From f2433c2c76fe45fa1ff28c41f08b600035c7267a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 1 Dec 2009 17:01:45 -0800 Subject: [PATCH] more .31 patches --- ...-fixing-infinite-loop-in-resume-path.patch | 37 ++++ ...ix-suspend-with-active-audio-streams.patch | 50 +++++ ...-work-around-mac80211-race-condition.patch | 63 +++++++ ...i915-fix-irq-stall-issue-on-ironlake.patch | 51 +++++ .../drm-i915-select-config_shmem.patch | 38 ++++ ...-edids-with-bad-htotal-vtotal-values.patch | 37 ++++ ...i-pdc-handshake-for-via-centaur-cpus.patch | 44 +++++ ...ct-o_direct-flag-also-in-fuse_create.patch | 43 +++++ ...ima-replace-gfp_kernel-with-gfp_nofs.patch | 80 ++++++++ ...-on-file-transfer-stalled-in-ht-mode.patch | 37 ++++ ...protection-mechanism-for-6000-series.patch | 148 +++++++++++++++ ...mac80211-fix-spurious-delba-handling.patch | 178 ++++++++++++++++++ .../mac80211-fix-two-remote-exploits.patch | 64 +++++++ ...which-causes-getcwd-to-return-enoent.patch | 40 ++++ queue-2.6.31/rfkill-fix-miscdev-ops.patch | 32 ++++ queue-2.6.31/series | 24 +++ ...-acpi-fix-sign-of-erestartsys-return.patch | 32 ++++ ...o-gain-wb-expo-for-the-ov7660-sensor.patch | 59 ++++++ ...-gspca-sonixj-webcam-0c45-6148-added.patch | 61 ++++++ ...nixj-do-the-ov7660-sensor-work-again.patch | 99 ++++++++++ ...-12691-gspca-sonixj-don-t-use-mdelay.patch | 29 +++ ...-drivers-for-0c45-60fc-and-0c45-613e.patch | 45 +++++ ...4l1-compat-fix-vidioc_g_std-handling.patch | 53 ++++++ ...dio-gemtek-pci-fix-double-mutex_lock.patch | 35 ++++ ...usionhdtv-dvb-t-dual-digital-4-rev-1.patch | 50 +++++ 25 files changed, 1429 insertions(+) create mode 100644 queue-2.6.31/asoc-aic23-fixing-infinite-loop-in-resume-path.patch create mode 100644 queue-2.6.31/asoc-fix-suspend-with-active-audio-streams.patch create mode 100644 queue-2.6.31/b43-work-around-mac80211-race-condition.patch create mode 100644 queue-2.6.31/drm-i915-fix-irq-stall-issue-on-ironlake.patch create mode 100644 queue-2.6.31/drm-i915-select-config_shmem.patch create mode 100644 queue-2.6.31/drm-work-around-edids-with-bad-htotal-vtotal-values.patch create mode 100644 queue-2.6.31/enable-acpi-pdc-handshake-for-via-centaur-cpus.patch create mode 100644 queue-2.6.31/fuse-reject-o_direct-flag-also-in-fuse_create.patch create mode 100644 queue-2.6.31/ima-replace-gfp_kernel-with-gfp_nofs.patch create mode 100644 queue-2.6.31/iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch create mode 100644 queue-2.6.31/iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch create mode 100644 queue-2.6.31/mac80211-fix-spurious-delba-handling.patch create mode 100644 queue-2.6.31/mac80211-fix-two-remote-exploits.patch create mode 100644 queue-2.6.31/nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch create mode 100644 queue-2.6.31/rfkill-fix-miscdev-ops.patch create mode 100644 queue-2.6.31/thinkpad-acpi-fix-sign-of-erestartsys-return.patch create mode 100644 queue-2.6.31/v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch create mode 100644 queue-2.6.31/v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch create mode 100644 queue-2.6.31/v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch create mode 100644 queue-2.6.31/v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch create mode 100644 queue-2.6.31/v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch create mode 100644 queue-2.6.31/v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch create mode 100644 queue-2.6.31/v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch create mode 100644 queue-2.6.31/v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch diff --git a/queue-2.6.31/asoc-aic23-fixing-infinite-loop-in-resume-path.patch b/queue-2.6.31/asoc-aic23-fixing-infinite-loop-in-resume-path.patch new file mode 100644 index 00000000000..1d33e880923 --- /dev/null +++ b/queue-2.6.31/asoc-aic23-fixing-infinite-loop-in-resume-path.patch @@ -0,0 +1,37 @@ +From e9ff5eb2ae018fe2298c68746c873bf828c6b10e Mon Sep 17 00:00:00 2001 +From: Anuj Aggarwal +Date: Fri, 27 Nov 2009 17:40:58 +0530 +Subject: ASoC: AIC23: Fixing infinite loop in resume path + +From: Anuj Aggarwal + +commit e9ff5eb2ae018fe2298c68746c873bf828c6b10e upstream. + +This patch fixes two issues: +a) Infinite loop in resume function +b) Writes to non-existing registers in resume function + +Signed-off-by: Anuj Aggarwal +Acked-by: Liam Girdwood +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/tlv320aic23.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/soc/codecs/tlv320aic23.c ++++ b/sound/soc/codecs/tlv320aic23.c +@@ -625,11 +625,10 @@ static int tlv320aic23_resume(struct pla + { + struct snd_soc_device *socdev = platform_get_drvdata(pdev); + struct snd_soc_codec *codec = socdev->card->codec; +- int i; + u16 reg; + + /* Sync reg_cache with the hardware */ +- for (reg = 0; reg < ARRAY_SIZE(tlv320aic23_reg); i++) { ++ for (reg = 0; reg < TLV320AIC23_RESET; reg++) { + u16 val = tlv320aic23_read_reg_cache(codec, reg); + tlv320aic23_write(codec, reg, val); + } diff --git a/queue-2.6.31/asoc-fix-suspend-with-active-audio-streams.patch b/queue-2.6.31/asoc-fix-suspend-with-active-audio-streams.patch new file mode 100644 index 00000000000..a6a471409ee --- /dev/null +++ b/queue-2.6.31/asoc-fix-suspend-with-active-audio-streams.patch @@ -0,0 +1,50 @@ +From 50b6bce59d154b5db137907a5c0ed45a4e7a3829 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Mon, 23 Nov 2009 13:11:53 +0000 +Subject: ASoC: Fix suspend with active audio streams + +From: Mark Brown + +commit 50b6bce59d154b5db137907a5c0ed45a4e7a3829 upstream. + +When we get a stream suspend event force the power down since otherwise +the stream would remain marked as active. In future we'll probably want +to make this stream-specific and add an interface to make the power down +of other widgets optional in order to support leaving bypass paths +active while suspending the processor. + +Reported-by: Joonyoung Shim +Tested-by: Joonyoung Shim +Acked-by: Liam Girdwood +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-dapm.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -774,9 +774,19 @@ static int dapm_power_widgets(struct snd + if (!w->power_check) + continue; + +- power = w->power_check(w); +- if (power) +- sys_power = 1; ++ /* If we're suspending then pull down all the ++ * power. */ ++ switch (event) { ++ case SND_SOC_DAPM_STREAM_SUSPEND: ++ power = 0; ++ break; ++ ++ default: ++ power = w->power_check(w); ++ if (power) ++ sys_power = 1; ++ break; ++ } + + if (w->power == power) + continue; diff --git a/queue-2.6.31/b43-work-around-mac80211-race-condition.patch b/queue-2.6.31/b43-work-around-mac80211-race-condition.patch new file mode 100644 index 00000000000..745ce059cc5 --- /dev/null +++ b/queue-2.6.31/b43-work-around-mac80211-race-condition.patch @@ -0,0 +1,63 @@ +From 18c6951091eca7645005a71b556106cc99a6f4b1 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Wed, 29 Jul 2009 10:54:06 -0500 +Subject: b43: Work around mac80211 race condition + +From: Larry Finger + +commit 18c6951091eca7645005a71b556106cc99a6f4b1 upstream. + +As shown in http://thread.gmane.org/gmane.linux.kernel.wireless.general/36497, +mac80211 has a bug that allows a call to the TX routine after the queues have +been stopped. This situation will only occur under extreme stress. Although +b43 does not crash when this condition occurs, it does generate a WARN_ON and +also logs a queue overrun message. This patch recognizes b43 is not at fault +and logs a message only when the most verbose debugging mode is enabled. In +the unlikely event that the queue is not stopped when the DMA queue becomes +full, then a warning is issued. + +During testing of this patch with one output stream running repeated tcpperf +writes and a second running a flood ping, this routine was entered with +the DMA ring stopped about once per hour. The condition where the DMA queue is +full but the ring has not been stopped has never been seen by me. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Cc: Michael Buesch +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/dma.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/b43/dma.c ++++ b/drivers/net/wireless/b43/dma.c +@@ -1334,13 +1334,22 @@ int b43_dma_tx(struct b43_wldev *dev, st + spin_lock_irqsave(&ring->lock, flags); + + B43_WARN_ON(!ring->tx); +- /* Check if the queue was stopped in mac80211, +- * but we got called nevertheless. +- * That would be a mac80211 bug. */ +- B43_WARN_ON(ring->stopped); + +- if (unlikely(free_slots(ring) < TX_SLOTS_PER_FRAME)) { +- b43warn(dev->wl, "DMA queue overflow\n"); ++ if (unlikely(ring->stopped)) { ++ /* We get here only because of a bug in mac80211. ++ * Because of a race, one packet may be queued after ++ * the queue is stopped, thus we got called when we shouldn't. ++ * For now, just refuse the transmit. */ ++ if (b43_debug(dev, B43_DBG_DMAVERBOSE)) ++ b43err(dev->wl, "Packet after queue stopped\n"); ++ err = -ENOSPC; ++ goto out_unlock; ++ } ++ ++ if (unlikely(WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME))) { ++ /* If we get here, we have a real error with the queue ++ * full, but queues not stopped. */ ++ b43err(dev->wl, "DMA queue overflow\n"); + err = -ENOSPC; + goto out_unlock; + } diff --git a/queue-2.6.31/drm-i915-fix-irq-stall-issue-on-ironlake.patch b/queue-2.6.31/drm-i915-fix-irq-stall-issue-on-ironlake.patch new file mode 100644 index 00000000000..f7790455c5e --- /dev/null +++ b/queue-2.6.31/drm-i915-fix-irq-stall-issue-on-ironlake.patch @@ -0,0 +1,51 @@ +From 2d109a845dd3074885db726892c629ab73dd0ed8 Mon Sep 17 00:00:00 2001 +From: Zou, Nanhai +Date: Fri, 6 Nov 2009 02:13:01 +0000 +Subject: drm/i915: Fix IRQ stall issue on Ironlake + +From: Zou, Nanhai + +commit 2d109a845dd3074885db726892c629ab73dd0ed8 upstream. + +The master irq control in DE must be disabled before irq handling, +and enable after the process. This fixes the irq stall issue on +Ironlake. + +Signed-off-by: Zou, Nanhai +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_irq.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -253,10 +253,15 @@ irqreturn_t igdng_irq_handler(struct drm + { + drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; + int ret = IRQ_NONE; +- u32 de_iir, gt_iir; ++ u32 de_iir, gt_iir, de_ier; + u32 new_de_iir, new_gt_iir; + struct drm_i915_master_private *master_priv; + ++ /* disable master interrupt before clearing iir */ ++ de_ier = I915_READ(DEIER); ++ I915_WRITE(DEIER, de_ier & ~DE_MASTER_IRQ_CONTROL); ++ (void)I915_READ(DEIER); ++ + de_iir = I915_READ(DEIIR); + gt_iir = I915_READ(GTIIR); + +@@ -287,6 +292,9 @@ irqreturn_t igdng_irq_handler(struct drm + gt_iir = new_gt_iir; + } + ++ I915_WRITE(DEIER, de_ier); ++ (void)I915_READ(DEIER); ++ + return ret; + } + diff --git a/queue-2.6.31/drm-i915-select-config_shmem.patch b/queue-2.6.31/drm-i915-select-config_shmem.patch new file mode 100644 index 00000000000..d28919fb63e --- /dev/null +++ b/queue-2.6.31/drm-i915-select-config_shmem.patch @@ -0,0 +1,38 @@ +From ca9ab10033d190c1ede85fdf456307bdfdabf079 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Sun, 22 Nov 2009 15:40:31 +0000 +Subject: drm/i915: Select CONFIG_SHMEM + +From: Chris Wilson + +commit ca9ab10033d190c1ede85fdf456307bdfdabf079 upstream. + +The driver requires shmfs as the backing filesystem to handle the buffer +objects, so ensure it is selected if the user chooses to build our +driver. + +Fixes: Bug 14662 - Dell E5500 kernel panic with KMS +http://bugzilla.kernel.org/show_bug.cgi?id=14662 + +The revealing nature of the panic is the NULL function pointer +dereference in read_cache_page_async(). + +Signed-off-by: Chris Wilson +Reported-and-tested-by: Mateusz Kaduk +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -82,6 +82,7 @@ config DRM_I830 + config DRM_I915 + tristate "i915 driver" + depends on AGP_INTEL ++ select SHMEM + select FB_CFB_FILLRECT + select FB_CFB_COPYAREA + select FB_CFB_IMAGEBLIT diff --git a/queue-2.6.31/drm-work-around-edids-with-bad-htotal-vtotal-values.patch b/queue-2.6.31/drm-work-around-edids-with-bad-htotal-vtotal-values.patch new file mode 100644 index 00000000000..4e4c1a1fb8c --- /dev/null +++ b/queue-2.6.31/drm-work-around-edids-with-bad-htotal-vtotal-values.patch @@ -0,0 +1,37 @@ +From 7064fef56369c9e2c6e35ff6d6b4b63d42a859ce Mon Sep 17 00:00:00 2001 +From: Jesse Barnes +Date: Thu, 5 Nov 2009 10:12:54 -0800 +Subject: drm: work around EDIDs with bad htotal/vtotal values + +From: Jesse Barnes + +commit 7064fef56369c9e2c6e35ff6d6b4b63d42a859ce upstream. + +We did this on the userspace side, but we need a similar fix for the +kernel. + +Fixes LP #460664. + +Signed-off-by: Jesse Barnes +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_edid.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -333,6 +333,12 @@ static struct drm_display_mode *drm_mode + mode->vsync_end = mode->vsync_start + vsync_pulse_width; + mode->vtotal = mode->vdisplay + vblank; + ++ /* Some EDIDs have bogus h/vtotal values */ ++ if (mode->hsync_end > mode->htotal) ++ mode->htotal = mode->hsync_end + 1; ++ if (mode->vsync_end > mode->vtotal) ++ mode->vtotal = mode->vsync_end + 1; ++ + drm_mode_set_name(mode); + + if (pt->misc & DRM_EDID_PT_INTERLACED) diff --git a/queue-2.6.31/enable-acpi-pdc-handshake-for-via-centaur-cpus.patch b/queue-2.6.31/enable-acpi-pdc-handshake-for-via-centaur-cpus.patch new file mode 100644 index 00000000000..229d1b23b1a --- /dev/null +++ b/queue-2.6.31/enable-acpi-pdc-handshake-for-via-centaur-cpus.patch @@ -0,0 +1,44 @@ +From d77b81974521c82fa6fda38dfff1b491dcc62a32 Mon Sep 17 00:00:00 2001 +From: Harald Welte +Date: Tue, 24 Nov 2009 16:53:00 +0100 +Subject: [CPUFREQ] Enable ACPI PDC handshake for VIA/Centaur CPUs + +From: Harald Welte + +commit d77b81974521c82fa6fda38dfff1b491dcc62a32 upstream. + +In commit 0de51088e6a82bc8413d3ca9e28bbca2788b5b53, we introduced the +use of acpi-cpufreq on VIA/Centaur CPU's by removing a vendor check for +VENDOR_INTEL. However, as it turns out, at least the Nano CPU's also +need the PDC (processor driver capabilities) handshake in order to +activate the methods required for acpi-cpufreq. + +Since arch_acpi_processor_init_pdc() contains another vendor check for +Intel, the PDC is not initialized on VIA CPU's. The resulting behavior +of a current mainline kernel on such systems is: acpi-cpufreq +loads and it indicates CPU frequency changes. However, the CPU stays at +a single frequency + +This trivial patch ensures that init_intel_pdc() is called on Intel and +VIA/Centaur CPU's alike. + +Signed-off-by: Harald Welte +Signed-off-by: Dave Jones +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/acpi/processor.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/acpi/processor.c ++++ b/arch/x86/kernel/acpi/processor.c +@@ -79,7 +79,8 @@ void arch_acpi_processor_init_pdc(struct + struct cpuinfo_x86 *c = &cpu_data(pr->id); + + pr->pdc = NULL; +- if (c->x86_vendor == X86_VENDOR_INTEL) ++ if (c->x86_vendor == X86_VENDOR_INTEL || ++ c->x86_vendor == X86_VENDOR_CENTAUR) + init_intel_pdc(pr, c); + + return; diff --git a/queue-2.6.31/fuse-reject-o_direct-flag-also-in-fuse_create.patch b/queue-2.6.31/fuse-reject-o_direct-flag-also-in-fuse_create.patch new file mode 100644 index 00000000000..12baeacae12 --- /dev/null +++ b/queue-2.6.31/fuse-reject-o_direct-flag-also-in-fuse_create.patch @@ -0,0 +1,43 @@ +From 1b7323965a8c6eee9dc4e345a7ae4bff1dc93149 Mon Sep 17 00:00:00 2001 +From: Csaba Henk +Date: Fri, 27 Nov 2009 19:30:14 +0530 +Subject: fuse: reject O_DIRECT flag also in fuse_create + +From: Csaba Henk + +commit 1b7323965a8c6eee9dc4e345a7ae4bff1dc93149 upstream. + +The comment in fuse_open about O_DIRECT: + + "VFS checks this, but only _after_ ->open()" + +also holds for fuse_create, however, the same kind of check was missing there. + +As an impact of this bug, open(newfile, O_RDWR|O_CREAT|O_DIRECT) fails, but a +stub newfile will remain if the fuse server handled the implied FUSE_CREATE +request appropriately. + +Other impact: in the above situation ima_file_free() will complain to open/free +imbalance if CONFIG_IMA is set. + +Signed-off-by: Csaba Henk +Signed-off-by: Miklos Szeredi +Cc: Harshavardhana +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dir.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -385,6 +385,9 @@ static int fuse_create_open(struct inode + if (fc->no_create) + return -ENOSYS; + ++ if (flags & O_DIRECT) ++ return -EINVAL; ++ + forget_req = fuse_get_req(fc); + if (IS_ERR(forget_req)) + return PTR_ERR(forget_req); diff --git a/queue-2.6.31/ima-replace-gfp_kernel-with-gfp_nofs.patch b/queue-2.6.31/ima-replace-gfp_kernel-with-gfp_nofs.patch new file mode 100644 index 00000000000..b5788f61855 --- /dev/null +++ b/queue-2.6.31/ima-replace-gfp_kernel-with-gfp_nofs.patch @@ -0,0 +1,80 @@ +From c09c59e6a070d6af05f238f255aea268185273ef Mon Sep 17 00:00:00 2001 +From: Mimi Zohar +Date: Wed, 18 Nov 2009 16:16:06 -0500 +Subject: ima: replace GFP_KERNEL with GFP_NOFS + +From: Mimi Zohar + +commit c09c59e6a070d6af05f238f255aea268185273ef upstream. + +While running fsstress tests on the NFSv4 mounted ext3 and ext4 +filesystem, the following call trace was generated on the nfs +server machine. + +Replace GFP_KERNEL with GFP_NOFS in ima_iint_insert() to avoid a +potential deadlock. + + ================================= + [ INFO: inconsistent lock state ] + 2.6.31-31.el6.x86_64 #1 + --------------------------------- + inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage. + kswapd2/75 [HC0[0]:SC0[0]:HE1:SE1] takes: + (jbd2_handle){+.+.?.}, at: [] jbd2_journal_start+0xfe/0x13f + {RECLAIM_FS-ON-W} state was registered at: + [] mark_held_locks+0x65/0x99 + [] lockdep_trace_alloc+0xbd/0xf5 + [] kmem_cache_alloc+0x40/0x185 + [] ima_iint_insert+0x3d/0xf1 + [] ima_inode_alloc+0x25/0x44 + [] inode_init_always+0xec/0x271 + [] alloc_inode+0x51/0xa1 + [] new_inode+0x2e/0x94 + [] ext4_new_inode+0xb8/0xdc9 + [] ext4_create+0xcf/0x175 + [] vfs_create+0x82/0xb8 + [] do_filp_open+0x32c/0x9ee + [] do_sys_open+0x6c/0x12c + [] sys_open+0x2e/0x44 + [] system_call_fastpath+0x16/0x1b + [] 0xffffffffffffffff + irq event stamp: 90371 + hardirqs last enabled at (90371): [] + kmem_cache_alloc+0xf0/0x185 + hardirqs last disabled at (90370): [] + kmem_cache_alloc+0x89/0x185 + softirqs last enabled at (89492): [] + __do_softirq+0x1bf/0x1eb + softirqs last disabled at (89477): [] call_softirq+0x1c/0x30 + + other info that might help us debug this: + 2 locks held by kswapd2/75: + #0: (shrinker_rwsem){++++..}, at: [] shrink_slab+0x44/0x177 + #1: (&type->s_umount_key#25){++++..}, at: [] + +Reported-by: Muni P. Beerakam +Reported-by: Amit K. Arora +Signed-off-by: Mimi Zohar +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_iint.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/security/integrity/ima/ima_iint.c ++++ b/security/integrity/ima/ima_iint.c +@@ -58,11 +58,11 @@ struct ima_iint_cache *ima_iint_insert(s + + if (!ima_initialized) + return iint; +- iint = kmem_cache_alloc(iint_cache, GFP_KERNEL); ++ iint = kmem_cache_alloc(iint_cache, GFP_NOFS); + if (!iint) + return iint; + +- rc = radix_tree_preload(GFP_KERNEL); ++ rc = radix_tree_preload(GFP_NOFS); + if (rc < 0) + goto out; + diff --git a/queue-2.6.31/iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch b/queue-2.6.31/iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch new file mode 100644 index 00000000000..23d16ed1115 --- /dev/null +++ b/queue-2.6.31/iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch @@ -0,0 +1,37 @@ +From reinette.chatre@intel.com Tue Dec 1 16:35:13 2009 +From: Reinette Chatre +Date: Wed, 25 Nov 2009 11:03:48 -0800 +Subject: iwlwifi: Fix issue on file transfer stalled in HT mode +To: stable@kernel.org +Cc: Reinette Chatre , wey-yi.w.guy@intel.com, linville@tuxdriver.com +Message-ID: <1259175828-14489-3-git-send-email-reinette.chatre@intel.com> + + +From: Wey-Yi Guy + +commit d01032e4fd33110f9f3a085a36cb819c1dfc5827 upstream + +Turn on RTS/CTS for HT to prevent uCode TX fifo underrun + +This is fix for +http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2103 + +Signed-off-by: Wey-Yi Guy +Tested-by: Jiajia Zheng +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-1000.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/iwlwifi/iwl-1000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-1000.c +@@ -71,5 +71,6 @@ struct iwl_cfg iwl1000_bgn_cfg = { + .need_pll_cfg = true, + .max_ll_items = OTP_MAX_LL_ITEMS_1000, + .shadow_ram_support = false, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + diff --git a/queue-2.6.31/iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch b/queue-2.6.31/iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch new file mode 100644 index 00000000000..90e67f43479 --- /dev/null +++ b/queue-2.6.31/iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch @@ -0,0 +1,148 @@ +From reinette.chatre@intel.com Tue Dec 1 16:34:01 2009 +From: Reinette Chatre +Date: Wed, 25 Nov 2009 11:03:47 -0800 +Subject: iwlwifi: Use RTS/CTS as the preferred protection mechanism for 6000 series +To: stable@kernel.org +Cc: Reinette Chatre , wey-yi.w.guy@intel.com, linville@tuxdriver.com +Message-ID: <1259175828-14489-2-git-send-email-reinette.chatre@intel.com> + + +From: Wey-Yi Guy + +commit 73871f7181a1406c67e93c8c83f5edb26057a2a6 upstream + +When 802.11g was introduced, we had RTS/CTS and CTS-to-Self protection +mechanisms. In an HT Beacon, HT stations use the "Operating Mode" field +in the HT Information Element to determine whether or not to use +protection. + +The Operating Mode field has 4 possible settings: 0-3: +Mode 0: If all stations in the BSS are 20/40 MHz HT capable, or if the +BSS is 20/40 MHz capable, or if all stations in the BSS are 20 MHz HT +stations in a 20 MHz BSS +Mode 1: used if there are non-HT stations or APs using the primary or +secondary channels +Mode 2: if only HT stations are associated in the BSS and at least one +20 MHz HT station is associated. +Mode 3: used if one or more non-HT stations are associated in the BSS. + +When in operating modes 1 or 3, and the Use_Protection field is 1 in the +Beacon's ERP IE, all HT transmissions must be protected using RTS/CTS or +CTS-to-Self. + +By default, CTS-to-self is the preferred protection mechanism for less +overhead and higher throughput; but using the full RTS/CTS will better +protect the inner exchange from interference, especially in +highly-congested environment. + +For 6000 series WIFI NIC, RTS/CTS protection mechanism is the +recommended choice for HT traffic based on the HW design. + +Signed-off-by: Wey-Yi Guy +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-6000.c | 4 ++++ + drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 9 +++++++++ + drivers/net/wireless/iwlwifi/iwl-agn.c | 10 +++++++--- + drivers/net/wireless/iwlwifi/iwl-core.h | 2 ++ + 4 files changed, 22 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-6000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c +@@ -109,6 +109,7 @@ struct iwl_cfg iwl6000_2agn_cfg = { + .need_pll_cfg = false, + .max_ll_items = OTP_MAX_LL_ITEMS_6x00, + .shadow_ram_support = true, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + + struct iwl_cfg iwl6050_2agn_cfg = { +@@ -127,6 +128,7 @@ struct iwl_cfg iwl6050_2agn_cfg = { + .need_pll_cfg = false, + .max_ll_items = OTP_MAX_LL_ITEMS_6x00, + .shadow_ram_support = true, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + + struct iwl_cfg iwl6000_3agn_cfg = { +@@ -145,6 +147,7 @@ struct iwl_cfg iwl6000_3agn_cfg = { + .need_pll_cfg = false, + .max_ll_items = OTP_MAX_LL_ITEMS_6x00, + .shadow_ram_support = true, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + + struct iwl_cfg iwl6050_3agn_cfg = { +@@ -163,6 +166,7 @@ struct iwl_cfg iwl6050_3agn_cfg = { + .need_pll_cfg = false, + .max_ll_items = OTP_MAX_LL_ITEMS_6x00, + .shadow_ram_support = true, ++ .use_rts_for_ht = true, /* use rts/cts protection */ + }; + + MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX)); +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -115,9 +115,6 @@ int iwl_commit_rxon(struct iwl_priv *pri + + /* always get timestamp with Rx frame */ + priv->staging_rxon.flags |= RXON_FLG_TSF2HOST_MSK; +- /* allow CTS-to-self if possible. this is relevant only for +- * 5000, but will not damage 4965 */ +- priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN; + + ret = iwl_check_rxon_cmd(priv); + if (ret) { +@@ -217,6 +214,13 @@ int iwl_commit_rxon(struct iwl_priv *pri + "Could not send WEP static key.\n"); + } + ++ /* ++ * allow CTS-to-self if possible for new association. ++ * this is relevant only for 5000 series and up, ++ * but will not damage 4965 ++ */ ++ priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN; ++ + /* Apply the new configuration + * RXON assoc doesn't clear the station table in uCode, + */ +--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c +@@ -415,6 +415,15 @@ static void rs_tl_turn_on_agg(struct iwl + else if (tid == IWL_AGG_ALL_TID) + for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++) + rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta); ++ if (priv->cfg->use_rts_for_ht) { ++ /* ++ * switch to RTS/CTS if it is the prefer protection method ++ * for HT traffic ++ */ ++ IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n"); ++ priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN; ++ iwlcore_commit_rxon(priv); ++ } + } + + static inline int get_num_of_ant_from_rate(u32 rate_n_flags) +--- a/drivers/net/wireless/iwlwifi/iwl-core.h ++++ b/drivers/net/wireless/iwlwifi/iwl-core.h +@@ -209,6 +209,7 @@ struct iwl_mod_params { + * @ucode_api_min: Lowest version of uCode API supported by driver. + * @max_ll_items: max number of OTP blocks + * @shadow_ram_support: shadow support for OTP memory ++ * @use_rts_for_ht: use rts/cts protection for HT traffic + * + * We enable the driver to be backward compatible wrt API version. The + * driver specifies which APIs it supports (with @ucode_api_max being the +@@ -247,6 +248,7 @@ struct iwl_cfg { + bool use_isr_legacy; + const u16 max_ll_items; + const bool shadow_ram_support; ++ bool use_rts_for_ht; + }; + + /*************************** diff --git a/queue-2.6.31/mac80211-fix-spurious-delba-handling.patch b/queue-2.6.31/mac80211-fix-spurious-delba-handling.patch new file mode 100644 index 00000000000..ded4f104d34 --- /dev/null +++ b/queue-2.6.31/mac80211-fix-spurious-delba-handling.patch @@ -0,0 +1,178 @@ +From 827d42c9ac91ddd728e4f4a31fefb906ef2ceff7 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Sun, 22 Nov 2009 12:28:41 +0100 +Subject: mac80211: fix spurious delBA handling + +From: Johannes Berg + +commit 827d42c9ac91ddd728e4f4a31fefb906ef2ceff7 upstream. + +Lennert Buytenhek noticed that delBA handling in mac80211 +was broken and has remotely triggerable problems, some of +which are due to some code shuffling I did that ended up +changing the order in which things were done -- this was + + commit d75636ef9c1af224f1097941879d5a8db7cd04e5 + Author: Johannes Berg + Date: Tue Feb 10 21:25:53 2009 +0100 + + mac80211: RX aggregation: clean up stop session + +and other parts were already present in the original + + commit d92684e66091c0f0101819619b315b4bb8b5bcc5 + Author: Ron Rindjunsky + Date: Mon Jan 28 14:07:22 2008 +0200 + + mac80211: A-MPDU Tx add delBA from recipient support + +The first problem is that I moved a BUG_ON before various +checks -- thereby making it possible to hit. As the comment +indicates, the BUG_ON can be removed since the ampdu_action +callback must already exist when the state is != IDLE. + +The second problem isn't easily exploitable but there's a +race condition due to unconditionally setting the state to +OPERATIONAL when a delBA frame is received, even when no +aggregation session was ever initiated. All the drivers +accept stopping the session even then, but that opens a +race window where crashes could happen before the driver +accepts it. Right now, a WARN_ON may happen with non-HT +drivers, while the race opens only for HT drivers. + +For this case, there are two things necessary to fix it: + 1) don't process spurious delBA frames, and be more careful + about the session state; don't drop the lock + + 2) HT drivers need to be prepared to handle a session stop + even before the session was really started -- this is + true for all drivers (that support aggregation) but + iwlwifi which can be fixed easily. The other HT drivers + (ath9k and ar9170) are behaving properly already. + +Reported-by: Lennert Buytenhek +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-tx.c | 10 +++++++++- + include/net/mac80211.h | 6 ++++++ + net/mac80211/agg-tx.c | 15 +++++++-------- + net/mac80211/ht.c | 8 +++----- + net/mac80211/ieee80211_i.h | 2 ++ + 5 files changed, 27 insertions(+), 14 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-tx.c ++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c +@@ -1233,8 +1233,16 @@ int iwl_tx_agg_stop(struct iwl_priv *pri + return -ENXIO; + } + ++ if (priv->stations[sta_id].tid[tid].agg.state == ++ IWL_EMPTYING_HW_QUEUE_ADDBA) { ++ IWL_DEBUG_HT(priv, "AGG stop before setup done\n"); ++ ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid); ++ priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF; ++ return 0; ++ } ++ + if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON) +- IWL_WARN(priv, "Stopping AGG while state not IWL_AGG_ON\n"); ++ IWL_WARN(priv, "Stopping AGG while state not ON or starting\n"); + + tid_data = &priv->stations[sta_id].tid[tid]; + ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4; +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -1244,6 +1244,12 @@ enum ieee80211_filter_flags { + * + * These flags are used with the ampdu_action() callback in + * &struct ieee80211_ops to indicate which action is needed. ++ * ++ * Note that drivers MUST be able to deal with a TX aggregation ++ * session being stopped even before they OK'ed starting it by ++ * calling ieee80211_start_tx_ba_cb(_irqsafe), because the peer ++ * might receive the addBA frame and send a delBA right away! ++ * + * @IEEE80211_AMPDU_RX_START: start Rx aggregation + * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation + * @IEEE80211_AMPDU_TX_START: start Tx aggregation +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -123,13 +123,18 @@ void ieee80211_send_bar(struct ieee80211 + ieee80211_tx_skb(sdata, skb, 0); + } + +-static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, +- enum ieee80211_back_parties initiator) ++int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, ++ enum ieee80211_back_parties initiator) + { + struct ieee80211_local *local = sta->local; + int ret; + u8 *state; + ++#ifdef CONFIG_MAC80211_HT_DEBUG ++ printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n", ++ sta->sta.addr, tid); ++#endif /* CONFIG_MAC80211_HT_DEBUG */ ++ + state = &sta->ampdu_mlme.tid_state_tx[tid]; + + if (*state == HT_AGG_STATE_OPERATIONAL) +@@ -143,7 +148,6 @@ static int ___ieee80211_stop_tx_ba_sessi + + /* HW shall not deny going back to legacy */ + if (WARN_ON(ret)) { +- *state = HT_AGG_STATE_OPERATIONAL; + /* + * We may have pending packets get stuck in this case... + * Not bothering with a workaround for now. +@@ -526,11 +530,6 @@ int __ieee80211_stop_tx_ba_session(struc + goto unlock; + } + +-#ifdef CONFIG_MAC80211_HT_DEBUG +- printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n", +- sta->sta.addr, tid); +-#endif /* CONFIG_MAC80211_HT_DEBUG */ +- + ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator); + + unlock: +--- a/net/mac80211/ht.c ++++ b/net/mac80211/ht.c +@@ -141,7 +141,6 @@ void ieee80211_process_delba(struct ieee + struct sta_info *sta, + struct ieee80211_mgmt *mgmt, size_t len) + { +- struct ieee80211_local *local = sdata->local; + u16 tid, params; + u16 initiator; + +@@ -161,10 +160,9 @@ void ieee80211_process_delba(struct ieee + WLAN_BACK_INITIATOR, 0); + else { /* WLAN_BACK_RECIPIENT */ + spin_lock_bh(&sta->lock); +- sta->ampdu_mlme.tid_state_tx[tid] = +- HT_AGG_STATE_OPERATIONAL; ++ if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK) ++ ___ieee80211_stop_tx_ba_session(sta, tid, ++ WLAN_BACK_RECIPIENT); + spin_unlock_bh(&sta->lock); +- ieee80211_stop_tx_ba_session(&local->hw, sta->sta.addr, tid, +- WLAN_BACK_RECIPIENT); + } + } +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1057,6 +1057,8 @@ void ieee80211_process_addba_request(str + + int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, + enum ieee80211_back_parties initiator); ++int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, ++ enum ieee80211_back_parties initiator); + + /* Spectrum management */ + void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata, diff --git a/queue-2.6.31/mac80211-fix-two-remote-exploits.patch b/queue-2.6.31/mac80211-fix-two-remote-exploits.patch new file mode 100644 index 00000000000..3fffb818e94 --- /dev/null +++ b/queue-2.6.31/mac80211-fix-two-remote-exploits.patch @@ -0,0 +1,64 @@ +From 4253119acf412fd686ef4bd8749b5a4d70ea3a51 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Fri, 20 Nov 2009 09:15:51 +0100 +Subject: mac80211: fix two remote exploits + +From: Johannes Berg + +commit 4253119acf412fd686ef4bd8749b5a4d70ea3a51 upstream. + +Lennert Buytenhek noticed a remotely triggerable problem +in mac80211, which is due to some code shuffling I did +that ended up changing the order in which things were +done -- this was in + + commit d75636ef9c1af224f1097941879d5a8db7cd04e5 + Author: Johannes Berg + Date: Tue Feb 10 21:25:53 2009 +0100 + + mac80211: RX aggregation: clean up stop session + +The problem is that the BUG_ON moved before the various +checks, and as such can be triggered. + +As the comment indicates, the BUG_ON can be removed since +the ampdu_action callback must already exist when the +state is OPERATIONAL. + +A similar code path leads to a WARN_ON in +ieee80211_stop_tx_ba_session, which can also be removed. + +Cc: Lennert Buytenhek +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/agg-rx.c | 4 ---- + net/mac80211/agg-tx.c | 2 +- + 2 files changed, 1 insertion(+), 5 deletions(-) + +--- a/net/mac80211/agg-rx.c ++++ b/net/mac80211/agg-rx.c +@@ -85,10 +85,6 @@ void ieee80211_sta_stop_rx_ba_session(st + struct ieee80211_local *local = sdata->local; + struct sta_info *sta; + +- /* stop HW Rx aggregation. ampdu_action existence +- * already verified in session init so we add the BUG_ON */ +- BUG_ON(!local->ops->ampdu_action); +- + rcu_read_lock(); + + sta = sta_info_get(local, ra); +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -546,7 +546,7 @@ int ieee80211_stop_tx_ba_session(struct + struct sta_info *sta; + int ret = 0; + +- if (WARN_ON(!local->ops->ampdu_action)) ++ if (!local->ops->ampdu_action) + return -EINVAL; + + if (tid >= STA_TID_NUM) diff --git a/queue-2.6.31/nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch b/queue-2.6.31/nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch new file mode 100644 index 00000000000..c657333306e --- /dev/null +++ b/queue-2.6.31/nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch @@ -0,0 +1,40 @@ +From 96d25e532234bec1a1989e6e1baf702d43a78b0d Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 11 Nov 2009 16:15:42 +0900 +Subject: NFSv4: Fix a cache validation bug which causes getcwd() to return ENOENT + +From: Trond Myklebust + +commit 96d25e532234bec1a1989e6e1baf702d43a78b0d upstream. + +Changeset a65318bf3afc93ce49227e849d213799b072c5fd (NFSv4: Simplify some +cache consistency post-op GETATTRs) incorrectly changed the getattr +bitmap for readdir(). +This causes the readdir() function to fail to return a +fileid/inode number, which again exposed a bug in the NFS readdir code that +causes spurious ENOENT errors to appear in applications (see +http://bugzilla.kernel.org/show_bug.cgi?id=14541). + +The immediate band aid is to revert the incorrect bitmap change, but more +long term, we should change the NFS readdir code to cope with the +fact that NFSv4 servers are not required to support fileids/inode numbers. + +Reported-by: Daniel J Blueman +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2740,7 +2740,7 @@ static int _nfs4_proc_readdir(struct den + .pages = &page, + .pgbase = 0, + .count = count, +- .bitmask = NFS_SERVER(dentry->d_inode)->cache_consistency_bitmask, ++ .bitmask = NFS_SERVER(dentry->d_inode)->attr_bitmask, + }; + struct nfs4_readdir_res res; + struct rpc_message msg = { diff --git a/queue-2.6.31/rfkill-fix-miscdev-ops.patch b/queue-2.6.31/rfkill-fix-miscdev-ops.patch new file mode 100644 index 00000000000..90c95e69f11 --- /dev/null +++ b/queue-2.6.31/rfkill-fix-miscdev-ops.patch @@ -0,0 +1,32 @@ +From 45ba564d765d6165330e9bb14a197bdd348c114d Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 23 Nov 2009 11:27:30 +0100 +Subject: rfkill: fix miscdev ops + +From: Johannes Berg + +commit 45ba564d765d6165330e9bb14a197bdd348c114d upstream. + +The /dev/rfkill ops don't refer to the module, +so it is possible to unload the module while +file descriptors are open. Fix this oversight. + +Reported-by: Maxim Levitsky +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/rfkill/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -1180,6 +1180,7 @@ static long rfkill_fop_ioctl(struct file + #endif + + static const struct file_operations rfkill_fops = { ++ .owner = THIS_MODULE, + .open = rfkill_fop_open, + .read = rfkill_fop_read, + .write = rfkill_fop_write, diff --git a/queue-2.6.31/series b/queue-2.6.31/series index 54c41fd3b6e..67c38df672c 100644 --- a/queue-2.6.31/series +++ b/queue-2.6.31/series @@ -45,3 +45,27 @@ usb-cdc_acm-fix-race-condition-when-opening-tty.patch usb-xhci-fix-bug-memory-free-after-failed-initialization.patch usb-xhci-fix-trb-physical-to-virtual-address-translation.patch usb-xhci-fix-scratchpad-deallocation.patch +iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch +iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch +ima-replace-gfp_kernel-with-gfp_nofs.patch +nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch +fuse-reject-o_direct-flag-also-in-fuse_create.patch +asoc-fix-suspend-with-active-audio-streams.patch +asoc-aic23-fixing-infinite-loop-in-resume-path.patch +mac80211-fix-two-remote-exploits.patch +mac80211-fix-spurious-delba-handling.patch +b43-work-around-mac80211-race-condition.patch +rfkill-fix-miscdev-ops.patch +thinkpad-acpi-fix-sign-of-erestartsys-return.patch +enable-acpi-pdc-handshake-for-via-centaur-cpus.patch +v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch +v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch +v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch +v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch +v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch +v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch +v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch +v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch +drm-i915-select-config_shmem.patch +drm-work-around-edids-with-bad-htotal-vtotal-values.patch +drm-i915-fix-irq-stall-issue-on-ironlake.patch diff --git a/queue-2.6.31/thinkpad-acpi-fix-sign-of-erestartsys-return.patch b/queue-2.6.31/thinkpad-acpi-fix-sign-of-erestartsys-return.patch new file mode 100644 index 00000000000..d31fc413023 --- /dev/null +++ b/queue-2.6.31/thinkpad-acpi-fix-sign-of-erestartsys-return.patch @@ -0,0 +1,32 @@ +From 80a8d1228e90349b4514e8c925c061fa5cbcea75 Mon Sep 17 00:00:00 2001 +From: Roel Kluin +Date: Fri, 20 Nov 2009 19:48:23 +0100 +Subject: thinkpad-acpi: fix sign of ERESTARTSYS return + +From: Roel Kluin + +commit 80a8d1228e90349b4514e8c925c061fa5cbcea75 upstream. + +The returned error should be negative + +Signed-off-by: Roel Kluin +Acked-by: Henrique de Moraes Holschuh +Signed-off-by: Andrew Morton +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -5863,7 +5863,7 @@ static int brightness_write(char *buf) + * Doing it this way makes the syscall restartable in case of EINTR + */ + rc = brightness_set(level); +- return (rc == -EINTR)? ERESTARTSYS : rc; ++ return (rc == -EINTR)? -ERESTARTSYS : rc; + } + + static struct ibm_struct brightness_driver_data = { diff --git a/queue-2.6.31/v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch b/queue-2.6.31/v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch new file mode 100644 index 00000000000..8984721eb21 --- /dev/null +++ b/queue-2.6.31/v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch @@ -0,0 +1,59 @@ +From d8f400efc1ef7b344e07590fb6b77431bc358ba0 Mon Sep 17 00:00:00 2001 +From: Jean-Francois Moine +Date: Wed, 8 Jul 2009 06:33:44 -0300 +Subject: V4L/DVB (12280): gspca - sonixj: Remove auto gain/wb/expo for the ov7660 sensor. + +From: Jean-Francois Moine + +commit d8f400efc1ef7b344e07590fb6b77431bc358ba0 upstream. + +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/sonixj.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -727,13 +727,13 @@ static const u8 ov7660_sensor_init[][8] + {0xa1, 0x21, 0x12, 0x05, 0x00, 0x00, 0x00, 0x10}, + /* Outformat = rawRGB */ + {0xa1, 0x21, 0x13, 0xb8, 0x00, 0x00, 0x00, 0x10}, /* init COM8 */ +- {0xd1, 0x21, 0x00, 0x01, 0x74, 0x74, 0x00, 0x10}, ++ {0xd1, 0x21, 0x00, 0x01, 0x74, 0x92, 0x00, 0x10}, + /* GAIN BLUE RED VREF */ + {0xd1, 0x21, 0x04, 0x00, 0x7d, 0x62, 0x00, 0x10}, + /* COM 1 BAVE GEAVE AECHH */ + {0xb1, 0x21, 0x08, 0x83, 0x01, 0x00, 0x00, 0x10}, /* RAVE COM2 */ + {0xd1, 0x21, 0x0c, 0x00, 0x08, 0x04, 0x4f, 0x10}, /* COM 3 4 5 6 */ +- {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xff, 0x10}, ++ {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xf8, 0x10}, + /* AECH CLKRC COM7 COM8 */ + {0xc1, 0x21, 0x14, 0x2c, 0x00, 0x02, 0x00, 0x10}, /* COM9 COM10 */ + {0xd1, 0x21, 0x17, 0x10, 0x60, 0x02, 0x7b, 0x10}, +@@ -1637,16 +1637,19 @@ static void setfreq(struct gspca_dev *gs + if (gspca_dev->ctrl_dis & (1 << FREQ_IDX)) + return; + if (sd->sensor == SENSOR_OV7660) { ++ u8 com8; ++ ++ com8 = 0xf8; /* no auto gain/wb/expo */ + switch (sd->freq) { + case 0: /* Banding filter disabled */ +- i2c_w1(gspca_dev, 0x13, 0xdf); ++ i2c_w1(gspca_dev, 0x13, com8 & 0xdf); + break; + case 1: /* 50 hz */ +- i2c_w1(gspca_dev, 0x13, 0xff); ++ i2c_w1(gspca_dev, 0x13, com8); + i2c_w1(gspca_dev, 0x3b, 0x0a); + break; + case 2: /* 60 hz */ +- i2c_w1(gspca_dev, 0x13, 0xff); ++ i2c_w1(gspca_dev, 0x13, com8); + i2c_w1(gspca_dev, 0x3b, 0x02); + break; + } diff --git a/queue-2.6.31/v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch b/queue-2.6.31/v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch new file mode 100644 index 00000000000..97b1e87be4a --- /dev/null +++ b/queue-2.6.31/v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch @@ -0,0 +1,61 @@ +From 6baefab531b22288be3b4ddef5671ea6469b09f8 Mon Sep 17 00:00:00 2001 +From: Denis Loginov +Date: Tue, 28 Jul 2009 03:39:10 -0300 +Subject: V4L/DVB (12356): gspca - sonixj: Webcam 0c45:6148 added + +From: Denis Loginov + +commit 6baefab531b22288be3b4ddef5671ea6469b09f8 upstream. + +Signed-off-by: Denis Loginov +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/video4linux/gspca.txt | 1 + + drivers/media/video/gspca/sonixj.c | 8 ++++++-- + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/Documentation/video4linux/gspca.txt ++++ b/Documentation/video4linux/gspca.txt +@@ -284,6 +284,7 @@ sonixj 0c45:613a Microdia Sonix PC Came + sonixj 0c45:613b Surfer SN-206 + sonixj 0c45:613c Sonix Pccam168 + sonixj 0c45:6143 Sonix Pccam168 ++sonixj 0c45:6148 Digitus DA-70811/ZSMC USB PC Camera ZS211/Microdia + sn9c20x 0c45:6240 PC Camera (SN9C201 + MT9M001) + sn9c20x 0c45:6242 PC Camera (SN9C201 + MT9M111) + sn9c20x 0c45:6248 PC Camera (SN9C201 + OV9655) +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -2339,7 +2339,8 @@ static const __devinitdata struct usb_de + {USB_DEVICE(0x0c45, 0x60fe), BSI(SN9C105, OV7630, 0x21)}, + #endif + {USB_DEVICE(0x0c45, 0x6100), BSI(SN9C120, MI0360, 0x5d)}, /*sn9c128*/ +-/* {USB_DEVICE(0x0c45, 0x6108), BSI(SN9C120, OM6801, 0x??)}, */ ++/* {USB_DEVICE(0x0c45, 0x6102), BSI(SN9C120, PO2030N, ??)}, */ ++/* {USB_DEVICE(0x0c45, 0x6108), BSI(SN9C120, OM6802, 0x21)}, */ + {USB_DEVICE(0x0c45, 0x610a), BSI(SN9C120, OV7648, 0x21)}, /*sn9c128*/ + {USB_DEVICE(0x0c45, 0x610b), BSI(SN9C120, OV7660, 0x21)}, /*sn9c128*/ + {USB_DEVICE(0x0c45, 0x610c), BSI(SN9C120, HV7131R, 0x11)}, /*sn9c128*/ +@@ -2355,6 +2356,7 @@ static const __devinitdata struct usb_de + #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE + {USB_DEVICE(0x0c45, 0x6130), BSI(SN9C120, MI0360, 0x5d)}, + #endif ++/* {USB_DEVICE(0x0c45, 0x6132), BSI(SN9C120, OV7670, 0x21)}, */ + {USB_DEVICE(0x0c45, 0x6138), BSI(SN9C120, MO4000, 0x21)}, + {USB_DEVICE(0x0c45, 0x613a), BSI(SN9C120, OV7648, 0x21)}, + #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE +@@ -2362,7 +2364,9 @@ static const __devinitdata struct usb_de + #endif + {USB_DEVICE(0x0c45, 0x613c), BSI(SN9C120, HV7131R, 0x11)}, + {USB_DEVICE(0x0c45, 0x613e), BSI(SN9C120, OV7630, 0x21)}, +- {USB_DEVICE(0x0c45, 0x6143), BSI(SN9C120, SP80708, 0x18)}, ++/* {USB_DEVICE(0x0c45, 0x6142), BSI(SN9C120, PO2030N, ??)}, *sn9c120b*/ ++ {USB_DEVICE(0x0c45, 0x6143), BSI(SN9C120, SP80708, 0x18)}, /*sn9c120b*/ ++ {USB_DEVICE(0x0c45, 0x6148), BSI(SN9C120, OM6802, 0x21)}, /*sn9c120b*/ + {} + }; + MODULE_DEVICE_TABLE(usb, device_table); diff --git a/queue-2.6.31/v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch b/queue-2.6.31/v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch new file mode 100644 index 00000000000..d6fbf1bb2ca --- /dev/null +++ b/queue-2.6.31/v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch @@ -0,0 +1,99 @@ +From 47f7f6fb7949b6546baf4b6f26bf0ca075d12759 Mon Sep 17 00:00:00 2001 +From: Jean-Francois Moine +Date: Tue, 25 Aug 2009 06:14:54 -0300 +Subject: V4L/DVB (12501): gspca - sonixj: Do the ov7660 sensor work again. + +From: Jean-Francois Moine + +commit 47f7f6fb7949b6546baf4b6f26bf0ca075d12759 upstream. + +- bad sensor power +- bad edge gain/threshold +- set back the auto gain +- light frequency filter inverted + +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/sonixj.c | 23 +++++++---------------- + 1 file changed, 7 insertions(+), 16 deletions(-) + +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -733,7 +733,7 @@ static const u8 ov7660_sensor_init[][8] + /* COM 1 BAVE GEAVE AECHH */ + {0xb1, 0x21, 0x08, 0x83, 0x01, 0x00, 0x00, 0x10}, /* RAVE COM2 */ + {0xd1, 0x21, 0x0c, 0x00, 0x08, 0x04, 0x4f, 0x10}, /* COM 3 4 5 6 */ +- {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xf8, 0x10}, ++ {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xff, 0x10}, + /* AECH CLKRC COM7 COM8 */ + {0xc1, 0x21, 0x14, 0x2c, 0x00, 0x02, 0x00, 0x10}, /* COM9 COM10 */ + {0xd1, 0x21, 0x17, 0x10, 0x60, 0x02, 0x7b, 0x10}, +@@ -783,7 +783,7 @@ static const u8 ov7660_sensor_init[][8] + {0xc1, 0x21, 0x88, 0xaf, 0xc7, 0xdf, 0x00, 0x10}, /* gamma curve */ + {0xc1, 0x21, 0x8b, 0x99, 0x99, 0xcf, 0x00, 0x10}, /* reserved */ + {0xb1, 0x21, 0x92, 0x00, 0x00, 0x00, 0x00, 0x10}, /* DM_LNL/H */ +- {0xb1, 0x21, 0xa1, 0x00, 0x00, 0x00, 0x00, 0x10}, ++ {0xa1, 0x21, 0xa1, 0x00, 0x00, 0x00, 0x00, 0x10}, + /****** (some exchanges in the win trace) ******/ + {0xa1, 0x21, 0x1e, 0x01, 0x00, 0x00, 0x00, 0x10}, /* MVFP */ + /* bits[3..0]reserved */ +@@ -1145,11 +1145,6 @@ static int configure_gpio(struct gspca_d + reg_w1(gspca_dev, 0x01, 0x42); + break; + case SENSOR_OV7660: +- reg_w1(gspca_dev, 0x01, 0x61); +- reg_w1(gspca_dev, 0x17, 0x20); +- reg_w1(gspca_dev, 0x01, 0x60); +- reg_w1(gspca_dev, 0x01, 0x40); +- break; + case SENSOR_SP80708: + reg_w1(gspca_dev, 0x01, 0x63); + reg_w1(gspca_dev, 0x17, 0x20); +@@ -1624,6 +1619,8 @@ static void setvflip(struct sd *sd) + + static void setinfrared(struct sd *sd) + { ++ if (sd->gspca_dev.ctrl_dis & (1 << INFRARED_IDX)) ++ return; + /*fixme: different sequence for StarCam Clip and StarCam 370i */ + /* Clip */ + i2c_w1(&sd->gspca_dev, 0x02, /* gpio */ +@@ -1639,10 +1636,10 @@ static void setfreq(struct gspca_dev *gs + if (sd->sensor == SENSOR_OV7660) { + u8 com8; + +- com8 = 0xf8; /* no auto gain/wb/expo */ ++ com8 = 0xdf; /* auto gain/wb/expo */ + switch (sd->freq) { + case 0: /* Banding filter disabled */ +- i2c_w1(gspca_dev, 0x13, com8 & 0xdf); ++ i2c_w1(gspca_dev, 0x13, com8 | 0x20); + break; + case 1: /* 50 hz */ + i2c_w1(gspca_dev, 0x13, com8); +@@ -1799,12 +1796,6 @@ static int sd_start(struct gspca_dev *gs + reg_w1(gspca_dev, 0x99, 0x60); + break; + case SENSOR_OV7660: +- reg_w1(gspca_dev, 0x9a, 0x05); +- if (sd->bridge == BRIDGE_SN9C105) +- reg_w1(gspca_dev, 0x99, 0xff); +- else +- reg_w1(gspca_dev, 0x99, 0x5b); +- break; + case SENSOR_SP80708: + reg_w1(gspca_dev, 0x9a, 0x05); + reg_w1(gspca_dev, 0x99, 0x59); +@@ -2328,7 +2319,7 @@ static const __devinitdata struct usb_de + {USB_DEVICE(0x0c45, 0x607c), BSI(SN9C102P, HV7131R, 0x11)}, + /* {USB_DEVICE(0x0c45, 0x607e), BSI(SN9C102P, OV7630, 0x??)}, */ + {USB_DEVICE(0x0c45, 0x60c0), BSI(SN9C105, MI0360, 0x5d)}, +-/* {USB_DEVICE(0x0c45, 0x60c8), BSI(SN9C105, OM6801, 0x??)}, */ ++/* {USB_DEVICE(0x0c45, 0x60c8), BSI(SN9C105, OM6802, 0x??)}, */ + /* {USB_DEVICE(0x0c45, 0x60cc), BSI(SN9C105, HV7131GP, 0x??)}, */ + {USB_DEVICE(0x0c45, 0x60ec), BSI(SN9C105, MO4000, 0x21)}, + /* {USB_DEVICE(0x0c45, 0x60ef), BSI(SN9C105, ICM105C, 0x??)}, */ diff --git a/queue-2.6.31/v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch b/queue-2.6.31/v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch new file mode 100644 index 00000000000..dc88e5399a1 --- /dev/null +++ b/queue-2.6.31/v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch @@ -0,0 +1,29 @@ +From 1f78a976ce18bc98e8b509cee04c5b3756098614 Mon Sep 17 00:00:00 2001 +From: Jean-Francois Moine +Date: Sat, 29 Aug 2009 07:11:58 -0300 +Subject: V4L/DVB (12691): gspca - sonixj: Don't use mdelay(). + +From: Jean-Francois Moine + +commit 1f78a976ce18bc98e8b509cee04c5b3756098614 upstream. + +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/sonixj.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -1150,7 +1150,7 @@ static int configure_gpio(struct gspca_d + reg_w1(gspca_dev, 0x17, 0x20); + reg_w1(gspca_dev, 0x01, 0x62); + reg_w1(gspca_dev, 0x01, 0x42); +- mdelay(100); ++ msleep(100); + reg_w1(gspca_dev, 0x02, 0x62); + break; + /* case SENSOR_HV7131R: */ diff --git a/queue-2.6.31/v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch b/queue-2.6.31/v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch new file mode 100644 index 00000000000..464cba82c49 --- /dev/null +++ b/queue-2.6.31/v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch @@ -0,0 +1,45 @@ +From f077b0a64856c5b3bf346ae9fba8631c1fb210cf Mon Sep 17 00:00:00 2001 +From: Jean-Francois Moine +Date: Tue, 1 Sep 2009 14:52:04 -0300 +Subject: V4L/DVB (12696): gspca - sonixj / sn9c102: Two drivers for 0c45:60fc and 0c45:613e. + +From: Jean-Francois Moine + +commit f077b0a64856c5b3bf346ae9fba8631c1fb210cf upstream. + +Let 0c45:60fc in sn9c102 and 0c45:613e in gspca-sonixj (sensor not supported). + +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/gspca/sonixj.c | 2 +- + drivers/media/video/sn9c102/sn9c102_devtable.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/video/gspca/sonixj.c ++++ b/drivers/media/video/gspca/sonixj.c +@@ -2325,8 +2325,8 @@ static const __devinitdata struct usb_de + /* {USB_DEVICE(0x0c45, 0x60ef), BSI(SN9C105, ICM105C, 0x??)}, */ + /* {USB_DEVICE(0x0c45, 0x60fa), BSI(SN9C105, OV7648, 0x??)}, */ + {USB_DEVICE(0x0c45, 0x60fb), BSI(SN9C105, OV7660, 0x21)}, +- {USB_DEVICE(0x0c45, 0x60fc), BSI(SN9C105, HV7131R, 0x11)}, + #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE ++ {USB_DEVICE(0x0c45, 0x60fc), BSI(SN9C105, HV7131R, 0x11)}, + {USB_DEVICE(0x0c45, 0x60fe), BSI(SN9C105, OV7630, 0x21)}, + #endif + {USB_DEVICE(0x0c45, 0x6100), BSI(SN9C120, MI0360, 0x5d)}, /*sn9c128*/ +--- a/drivers/media/video/sn9c102/sn9c102_devtable.h ++++ b/drivers/media/video/sn9c102/sn9c102_devtable.h +@@ -123,8 +123,8 @@ static const struct usb_device_id sn9c10 + { SN9C102_USB_DEVICE(0x0c45, 0x613b, BRIDGE_SN9C120), }, + #if !defined CONFIG_USB_GSPCA && !defined CONFIG_USB_GSPCA_MODULE + { SN9C102_USB_DEVICE(0x0c45, 0x613c, BRIDGE_SN9C120), }, +-#endif + { SN9C102_USB_DEVICE(0x0c45, 0x613e, BRIDGE_SN9C120), }, ++#endif + { } + }; + diff --git a/queue-2.6.31/v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch b/queue-2.6.31/v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch new file mode 100644 index 00000000000..f2901cc4043 --- /dev/null +++ b/queue-2.6.31/v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch @@ -0,0 +1,53 @@ +From 707ca1e30f087f9a6d144693dafc4b67880678c2 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Tue, 15 Sep 2009 08:08:20 -0300 +Subject: V4L/DVB (12948): v4l1-compat: fix VIDIOC_G_STD handling + +From: Hans Verkuil + +commit 707ca1e30f087f9a6d144693dafc4b67880678c2 upstream. + +The VIDIOC_G_STD ioctl may not be present in the case of radio receivers. +In that case G_STD will return an error. The v4l1-compat layer should not +attempt to propagate that error to the caller, instead it should be +ignored. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/v4l1-compat.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +--- a/drivers/media/video/v4l1-compat.c ++++ b/drivers/media/video/v4l1-compat.c +@@ -565,10 +565,9 @@ static noinline long v4l1_compat_get_inp + break; + } + chan->norm = 0; +- err = drv(file, VIDIOC_G_STD, &sid); +- if (err < 0) +- dprintk("VIDIOCGCHAN / VIDIOC_G_STD: %ld\n", err); +- if (err == 0) { ++ /* Note: G_STD might not be present for radio receivers, ++ * so we should ignore any errors. */ ++ if (drv(file, VIDIOC_G_STD, &sid) == 0) { + if (sid & V4L2_STD_PAL) + chan->norm = VIDEO_MODE_PAL; + if (sid & V4L2_STD_NTSC) +@@ -777,10 +776,9 @@ static noinline long v4l1_compat_get_tun + tun->flags |= VIDEO_TUNER_SECAM; + } + +- err = drv(file, VIDIOC_G_STD, &sid); +- if (err < 0) +- dprintk("VIDIOCGTUNER / VIDIOC_G_STD: %ld\n", err); +- if (err == 0) { ++ /* Note: G_STD might not be present for radio receivers, ++ * so we should ignore any errors. */ ++ if (drv(file, VIDIOC_G_STD, &sid) == 0) { + if (sid & V4L2_STD_PAL) + tun->mode = VIDEO_MODE_PAL; + if (sid & V4L2_STD_NTSC) diff --git a/queue-2.6.31/v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch b/queue-2.6.31/v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch new file mode 100644 index 00000000000..6348a17ff65 --- /dev/null +++ b/queue-2.6.31/v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch @@ -0,0 +1,35 @@ +From 3addbb8075c00e2a2408c192bd1002dead26b2aa Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Thu, 5 Nov 2009 13:26:32 -0300 +Subject: V4L/DVB (13321): radio-gemtek-pci: fix double mutex_lock + +From: Hans Verkuil + +commit 3addbb8075c00e2a2408c192bd1002dead26b2aa upstream. + +Double mutexlock found by the Linux Driver Verification project and +reported by Alexander Strakh. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/radio/radio-gemtek-pci.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/media/radio/radio-gemtek-pci.c ++++ b/drivers/media/radio/radio-gemtek-pci.c +@@ -181,12 +181,10 @@ static void gemtek_pci_mute(struct gemte + + static void gemtek_pci_unmute(struct gemtek_pci *card) + { +- mutex_lock(&card->lock); + if (card->mute) { + gemtek_pci_setfrequency(card, card->current_frequency); + card->mute = false; + } +- mutex_unlock(&card->lock); + } + + static int gemtek_pci_getsignal(struct gemtek_pci *card) diff --git a/queue-2.6.31/v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch b/queue-2.6.31/v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch new file mode 100644 index 00000000000..107374544ad --- /dev/null +++ b/queue-2.6.31/v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch @@ -0,0 +1,50 @@ +From 0bc3518019f917a370935055f07698a4e9b3ea20 Mon Sep 17 00:00:00 2001 +From: Robert Lowery +Date: Sun, 8 Nov 2009 00:00:11 -0300 +Subject: V4L/DVB (13436): cxusb: Fix hang on DViCO FusionHDTV DVB-T Dual Digital 4 (rev 1) + +From: Robert Lowery + +commit 0bc3518019f917a370935055f07698a4e9b3ea20 upstream. + +Address yet another regression introduced by the introduction of the zl10353 +disable_i2c_gate field. + +djh - I unmangled the patch which apparently got screwed up in the user's +email client. + +Signed-off-by: Robert Lowery +Signed-off-by: Devin Heitmueller +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/dvb-usb/cxusb.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/media/dvb/dvb-usb/cxusb.c ++++ b/drivers/media/dvb/dvb-usb/cxusb.c +@@ -663,6 +663,14 @@ static struct zl10353_config cxusb_zl103 + .parallel_ts = 1, + }; + ++static struct zl10353_config cxusb_zl10353_xc3028_config_no_i2c_gate = { ++ .demod_address = 0x0f, ++ .if2 = 45600, ++ .no_tuner = 1, ++ .parallel_ts = 1, ++ .disable_i2c_gate_ctrl = 1, ++}; ++ + static struct mt352_config cxusb_mt352_xc3028_config = { + .demod_address = 0x0f, + .if2 = 4560, +@@ -894,7 +902,7 @@ static int cxusb_dualdig4_frontend_attac + cxusb_bluebird_gpio_pulse(adap->dev, 0x02, 1); + + if ((adap->fe = dvb_attach(zl10353_attach, +- &cxusb_zl10353_xc3028_config, ++ &cxusb_zl10353_xc3028_config_no_i2c_gate, + &adap->dev->i2c_adap)) == NULL) + return -EIO; + -- 2.47.2