diff options
7 files changed, 499 insertions, 0 deletions
@@ -12,6 +12,7 @@ gregkh/gkh-version.patch ################################# # TTY patches for 2.6.35 ################################# +tty.current/serial-cpm_uart-implement-the-cpm_uart_early_write-function-for-console-poll.patch ################################# # USB patches for 2.6.35 @@ -24,6 +25,8 @@ usb.current/usb-r8a66597-fix-failure-in-change-of-status.patch usb.current/usb-musb-fix-a-bug-by-making-suspend-interrupt-available-in-device-mode.patch usb.current/usb-otg-ulpi-bail-out-on-read-errors.patch usb.current/usb-ehci-mxc-bail-out-on-transceiver-problems.patch +usb.current/usb-s3c2410-deactivate-endpoints-before-gadget-unbinding.patch +usb.current/usb-fix-oops-in-usb_sg_init.patch ################################# # Staging patches for 2.6.35 @@ -32,6 +35,7 @@ staging.current/staging-usbip-usbip_common-kill-rx-thread-on-tx-thread-creation- staging.current/staging-batman-adv-return-efault-on-copy_to_user-errors.patch staging.current/staging-batman-adv-fix-function-prototype.patch staging.current/staging-mrst-touchscreen-fix-dereferencing-free-memory.patch +staging.current/staging-comedi-drivers-adl_pci9111-fix-ai-commands-in-trig_follow-case.patch ##################################################################### @@ -99,6 +103,7 @@ tty/tty-remove-tty_lock_nested.patch tty/tty-implement-btm-as-mutex-instead-of-bkl.patch tty/tty-release-btm-while-sleeping-in-block_til_ready.patch tty/8250-fix-set_ldisc-operation.patch +tty/tty-avoid-recursive-btm-in-pty_close.patch ################################### @@ -144,6 +149,7 @@ usb/usb-gadget-f_mass_storage-fsg_add-renamed-to-fsg_bind_config.patch usb/usb-gadget-f_fs-functionfs_add-renamed-to-functionfs_bind_config.patch usb/usb-gadget-composite-usb_string_ids_-functions-added.patch usb/usb-gadget-f_fs-use-usb_string_ids_n.patch +usb/usb-gadget-f_mass_storage-dead-code-removed.patch # staging stuff is now in the staging-next tree on git.kernel.org diff --git a/staging.current/staging-comedi-drivers-adl_pci9111-fix-ai-commands-in-trig_follow-case.patch b/staging.current/staging-comedi-drivers-adl_pci9111-fix-ai-commands-in-trig_follow-case.patch new file mode 100644 index 00000000000000..b07c9c5e09ec8d --- /dev/null +++ b/staging.current/staging-comedi-drivers-adl_pci9111-fix-ai-commands-in-trig_follow-case.patch @@ -0,0 +1,53 @@ +From abbotti@mev.co.uk Fri Jun 18 08:50:02 2010 +From: Ian Abbott <abbotti@mev.co.uk> +Date: Fri, 18 Jun 2010 12:11:28 +0100 +Subject: Staging: comedi: drivers: adl_pci9111: Fix AI commands in TRIG_FOLLOW case +Cc: Frank Mori Hess <fmhess@users.sourceforge.net>, Ian Abbott <abbotti@mev.co.uk>, Greg Kroah-Hartman <gregkh@suse.de> +Message-ID: <1276859488-10456-1-git-send-email-abbotti@mev.co.uk> + + +From: Ian Abbott <abbotti@mev.co.uk> + +I received a report that AI streaming acquisitions do not work properly +for the adl_pci9111 driver when convert_src is TRIG_TIMER and +scan_begin_src is TRIG_FOLLOW (and scan_begin_arg is therefore 0). This +seems to be down to the incorrect setting of dev_private->scan_delay in +pci9111_ai_do_cmd(). Under the previously stated conditions, +dev_private->scan_delay ends up set to (unsigned int)-1, but it ought to +be set to 0. The function sets it to 0 initially, and it only makes +sense to change it if both convert_src and scan_begin_src are set to +TRIG_TIMER. + +Note: 'scan_delay' is the number of unwanted scans to discard after each +valid scan. The hardware does not support 'scan' timing as such, just a +regularly paced conversion timer (with automatic channel switching +between conversions). The driver simulates a scan period that is some +(>1) multiple of the conversion period times the scan length +(chanlist_len samples) by reading chanlist_len samples and discarding +the next scan_delay times chanlist_len samples. + +Signed-off-by: Ian Abbott <abbotti@mev.co.uk> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/staging/comedi/drivers/adl_pci9111.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/staging/comedi/drivers/adl_pci9111.c ++++ b/drivers/staging/comedi/drivers/adl_pci9111.c +@@ -824,9 +824,12 @@ static int pci9111_ai_do_cmd(struct come + plx9050_interrupt_control(dev_private->lcr_io_base, true, true, + false, true, true); + +- dev_private->scan_delay = +- (async_cmd->scan_begin_arg / (async_cmd->convert_arg * +- async_cmd->chanlist_len)) - 1; ++ if (async_cmd->scan_begin_src == TRIG_TIMER) { ++ dev_private->scan_delay = ++ (async_cmd->scan_begin_arg / ++ (async_cmd->convert_arg * ++ async_cmd->chanlist_len)) - 1; ++ } + + break; + diff --git a/tty.current/serial-cpm_uart-implement-the-cpm_uart_early_write-function-for-console-poll.patch b/tty.current/serial-cpm_uart-implement-the-cpm_uart_early_write-function-for-console-poll.patch new file mode 100644 index 00000000000000..161436af0d8f84 --- /dev/null +++ b/tty.current/serial-cpm_uart-implement-the-cpm_uart_early_write-function-for-console-poll.patch @@ -0,0 +1,197 @@ +From dongdong.deng@windriver.com Fri Jun 18 08:48:14 2010 +From: Dongdong Deng <dongdong.deng@windriver.com> +Date: Thu, 17 Jun 2010 11:13:40 +0800 +Subject: serial: cpm_uart: implement the cpm_uart_early_write() function for console poll +To: jason.wessel@windriver.com, gregkh@suse.de, galak@kernel.crashing.org, bruce.ashfield@windriver.com, dongdong.deng@windriver.com +Cc: linux-kernel@vger.kernel.org +Message-ID: <1276744420-7845-1-git-send-email-dongdong.deng@windriver.com> + + +The cpm_uart_early_write() function which was used for console poll +isn't implemented in the cpm uart driver. + +Implementing this function both fixes the build when CONFIG_CONSOLE_POLL +is set and allows kgdboc to work via the cpm uart. + +Signed-off-by: Dongdong Deng <dongdong.deng@windriver.com> +Reviewed-by: Bruce Ashfield <bruce.ashfield@windriver.com> +Cc: stable <stable@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/serial/cpm_uart/cpm_uart_core.c | 143 +++++++++++++++++--------------- + 1 file changed, 79 insertions(+), 64 deletions(-) + +--- a/drivers/serial/cpm_uart/cpm_uart_core.c ++++ b/drivers/serial/cpm_uart/cpm_uart_core.c +@@ -930,6 +930,83 @@ static void cpm_uart_config_port(struct + } + } + ++#if defined(CONFIG_CONSOLE_POLL) || defined(CONFIG_SERIAL_CPM_CONSOLE) ++/* ++ * Write a string to the serial port ++ * Note that this is called with interrupts already disabled ++ */ ++static void cpm_uart_early_write(struct uart_cpm_port *pinfo, ++ const char *string, u_int count) ++{ ++ unsigned int i; ++ cbd_t __iomem *bdp, *bdbase; ++ unsigned char *cpm_outp_addr; ++ ++ /* Get the address of the host memory buffer. ++ */ ++ bdp = pinfo->tx_cur; ++ bdbase = pinfo->tx_bd_base; ++ ++ /* ++ * Now, do each character. This is not as bad as it looks ++ * since this is a holding FIFO and not a transmitting FIFO. ++ * We could add the complexity of filling the entire transmit ++ * buffer, but we would just wait longer between accesses...... ++ */ ++ for (i = 0; i < count; i++, string++) { ++ /* Wait for transmitter fifo to empty. ++ * Ready indicates output is ready, and xmt is doing ++ * that, not that it is ready for us to send. ++ */ ++ while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0) ++ ; ++ ++ /* Send the character out. ++ * If the buffer address is in the CPM DPRAM, don't ++ * convert it. ++ */ ++ cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), ++ pinfo); ++ *cpm_outp_addr = *string; ++ ++ out_be16(&bdp->cbd_datlen, 1); ++ setbits16(&bdp->cbd_sc, BD_SC_READY); ++ ++ if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP) ++ bdp = bdbase; ++ else ++ bdp++; ++ ++ /* if a LF, also do CR... */ ++ if (*string == 10) { ++ while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0) ++ ; ++ ++ cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), ++ pinfo); ++ *cpm_outp_addr = 13; ++ ++ out_be16(&bdp->cbd_datlen, 1); ++ setbits16(&bdp->cbd_sc, BD_SC_READY); ++ ++ if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP) ++ bdp = bdbase; ++ else ++ bdp++; ++ } ++ } ++ ++ /* ++ * Finally, Wait for transmitter & holding register to empty ++ * and restore the IER ++ */ ++ while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0) ++ ; ++ ++ pinfo->tx_cur = bdp; ++} ++#endif ++ + #ifdef CONFIG_CONSOLE_POLL + /* Serial polling routines for writing and reading from the uart while + * in an interrupt or debug context. +@@ -999,7 +1076,7 @@ static void cpm_put_poll_char(struct uar + static char ch[2]; + + ch[0] = (char)c; +- cpm_uart_early_write(pinfo->port.line, ch, 1); ++ cpm_uart_early_write(pinfo, ch, 1); + } + #endif /* CONFIG_CONSOLE_POLL */ + +@@ -1130,9 +1207,6 @@ static void cpm_uart_console_write(struc + u_int count) + { + struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index]; +- unsigned int i; +- cbd_t __iomem *bdp, *bdbase; +- unsigned char *cp; + unsigned long flags; + int nolock = oops_in_progress; + +@@ -1142,66 +1216,7 @@ static void cpm_uart_console_write(struc + spin_lock_irqsave(&pinfo->port.lock, flags); + } + +- /* Get the address of the host memory buffer. +- */ +- bdp = pinfo->tx_cur; +- bdbase = pinfo->tx_bd_base; +- +- /* +- * Now, do each character. This is not as bad as it looks +- * since this is a holding FIFO and not a transmitting FIFO. +- * We could add the complexity of filling the entire transmit +- * buffer, but we would just wait longer between accesses...... +- */ +- for (i = 0; i < count; i++, s++) { +- /* Wait for transmitter fifo to empty. +- * Ready indicates output is ready, and xmt is doing +- * that, not that it is ready for us to send. +- */ +- while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0) +- ; +- +- /* Send the character out. +- * If the buffer address is in the CPM DPRAM, don't +- * convert it. +- */ +- cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo); +- *cp = *s; +- +- out_be16(&bdp->cbd_datlen, 1); +- setbits16(&bdp->cbd_sc, BD_SC_READY); +- +- if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP) +- bdp = bdbase; +- else +- bdp++; +- +- /* if a LF, also do CR... */ +- if (*s == 10) { +- while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0) +- ; +- +- cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo); +- *cp = 13; +- +- out_be16(&bdp->cbd_datlen, 1); +- setbits16(&bdp->cbd_sc, BD_SC_READY); +- +- if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP) +- bdp = bdbase; +- else +- bdp++; +- } +- } +- +- /* +- * Finally, Wait for transmitter & holding register to empty +- * and restore the IER +- */ +- while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0) +- ; +- +- pinfo->tx_cur = bdp; ++ cpm_uart_early_write(pinfo, s, count); + + if (unlikely(nolock)) { + local_irq_restore(flags); diff --git a/tty/tty-avoid-recursive-btm-in-pty_close.patch b/tty/tty-avoid-recursive-btm-in-pty_close.patch new file mode 100644 index 00000000000000..db728a5d5bd454 --- /dev/null +++ b/tty/tty-avoid-recursive-btm-in-pty_close.patch @@ -0,0 +1,130 @@ +From arnd@arndb.de Fri Jun 18 08:55:40 2010 +From: Arnd Bergmann <arnd@arndb.de> +Date: Fri, 18 Jun 2010 14:58:07 +0200 +Subject: tty: avoid recursive BTM in pty_close +To: Frederic Weisbecker <fweisbec@gmail.com> +Cc: Tony Luck <tony.luck@intel.com>, Alan Cox <alan@lxorguk.ukuu.org.uk>, linux-kernel@vger.kernel.org, Greg KH <gregkh@suse.de>, Thomas Gleixner <tglx@linutronix.de>, Andrew Morton <akpm@linux-foundation.org>, John Kacur <jkacur@redhat.com>, Al Viro <viro@zeniv.linux.org.uk>, Ingo Molnar <mingo@elte.hu> +Message-ID: <201006181458.07687.arnd@arndb.de> + + +When the console has been redirected, a hangup of the tty +will cause tty_release to be called under the big tty_mutex, +which leads to a deadlock because hangup is also called +under the BTM. + +This moves the BTM deeper into the tty_hangup function so +we can close the redirected tty without holding the BTM. +In case of pty, we now need to drop the BTM before +calling tty_vhangup. + +Signed-off-by: Arnd Bergmann <arnd@arndb.de> +Cc: Tony Luck <tony.luck@intel.com> +Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> +Cc: Thomas Gleixner <tglx@linutronix.de> +Cc: Andrew Morton <akpm@linux-foundation.org> +Cc: John Kacur <jkacur@redhat.com> +Cc: Al Viro <viro@zeniv.linux.org.uk> +Cc: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/char/pty.c | 4 +++- + drivers/char/tty_io.c | 24 ++++++++++++------------ + 2 files changed, 15 insertions(+), 13 deletions(-) + +--- a/drivers/char/pty.c ++++ b/drivers/char/pty.c +@@ -62,7 +62,9 @@ static void pty_close(struct tty_struct + if (tty->driver == ptm_driver) + devpts_pty_kill(tty->link); + #endif +- tty_vhangup_locked(tty->link); ++ tty_unlock(); ++ tty_vhangup(tty->link); ++ tty_lock(); + } + } + +--- a/drivers/char/tty_io.c ++++ b/drivers/char/tty_io.c +@@ -471,7 +471,7 @@ void tty_wakeup(struct tty_struct *tty) + EXPORT_SYMBOL_GPL(tty_wakeup); + + /** +- * do_tty_hangup - actual handler for hangup events ++ * __tty_hangup - actual handler for hangup events + * @work: tty device + * + * This can be called by the "eventd" kernel thread. That is process +@@ -492,7 +492,7 @@ EXPORT_SYMBOL_GPL(tty_wakeup); + * tasklist_lock to walk task list for hangup event + * ->siglock to protect ->signal/->sighand + */ +-void tty_vhangup_locked(struct tty_struct *tty) ++void __tty_hangup(struct tty_struct *tty) + { + struct file *cons_filp = NULL; + struct file *filp, *f = NULL; +@@ -512,10 +512,12 @@ void tty_vhangup_locked(struct tty_struc + } + spin_unlock(&redirect_lock); + ++ tty_lock(); ++ + /* inuse_filps is protected by the single tty lock, + this really needs to change if we want to flush the + workqueue with the lock held */ +- check_tty_count(tty, "do_tty_hangup"); ++ check_tty_count(tty, "tty_hangup"); + + file_list_lock(); + /* This breaks for file handles being sent over AF_UNIX sockets ? */ +@@ -594,6 +596,9 @@ void tty_vhangup_locked(struct tty_struc + */ + set_bit(TTY_HUPPED, &tty->flags); + tty_ldisc_enable(tty); ++ ++ tty_unlock(); ++ + if (f) + fput(f); + } +@@ -603,9 +608,7 @@ static void do_tty_hangup(struct work_st + struct tty_struct *tty = + container_of(work, struct tty_struct, hangup_work); + +- tty_lock(); +- tty_vhangup_locked(tty); +- tty_unlock(); ++ __tty_hangup(tty); + } + + /** +@@ -643,13 +646,12 @@ void tty_vhangup(struct tty_struct *tty) + + printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf)); + #endif +- tty_lock(); +- tty_vhangup_locked(tty); +- tty_unlock(); ++ __tty_hangup(tty); + } + + EXPORT_SYMBOL(tty_vhangup); + ++ + /** + * tty_vhangup_self - process vhangup for own ctty + * +@@ -727,10 +729,8 @@ void disassociate_ctty(int on_exit) + if (tty) { + tty_pgrp = get_pid(tty->pgrp); + if (on_exit) { +- tty_lock(); + if (tty->driver->type != TTY_DRIVER_TYPE_PTY) +- tty_vhangup_locked(tty); +- tty_unlock(); ++ tty_vhangup(tty); + } + tty_kref_put(tty); + } else if (on_exit) { diff --git a/usb.current/usb-fix-oops-in-usb_sg_init.patch b/usb.current/usb-fix-oops-in-usb_sg_init.patch new file mode 100644 index 00000000000000..08be68a0d0f95c --- /dev/null +++ b/usb.current/usb-fix-oops-in-usb_sg_init.patch @@ -0,0 +1,37 @@ +From stern@rowland.harvard.edu Fri Jun 18 08:50:48 2010 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Fri, 18 Jun 2010 10:16:33 -0400 (EDT) +Subject: USB: fix oops in usb_sg_init() +To: Greg KH <greg@kroah.com> +Cc: "Gupta, Ajay Kumar" <ajay.gupta@ti.com>, "matthew@wil.cx" <matthew@wil.cx> +Message-ID: <Pine.LNX.4.44L0.1006181014130.1606-100000@iolanthe.rowland.org> + + +This patch (as1401) fixes a bug in usb_sg_init() that can cause an +invalid pointer dereference. An inner loop reuses some local variables +in an unsafe manner, so new variables are introduced. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Tested-by: Ajay Kumar Gupta <ajay.gupta@ti.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/core/message.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *i + /* A length of zero means transfer the whole sg list */ + len = length; + if (len == 0) { +- for_each_sg(sg, sg, nents, i) +- len += sg->length; ++ struct scatterlist *sg2; ++ int j; ++ ++ for_each_sg(sg, sg2, nents, j) ++ len += sg2->length; + } + } else { + /* diff --git a/usb.current/usb-s3c2410-deactivate-endpoints-before-gadget-unbinding.patch b/usb.current/usb-s3c2410-deactivate-endpoints-before-gadget-unbinding.patch new file mode 100644 index 00000000000000..4b2ab94bd43d81 --- /dev/null +++ b/usb.current/usb-s3c2410-deactivate-endpoints-before-gadget-unbinding.patch @@ -0,0 +1,36 @@ +From vzapolskiy@gmail.com Fri Jun 18 08:49:24 2010 +From: Vladimir Zapolskiy <vzapolskiy@gmail.com> +Date: Fri, 18 Jun 2010 08:25:00 +0400 +Subject: USB: s3c2410: deactivate endpoints before gadget unbinding +To: linux-usb@vger.kernel.org +Cc: Vladimir Zapolskiy <vzapolskiy@gmail.com>, Greg Kroah-Hartman <gregkh@suse.de> +Message-ID: <1276835100-28326-1-git-send-email-vzapolskiy@gmail.com> + + +Gadget disconnect must be called before unbinding to avoid races. +The change fixes an oops on g_ether module unregistering. + +Signed-off-by: Vladimir Zapolskiy <vzapolskiy@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/gadget/s3c2410_udc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/s3c2410_udc.c ++++ b/drivers/usb/gadget/s3c2410_udc.c +@@ -1700,9 +1700,13 @@ int usb_gadget_unregister_driver(struct + if (!driver || driver != udc->driver || !driver->unbind) + return -EINVAL; + +- dprintk(DEBUG_NORMAL,"usb_gadget_register_driver() '%s'\n", ++ dprintk(DEBUG_NORMAL, "usb_gadget_unregister_driver() '%s'\n", + driver->driver.name); + ++ /* report disconnect */ ++ if (driver->disconnect) ++ driver->disconnect(&udc->gadget); ++ + driver->unbind(&udc->gadget); + + device_del(&udc->gadget.dev); diff --git a/usb/usb-gadget-f_mass_storage-dead-code-removed.patch b/usb/usb-gadget-f_mass_storage-dead-code-removed.patch new file mode 100644 index 00000000000000..25433abd9f3fcd --- /dev/null +++ b/usb/usb-gadget-f_mass_storage-dead-code-removed.patch @@ -0,0 +1,40 @@ +From m.nazarewicz@samsung.com Fri Jun 18 08:53:22 2010 +From: Michal Nazarewicz <m.nazarewicz@samsung.com> +Date: Fri, 18 Jun 2010 15:59:43 +0200 +Subject: USB: gadget: f_mass_storage: dead code removed +To: linux-usb@vger.kernel.org +Cc: David Brownell <dbrownell@users.sourceforge.net>, linux-kernel@vger.kernel.org +Message-ID: <51bd2ee9463ebc8665480baac702645c4947b37a.1276868197.git.m.nazarewicz@samsung.com> + + +The ep0req_name was never used in f_mass_storage hence it may +be safely removed from the code. It was a leftover from File +Storage Gadget which used it for debug messages. + +Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com> +Cc: David Brownell <dbrownell@users.sourceforge.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/gadget/f_mass_storage.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/usb/gadget/f_mass_storage.c ++++ b/drivers/usb/gadget/f_mass_storage.c +@@ -333,7 +333,6 @@ struct fsg_common { + struct usb_ep *ep0; /* Copy of gadget->ep0 */ + struct usb_request *ep0req; /* Copy of cdev->req */ + unsigned int ep0_req_tag; +- const char *ep0req_name; + + struct fsg_buffhd *next_buffhd_to_fill; + struct fsg_buffhd *next_buffhd_to_drain; +@@ -624,8 +623,6 @@ static int fsg_setup(struct usb_function + + /* Respond with data/status */ + req->length = min((u16)1, w_length); +- fsg->common->ep0req_name = +- ctrl->bRequestType & USB_DIR_IN ? "ep0-in" : "ep0-out"; + return ep0_queue(fsg->common); + } + |