Commit graph

134,929 commits

Author SHA1 Message Date
Alan Cox
a8d12007c7 n_gsm: Fix timings
Alek Du reported that the code erroneously applies time to jiffies
conversions twice to the t1 and t2 values. In normal use on a modem link
this cases no visible problem but on a slower link it will break as with
HZ=1000 as is typical we are running t1/t2 ten times too fast.

Alek's original patch removed the conversion from the timer setting but we
in fact have to be more careful as the contents of t1/t2 are visible via
the device API and we thus need to correct the constants.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-11-08 10:10:20 -08:00
Nico Erfurth
ea1649dea9 Fix incorrect usage of NET_IP_ALIGN
The driver used NET_IP_ALIGN to remove some additional padding inside of
the rx_fixup function. On many architectures NET_IP_ALIGN defaults to 2
which removed the correct amount of bytes.

On MCORE2-machines commit ea812ca1b0
introduces a change which sets NET_IP_ALIGN to 0 by default. Which
triggered the bug on these machines.

This fix introduces a new RXW_PADDING define and uses this instead of
NET_IP_ALIGN. The name was taken from the original SMSC7500 driver which
is provided by SMSC.

Signed-off-by: Nico Erfurth <ne@erfurth.eu>
Tested-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-08 12:37:07 -05:00
hayeswang
10953db8e1 r8169: increase the delay parameter of pm_schedule_suspend
The link down would occur when reseting PHY. And it would take about 2 ~ 5 seconds
from link down to link up. If the delay of pm_schedule_suspend is not long enough,
the device would enter runtime_suspend before link up. After link up, the device
would wake up and reset PHY again. Then, you would find the driver keep in a loop
of runtime_suspend and rumtime_resume.

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-08 12:37:06 -05:00
Ming Lei
08f2e6312c iommu: omap: Fix compile failure
Fix compile failure in drivers/iommu/omap-iommu-debug.c
because of missing module.h include.

Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2011-11-08 17:11:57 +01:00
Wen-chien Jesse Sung
d13431ca3e Bluetooth: Add support for Broadcom BCM20702A0
Since this device declares itself as vendor specific, must add
a new entry to device ID table to support it.

usb-device output of this device:

T:  Bus=01 Lev=02 Prnt=02 Port=03 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=413c ProdID=8197 Rev=01.12
S:  Manufacturer=Broadcom Corp
S:  Product=BCM20702A0
S:  SerialNumber=D0DF9AA9C9F1
C:  #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2011-11-08 13:15:43 -02:00
Robert Richter
de346b6949 Merge branch 'perf/core' into oprofile/master
Merge reason: Resolve conflicts with Don's NMI rework:

    commit 9c48f1c629
    Author: Don Zickus <dzickus@redhat.com>
    Date:   Fri Sep 30 15:06:21 2011 -0400
    x86, nmi: Wire up NMI handlers to new routines

Conflicts:
	arch/x86/oprofile/nmi_timer_int.c

Signed-off-by: Robert Richter <robert.richter@amd.com>
2011-11-08 15:52:15 +01:00
Mark Brown
81bf58eb3c Merge branches 'regmap/irq' and 'regmap/cache' into regmap-next 2011-11-08 14:16:06 +00:00
Mark Brown
50b776fc71 regmap: Rename LZO cache type to compressed
Users probably don't care about the specific compression algorithm and
we might want to use a different algorithm (snappy being the one I'm
thinking of right now) so update the public interface to have a more
generic name.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2011-11-08 14:15:00 +00:00
Hans Verkuil
e9eb0dadba [media] V4L menu: add submenu for platform devices
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 12:09:52 -02:00
Eyal Shapira
b693289406 wl12xx: fix SDIO suspend/resume
wl1271_suspend/resume() accessed the wrong struct and not wl1271
which caused it to think that wow was enabled when it wasn't.

Signed-off-by: Eyal Shapira <eyal@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 16:00:35 +02:00
Eliad Peller
c31e494689 wl12xx: handle idle changes per-interface
Idle changes are currently handled per hardware.
However, some operations should be done only per-interface.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:58:46 +02:00
Hans Verkuil
1df3a2c6d0 [media] cx88: fix menu level for the VP-3054 module
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:52:21 -02:00
Hans Verkuil
486eeb5628 [media] V4L menu: move all PCI(e) devices to their own submenu
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:51:29 -02:00
Eliad Peller
8a0f2ee378 wl12xx: use p2p rate index when the skb has the NO_CCK flag
If the skb contains the NO_CCK flag, use the p2p rate index
(which contains only the OFDM rates)

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:50:09 +02:00
Guy Eilam
bfafba8a4c wl12xx: set scan probe requests rate according to the no_cck flag
Set the TX rate of probe requests during scanning according to the
no_cck flag in the scan request struct.

Signed-off-by: Guy Eilam <guy@wizery.com>
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:50:09 +02:00
Hans Verkuil
e21d98651a [media] V4L menu: reorganize the radio menu
Move all USB radio devices to the top of the list and move all ISA
devices to a separate menu.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:49:02 -02:00
Hans Verkuil
6e66135cab [media] V4L menu: remove duplicate USB dependency
Thanks to Guennadi Liakhovetski <g.liakhovetski@gmx.de> for pointing this
out to me.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:48:39 -02:00
Hans Verkuil
9fa0b852e1 [media] V4L menu: move all platform drivers to the bottom of the menu
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:48:25 -02:00
Hans Verkuil
053fed7ef9 [media] V4L menu: remove the EXPERIMENTAL tag from vino and c-qcam
These are really, really old drivers. These are really no longer experimental...

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:47:48 -02:00
Hans Verkuil
a3c581be78 [media] V4L menu: move ISA and parport drivers into their own submenu
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:47:28 -02:00
Hans Verkuil
044ab15353 [media] V4L menu: move USB drivers section to the top
USB webcams are some of the most used V4L devices, so move it to a more
prominent place in the menu instead of being at the end.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:47:06 -02:00
Jean Delvare
819cd82b0a [media] usbvision: Drop broken 10-bit I2C address support
The support for 10-bit I2C addresses in usbvision seems plain broken
to me. I had already noticed that back in February 2007 [1]. The code
was not fixed since then, so I take it that it's not actually needed.
And as a matter of fact I don't know of any 10-bit addressed I2C
tuner, encode, decoder or the like.

So let's simply get rid of the broken and useless code.

I'm also adding I2C_FUNC_I2C, as the driver and hardware support plain
I2C messaging.

[1] http://marc.info/?l=linux-i2c&m=117499415208244&w=2

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:38:10 -02:00
Malcolm Priestley
fdb5a9111e [media] Support for Sveon STV22 (IT9137)
This indeed a clone of Kworld UB499 2T

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:37:41 -02:00
Luciano Coelho
3f3fd78e33 wl12xx: increase firmware upload chunk size
The chunk size used during firmware upload was set to 512, which is
the size of a single SDIO block (or two).  This is very inneficient
because we send one or two blocks only per SDIO transaction and don't
get the full benefits of sdio block transfers.

This patch increases the chunk size to 16K.  This more than doubles
the transfer speed both in wl127x and wl128x chips, with greater
impact on the latter:

wl127x:   512 bytes chunk -> ~132ms
        16384 bytes chunk ->  ~57ms
wl128x:   512 bytes chunk -> ~216ms
        16384 bytes chunk ->  ~37ms

Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:36:53 +02:00
Luciano Coelho
e62c9ce4a4 wl12xx: use the same SDIO block size for all different chips
The sdio driver uses a block size of 512 bytes by default.  With our
card, this doesn't work correctly because it sets the block size FBR
in the chip too early (ie. before the chip is powered on).  Thus, if
we don't set it explicitly, block mode remains disabled in the chip.
If we try to send more data than fits in one block, the sdio driver
will split it into separate blocks before sending to the chip.  This
causes problems because the chip is not expecting multiple blocks.

At the moment this is not a problem, because we use chunks of 512
bytes for firmware upload and the data is always sent in byte mode.
In the next patch, we will change the chunk size to a bigger value, so
this patch is a preparation for that.

Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:36:53 +02:00
Luciano Coelho
ce39defb5c wl12xx: change blocksize alignment quirk to negative
SDIO blocksize alignment support is now the rule, not the exception.
To simplify the code in patches to come, invert the meaning of the
quirk to be negative (ie. the quirk is set if the device does _not_
support blocksize alignment).

Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:36:53 +02:00
Eliad Peller
2f8e81ad42 wl12xx: clear wl->vif on remove_interface
wl->vif should be cleared on remove_interface()
(rather than on stop()) even when only a single
vif is supported, because during vif mode change
stop() might not get called (e.g. because of
monitor interface existence)

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:36:46 +02:00
Eliad Peller
fa5e13756a wl12xx: add vifs_state debugfs key
Add debugfs key to dump information regarding the
active vifs (similar to the driver_state debugfs key)

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:36:46 +02:00
Arik Nemtsov
a693534b1a wl12xx: keep beacon-filtering enabled during STA operation
Enable beacon filtering on STA init, and don't disable it when entering
active mode. Otherwise dynamic-PS supports means we receive beacons from
the current AP during any Tx/Rx performed by the driver.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:36:46 +02:00
Eliad Peller
d6fa37c9ff wl12xx: reconfigure rate policies on set_bitrate_mask
The rate policies are configured only after association,
resulting in auth req being sent in wrong rates.

Reconfigure rate policies on bitrate mask change.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:36:45 +02:00
Eliad Peller
679a673414 wl12xx: couple role_start_dev with roc
Device role is always started along with ROC.
Couple them together by introducing new wl12xx_start_dev
and wl12xx_stop_dev functions.

By using these functions, we solve a bug that occured during
channel switch - we started the dev role on one channel, and
ROCed on a different one.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-11-08 15:36:45 +02:00
Sylwester Nawrocki
34490a0a3d [media] staging: as102: Eliminate as10x_handle_t alias
Remove pre-processor defined as10x_handle_t data type by directly
replacing it with struct as102_bus_adapter_t. phandle is renamed
to adap inside function bodies.

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:33:25 -02:00
Sylwester Nawrocki
d758b9ef7a [media] staging: as102: Define device name string pointers constant
Supresses following checkpatch warning:
WARNING: static const char * array should probably be static const char * const

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:32:42 -02:00
Sylwester Nawrocki
a11726349c [media] staging: as102: Move variable declarations to the header
Fixes following checkpatch.pl warning:
WARNING: externs should be avoided in .c files

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:32:06 -02:00
Sylwester Nawrocki
3288e201a1 [media] staging: as102: Use linux/uaccess.h instead of asm/uaccess.h
Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:31:25 -02:00
Sylwester Nawrocki
c20ec0354f [media] staging: as102: Remove linkage specifiers for C++
The as10x_cmd.h header is not public so there should be no need
for an "extern "C"" in it.

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:31:13 -02:00
Sylwester Nawrocki
7d462fe580 [media] staging: as102: Replace printk(KERN_<LEVEL> witk pr_<level>
While at it also correct some spelling errors.

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:31:01 -02:00
Sylwester Nawrocki
14e0e4bf6c [media] staging: as102: Whitespace and indentation cleanup
Remove some unnecessary braces. Replace spaces with tabs where
expected. Replace gcc specific __FUNCTION__ with  C99 __func__.
No functional changes.

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:30:46 -02:00
Sylwester Nawrocki
880102898f [media] staging: as102: Fix the dvb device registration error path
Release already acquired resources when error happens during
devices registration steps.
Use dev_err()  where struct device is available, instead of driver
specific err().

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:29:22 -02:00
Sylwester Nawrocki
fa1a13f621 [media] staging: as102: Replace pragma(pack) with attribute __packed
Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Piotr Chmura <chmooreck@poczta.onet.pl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:28:55 -02:00
Sylwester Nawrocki
57753767dd [media] staging: as102: Make the driver select CONFIG_FW_LOADER
It doesn't seem to be of much advantage to compile in FW_LOADER
support conditionally, then make the driver always select FW_LOADER
and remove #idefs from the code.

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:28:37 -02:00
Sylwester Nawrocki
82aae98df4 [media] staging: as102: Remove leftovers of the SPI bus driver
SPI bus driver support is not included in this module, the SPI
driver files are missing. But some bits are still present so
clean up the unused code.
The SPI driver support can be properly added later if needed.

Then CONFIG_AS102_SPI and CONFIG_AS102_USB is now not needed
and the pre-processor statements using these config options
can now be removed from *.c files.

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:28:06 -02:00
Sylwester Nawrocki
c06271e052 [media] staging: as102: Remove unnecessary typedefs
According to the kernel coding rules typedefs should be avoided,
so replace theit occurances with explicit enum/union types.

Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:24:44 -02:00
Piotr Chmura
7f033e3354 [media] staging: as102: Remove comment tags for editors configuration
Cc: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Piotr Chmura <chmooreck@poczta.onet.pl>
Signed-off-by: Sylwester Nawrocki <snjw23@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:24:25 -02:00
Malcolm Priestley
3339a5b165 [media] it913x-fe ver 1.10 correct SNR reading from frontend
Correction of reading from frontend and represents
a SNR nonlinear scale of minimum signal to full signal.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:23:03 -02:00
Peter De Schrijver
c540d9f13d [media] bt8xx: add support for PCI device ID 0x36c
add support for conexant PCI device 0x36c. Seems to be fully compatible with
the currently supported chips, yet the chip has different PCI ID.

Signed-off-by: Peter De Schrijver <p2@psychaos.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:22:24 -02:00
Peter De Schrijver
de2843b663 [media] bt8xx: add support for Tongwei Video Technology TD-3116
The following patch adds support for the Tongwei Video Technology TD-3116 board. This
is a Bt878 based capture card with 16 inputs meant for surveilance applications.
It also offers a way to check which inputs have a video signal while capturing another
input. In addition there are a number of alarm inputs and outputs available and there
is microcontroller which is presumably intended for use as a system watchdog. None of
these extra capabilities are supported by the patch.

Signed-off-by: Peter De Schrijver <p2@psychaos.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 11:17:57 -02:00
Malcolm Priestley
3822c7cef7 [media] it913x ver 1.09 support for USB 1 devices (IT9135)
IT9135 devices do support USB 1.
Support added with restricton on pid count to 5.
IT9137 devices wil not connect in USB 1 mode.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 10:45:19 -02:00
Hans de Goede
1249a3a82d [media] v4l2-ctrl: Send change events to all fh for auto cluster slave controls
Otherwise the fh changing the master control won't get the inactive state
change event for the slave controls.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 10:30:33 -02:00
Hans de Goede
e3e72f39b6 [media] v4l2-event: Don't set sev->fh to NULL on unsubscribe
Setting sev->fh to NULL causes problems for the del op added in the next
patch of this series, since this op needs a way to get to its own data
structures, and typically this will be done by using container_of on an
embedded v4l2_fh struct.

The reason the original code is setting sev->fh to NULL is to signal
to users of the event framework that the unsubscription has happened,
but since their is no shared lock between the event framework and users
of it, this is inherently racy, and it also turns out to be unnecessary
as long as both the event framework and the user of the framework do their
own locking properly and the user guarantees that it holds no references
to the subcribed_event structure after its del operation has been called.

This is best explained by looking at the only code currently checking for
sev->fh being set to NULL on unsubscribe, which is the v4l2-ctrls.c send_event
function. Here is the relevant code from v4l2-ctrls: send_event():

	if (sev->fh && (sev->fh != fh ||
			(sev->flags & V4L2_EVENT_SUB_FL_ALLOW_FEEDBACK)))
		v4l2_event_queue_fh(sev->fh, &ev);

Now lets say that v4l2_event_unsubscribe and v4l2-ctrls: send_event() race
on the same sev, then the following could happens:

1) send_event checks sev->fh, finds it is not NULL
<thread switch>
2) v4l2_event_unsubscribe sets sev->fh NULL
3) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
   as the thread calling send_event holds the ctrl_lock
<thread switch>
4) send_event calls v4l2_event_queue_fh(sev->fh, &ev) which not is equivalent
   to calling: v4l2_event_queue_fh(NULL, &ev)
5) oops, NULL pointer deref.

Now again without setting sev->fh to NULL in v4l2_event_unsubscribe and
without the (now senseless since always true) sev->fh != NULL check in

1) send_event is about to call v4l2_event_queue_fh(sev->fh, &ev)
<thread switch>
2) v4l2_event_unsubscribe removes sev->list from the fh->subscribed list
<thread switch>
3) send_event calls v4l2_event_queue_fh(sev->fh, &ev)
4) v4l2_event_queue_fh blocks on the fh_lock spinlock
<thread switch>
5) v4l2_event_unsubscribe unlocks the fh_lock spinlock
6) v4l2_event_unsubscribe calls v4l2_ctrls del_event function, this blocks
   as the thread calling send_event holds the ctrl_lock
<thread switch>
8) v4l2_event_queue_fh takes the fh_lock
7) v4l2_event_queue_fh calls v4l2_event_subscribed, does not find it since
   sev->list has been removed from fh->subscribed already -> does nothing
9) v4l2_event_queue_fh releases the fh_lock
10) the caller of send_event releases the ctrl lock (mutex)
<thread switch>
11) v4l2_ctrls del_event takes the ctrl lock
12) v4l2_ctrls del_event removes sev->node from the ev_subs list
13) v4l2_ctrls del_event releases the ctrl lock
14) v4l2_event_unsubscribe frees the sev, to which no references are being
    held anymore

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-08 10:29:51 -02:00