3.0 patches

7 files changed, 353 insertions, 0 deletions

diff --git a/queue-3.0/alsa-snd-usb-caiaq-correct-offset-fields-of-outbound.patch b/queue-3.0/alsa-snd-usb-caiaq-correct-offset-fields-of-outbound.patch
new file mode 100644
index 0000000000..b833f280c8
--- /dev/null
+++ b/queue-3.0/alsa-snd-usb-caiaq-correct-offset-fields-of-outbound.patch
@@ -0,0 +1,53 @@
+From 15439bde3af7ff88459ea2b5520b77312e958df2 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Fri, 5 Aug 2011 13:49:52 +0200
+Subject: ALSA: snd-usb-caiaq: Correct offset fields of outbound iso_frame_desc
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 15439bde3af7ff88459ea2b5520b77312e958df2 upstream.
+
+This fixes faulty outbount packets in case the inbound packets
+received from the hardware are fragmented and contain bogus input
+iso frames. The bug has been there for ages, but for some strange
+reasons, it was only triggered by newer machines in 64bit mode.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-and-tested-by: William Light <wrl@illest.net>
+Reported-by: Pedro Ribeiro <pedrib@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/caiaq/audio.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -614,6 +614,7 @@ static void read_completed(struct urb *u
+ 	struct snd_usb_caiaqdev *dev;
+ 	struct urb *out;
+ 	int frame, len, send_it = 0, outframe = 0;
++	size_t offset = 0;
+ 
+ 	if (urb->status || !info)
+ 		return;
+@@ -634,7 +635,8 @@ static void read_completed(struct urb *u
+ 		len = urb->iso_frame_desc[outframe].actual_length;
+ 		out->iso_frame_desc[outframe].length = len;
+ 		out->iso_frame_desc[outframe].actual_length = 0;
+-		out->iso_frame_desc[outframe].offset = BYTES_PER_FRAME * frame;
++		out->iso_frame_desc[outframe].offset = offset;
++		offset += len;
+ 
+ 		if (len > 0) {
+ 			spin_lock(&dev->spinlock);
+@@ -650,7 +652,7 @@ static void read_completed(struct urb *u
+ 	}
+ 
+ 	if (send_it) {
+-		out->number_of_packets = FRAMES_PER_URB;
++		out->number_of_packets = outframe;
+ 		out->transfer_flags = URB_ISO_ASAP;
+ 		usb_submit_urb(out, GFP_ATOMIC);
+ 	}
diff --git a/queue-3.0/asoc-fix-binding-of-wm8750-on-jive.patch b/queue-3.0/asoc-fix-binding-of-wm8750-on-jive.patch
new file mode 100644
index 0000000000..38ad43eb27
--- /dev/null
+++ b/queue-3.0/asoc-fix-binding-of-wm8750-on-jive.patch
@@ -0,0 +1,30 @@
+From 6678050442e90a4e9511a9ed14b9bdfc5e393323 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Wed, 3 Aug 2011 17:36:48 +0900
+Subject: ASoC: Fix binding of WM8750 on Jive
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 6678050442e90a4e9511a9ed14b9bdfc5e393323 upstream.
+
+The I2C address is misformatted and would never match.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/samsung/jive_wm8750.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/samsung/jive_wm8750.c
++++ b/sound/soc/samsung/jive_wm8750.c
+@@ -131,7 +131,7 @@ static struct snd_soc_dai_link jive_dai
+ 	.cpu_dai_name	= "s3c2412-i2s",
+ 	.codec_dai_name = "wm8750-hifi",
+ 	.platform_name	= "samsung-audio",
+-	.codec_name	= "wm8750-codec.0-0x1a",
++	.codec_name	= "wm8750-codec.0-001a",
+ 	.init		= jive_wm8750_init,
+ 	.ops		= &jive_ops,
+ };
diff --git a/queue-3.0/asoc-tegra-tegra_pcm_deallocate_dma_buffer-don-t-oops.patch b/queue-3.0/asoc-tegra-tegra_pcm_deallocate_dma_buffer-don-t-oops.patch
new file mode 100644
index 0000000000..0155da0066
--- /dev/null
+++ b/queue-3.0/asoc-tegra-tegra_pcm_deallocate_dma_buffer-don-t-oops.patch
@@ -0,0 +1,42 @@
+From a96edd59b2bc88b3d1ea47e0ba48076d65db9302 Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Thu, 4 Aug 2011 16:44:42 -0600
+Subject: ASoC: Tegra: tegra_pcm_deallocate_dma_buffer: Don't OOPS
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit a96edd59b2bc88b3d1ea47e0ba48076d65db9302 upstream.
+
+Not all PCM devices have all sub-streams. Specifically, the SPDIF driver
+only supports playback and hence has no capture substream. Check whether
+a substream exists before dereferencing it, when de-allocating DMA
+buffers in tegra_pcm_deallocate_dma_buffer.
+
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/tegra/tegra_pcm.c |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/tegra/tegra_pcm.c
++++ b/sound/soc/tegra/tegra_pcm.c
+@@ -309,9 +309,14 @@ static int tegra_pcm_preallocate_dma_buf
+ 
+ static void tegra_pcm_deallocate_dma_buffer(struct snd_pcm *pcm, int stream)
+ {
+-	struct snd_pcm_substream *substream = pcm->streams[stream].substream;
+-	struct snd_dma_buffer *buf = &substream->dma_buffer;
++	struct snd_pcm_substream *substream;
++	struct snd_dma_buffer *buf;
+ 
++	substream = pcm->streams[stream].substream;
++	if (!substream)
++		return;
++
++	buf = &substream->dma_buffer;
+ 	if (!buf->area)
+ 		return;
+ 
diff --git a/queue-3.0/asoc-tegra-wm8903-machine-driver-allow-re-insertion-of.patch b/queue-3.0/asoc-tegra-wm8903-machine-driver-allow-re-insertion-of.patch
new file mode 100644
index 0000000000..3c0dbb9c6c
--- /dev/null
+++ b/queue-3.0/asoc-tegra-wm8903-machine-driver-allow-re-insertion-of.patch
@@ -0,0 +1,80 @@
+From 29591ed4ac6fe00e3ff23b5be0cdc7016ef9c47e Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Thu, 4 Aug 2011 16:44:43 -0600
+Subject: ASoC: Tegra: wm8903 machine driver: Allow re-insertion of
+ module
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit 29591ed4ac6fe00e3ff23b5be0cdc7016ef9c47e upstream.
+
+Two issues were preventing module snd-soc-tegra-wm8903.ko from being
+removed and re-inserted:
+
+a) The speaker-enable GPIO is hosted by the WM8903 chip. This GPIO must
+   be freed before snd_soc_unregister_card() is called, because that
+   triggers wm8903.c:wm8903_remove(), which calls gpiochip_remove(), which
+   then fails if any of the GPIOs are in use. To solve this, free all GPIOs
+   first, so the code doesn't care where they come from.
+
+b) We need to call snd_soc_jack_free_gpios() to match the call to
+   snd_soc_jack_add_gpios() during initialization. Without this, the
+   call to snd_soc_jack_add_gpios() fails during any subsequent modprobe
+   and initialization, since the GPIO and IRQ are already registered. In
+   turn, this causes the headphone state not to be monitored, so the
+   headphone is assumed not to be plugged in, and the audio path to it is
+   never enabled.
+
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/tegra/tegra_wm8903.c |   15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/tegra/tegra_wm8903.c
++++ b/sound/soc/tegra/tegra_wm8903.c
+@@ -56,6 +56,7 @@
+ #define GPIO_HP_MUTE    BIT(1)
+ #define GPIO_INT_MIC_EN BIT(2)
+ #define GPIO_EXT_MIC_EN BIT(3)
++#define GPIO_HP_DET     BIT(4)
+ 
+ struct tegra_wm8903 {
+ 	struct tegra_asoc_utils_data util_data;
+@@ -304,6 +305,7 @@ static int tegra_wm8903_init(struct snd_
+ 		snd_soc_jack_add_gpios(&tegra_wm8903_hp_jack,
+ 					1,
+ 					&tegra_wm8903_hp_jack_gpio);
++		machine->gpio_requested |= GPIO_HP_DET;
+ 	}
+ 
+ 	snd_soc_jack_new(codec, "Mic Jack", SND_JACK_MICROPHONE,
+@@ -429,10 +431,10 @@ static int __devexit tegra_wm8903_driver
+ 	struct tegra_wm8903 *machine = snd_soc_card_get_drvdata(card);
+ 	struct tegra_wm8903_platform_data *pdata = machine->pdata;
+ 
+-	snd_soc_unregister_card(card);
+-
+-	tegra_asoc_utils_fini(&machine->util_data);
+-
++	if (machine->gpio_requested & GPIO_HP_DET)
++		snd_soc_jack_free_gpios(&tegra_wm8903_hp_jack,
++					1,
++					&tegra_wm8903_hp_jack_gpio);
+ 	if (machine->gpio_requested & GPIO_EXT_MIC_EN)
+ 		gpio_free(pdata->gpio_ext_mic_en);
+ 	if (machine->gpio_requested & GPIO_INT_MIC_EN)
+@@ -441,6 +443,11 @@ static int __devexit tegra_wm8903_driver
+ 		gpio_free(pdata->gpio_hp_mute);
+ 	if (machine->gpio_requested & GPIO_SPKR_EN)
+ 		gpio_free(pdata->gpio_spkr_en);
++	machine->gpio_requested = 0;
++
++	snd_soc_unregister_card(card);
++
++	tegra_asoc_utils_fini(&machine->util_data);
+ 
+ 	kfree(machine);
+ 
diff --git a/queue-3.0/ath5k-fix-error-handling-in-ath5k_beacon_send.patch b/queue-3.0/ath5k-fix-error-handling-in-ath5k_beacon_send.patch
new file mode 100644
index 0000000000..c7518732f8
--- /dev/null
+++ b/queue-3.0/ath5k-fix-error-handling-in-ath5k_beacon_send.patch
@@ -0,0 +1,86 @@
+From bdc71bc59231f5542af13b5061b9ab124d093050 Mon Sep 17 00:00:00 2001
+From: Bob Copeland <me@bobcopeland.com>
+Date: Sun, 7 Aug 2011 19:36:07 -0400
+Subject: ath5k: fix error handling in ath5k_beacon_send
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit bdc71bc59231f5542af13b5061b9ab124d093050 upstream.
+
+This cleans up error handling for the beacon in case of dma mapping
+failure.  We need to free the skb when dma mapping fails instead of
+nulling and leaking the pointer, and we should bail out to avoid
+giving the hardware the bad descriptor.
+
+Finally, we need to perform the null check after trying to update
+the beacon, or else beacons will never be sent after a single
+mapping failure.
+
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/base.c |   23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -1748,6 +1748,8 @@ ath5k_beacon_setup(struct ath5k_softc *s
+ 
+ 	if (dma_mapping_error(sc->dev, bf->skbaddr)) {
+ 		ATH5K_ERR(sc, "beacon DMA mapping failed\n");
++		dev_kfree_skb_any(skb);
++		bf->skb = NULL;
+ 		return -EIO;
+ 	}
+ 
+@@ -1832,8 +1834,6 @@ ath5k_beacon_update(struct ieee80211_hw
+ 	ath5k_txbuf_free_skb(sc, avf->bbuf);
+ 	avf->bbuf->skb = skb;
+ 	ret = ath5k_beacon_setup(sc, avf->bbuf);
+-	if (ret)
+-		avf->bbuf->skb = NULL;
+ out:
+ 	return ret;
+ }
+@@ -1854,6 +1854,7 @@ ath5k_beacon_send(struct ath5k_softc *sc
+ 	struct ath5k_vif *avf;
+ 	struct ath5k_buf *bf;
+ 	struct sk_buff *skb;
++	int err;
+ 
+ 	ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON, "in beacon_send\n");
+ 
+@@ -1902,11 +1903,6 @@ ath5k_beacon_send(struct ath5k_softc *sc
+ 
+ 	avf = (void *)vif->drv_priv;
+ 	bf = avf->bbuf;
+-	if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION ||
+-			sc->opmode == NL80211_IFTYPE_MONITOR)) {
+-		ATH5K_WARN(sc, "bf=%p bf_skb=%p\n", bf, bf ? bf->skb : NULL);
+-		return;
+-	}
+ 
+ 	/*
+ 	 * Stop any current dma and put the new frame on the queue.
+@@ -1920,8 +1916,17 @@ ath5k_beacon_send(struct ath5k_softc *sc
+ 
+ 	/* refresh the beacon for AP or MESH mode */
+ 	if (sc->opmode == NL80211_IFTYPE_AP ||
+-			sc->opmode == NL80211_IFTYPE_MESH_POINT)
+-		ath5k_beacon_update(sc->hw, vif);
++			sc->opmode == NL80211_IFTYPE_MESH_POINT) {
++		err = ath5k_beacon_update(sc->hw, vif);
++		if (err)
++			return;
++	}
++
++	if (unlikely(bf->skb == NULL || sc->opmode == NL80211_IFTYPE_STATION ||
++			sc->opmode == NL80211_IFTYPE_MONITOR)) {
++		ATH5K_WARN(sc, "bf=%p bf_skb=%p\n", bf, bf->skb);
++		return;
++	}
+ 
+ 	trace_ath5k_tx(sc, bf->skb, &sc->txqs[sc->bhalq]);
+ 
diff --git a/queue-3.0/hwmon-ibmaem-add-missing-kfree.patch b/queue-3.0/hwmon-ibmaem-add-missing-kfree.patch
new file mode 100644
index 0000000000..5fa67a44b9
--- /dev/null
+++ b/queue-3.0/hwmon-ibmaem-add-missing-kfree.patch
@@ -0,0 +1,56 @@
+From 66a89b2164e2d30661edbd1953eacf0594d8203a Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Tue, 9 Aug 2011 11:10:56 -0400
+Subject: hwmon: (ibmaem) add missing kfree
+
+From: Julia Lawall <julia@diku.dk>
+
+commit 66a89b2164e2d30661edbd1953eacf0594d8203a upstream.
+
+rs_resp is dynamically allocated in aem_read_sensor(), so it should be freed
+before exiting in every case.  This collects the kfree and the return at
+the end of the function.
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/ibmaem.c |   15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/hwmon/ibmaem.c
++++ b/drivers/hwmon/ibmaem.c
+@@ -432,13 +432,15 @@ static int aem_read_sensor(struct aem_da
+ 	aem_send_message(ipmi);
+ 
+ 	res = wait_for_completion_timeout(&ipmi->read_complete, IPMI_TIMEOUT);
+-	if (!res)
+-		return -ETIMEDOUT;
++	if (!res) {
++		res = -ETIMEDOUT;
++		goto out;
++	}
+ 
+ 	if (ipmi->rx_result || ipmi->rx_msg_len != rs_size ||
+ 	    memcmp(&rs_resp->id, &system_x_id, sizeof(system_x_id))) {
+-		kfree(rs_resp);
+-		return -ENOENT;
++		res = -ENOENT;
++		goto out;
+ 	}
+ 
+ 	switch (size) {
+@@ -463,8 +465,11 @@ static int aem_read_sensor(struct aem_da
+ 		break;
+ 	}
+ 	}
++	res = 0;
+ 
+-	return 0;
++out:
++	kfree(rs_resp);
++	return res;
+ }
+ 
+ /* Update AEM energy registers */
diff --git a/queue-3.0/series b/queue-3.0/series
index e5f00343c6..211e57219b 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -12,3 +12,9 @@ usb-option-driver-add-pid-for-vodafone-huawei-k3771.patch
 usb-option-driver-add-pid-for-vodafone-huawei-k4510.patch
 usb-option-driver-add-pid-for-vodafone-huawei-k4511.patch
 atm-br2864-sent-packets-truncated-in-vc-routed-mode.patch
+hwmon-ibmaem-add-missing-kfree.patch
+alsa-snd-usb-caiaq-correct-offset-fields-of-outbound.patch
+asoc-fix-binding-of-wm8750-on-jive.patch
+asoc-tegra-tegra_pcm_deallocate_dma_buffer-don-t-oops.patch
+asoc-tegra-wm8903-machine-driver-allow-re-insertion-of.patch
+ath5k-fix-error-handling-in-ath5k_beacon_send.patch