complete ULE header is present in current TS. */ + /* Extract ULE type field. */ + if (priv->ule_sndu_type_1) { ++ priv->ule_sndu_type_1 = 0; + priv->ule_sndu_type |= from_where[0]; + from_where += 1; /* points to payload start. */ + ts_remain -= 1; diff --git a/queue-2.6.33/v4l-dvb-fusionhdtv-use-quick-reads-for-i2c-ir-device-probing.patch b/queue-2.6.33/v4l-dvb-fusionhdtv-use-quick-reads-for-i2c-ir-device-probing.patch new file mode 100644 index 00000000000..d9ea06d3d73 --- /dev/null +++ b/queue-2.6.33/v4l-dvb-fusionhdtv-use-quick-reads-for-i2c-ir-device-probing.patch @@ -0,0 +1,80 @@ +From 806b07c29b711aaf90c81d2a19711607769f8246 Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Wed, 26 May 2010 10:05:11 -0300 +Subject: V4L/DVB: FusionHDTV: Use quick reads for I2C IR device probing + +From: Jean Delvare + +commit 806b07c29b711aaf90c81d2a19711607769f8246 upstream. + +IR support on FusionHDTV cards is broken since kernel 2.6.31. One side +effect of the switch to the standard binding model for IR I2C devices +was to let i2c-core do the probing instead of the ir-kbd-i2c driver. +There is a slight difference between the two probe methods: i2c-core +uses 0-byte writes, while the ir-kbd-i2c was using 0-byte reads. As +some IR I2C devices only support reads, the new probe method fails to +detect them. + +For now, revert to letting the driver do the probe, using 0-byte +reads. In the future, i2c-core will be extended to let callers of +i2c_new_probed_device() provide a custom probing function. + +Signed-off-by: Jean Delvare +Tested-by: "Timothy D. Lenz" +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/cx23885/cx23885-i2c.c | 12 +++++++++++- + drivers/media/video/cx88/cx88-i2c.c | 16 +++++++++++++++- + 2 files changed, 26 insertions(+), 2 deletions(-) + +--- a/drivers/media/video/cx23885/cx23885-i2c.c ++++ b/drivers/media/video/cx23885/cx23885-i2c.c +@@ -365,7 +365,17 @@ int cx23885_i2c_register(struct cx23885_ + + memset(&info, 0, sizeof(struct i2c_board_info)); + strlcpy(info.type, "ir_video", I2C_NAME_SIZE); +- i2c_new_probed_device(&bus->i2c_adap, &info, addr_list); ++ /* ++ * We can't call i2c_new_probed_device() because it uses ++ * quick writes for probing and the IR receiver device only ++ * replies to reads. ++ */ ++ if (i2c_smbus_xfer(&bus->i2c_adap, addr_list[0], 0, ++ I2C_SMBUS_READ, 0, I2C_SMBUS_QUICK, ++ NULL) >= 0) { ++ info.addr = addr_list[0]; ++ i2c_new_device(&bus->i2c_adap, &info); ++ } + } + + return bus->i2c_rc; +--- a/drivers/media/video/cx88/cx88-i2c.c ++++ b/drivers/media/video/cx88/cx88-i2c.c +@@ -188,10 +188,24 @@ int cx88_i2c_init(struct cx88_core *core + 0x18, 0x6b, 0x71, + I2C_CLIENT_END + }; ++ const unsigned short *addrp; + + memset(&info, 0, sizeof(struct i2c_board_info)); + strlcpy(info.type, "ir_video", I2C_NAME_SIZE); +- i2c_new_probed_device(&core->i2c_adap, &info, addr_list); ++ /* ++ * We can't call i2c_new_probed_device() because it uses ++ * quick writes for probing and at least some R receiver ++ * devices only reply to reads. ++ */ ++ for (addrp = addr_list; *addrp != I2C_CLIENT_END; addrp++) { ++ if (i2c_smbus_xfer(&core->i2c_adap, *addrp, 0, ++ I2C_SMBUS_READ, 0, ++ I2C_SMBUS_QUICK, NULL) >= 0) { ++ info.addr = *addrp; ++ i2c_new_device(&core->i2c_adap, &info); ++ break; ++ } ++ } + } + return core->i2c_rc; + } diff --git a/queue-2.6.33/v4l-dvb-uvcvideo-add-support-for-packard-bell-easynote-mx52-integrated-webcam.patch b/queue-2.6.33/v4l-dvb-uvcvideo-add-support-for-packard-bell-easynote-mx52-integrated-webcam.patch new file mode 100644 index 00000000000..ad71d1f02cc --- /dev/null +++ b/queue-2.6.33/v4l-dvb-uvcvideo-add-support-for-packard-bell-easynote-mx52-integrated-webcam.patch @@ -0,0 +1,38 @@ +From f129b03ba272c86c42ad476684caa0d6109cb383 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Sat, 13 Mar 2010 18:12:15 -0300 +Subject: V4L/DVB: uvcvideo: Add support for Packard Bell EasyNote MX52 integrated webcam + +From: Laurent Pinchart + +commit f129b03ba272c86c42ad476684caa0d6109cb383 upstream. + +The camera requires the STREAM_NO_FID quirk. Add a corresponding entry +in the device IDs list. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/uvc/uvc_driver.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/media/video/uvc/uvc_driver.c ++++ b/drivers/media/video/uvc/uvc_driver.c +@@ -2059,6 +2059,15 @@ static struct usb_device_id uvc_ids[] = + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = UVC_QUIRK_STREAM_NO_FID }, ++ /* Syntek (Packard Bell EasyNote MX52 */ ++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = 0x174f, ++ .idProduct = 0x8a12, ++ .bInterfaceClass = USB_CLASS_VIDEO, ++ .bInterfaceSubClass = 1, ++ .bInterfaceProtocol = 0, ++ .driver_info = UVC_QUIRK_STREAM_NO_FID }, + /* Syntek (Asus F9SG) */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, diff --git a/queue-2.6.33/v4l-dvb-uvcvideo-add-support-for-unbranded-arkmicro-18ec-3290-webcams.patch b/queue-2.6.33/v4l-dvb-uvcvideo-add-support-for-unbranded-arkmicro-18ec-3290-webcams.patch new file mode 100644 index 00000000000..6bf2997fb98 --- /dev/null +++ b/queue-2.6.33/v4l-dvb-uvcvideo-add-support-for-unbranded-arkmicro-18ec-3290-webcams.patch @@ -0,0 +1,38 @@ +From 1e4d05bc95a0fe2972c5c91ed45466587d07cd2c Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Thu, 4 Mar 2010 07:51:25 -0300 +Subject: V4L/DVB: uvcvideo: Add support for unbranded Arkmicro 18ec:3290 webcams + +From: Laurent Pinchart + +commit 1e4d05bc95a0fe2972c5c91ed45466587d07cd2c upstream. + +The camera requires the PROBE_DEF quirk. Add a corresponding entry in +the device IDs list. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/uvc/uvc_driver.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/media/video/uvc/uvc_driver.c ++++ b/drivers/media/video/uvc/uvc_driver.c +@@ -2123,6 +2123,15 @@ static struct usb_device_id uvc_ids[] = + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = UVC_QUIRK_PROBE_MINMAX }, ++ /* Arkmicro unbranded */ ++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = 0x18ec, ++ .idProduct = 0x3290, ++ .bInterfaceClass = USB_CLASS_VIDEO, ++ .bInterfaceSubClass = 1, ++ .bInterfaceProtocol = 0, ++ .driver_info = UVC_QUIRK_PROBE_DEF }, + /* Bodelin ProScopeHR */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_DEV_HI diff --git a/queue-2.6.33/v4l-dvb-uvcvideo-add-support-for-v4l2_pix_fmt_y16.patch b/queue-2.6.33/v4l-dvb-uvcvideo-add-support-for-v4l2_pix_fmt_y16.patch new file mode 100644 index 00000000000..d9f43707342 --- /dev/null +++ b/queue-2.6.33/v4l-dvb-uvcvideo-add-support-for-v4l2_pix_fmt_y16.patch @@ -0,0 +1,58 @@ +From 61421206833a4085d9bdf35b2b84cd9a67dfdfac Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Mon, 12 Apr 2010 10:41:22 -0300 +Subject: V4L/DVB: uvcvideo: Add support for V4L2_PIX_FMT_Y16 + +From: Laurent Pinchart + +commit 61421206833a4085d9bdf35b2b84cd9a67dfdfac upstream. + +The Miricle 307K (17dc:0202) camera reports a 16-bit greyscale format, +support it in the driver. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/uvc/uvc_driver.c | 7 ++++++- + drivers/media/video/uvc/uvcvideo.h | 4 +++- + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/media/video/uvc/uvc_driver.c ++++ b/drivers/media/video/uvc/uvc_driver.c +@@ -84,11 +84,16 @@ static struct uvc_format_desc uvc_fmts[] + .fcc = V4L2_PIX_FMT_UYVY, + }, + { +- .name = "Greyscale", ++ .name = "Greyscale (8-bit)", + .guid = UVC_GUID_FORMAT_Y800, + .fcc = V4L2_PIX_FMT_GREY, + }, + { ++ .name = "Greyscale (16-bit)", ++ .guid = UVC_GUID_FORMAT_Y16, ++ .fcc = V4L2_PIX_FMT_Y16, ++ }, ++ { + .name = "RGB Bayer", + .guid = UVC_GUID_FORMAT_BY8, + .fcc = V4L2_PIX_FMT_SBGGR8, +--- a/drivers/media/video/uvc/uvcvideo.h ++++ b/drivers/media/video/uvc/uvcvideo.h +@@ -128,11 +128,13 @@ struct uvc_xu_control { + #define UVC_GUID_FORMAT_Y800 \ + { 'Y', '8', '0', '0', 0x00, 0x00, 0x10, 0x00, \ + 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71} ++#define UVC_GUID_FORMAT_Y16 \ ++ { 'Y', '1', '6', ' ', 0x00, 0x00, 0x10, 0x00, \ ++ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71} + #define UVC_GUID_FORMAT_BY8 \ + { 'B', 'Y', '8', ' ', 0x00, 0x00, 0x10, 0x00, \ + 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71} + +- + /* ------------------------------------------------------------------------ + * Driver specific constants. + */ diff --git a/queue-2.6.33/x86-send-a-sigtrap-for-user-icebp-traps.patch b/queue-2.6.33/x86-send-a-sigtrap-for-user-icebp-traps.patch index d33391cdbb8..411267b7c5d 100644 --- a/queue-2.6.33/x86-send-a-sigtrap-for-user-icebp-traps.patch +++ b/queue-2.6.33/x86-send-a-sigtrap-for-user-icebp-traps.patch @@ -63,7 +63,7 @@ Signed-off-by: Greg Kroah-Hartman + * then it's very likely the result of an icebp/int01 trap. + * User wants a sigtrap for that. + */ -+ if (!dr6 && user_mode(regs)) ++ if (!(dr6 & ~0xffff0ff0) && user_mode(regs)) + user_icebp = 1; + /* Catch kmemcheck conditions first of all! */