]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.0 patches
authorGreg Kroah-Hartman <gregkh@suse.de>
Thu, 15 Sep 2011 10:13:07 +0000 (12:13 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Thu, 15 Sep 2011 10:13:07 +0000 (12:13 +0200)
queue-3.0/arm-7081-1-mach-integrator-fix-the-clocksource.patch [new file with mode: 0644]
queue-3.0/arm-davinci-da850-evm-read-mac-address-from-spi-flash.patch [new file with mode: 0644]
queue-3.0/arm-davinci-fix-cache-flush-build-error.patch [new file with mode: 0644]
queue-3.0/avoid-dereferencing-a-request_queue-after-last-close.patch [new file with mode: 0644]
queue-3.0/drm-nouveau-properly-handle-allocation-failure-in-nouveau_sgdma_populate.patch [new file with mode: 0644]
queue-3.0/hwmon-max16065-fix-current-calculation.patch [new file with mode: 0644]
queue-3.0/md-fix-handling-for-devices-from-2tb-to-4tb-in-0.90.patch [new file with mode: 0644]
queue-3.0/nuvoton-cir-simplify-raw-ir-sample-handling.patch [new file with mode: 0644]
queue-3.0/series
queue-3.0/vp7045-fix-buffer-setup.patch [new file with mode: 0644]

diff --git a/queue-3.0/arm-7081-1-mach-integrator-fix-the-clocksource.patch b/queue-3.0/arm-7081-1-mach-integrator-fix-the-clocksource.patch
new file mode 100644 (file)
index 0000000..dc169b5
--- /dev/null
@@ -0,0 +1,45 @@
+From bb9ea77846620ed2b37e74c852d72c7a476b248c Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 6 Sep 2011 08:08:13 +0100
+Subject: ARM: 7081/1: mach-integrator: fix the clocksource
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit bb9ea77846620ed2b37e74c852d72c7a476b248c upstream.
+
+I was intrigued by the fact that the clock stood still on
+the Integrator, but it wasn't strange at all, because the
+timer was set up all wrong and probably has been for a
+while. With this patch the clock starts ticking again:
+make the timer periodic (reload), |= on the divisor bit
+and load the timer before starting it.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-integrator/integrator_ap.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/mach-integrator/integrator_ap.c
++++ b/arch/arm/mach-integrator/integrator_ap.c
+@@ -337,15 +337,15 @@ static unsigned long timer_reload;
+ static void integrator_clocksource_init(u32 khz)
+ {
+       void __iomem *base = (void __iomem *)TIMER2_VA_BASE;
+-      u32 ctrl = TIMER_CTRL_ENABLE;
++      u32 ctrl = TIMER_CTRL_ENABLE | TIMER_CTRL_PERIODIC;
+       if (khz >= 1500) {
+               khz /= 16;
+-              ctrl = TIMER_CTRL_DIV16;
++              ctrl |= TIMER_CTRL_DIV16;
+       }
+-      writel(ctrl, base + TIMER_CTRL);
+       writel(0xffff, base + TIMER_LOAD);
++      writel(ctrl, base + TIMER_CTRL);
+       clocksource_mmio_init(base + TIMER_VALUE, "timer2",
+               khz * 1000, 200, 16, clocksource_mmio_readl_down);
diff --git a/queue-3.0/arm-davinci-da850-evm-read-mac-address-from-spi-flash.patch b/queue-3.0/arm-davinci-da850-evm-read-mac-address-from-spi-flash.patch
new file mode 100644 (file)
index 0000000..c7abc15
--- /dev/null
@@ -0,0 +1,94 @@
+From 810198bc9c109489dfadc57131c5183ce6ad2d7d Mon Sep 17 00:00:00 2001
+From: "Rajashekhara, Sudhakar" <sudhakar.raj@ti.com>
+Date: Tue, 12 Jul 2011 15:58:53 +0530
+Subject: ARM: davinci: da850 EVM: read mac address from SPI flash
+
+From: "Rajashekhara, Sudhakar" <sudhakar.raj@ti.com>
+
+commit 810198bc9c109489dfadc57131c5183ce6ad2d7d upstream.
+
+DA850/OMAP-L138 EMAC driver uses random mac address instead of
+a fixed one because the mac address is not stuffed into EMAC
+platform data.
+
+This patch provides a function which reads the mac address
+stored in SPI flash (registered as MTD device) and populates the
+EMAC platform data. The function which reads the mac address is
+registered as a callback which gets called upon addition of MTD
+device.
+
+NOTE: In case the MAC address stored in SPI flash is erased, follow
+the instructions at [1] to restore it.
+
+[1] http://processors.wiki.ti.com/index.php/GSG:_OMAP-L138_DVEVM_Additional_Procedures#Restoring_MAC_address_on_SPI_Flash
+
+Modifications in v2:
+Guarded registering the mtd_notifier only when MTD is enabled.
+Earlier this was handled using mtd_has_partitions() call, but
+this has been removed in Linux v3.0.
+
+Modifications in v3:
+a. Guarded da850_evm_m25p80_notify_add() function and
+   da850evm_spi_notifier structure with CONFIG_MTD macros.
+b. Renamed da850_evm_register_mtd_user() function to
+   da850_evm_setup_mac_addr() and removed the struct mtd_notifier
+   argument to this function.
+c. Passed the da850evm_spi_notifier structure to register_mtd_user()
+   function.
+
+Modifications in v4:
+Moved the da850_evm_setup_mac_addr() function within the first
+CONFIG_MTD ifdef construct.
+
+Signed-off-by: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-davinci/board-da850-evm.c |   28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/arch/arm/mach-davinci/board-da850-evm.c
++++ b/arch/arm/mach-davinci/board-da850-evm.c
+@@ -115,6 +115,32 @@ static struct spi_board_info da850evm_sp
+       },
+ };
++#ifdef CONFIG_MTD
++static void da850_evm_m25p80_notify_add(struct mtd_info *mtd)
++{
++      char *mac_addr = davinci_soc_info.emac_pdata->mac_addr;
++      size_t retlen;
++
++      if (!strcmp(mtd->name, "MAC-Address")) {
++              mtd->read(mtd, 0, ETH_ALEN, &retlen, mac_addr);
++              if (retlen == ETH_ALEN)
++                      pr_info("Read MAC addr from SPI Flash: %pM\n",
++                              mac_addr);
++      }
++}
++
++static struct mtd_notifier da850evm_spi_notifier = {
++      .add    = da850_evm_m25p80_notify_add,
++};
++
++static void da850_evm_setup_mac_addr(void)
++{
++      register_mtd_user(&da850evm_spi_notifier);
++}
++#else
++static void da850_evm_setup_mac_addr(void) { }
++#endif
++
+ static struct mtd_partition da850_evm_norflash_partition[] = {
+       {
+               .name           = "bootloaders + env",
+@@ -1237,6 +1263,8 @@ static __init void da850_evm_init(void)
+       if (ret)
+               pr_warning("da850_evm_init: spi 1 registration failed: %d\n",
+                               ret);
++
++      da850_evm_setup_mac_addr();
+ }
+ #ifdef CONFIG_SERIAL_8250_CONSOLE
diff --git a/queue-3.0/arm-davinci-fix-cache-flush-build-error.patch b/queue-3.0/arm-davinci-fix-cache-flush-build-error.patch
new file mode 100644 (file)
index 0000000..5af8e87
--- /dev/null
@@ -0,0 +1,41 @@
+From 897a6a1a14837d6d582bfd1fd7aba00be44b6469 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 2 Aug 2011 17:48:38 +0200
+Subject: ARM: davinci: fix cache flush build error
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 897a6a1a14837d6d582bfd1fd7aba00be44b6469 upstream.
+
+The TNET variant of DaVinci compiles some code that it shares
+with other DaVinci variants, however it has a V6 CPU rather than
+an ARM926T, thus the hardcoded call to arm926_flush_kern_cache_all()
+in sleep.S will obviously fail, and we need to build with the
+v6_flush_kern_cache_all() call instead. This was triggered by
+manually altering the DaVinci config to build the TNET version.
+
+Cc: Dave Martin <dave.martin@linaro.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-davinci/sleep.S |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mach-davinci/sleep.S
++++ b/arch/arm/mach-davinci/sleep.S
+@@ -217,7 +217,11 @@ ddr2clk_stop_done:
+ ENDPROC(davinci_ddr_psc_config)
+ CACHE_FLUSH:
+-      .word   arm926_flush_kern_cache_all
++#ifdef CONFIG_CPU_V6
++      .word   v6_flush_kern_cache_all
++#else
++      .word   arm926_flush_kern_cache_all
++#endif
+ ENTRY(davinci_cpu_suspend_sz)
+       .word   . - davinci_cpu_suspend
diff --git a/queue-3.0/avoid-dereferencing-a-request_queue-after-last-close.patch b/queue-3.0/avoid-dereferencing-a-request_queue-after-last-close.patch
new file mode 100644 (file)
index 0000000..f86ee71
--- /dev/null
@@ -0,0 +1,60 @@
+From 94007751bb02797ba87bac7aacee2731ac2039a3 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Sat, 10 Sep 2011 17:20:21 +1000
+Subject: Avoid dereferencing a 'request_queue' after last close.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 94007751bb02797ba87bac7aacee2731ac2039a3 upstream.
+
+On the last close of an 'md' device which as been stopped, the device
+is destroyed and in particular the request_queue is freed.  The free
+is done in a separate thread so it might happen a short time later.
+
+__blkdev_put calls bdev_inode_switch_bdi *after* ->release has been
+called.
+
+Since commit f758eeabeb96f878c860e8f110f94ec8820822a9
+bdev_inode_switch_bdi will dereference the 'old' bdi, which lives
+inside a request_queue, to get a spin lock.  This causes the last
+close on an md device to sometime take a spin_lock which lives in
+freed memory - which results in an oops.
+
+So move the called to bdev_inode_switch_bdi before the call to
+->release.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Acked-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/block_dev.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1419,6 +1419,11 @@ static int __blkdev_put(struct block_dev
+               WARN_ON_ONCE(bdev->bd_holders);
+               sync_blockdev(bdev);
+               kill_bdev(bdev);
++              /* ->release can cause the old bdi to disappear,
++               * so must switch it out first
++               */
++              bdev_inode_switch_bdi(bdev->bd_inode,
++                                      &default_backing_dev_info);
+       }
+       if (bdev->bd_contains == bdev) {
+               if (disk->fops->release)
+@@ -1432,8 +1437,6 @@ static int __blkdev_put(struct block_dev
+               disk_put_part(bdev->bd_part);
+               bdev->bd_part = NULL;
+               bdev->bd_disk = NULL;
+-              bdev_inode_switch_bdi(bdev->bd_inode,
+-                                      &default_backing_dev_info);
+               if (bdev != bdev->bd_contains)
+                       victim = bdev->bd_contains;
+               bdev->bd_contains = NULL;
diff --git a/queue-3.0/drm-nouveau-properly-handle-allocation-failure-in-nouveau_sgdma_populate.patch b/queue-3.0/drm-nouveau-properly-handle-allocation-failure-in-nouveau_sgdma_populate.patch
new file mode 100644 (file)
index 0000000..5f0f9f3
--- /dev/null
@@ -0,0 +1,36 @@
+From 17c8b960930da3599e47801a54ac0ea1070545d2 Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Mon, 22 Aug 2011 23:14:05 +0200
+Subject: drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit 17c8b960930da3599e47801a54ac0ea1070545d2 upstream.
+
+Not cleaning after alloc failure would result in crash on destroy,
+because nouveau_sgdma_clear assumes "ttm_alloced" to be not null when
+"pages" is not null.
+
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_sgdma.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
++++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+@@ -37,8 +37,11 @@ nouveau_sgdma_populate(struct ttm_backen
+               return -ENOMEM;
+       nvbe->ttm_alloced = kmalloc(sizeof(bool) * num_pages, GFP_KERNEL);
+-      if (!nvbe->ttm_alloced)
++      if (!nvbe->ttm_alloced) {
++              kfree(nvbe->pages);
++              nvbe->pages = NULL;
+               return -ENOMEM;
++      }
+       nvbe->nr_pages = 0;
+       while (num_pages--) {
diff --git a/queue-3.0/hwmon-max16065-fix-current-calculation.patch b/queue-3.0/hwmon-max16065-fix-current-calculation.patch
new file mode 100644 (file)
index 0000000..1c26f75
--- /dev/null
@@ -0,0 +1,30 @@
+From ff71c182f461da5ae9d2d65f8a63f5a9193b9be1 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Sun, 28 Aug 2011 13:01:49 -0700
+Subject: hwmon: (max16065) Fix current calculation
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit ff71c182f461da5ae9d2d65f8a63f5a9193b9be1 upstream.
+
+Current calculation is completely wrong. Add missing brackets to fix it.
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/max16065.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/max16065.c
++++ b/drivers/hwmon/max16065.c
+@@ -124,7 +124,7 @@ static inline int MV_TO_LIMIT(int mv, in
+ static inline int ADC_TO_CURR(int adc, int gain)
+ {
+-      return adc * 1400000 / gain * 255;
++      return adc * 1400000 / (gain * 255);
+ }
+ /*
diff --git a/queue-3.0/md-fix-handling-for-devices-from-2tb-to-4tb-in-0.90.patch b/queue-3.0/md-fix-handling-for-devices-from-2tb-to-4tb-in-0.90.patch
new file mode 100644 (file)
index 0000000..3b36d90
--- /dev/null
@@ -0,0 +1,68 @@
+From 27a7b260f71439c40546b43588448faac01adb93 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Sat, 10 Sep 2011 17:21:28 +1000
+Subject: md: Fix handling for devices from 2TB to 4TB in 0.90
+ metadata.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 27a7b260f71439c40546b43588448faac01adb93 upstream.
+
+0.90 metadata uses an unsigned 32bit number to count the number of
+kilobytes used from each device.
+This should allow up to 4TB per device.
+However we multiply this by 2 (to get sectors) before casting to a
+larger type, so sizes above 2TB get truncated.
+
+Also we allow rdev->sectors to be larger than 4TB, so it is possible
+for the array to be resized larger than the metadata can handle.
+So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in
+used.
+
+Also the sanity check at the end of super_90_load should include level
+1 as it used ->size too. (RAID0 and Linear don't use ->size at all).
+
+Reported-by: Pim Zandbergen <P.Zandbergen@macroscoop.nl>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1084,8 +1084,11 @@ static int super_90_load(mdk_rdev_t *rde
+                       ret = 0;
+       }
+       rdev->sectors = rdev->sb_start;
++      /* Limit to 4TB as metadata cannot record more than that */
++      if (rdev->sectors >= (2ULL << 32))
++              rdev->sectors = (2ULL << 32) - 2;
+-      if (rdev->sectors < sb->size * 2 && sb->level > 1)
++      if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
+               /* "this cannot possibly happen" ... */
+               ret = -EINVAL;
+@@ -1119,7 +1122,7 @@ static int super_90_validate(mddev_t *md
+               mddev->clevel[0] = 0;
+               mddev->layout = sb->layout;
+               mddev->raid_disks = sb->raid_disks;
+-              mddev->dev_sectors = sb->size * 2;
++              mddev->dev_sectors = ((sector_t)sb->size) * 2;
+               mddev->events = ev1;
+               mddev->bitmap_info.offset = 0;
+               mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
+@@ -1361,6 +1364,11 @@ super_90_rdev_size_change(mdk_rdev_t *rd
+       rdev->sb_start = calc_dev_sboffset(rdev);
+       if (!num_sectors || num_sectors > rdev->sb_start)
+               num_sectors = rdev->sb_start;
++      /* Limit to 4TB as metadata cannot record more than that.
++       * 4TB == 2^32 KB, or 2*2^32 sectors.
++       */
++      if (num_sectors >= (2ULL << 32))
++              num_sectors = (2ULL << 32) - 2;
+       md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
+                      rdev->sb_page);
+       md_super_wait(rdev->mddev);
diff --git a/queue-3.0/nuvoton-cir-simplify-raw-ir-sample-handling.patch b/queue-3.0/nuvoton-cir-simplify-raw-ir-sample-handling.patch
new file mode 100644 (file)
index 0000000..9946283
--- /dev/null
@@ -0,0 +1,131 @@
+From de4ed0c111ed078b8729a5cc49c23197740f5bad Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Mon, 8 Aug 2011 17:20:40 -0300
+Subject: [media] nuvoton-cir: simplify raw IR sample handling
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit de4ed0c111ed078b8729a5cc49c23197740f5bad upstream.
+
+The nuvoton-cir driver was storing up consecutive pulse-pulse and
+space-space samples internally, for no good reason, since
+ir_raw_event_store_with_filter() already merges back to back like
+samples types for us. This should also fix a regression introduced late
+in 3.0 that related to a timeout change, which actually becomes correct
+when coupled with this change. Tested with RC6 and RC5 on my own
+nuvoton-cir hardware atop vanilla 3.0.0, after verifying quirky
+behavior in 3.0 due to the timeout change.
+
+Reported-by: Stephan Raue <sraue@openelec.tv>
+CC: Stephan Raue <sraue@openelec.tv>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/rc/nuvoton-cir.c |   45 +++++++----------------------------------
+ drivers/media/rc/nuvoton-cir.h |    1 
+ 2 files changed, 8 insertions(+), 38 deletions(-)
+
+--- a/drivers/media/rc/nuvoton-cir.c
++++ b/drivers/media/rc/nuvoton-cir.c
+@@ -624,7 +624,6 @@ static void nvt_dump_rx_buf(struct nvt_d
+ static void nvt_process_rx_ir_data(struct nvt_dev *nvt)
+ {
+       DEFINE_IR_RAW_EVENT(rawir);
+-      unsigned int count;
+       u32 carrier;
+       u8 sample;
+       int i;
+@@ -637,65 +636,38 @@ static void nvt_process_rx_ir_data(struc
+       if (nvt->carrier_detect_enabled)
+               carrier = nvt_rx_carrier_detect(nvt);
+-      count = nvt->pkts;
+-      nvt_dbg_verbose("Processing buffer of len %d", count);
++      nvt_dbg_verbose("Processing buffer of len %d", nvt->pkts);
+       init_ir_raw_event(&rawir);
+-      for (i = 0; i < count; i++) {
+-              nvt->pkts--;
++      for (i = 0; i < nvt->pkts; i++) {
+               sample = nvt->buf[i];
+               rawir.pulse = ((sample & BUF_PULSE_BIT) != 0);
+               rawir.duration = US_TO_NS((sample & BUF_LEN_MASK)
+                                         * SAMPLE_PERIOD);
+-              if ((sample & BUF_LEN_MASK) == BUF_LEN_MASK) {
+-                      if (nvt->rawir.pulse == rawir.pulse)
+-                              nvt->rawir.duration += rawir.duration;
+-                      else {
+-                              nvt->rawir.duration = rawir.duration;
+-                              nvt->rawir.pulse = rawir.pulse;
+-                      }
+-                      continue;
+-              }
+-
+-              rawir.duration += nvt->rawir.duration;
+-
+-              init_ir_raw_event(&nvt->rawir);
+-              nvt->rawir.duration = 0;
+-              nvt->rawir.pulse = rawir.pulse;
+-
+-              if (sample == BUF_PULSE_BIT)
+-                      rawir.pulse = false;
+-
+-              if (rawir.duration) {
+-                      nvt_dbg("Storing %s with duration %d",
+-                              rawir.pulse ? "pulse" : "space",
+-                              rawir.duration);
++              nvt_dbg("Storing %s with duration %d",
++                      rawir.pulse ? "pulse" : "space", rawir.duration);
+-                      ir_raw_event_store_with_filter(nvt->rdev, &rawir);
+-              }
++              ir_raw_event_store_with_filter(nvt->rdev, &rawir);
+               /*
+                * BUF_PULSE_BIT indicates end of IR data, BUF_REPEAT_BYTE
+                * indicates end of IR signal, but new data incoming. In both
+                * cases, it means we're ready to call ir_raw_event_handle
+                */
+-              if ((sample == BUF_PULSE_BIT) && nvt->pkts) {
++              if ((sample == BUF_PULSE_BIT) && (i + 1 < nvt->pkts)) {
+                       nvt_dbg("Calling ir_raw_event_handle (signal end)\n");
+                       ir_raw_event_handle(nvt->rdev);
+               }
+       }
++      nvt->pkts = 0;
++
+       nvt_dbg("Calling ir_raw_event_handle (buffer empty)\n");
+       ir_raw_event_handle(nvt->rdev);
+-      if (nvt->pkts) {
+-              nvt_dbg("Odd, pkts should be 0 now... (its %u)", nvt->pkts);
+-              nvt->pkts = 0;
+-      }
+-
+       nvt_dbg_verbose("%s done", __func__);
+ }
+@@ -1054,7 +1026,6 @@ static int nvt_probe(struct pnp_dev *pde
+       spin_lock_init(&nvt->nvt_lock);
+       spin_lock_init(&nvt->tx.lock);
+-      init_ir_raw_event(&nvt->rawir);
+       ret = -EBUSY;
+       /* now claim resources */
+--- a/drivers/media/rc/nuvoton-cir.h
++++ b/drivers/media/rc/nuvoton-cir.h
+@@ -67,7 +67,6 @@ static int debug;
+ struct nvt_dev {
+       struct pnp_dev *pdev;
+       struct rc_dev *rdev;
+-      struct ir_raw_event rawir;
+       spinlock_t nvt_lock;
index 155f50f9134fd8bf9a76939b3933a24b59c0ce67..f43c89a55e41be11a8c13756d29ff463ee1956b1 100644 (file)
@@ -69,3 +69,12 @@ mmc-sdhci-s3c-fix-mmc-card-i-o-problem.patch
 xen-use-maximum-reservation-to-limit-amount-of-usable-ram.patch
 xen-x86_32-do-not-enable-iterrupts-when-returning-from.patch
 xen-smp-warn-user-why-they-keel-over-nosmp-or-noapic-and-what-to-use-instead.patch
+hwmon-max16065-fix-current-calculation.patch
+arm-7081-1-mach-integrator-fix-the-clocksource.patch
+arm-davinci-da850-evm-read-mac-address-from-spi-flash.patch
+arm-davinci-fix-cache-flush-build-error.patch
+drm-nouveau-properly-handle-allocation-failure-in-nouveau_sgdma_populate.patch
+avoid-dereferencing-a-request_queue-after-last-close.patch
+md-fix-handling-for-devices-from-2tb-to-4tb-in-0.90.patch
+nuvoton-cir-simplify-raw-ir-sample-handling.patch
+vp7045-fix-buffer-setup.patch
diff --git a/queue-3.0/vp7045-fix-buffer-setup.patch b/queue-3.0/vp7045-fix-buffer-setup.patch
new file mode 100644 (file)
index 0000000..00b49fe
--- /dev/null
@@ -0,0 +1,80 @@
+From fc61ccd35fd59d5362d37c8bf9c0526c85086c84 Mon Sep 17 00:00:00 2001
+From: Florian Mickler <florian@mickler.org>
+Date: Wed, 10 Aug 2011 07:05:20 -0300
+Subject: [media] vp7045: fix buffer setup
+
+From: Florian Mickler <florian@mickler.org>
+
+commit fc61ccd35fd59d5362d37c8bf9c0526c85086c84 upstream.
+
+dvb_usb_device_init calls the frontend_attach method of this driver which
+uses vp7045_usb_ob. In order to have a buffer ready in vp7045_usb_op, it has to
+be allocated before that happens.
+
+Luckily we can use the whole private data as the buffer as it gets separately
+allocated on the heap via kzalloc in dvb_usb_device_init and is thus apt for
+use via usb_control_msg.
+
+This fixes a
+       BUG: unable to handle kernel paging request at 0000000000001e78
+
+reported by Tino Keitel and diagnosed by Dan Carpenter.
+
+Tested-by: Tino Keitel <tino.keitel@tikei.de>
+Signed-off-by: Florian Mickler <florian@mickler.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/dvb-usb/vp7045.c |   26 ++++----------------------
+ 1 file changed, 4 insertions(+), 22 deletions(-)
+
+--- a/drivers/media/dvb/dvb-usb/vp7045.c
++++ b/drivers/media/dvb/dvb-usb/vp7045.c
+@@ -224,26 +224,8 @@ static struct dvb_usb_device_properties
+ static int vp7045_usb_probe(struct usb_interface *intf,
+               const struct usb_device_id *id)
+ {
+-      struct dvb_usb_device *d;
+-      int ret = dvb_usb_device_init(intf, &vp7045_properties,
+-                                 THIS_MODULE, &d, adapter_nr);
+-      if (ret)
+-              return ret;
+-
+-      d->priv = kmalloc(20, GFP_KERNEL);
+-      if (!d->priv) {
+-              dvb_usb_device_exit(intf);
+-              return -ENOMEM;
+-      }
+-
+-      return ret;
+-}
+-
+-static void vp7045_usb_disconnect(struct usb_interface *intf)
+-{
+-      struct dvb_usb_device *d = usb_get_intfdata(intf);
+-      kfree(d->priv);
+-      dvb_usb_device_exit(intf);
++      return dvb_usb_device_init(intf, &vp7045_properties,
++                                 THIS_MODULE, NULL, adapter_nr);
+ }
+ static struct usb_device_id vp7045_usb_table [] = {
+@@ -258,7 +240,7 @@ MODULE_DEVICE_TABLE(usb, vp7045_usb_tabl
+ static struct dvb_usb_device_properties vp7045_properties = {
+       .usb_ctrl = CYPRESS_FX2,
+       .firmware = "dvb-usb-vp7045-01.fw",
+-      .size_of_priv = sizeof(u8 *),
++      .size_of_priv = 20,
+       .num_adapters = 1,
+       .adapter = {
+@@ -305,7 +287,7 @@ static struct dvb_usb_device_properties
+ static struct usb_driver vp7045_usb_driver = {
+       .name           = "dvb_usb_vp7045",
+       .probe          = vp7045_usb_probe,
+-      .disconnect     = vp7045_usb_disconnect,
++      .disconnect     = dvb_usb_device_exit,
+       .id_table       = vp7045_usb_table,
+ };