7 years agoALSA : au88x0 - Limit number of channels to fix Oops via OSS emu
Raymond Yau [Sun, 16 Jan 2011 02:55:54 +0000 (10:55 +0800)]
ALSA : au88x0 - Limit number of channels to fix Oops via OSS emu

commit d9ab344336f74c012f6643ed3d1ad8ca0136de3b upstream.

Fix playback/capture channels patch to change supported playback
channels of au8830 to 1,2,4 and capture channels to 1,2.
This prevent oops when oss emulation use SNDCTL_DSP_CHANNELS to
set 3 Channels

Signed-off-by: Raymond Yau <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoem28xx: Fix audio input for Terratec Grabby
Mauro Carvalho Chehab [Mon, 25 Oct 2010 20:51:15 +0000 (17:51 -0300)]
em28xx: Fix audio input for Terratec Grabby

commit a3fa904ec79b94f0db7faed010ff94d42f7d1d47 upstream.

The audio input line was wrong. Fix it.

Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoradio-aimslab.c: Fix gcc 4.5+ bug
Mauro Carvalho Chehab [Thu, 6 Jan 2011 10:16:04 +0000 (08:16 -0200)]
radio-aimslab.c: Fix gcc 4.5+ bug

commit e3c92215198cb6aa00ad38db2780faa6b72e0a3f upstream.

gcc 4.5+ doesn't properly evaluate some inlined expressions.
A previous patch were proposed by Andrew Morton using noinline.
However, the entire inlined function is bogus, so let's just
remove it and be happy.

Reported-by: Andrew Morton <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agocfg80211: fix allowing country IEs for WIPHY_FLAG_STRICT_REGULATORY
Luis R. Rodriguez [Wed, 20 Oct 2010 17:18:54 +0000 (10:18 -0700)]
cfg80211: fix allowing country IEs for WIPHY_FLAG_STRICT_REGULATORY

commit 749b527b21465fb079796c03ffb4302584dc31c1 upstream.

We should be enabling country IE hints for WIPHY_FLAG_STRICT_REGULATORY
even if we haven't yet recieved regulatory domain hint for the driver
if it needed one. Without this Country IEs are not passed on to drivers
that have set WIPHY_FLAG_STRICT_REGULATORY, today this is just all
Atheros chipset drivers: ath5k, ath9k, ar9170, carl9170.

This was part of the original design, however it was completely

Cc: Easwar Krishnan <>
Signed-off-by: Luis R. Rodriguez <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agocfg80211: pass the reg hint initiator to helpers
Luis R. Rodriguez [Wed, 20 Oct 2010 17:18:53 +0000 (10:18 -0700)]
cfg80211: pass the reg hint initiator to helpers

commit 7ca43d03b1291481bdf894bbaec5d580e7684e7d upstream.

This is required later.

Cc: Easwar Krishnan <>
Signed-off-by: Luis R. Rodriguez <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agompt2sas: add missing initialization of scsih_cmds
Kashyap, Desai [Tue, 17 Nov 2009 07:46:37 +0000 (13:16 +0530)]
mpt2sas: add missing initialization of scsih_cmds

commit d685c262083dcd5fd98b7499b22a377a3225229c upstream.

Internal command scsih_cmds init is included in mpt2sas_base_attach.

Signed-off-by: Kashyap Desai <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agompt2sas: Kernel Panic during Large Topology discovery
Kashyap, Desai [Tue, 4 Jan 2011 06:08:39 +0000 (11:38 +0530)]
mpt2sas: Kernel Panic during Large Topology discovery

commit 4224489f45b503f0a1f1cf310f76dc108f45689a upstream.

There was a configuration page timing out during the initial port
enable at driver load time. The port enable would fail, and this would
result in the driver unloading itself, meanwhile the driver was accessing
freed memory in another context resulting in the panic.  The fix is to
prevent access to freed memory once the driver had issued the diag reset
which woke up the sleeping port enable process.  The routine
_base_reset_handler was reorganized so the last sleeping process woken up was
the port_enable.

Signed-off-by: Kashyap Desai <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agompt2sas: Correct resizing calculation for max_queue_depth
Kashyap, Desai [Tue, 4 Jan 2011 06:04:57 +0000 (11:34 +0530)]
mpt2sas: Correct resizing calculation for max_queue_depth

commit 11e1b961ab067ee3acaf723531da4d3f23e1d6f7 upstream.

The ioc->hba_queue_depth is not properly resized when the controller
firmware reports that it supports more outstanding IO than what can be fit
inside the reply descriptor pool depth. This is reproduced by setting the
controller global credits larger than 30,000. The bug results in an
incorrect sizing of the queues. The fix is to resize the queue_size by
dividing queue_diff by two.

Signed-off-by: Kashyap Desai <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agompt2sas: Fix the race between broadcast asyn event and scsi command completion
Kashyap, Desai [Wed, 5 Jan 2011 12:24:32 +0000 (17:54 +0530)]
mpt2sas: Fix the race between broadcast asyn event and scsi command completion

commit ec07a053597bdab51cbd23619f9f9f392712508a upstream.

False timeout after hard resets, there were two issues which leads
to timeout.
(1) Panic because of invalid memory access in the broadcast asyn
event processing routine due to a race between accessing the scsi command
pointer from broadcast asyn event processing thread and completing
the same scsi command from the interrupt context.
(2)  Broadcast asyn event notifcations are not handled due to events
ignored while the broadcast asyn event is activity being processed
from the event process kernel thread.

In addition, changed the ABRT_TASK_SET to ABORT_TASK in the
broadcast async event processing routine.   This is less disruptive to other
request that generate Broadcast Asyn Primitives besides target
reset. e.g clear reservations, microcode download,and mode select.

Signed-off-by: Kashyap Desai <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agompt2sas: fix internal device reset for older firmware prior to MPI Rev K
Kashyap, Desai [Tue, 4 Jan 2011 06:04:17 +0000 (11:34 +0530)]
mpt2sas: fix internal device reset for older firmware prior to MPI Rev K

commit efe82a16bc0f9f9e1fc8fa706eb0309fcd57770a upstream.

The "internal device reset complete" event is not supported
for older firmware prior to MPI Rev K We added
a check in the driver so the "internal device reset" event is
ignored for older firmware.  When ignored, the tm_busy flag doesn't
get set nor cleared.  Without this fix, IO queues would be froozen
indefinetly after the "internal device reset" event, as the "complete" event
never sent to clear the flag.

Signed-off-by: Kashyap Desai <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agompt2sas: Fix device removal handshake for zoned devices
Kashyap, Desai [Tue, 4 Jan 2011 06:02:13 +0000 (11:32 +0530)]
mpt2sas: Fix device removal handshake for zoned devices

commit 4dc2757a2e9a9d1f2faee4fc6119276fc0061c16 upstream.

When zoning end devices, the driver is not sending device
removal handshake alogrithm to firmware. This results in controller
firmware not sending sas topology add events the next time the device is
added. The fix is the driver should be doing the device removal handshake
even though the PHYSTATUS_VACANT bit is set in the PhyStatus of the
event data. The current design is avoiding the handshake when the
VACANT bit is set in the phy status.

Signed-off-by: Kashyap Desai <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agofix incorrect value of SCSI_MAX_SG_CHAIN_SEGMENTS due to include file ordering
David Dillow [Sun, 16 Jan 2011 20:12:39 +0000 (15:12 -0500)]
fix incorrect value of SCSI_MAX_SG_CHAIN_SEGMENTS due to include file ordering

commit ac61c46f4f7665ab4548e90430c37b2529e16cff upstream.

If the compiled object doesn't include linux/scatterlist.h before
scsi/scsi.h, it will get an incorrect definition of

Signed-off-by: David Dillow <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agompt2sas: fix Integrated Raid unsynced on shutdown problem
Kashyap, Desai [Tue, 4 Jan 2011 06:10:23 +0000 (11:40 +0530)]
mpt2sas: fix Integrated Raid unsynced on shutdown problem

commit 3a9c913a3e57b170887d39456e04c18f2305ec67 upstream.

IR shutdown(sending) and IR shutdown(complete) messages not
listed in /var/log/messages when driver is removed.

request when the driver is unloaded so the IR metadata journal is updated.
If this request is not sent, then the volume would need a "check
consistency" issued on the next bootup if the volume was roamed from one
initiator to another. The current driver supports this feature only when the
system is rebooted, however this also need to be supported if the driver is

To fix this issue, the driver is going
to need to call the _scsih_ir_shutdown prior to reporting
the volumes missing from the OS, hence the device handles
are still present.

Signed-off-by: Kashyap Desai <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agolibsas: fix runaway error handler problem
James Bottomley [Thu, 20 Jan 2011 23:26:44 +0000 (17:26 -0600)]
libsas: fix runaway error handler problem

commit 9ee91f7fb550a4c82f82d9818e42493484c754af upstream.

libsas makes use of scsi_schedule_eh() but forgets to clear the
host_eh_scheduled flag in its error handling routine.  Because of this,
the error handler thread never gets to sleep; it's constantly awake and
trying to run the error routine leading to console spew and inability to
run anything else (at least on a UP system).  The fix is to clear the
flag as we splice the work queue.

Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agofix medium error problems with some arrays which can cause data corruption
James Bottomley [Fri, 17 Dec 2010 20:36:34 +0000 (15:36 -0500)]
fix medium error problems with some arrays which can cause data corruption

commit a8733c7baf457b071528e385a0b7d4aaec79287c upstream.

Our current handling of medium error assumes that data is returned up
to the bad sector.  This assumption holds good for all disk devices,
all DIF arrays and most ordinary arrays.  However, an LSI array engine
was recently discovered which reports a medium error without returning
any data.  This means that when we report good data up to the medium
error, we've reported junk originally in the buffer as good.  Worse,
if the read consists of requested data plus a readahead, and the error
occurs in readahead, we'll just strip off the readahead and report
junk up to userspace as good data with no error.

The fix for this is to have the error position computation take into
account the amount of data returned by the driver using the scsi
residual data.  Unfortunately, not every driver fills in this data,
but for those who don't, it's set to zero, which means we'll think a
full set of data was transferred and the behaviour will be identical
to the prior behaviour of the code (believe the buffer up to the error
sector).  All modern drivers seem to set the residual, so that should
fix up the LSI failure/corruption case.

Reported-by: Douglas Gilbert <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoqdio: use proper QEBSM operand for SIGA-R and SIGA-S
Jan Glauber [Wed, 5 Jan 2011 11:47:52 +0000 (12:47 +0100)]
qdio: use proper QEBSM operand for SIGA-R and SIGA-S

commit 958c0ba403cb6a693b54be2389f9ef53377fa259 upstream.

If QIOASSIST is enabled for a qdio device the SIGA instruction requires
a modified function code. This function code modifier was missing for
SIGA-R and SIGA-S which can lead to a kernel panic caused by an
operand exception.

Signed-off-by: Jan Glauber <>
Signed-off-by: Martin Schwidefsky <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k_hw: Fix system hang when resuming from S3/S4
Rajkumar Manoharan [Thu, 27 Jan 2011 13:09:37 +0000 (18:39 +0530)]
ath9k_hw: Fix system hang when resuming from S3/S4

commit 5b64aa72ead6f8be488d2be7af579f0d69fb7a6e upstream.

The bit 6 & 7 of AR_WA (0x4004) should be enabled only
for the chips that are supporting L0s functionality
while resuming back from S3/S4.

Enabling these bits for AR9280 is causing system hang
within a few S3/S4-resume cycles.

Cc: Jack Lee <>
Signed-off-by: Rajkumar Manoharan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k_hw: disabled PAPRD for AR9003
Luis R. Rodriguez [Fri, 21 Jan 2011 01:47:39 +0000 (17:47 -0800)]
ath9k_hw: disabled PAPRD for AR9003

commit 6f4810101a629b31b5427872a09ea092cfc5c4bd upstream.

AR9003's PAPRD was enabled prematurely, and is causing some
large discrepancies on throughput and network connectivity.
For example downlink (RX) throughput against an AR9280 AP
can vary widlely from 43-73 Mbit/s while disabling this
gets AR9382 (2x2) up to around 93 Mbit/s in a 2.4 GHz HT20 setup.

Cc: Paul Shaw <>
Signed-off-by: Luis R. Rodriguez <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k_hw: do PA offset calibration only on longcal interval
Rajkumar Manoharan [Mon, 17 Jan 2011 09:51:40 +0000 (15:21 +0530)]
ath9k_hw: do PA offset calibration only on longcal interval

commit 811ea256b30b37091b5bbf41517404cf98ab56c1 upstream.

The power detector adc offset calibration has to be done
on 4 minutes interval (longcal * pa_skip_count). But the commit
"ath9k_hw: fix a noise floor calibration related race condition"
makes the PA calibration executed more frequently beased on
nfcal_pending value. Running PAOffset calibration lesser than
longcal interval doesn't help anything and the worse part is that
it causes NF load timeouts and RX deaf conditions.

In a very noisy environment, where the distance b/w AP & station
is ~10 meter and running a downlink udp traffic with frequent
background scan causes "Timeout while waiting for nf to load:
AR_PHY_AGC_CONTROL=0x40d1a" and moves the chip into deaf state.
This issue was originaly reported in Android platform where
the network-manager application does bgscan more frequently
on AR9271 chips. (AR9285 family usb device).

Signed-off-by: Vasanthakumar Thiagarajan <>
Signed-off-by: Rajkumar Manoharan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k: fix beacon restart on channel change
Rajkumar Manoharan [Thu, 30 Dec 2010 13:37:44 +0000 (19:07 +0530)]
ath9k: fix beacon restart on channel change

commit 1186488b4a4d4871e40cb1604ba3ede3d4b7cc90 upstream.

Restart the beacon timers only if the beacon
was already configured. Otherwise beacons timers
are restarted unnecessarily in unassociated state too.

Signed-off-by: Rajkumar Manoharan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k: fix aphy / wiphy idle mismatch
Luis R. Rodriguez [Mon, 20 Dec 2010 16:29:59 +0000 (11:29 -0500)]
ath9k: fix aphy / wiphy idle mismatch

commit afe68d0a8f5961652e26cea39d74e2cc820de841 upstream.

ath9k supports its own set of virtual wiphys, and it uses
the mac80211 idle notifications to know when a device needs
to be idle or not. We recently changed ath9k to force idle
on driver stop() and on resume but forgot to take into account
ath9k's own virtual wiphy idle states. These are used internally
by ath9k to check if the device's radio should be powered down
on each idle call. Without this change its possible that the
device could have been forced off but the virtual wiphy idle
was left on.

Cc: Paul Stewart <>
Cc: Amod Bodas <>
Signed-off-by: Luis R. Rodriguez <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k: fix assumptions for idle calls on suspend/resume
Luis R. Rodriguez [Tue, 7 Dec 2010 23:13:20 +0000 (15:13 -0800)]
ath9k: fix assumptions for idle calls on suspend/resume

commit a08e7ade9ddf4fe79576f953cc5c1725e944d26c upstream.

mac80211 will notify drivers when to go idle and ath9k
assumed that it would get further notifications for idle
states after a device stop() config call but as per agreed
semantics the idle state of the radio is left up to driver
after mac80211 issues the stop() callback. The driver is
resposnbile for ensuring the device remains idle after
that even between suspend / resume calls.

This fixes suspend/resume when you issue suspend and resume
twice on ath9k when ath9k_stop() was already called. We need
to put the radio to full sleep in order for resume to work

What might seem fishy is we are turning the radio off
after resume. The reason why we do this is because we know
we should not have anything enabled after a mac80211 tells
us to stop(), if we resume and never get a start() we won't
get another stop() by mac80211 so to be safe always bring
the 802.11 device with the radio disabled after resume,
this ensures that if we suspend we already have the radio
disabled and only a start() will ever trigger it on.

Cc: Paul Stewart <>
Cc: Amod Bodas <>
Signed-off-by: Luis R. Rodriguez <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k: Fix bug in delimiter padding computation
Vasanthakumar Thiagarajan [Wed, 10 Nov 2010 13:03:15 +0000 (05:03 -0800)]
ath9k: Fix bug in delimiter padding computation

commit 39ec2997c374b528cdbf65099b6d6b8593a67f7f upstream.

There is a roundng error in delimiter padding computation
which causes severe throughput drop with some of AR9003.

signed-off-by: Felix Fietkau <>
Signed-off-by: Vasanthakumar Thiagarajan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k: move the PCU lock to the sc structure
Luis R. Rodriguez [Tue, 26 Oct 2010 22:27:24 +0000 (15:27 -0700)]
ath9k: move the PCU lock to the sc structure

commit 4bdd1e978ede034c1211957eb17eaf50de00d234 upstream.

The PCU lock should be used to contend TX DMA as well,
this will be done next.

This is part of a series of patches which fix stopping
TX DMA completley when requested on the driver.
For more details about this issue refer to this thread:

Tested-by: Ben Greear <>
Cc: Kyungwan Nam <>
Signed-off-by: Luis R. Rodriguez <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k: simplify hw reset locking
Luis R. Rodriguez [Tue, 26 Oct 2010 22:27:23 +0000 (15:27 -0700)]
ath9k: simplify hw reset locking

commit 9d94674ab754be0e275120a183670ead435f9c0d upstream.

The new PCU lock is better placed so we can just contend
against that when trying to reset hardware.

This is part of a series of patches which fix stopping
TX DMA completley when requested on the driver.
For more details about this issue refer to this thread:

Tested-by: Ben Greear <>
Cc: Kyungwan Nam <>
Signed-off-by: Luis R. Rodriguez <>
Signed-off-by: John W. Linville <>
7 years agoath9k_hw: Fix XPABIAS level configuration for AR9003
Vasanthakumar Thiagarajan [Wed, 10 Nov 2010 13:03:11 +0000 (05:03 -0800)]
ath9k_hw: Fix XPABIAS level configuration for AR9003

commit 52a0e2477dac2106bc1688cbe9615cdafc9deb7d upstream.

Improper configuration of 0x16288 and 0x16290 would affect transmission.

Signed-off-by: Vasanthakumar Thiagarajan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoath9k_htc: Handle pending URBs properly
Sujith Manoharan [Tue, 28 Dec 2010 08:58:05 +0000 (14:28 +0530)]
ath9k_htc: Handle pending URBs properly

commit ff8f59b5bbdf1527235b8c88d859c7d23691324f upstream.

When doing a channel change, the pending URBs have to be killed
properly on calling htc_stop().

This fixes the probe response timeout seen when sending UDP traffic at
a high rate and running background scan at the same time.

Signed-off-by: Sujith Manoharan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoiwlagn: Re-enable RF_KILL interrupt when down
Don Fry [Sun, 6 Feb 2011 17:29:45 +0000 (09:29 -0800)]
iwlagn: Re-enable RF_KILL interrupt when down

commit 3dd823e6b86407aed1a025041d8f1df77e43a9c8 upstream.

With commit 554d1d027b19265c4aa3f718b3126d2b86e09a08 only one RF_KILL
interrupt will be seen by the driver when the interface is down.

Re-enable the interrupt when it occurs to see all transitions.

Signed-off-by: Don Fry <>
Signed-off-by: Wey-Yi Guy <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoiwlagn: enable only rfkill interrupt when device is down
Stanislaw Gruszka [Thu, 23 Dec 2010 11:38:21 +0000 (12:38 +0100)]
iwlagn: enable only rfkill interrupt when device is down

commit 554d1d027b19265c4aa3f718b3126d2b86e09a08 upstream.

Since commit 6cd0b1cb872b3bf9fc5de4536404206ab74bafdd "iwlagn: fix
hw-rfkill while the interface is down", we enable interrupts when
device is not ready to receive them. However hardware, when it is in
some inconsistent state, can generate other than rfkill interrupts
and crash the system. I can reproduce crash with "kernel BUG at
drivers/net/wireless/iwlwifi/iwl-agn.c:1010!" message, when forcing
firmware restarts.

To fix only enable rfkill interrupt when down device and after probe.
I checked patch on laptop with 5100 device, rfkill change is still
passed to user space when device is down.

Signed-off-by: Stanislaw Gruszka <>
Acked-by: Wey-Yi Guy <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agomac80211: fix initialization of skb->cb in ieee80211_subif_start_xmit
Felix Fietkau [Sat, 18 Dec 2010 18:30:48 +0000 (19:30 +0100)]
mac80211: fix initialization of skb->cb in ieee80211_subif_start_xmit

commit 489ee9195a7de9e6bc833d639ff6b553ffdad90e upstream.

The change 'mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs'
added a check for copying the skb if it's shared, however the tx info variable
still points at the cb of the old skb

Signed-off-by: Felix Fietkau <>
Acked-by: Helmut Schaa <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agomac80211: fix a crash in ieee80211_beacon_get_tim on change_interface
Felix Fietkau [Mon, 24 Jan 2011 18:28:49 +0000 (19:28 +0100)]
mac80211: fix a crash in ieee80211_beacon_get_tim on change_interface

commit eb3e554b4b3a56386ef5214dbe0e3935a350178b upstream.

Some drivers (e.g. ath9k) do not always disable beacons when they're
supposed to. When an interface is changed using the change_interface op,
the mode specific sdata part is in an undefined state and trying to
get a beacon at this point can produce weird crashes.

To fix this, add a check for ieee80211_sdata_running before using
anything from the sdata.

Signed-off-by: Felix Fietkau <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agomac80211: use maximum number of AMPDU frames as default in BA RX
Luciano Coelho [Wed, 12 Jan 2011 13:18:11 +0000 (15:18 +0200)]
mac80211: use maximum number of AMPDU frames as default in BA RX

commit 82694f764dad783a123394e2220b92b9be721b43 upstream.

When the buffer size is set to zero in the block ack parameter set
field, we should use the maximum supported number of subframes.  The
existing code was bogus and was doing some unnecessary calculations
that lead to wrong values.

Thanks Johannes for helping me figure this one out.

Cc: Johannes Berg <>
Signed-off-by: Luciano Coelho <>
Reviewed-by: Johannes Berg <>
Signed-off-by: John W. Linville <>
7 years agomac80211: add missing synchronize_rcu
Johannes Berg [Mon, 3 Jan 2011 18:42:24 +0000 (19:42 +0100)]
mac80211: add missing synchronize_rcu

commit d2460f4b2fa6dbdeec800414f9cf5b1fc8b71197 upstream.

commit ad0e2b5a00dbec303e4682b403bb6703d11dcdb2
Author: Johannes Berg <>
Date:   Tue Jun 1 10:19:19 2010 +0200

    mac80211: simplify key locking

removed the synchronization against RCU and thus
opened a race window where we can use a key for
TX while it is already freed. Put a synchronisation
into the right place to close that window.

Reported-by: Jussi Kivilinna <>
Signed-off-by: Johannes Berg <>
Signed-off-by: John W. Linville <>
7 years agomac80211: fix mesh forwarding when ratelimited too
Milton Miller [Thu, 30 Dec 2010 08:01:03 +0000 (02:01 -0600)]
mac80211: fix mesh forwarding when ratelimited too

commit 919bbad580445801c22ef6ccbe624551fee652bd upstream.

Commit b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 said:

    Under memory pressure, the mac80211 mesh code
    may helpfully print a message that it failed
    to clone a mesh frame and then will proceed
    to crash trying to use it anyway. Fix that.

Avoid the reference whenever the frame copy is unsuccessful
regardless of the debug message being suppressed or printed.

Signed-off-by: Milton Miller <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agostaging: rt2860: Fix incorrect netif_stop_queue usage warning
Denis Kirjanov [Mon, 10 Jan 2011 20:09:30 +0000 (20:09 +0000)]
staging: rt2860: Fix incorrect netif_stop_queue usage warning

commit 9c33008412683eba91bce2dc4575f28c728b6bd1 upstream.

The TX queues are allocated inside register_netdev.
It doesn't make any sense to stop the queue before

Signed-off-by: Denis Kirjanov <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoStaging: rt2860: fix previous patch error
Chien-Chia Chen [Thu, 9 Dec 2010 02:52:08 +0000 (10:52 +0800)]
Staging: rt2860: fix previous patch error

commit 1f0613158ea14b399fd7a16470630a729ba9d0c3 upstream.

Somehow Greg messed up the last patch and missed a chunk.  This patch
contains the missing chunk.

Acked-by: Chun-Yi Lee <>
Signed-off-by: Chien-Chia Chen <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoStaging: rt3090: Fix RT3090 scan AP function
Chien-Chia Chen [Wed, 8 Dec 2010 22:20:33 +0000 (14:20 -0800)]
Staging: rt3090: Fix RT3090 scan AP function

commit 1226056d9608d241db4b558a0d88a347ad5c66ae upstream.

Fix RT3090 scan AP function.

This patch fixes the rt3090 wireless module failed
to scan AP around due to  Windows driver causing
rt3090 module unable to scan AP in Linux.

Acked-by: Chun-Yi Lee <>
Signed-off-by: Chien-Chia Chen <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agostaging: hv: Enable sending GARP packet after live migration
Haiyang Zhang [Wed, 2 Feb 2011 21:42:58 +0000 (13:42 -0800)]
staging: hv: Enable sending GARP packet after live migration

commit 7c161d0b900ea9bd9fc5ea5d3fa9916e9eb0dd88 upstream.

The hv_netvsc gets RNDIS_STATUS_MEDIA_CONNECT event after the VM
is live migrated. Adding call to netif_notify_peers() for this event
to send GARP (Gratuitous ARP) to notify network peers. Otherwise,
the VM's network connection may stop after a live migration.

This patch should also be applied to stable kernel 2.6.32 and later.

Signed-off-by: Haiyang Zhang <>
Signed-off-by: Hank Janssen <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agostaging: hv: fix netvsc sleeping while atomic
Timo Teräs [Fri, 17 Dec 2010 09:40:24 +0000 (11:40 +0200)]
staging: hv: fix netvsc sleeping while atomic

commit d70c673153d42e8aefd5ac296c8159ef222d076b upstream.

The channel callbacks are called directly from vmbus_event_dpc
which runs in tasklet context. These callbacks need to use


Cc: Hank Janssen <>
Cc: Haiyang Zhang <>
Signed-off-by: Timo Teräs <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoStaging: hv: fix sysfs symlink on hv block device
Ky Srinivasan [Fri, 17 Dec 2010 01:59:19 +0000 (18:59 -0700)]
Staging: hv: fix sysfs symlink on hv block device

commit 268eff909afaca93188d2d14554cbf824f6a0e41 upstream.

The block device does not create the proper symlink in sysfs because we
forgot to set up the gendisk structure properly.  This patch fixes the

Signed-off-by: K. Y. Srinivasan <>
Cc: Hank Janssen <>
Cc: Haiyang Zhang <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agostaging: comedi: ni_labpc: Use shared IRQ for PCMCIA card
Ian Abbott [Wed, 19 Jan 2011 11:48:44 +0000 (11:48 +0000)]
staging: comedi: ni_labpc: Use shared IRQ for PCMCIA card

commit d1ce318496f5943d2cc5e20171fc383a59a1421f upstream.

The ni_labpc driver module only requests a shared IRQ for PCI devices,
requesting a non-shared IRQ for non-PCI devices.
As this module is also used by the ni_labpc_cs module for certain
National Instruments PCMCIA cards, it also needs to request a shared IRQ
for PCMCIA devices, otherwise you get a IRQ mismatch with the CardBus

Signed-off-by: Ian Abbott <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agostaging: comedi: add support for newer jr3 1-channel pci board
Ruben Smits [Sat, 11 Dec 2010 07:26:18 +0000 (08:26 +0100)]
staging: comedi: add support for newer jr3 1-channel pci board

commit 6292817d58637f85dd623cfe563c7f5ec4f4c470 upstream.

add DEVICE_ID to table

Signed-off-by: Ruben Smits <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agostaging: zram: fix data corruption issue
Nitin Gupta [Sun, 6 Feb 2011 01:34:20 +0000 (20:34 -0500)]
staging: zram: fix data corruption issue

commit 5414e557fca545614ceedc3d3496f747457e2e3b upstream.

In zram_read() and zram_write() we were not incrementing the
index number and thus were reading/writing values from/to
incorrect sectors on zram disk, resulting in data corruption.

Signed-off-by: Nitin Gupta <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: fix race between root-hub resume and wakeup requests
Alan Stern [Wed, 2 Feb 2011 18:59:33 +0000 (13:59 -0500)]
USB: fix race between root-hub resume and wakeup requests

commit bf3d7d40e42a85ca73a34e1385ff34f092a384eb upstream.

The USB core keeps track of pending resume requests for root hubs, in
order to resolve races between wakeup requests and suspends.  However
the code that does this is subject to another race (between wakeup
requests and resumes) because the WAKEUP_PENDING flag is cleared
before the resume occurs, leaving a window in which another wakeup
request might arrive.

This patch (as1447) fixes the problem by clearing the WAKEUP_PENDING
flag after the resume instead of before it.

This fixes Bugzilla #24952.

Signed-off-by: Alan Stern <>
Tested-by: Paul Bender <>
Tested-by: warpme <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: prevent buggy hubs from crashing the USB stack
Alan Stern [Mon, 31 Jan 2011 15:56:37 +0000 (10:56 -0500)]
USB: prevent buggy hubs from crashing the USB stack

commit d199c96d41d80a567493e12b8e96ea056a1350c1 upstream.

If anyone comes across a high-speed hub that (by mistake or by design)
claims to have no Transaction Translators, plugging a full- or
low-speed device into it will cause the USB stack to crash.  This
patch (as1446) prevents the problem by ignoring such devices, since
the kernel has no way to communicate with them.

Signed-off-by: Alan Stern <>
Tested-by: Perry Neben <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: EHCI: fix scheduling while atomic during suspend
Yin Kangkai [Fri, 28 Jan 2011 04:04:35 +0000 (12:04 +0800)]
USB: EHCI: fix scheduling while atomic during suspend

commit 148fc55fd0449683a1d15bf219ad8d8b6fa17545 upstream.

There is a msleep with spin lock held during ehci pci suspend, which will
cause kernel BUG: scheduling while atomic. Fix that.

[  184.139620] BUG: scheduling while atomic: kworker/u:11/416/0x00000002
[  184.139632] 4 locks held by kworker/u:11/416:
[  184.139640]  #0:  (events_unbound){+.+.+.}, at: [<c104ddd4>] process_one_work+0x1b3/0x4cb
[  184.139669]  #1:  ((&entry->work)){+.+.+.}, at: [<c104ddd4>] process_one_work+0x1b3/0x4cb
[  184.139686]  #2:  (&__lockdep_no_validate__){+.+.+.}, at: [<c127cde3>] __device_suspend+0x2c/0x154
[  184.139706]  #3:  (&(&ehci->lock)->rlock){-.-...}, at: [<c132f3d8>] ehci_pci_suspend+0x35/0x7b
[  184.139725] Modules linked in: serio_raw pegasus joydev mrst_gfx(C) battery
[  184.139748] irq event stamp: 52
[  184.139753] hardirqs last  enabled at (51): [<c14fdaac>] mutex_lock_nested+0x258/0x293
[  184.139766] hardirqs last disabled at (52): [<c14fe7b4>] _raw_spin_lock_irqsave+0xf/0x3e
[  184.139777] softirqs last  enabled at (0): [<c10371c1>] copy_process+0x3d2/0x109d
[  184.139789] softirqs last disabled at (0): [<  (null)>]   (null)
[  184.139802] Pid: 416, comm: kworker/u:11 Tainted: G         C  2.6.37-6.3-adaptation-oaktrail #37
[  184.139809] Call Trace:
[  184.139820]  [<c102eeff>] __schedule_bug+0x5e/0x65
[  184.139829]  [<c14fbca5>] schedule+0xac/0xc4c
[  184.139840]  [<c11d4845>] ? string+0x37/0x8b
[  184.139853]  [<c1044f21>] ? lock_timer_base+0x1f/0x3e
[  184.139863]  [<c14fe7da>] ? _raw_spin_lock_irqsave+0x35/0x3e
[  184.139876]  [<c1061590>] ? trace_hardirqs_off+0xb/0xd
[  184.139885]  [<c14fccdc>] schedule_timeout+0x283/0x2d9
[  184.139896]  [<c104516f>] ? process_timeout+0x0/0xa
[  184.139906]  [<c14fcd47>] schedule_timeout_uninterruptible+0x15/0x17
[  184.139916]  [<c104566a>] msleep+0x10/0x16
[  184.139926]  [<c132f316>] ehci_adjust_port_wakeup_flags+0x69/0xf6
[  184.139937]  [<c132f3eb>] ehci_pci_suspend+0x48/0x7b
[  184.139946]  [<c1326587>] suspend_common+0x52/0xbb
[  184.139956]  [<c1326625>] hcd_pci_suspend+0x26/0x28
[  184.139967]  [<c11e7182>] pci_pm_suspend+0x5f/0xd0
[  184.139976]  [<c127ca3a>] pm_op+0x5d/0xf0
[  184.139986]  [<c127ceac>] __device_suspend+0xf5/0x154
[  184.139996]  [<c127d2c8>] async_suspend+0x16/0x3a
[  184.140006]  [<c1058f54>] async_run_entry_fn+0x89/0x111
[  184.140016]  [<c104deb6>] process_one_work+0x295/0x4cb
[  184.140026]  [<c1058ecb>] ? async_run_entry_fn+0x0/0x111
[  184.140036]  [<c104e3d0>] worker_thread+0x17f/0x298
[  184.140045]  [<c104e251>] ? worker_thread+0x0/0x298
[  184.140055]  [<c105277f>] kthread+0x64/0x69
[  184.140064]  [<c105271b>] ? kthread+0x0/0x69
[  184.140075]  [<c1002efa>] kernel_thread_helper+0x6/0x1a

Signed-off-by: Yin Kangkai <>
Acked-by: Alan Stern <>
CC: David Brownell <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: ftdi_sio: Add VID=0x0647, PID=0x0100 for Acton Research spectrograph
Michael Williamson [Fri, 28 Jan 2011 00:36:19 +0000 (18:36 -0600)]
USB: ftdi_sio: Add VID=0x0647, PID=0x0100 for Acton Research spectrograph

commit 28fe2eb0162a1d23370dd99ff7d0e35632b1ee91 upstream.

Add the USB Vendor ID and Product ID for a Acton Research Corp.
spectrograph device with a FTDI chip for serial I/O.

Signed-off-by: Michael H Williamson <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: cdc-acm: Adding second ACM channel support for Nokia N8
Arvid Ephraim Picciani [Tue, 25 Jan 2011 14:58:40 +0000 (15:58 +0100)]
USB: cdc-acm: Adding second ACM channel support for Nokia N8

commit 721d92fc6373dee15846216f9d178ec240ec0fd7 upstream.

This adds the N8 to the list of devices in cdc-acm, in order to get the
secondary ACM device exposed.

In the spirit of:

Signed-off-by: Arvid Ephraim Picciani <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: ftdi_sio: add ST Micro Connect Lite uart support
Jean-Christophe PLAGNIOL-VILLARD [Sat, 29 Jan 2011 14:32:52 +0000 (15:32 +0100)]
USB: ftdi_sio: add ST Micro Connect Lite uart support

commit 6ec2f46c4b4abf48c88c0ae7c476f347b97e1105 upstream.

on ST Micro Connect Lite we have 4 port
Part A and B for the JTAG
Port C Uart
Port D for PIO

Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: Storage: Add unusual_devs entry for VTech Kidizoom
Nick Holloway [Wed, 26 Jan 2011 21:47:43 +0000 (21:47 +0000)]
USB: Storage: Add unusual_devs entry for VTech Kidizoom

commit c25f6b1591b158f7ae3b9132367d0fa6d632e70e upstream.

This device suffers from the off-by-one error when reporting the capacity,
so add entry with US_FL_FIX_CAPACITY.

Signed-off-by: Nick Holloway <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: ti_usb: fix module removal
Ionut Nicu [Tue, 28 Dec 2010 20:21:08 +0000 (22:21 +0200)]
USB: ti_usb: fix module removal

commit b14de3857227cd978f515247853fd15cc2425d3e upstream.

If usb_deregister() is called after usb_serial_deregister() when
the device is plugged in, the following Oops occurs:

[   95.337377] BUG: unable to handle kernel NULL pointer dereference at 00000010
[   95.338236] IP: [<c0776b2d>] klist_put+0x12/0x62
[   95.338356] *pdpt = 000000003001a001 *pde = 0000000000000000
[   95.338356] Oops: 0000 [#1] SMP
[   95.340499] last sysfs file: /sys/devices/pci0000:00/0000:00:1d.2/usb8/idVendor
[   95.340499] Modules linked in: ti_usb_3410_5052(-) usbserial cpufreq_ondemand acpi_cpufreq mperf iptable_nat nf_nat iptable_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables ipv6 uinput arc4 ecb iwlagn iwlcore mac80211 cfg80211 microcode pcspkr acer_wmi joydev wmi sky2 [last unloaded: scsi_wait_scan]
[   95.341908]
[   95.341908] Pid: 1532, comm: modprobe Not tainted 2.6.37-rc7+ #6 Eiger                          /Aspire 5930
[   95.341908] EIP: 0060:[<c0776b2d>] EFLAGS: 00010246 CPU: 0
[   95.341908] EIP is at klist_put+0x12/0x62
[   95.341908] EAX: 00000000 EBX: eedc0c84 ECX: c09c21b4 EDX: 00000001
[   95.341908] ESI: 00000000 EDI: efaa0c1c EBP: f214fe2c ESP: f214fe1c
[   95.341908]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[   95.341908] Process modprobe (pid: 1532, ti=f214e000 task=efaaf080 task.ti=f214e000)
[   95.341908] Stack:
[   95.341908]  f214fe24 eedc0c84 efaaf080 efaa0c1c f214fe34 c0776ba8 f214fe5c c0776c76
[   95.341908]  c09c21b4 c09c21b4 eedc0c84 efaaf080 00000000 c0634398 eafe2d1c f7b515f0
[   95.341908]  f214fe6c c0631b5c eafe2d50 eafe2d1c f214fe7c c0631ba2 eafe2d1c eafe2c00
[   95.341908] Call Trace:
[   95.341908]  [<c0776ba8>] ? klist_del+0xd/0xf
[   95.341908]  [<c0776c76>] ? klist_remove+0x48/0x74
[   95.341908]  [<c0634398>] ? devres_release_all+0x49/0x51
[   95.341908]  [<c0631b5c>] ? __device_release_driver+0x7b/0xa4
[   95.341908]  [<c0631ba2>] ? device_release_driver+0x1d/0x28
[   95.341908]  [<c06317c4>] ? bus_remove_device+0x92/0xa1
[   95.341908]  [<c062f3d8>] ? device_del+0xf9/0x13e
[   95.341908]  [<f7b06146>] ? usb_serial_disconnect+0xd9/0x116 [usbserial]
[   95.341908]  [<c0681e3f>] ? usb_disable_interface+0x32/0x40
[   95.341908]  [<c0683972>] ? usb_unbind_interface+0x48/0xfd
[   95.341908]  [<c0631b43>] ? __device_release_driver+0x62/0xa4
[   95.341908]  [<c06320b9>] ? driver_detach+0x62/0x81
[   95.341908]  [<c0631a41>] ? bus_remove_driver+0x8f/0xae
[   95.341908]  [<c063214c>] ? driver_unregister+0x50/0x57
[   95.341908]  [<c0682f95>] ? usb_deregister+0x77/0x84
[   95.341908]  [<f7b505b6>] ? ti_exit+0x26/0x28 [ti_usb_3410_5052]
[   95.341908]  [<c046a307>] ? sys_delete_module+0x181/0x1de
[   95.341908]  [<c04e2727>] ? path_put+0x1a/0x1d
[   95.341908]  [<c047f4c5>] ? audit_syscall_entry+0x116/0x138
[   95.341908]  [<c04094df>] ? sysenter_do_call+0x12/0x28
[   95.341908] Code: 00 83 7d f0 00 74 09 85 f6 74 05 89 f0 ff 55 f0 8b 43 04 5a 5b 5e 5f 5d c3 55 89 e5 57 56 53 89 c3 83 ec 04 8b 30 83 e6 fe 89 f0 <8b> 7e 10 88 55 f0 e8 47 26 01 00 8a 55 f0 84 d2 74 17 f6 03 01
[   95.341908] EIP: [<c0776b2d>] klist_put+0x12/0x62 SS:ESP 0068:f214fe1c
[   95.341908] CR2: 0000000000000010
[   95.342357] ---[ end trace 8124d00ad871ad18 ]---

Signed-off-by: Ionut Nicu <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: io_edgeport: fix the reported firmware major and minor
Bjørn Mork [Mon, 17 Jan 2011 13:19:37 +0000 (14:19 +0100)]
USB: io_edgeport: fix the reported firmware major and minor

commit 271c1150b4f8e1685e5a8cbf76e329ec894481da upstream.

The major and minor number saved in the product_info structure
were copied from the address instead of the data, causing an
inconsistency in the reported versions during firmware loading:

 usb 4-1: firmware: requesting edgeport/down.fw
 /usr/src/linux/drivers/usb/serial/io_edgeport.c: downloading firmware version (930) 1.16.4
 /usr/src/linux/drivers/usb/serial/io_edgeport.c: edge_startup - time 3 4328191260
 /usr/src/linux/drivers/usb/serial/io_edgeport.c:   FirmwareMajorVersion  0.0.4

This can cause some confusion whether firmware loaded successfully
or not.

Signed-off-by: Bjørn Mork <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: g_printer: fix bug in module parameter definitions
Alan Stern [Mon, 10 Jan 2011 16:24:14 +0000 (11:24 -0500)]
USB: g_printer: fix bug in module parameter definitions

commit ad84e4a9efb7c8ed322bafb6ebdb9c3a49a3d3a8 upstream.

This patch (as1442) fixes a bug in g_printer: Module parameters should
not be marked "__initdata" if they are accessible in sysfs (i.e., if
the mode value in the module_param() macro is nonzero).  Otherwise
attempts to access the parameters will cause addressing violations.

Character-string module parameters must not be marked "__initdata"
if the module can be unloaded, because the kernel needs to access the
parameter variable at unload time in order to free the
dynamically-allocated string.

Signed-off-by: Alan Stern <>
CC: Roland Kletzing <>
CC: Craig W. Nadler <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: g_printer: fix bug in unregistration
Alan Stern [Mon, 10 Jan 2011 16:23:05 +0000 (11:23 -0500)]
USB: g_printer: fix bug in unregistration

commit d5aa475180d03d45c5dc6134aa833f1b3e89c45e upstream.

This patch (as1441) fixes a bug in g_printer.  The gadget driver, char
device number, and class device should be unregistered in reverse
order of registration.  As it is now, when the module is unloaded the
class device gets unregistered first, causing a crash when the unbind
method tries to access it.

This fixes Bugzilla #25882.

Signed-off-by: Alan Stern <>
CC: Roland Kletzing <>
CC: Craig W. Nadler <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: EHCI: fix DMA deallocation bug
Alan Stern [Thu, 6 Jan 2011 15:17:09 +0000 (10:17 -0500)]
USB: EHCI: fix DMA deallocation bug

commit f75593ceaa08e6d27aec1a5de31cded19e850dd1 upstream.

This patch (as1440) fixes a bug in ehci-hcd.  ehci->periodic_size is
used to compute the size in a dma_alloc_coherent() call, but then it
gets changed later on.  As a result, the corresponding call to
dma_free_coherent() passes a different size from the original
allocation.  Fix the problem by adjusting ehci->periodic_size before
carrying out any of the memory allocations.

Signed-off-by: Alan Stern <>
Tested-by: Larry Finger <>
CC: David Brownell <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: EHCI: ASPM quirk of ISOC on AMD Hudson
Alex He [Tue, 21 Dec 2010 09:45:46 +0000 (17:45 +0800)]
USB: EHCI: ASPM quirk of ISOC on AMD Hudson

commit baab93afc2844b68d57b0dcca5e1d34c5d7cf411 upstream.

AMD Hudson also needs the same ASPM quirk as SB800

Signed-off-by: Alex He <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB serial: add missing .usb_driver field in serial drivers
Alan Stern [Tue, 11 Jan 2011 19:16:50 +0000 (14:16 -0500)]
USB serial: add missing .usb_driver field in serial drivers

commit 5620b5f7f19e9ee3fcf6ecf493fed7821b7b495b upstream.

This patch (as1443) fixes a bug found in many of the USB serial
drivers: They don't set the .usb_driver field in their
usb_serial_driver structure.  This field is needed for assigning
dynamic IDs for device matching.

In addition, starting with the 2.6.37 kernel, the .usb_driver field is
needed for proper autosuspend operation.  Without it, attempts to open
the device file will fail.

Signed-off-by: Alan Stern <>
Reported-by: Dan Williams <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: adding USB support for Cinterion's HC2x, EU3 and PH8 products
Nicolaus Colberg [Wed, 12 Jan 2011 15:30:03 +0000 (16:30 +0100)]
USB: adding USB support for Cinterion's HC2x, EU3 and PH8 products

commit aa52b3a92918039b273fc9d1994bd34227c40269 upstream.

/drivers/usb/serial/option.c: Adding support for Cinterion's HC25, HC28,
HC28J, EU3-E, EU3-P and PH8 by correcting/adding Cinterion's and
Siemens' Vendor IDs as well as Product IDs and USB_DEVICE tuples

Signed-off-by: Nicolaus Colberg <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: serial: Updated support for ICOM devices
Pieter Maes [Mon, 17 Jan 2011 23:26:16 +0000 (00:26 +0100)]
USB: serial: Updated support for ICOM devices

commit a9d61bc49188e32d2ae9cf0f683cde3e1744feef upstream.

I found the original patch on the db0fhn repeater wiki (couldn't find the email
of the origial author) I guess it was never commited.
I updated and added some Icom HAM-radio devices to the ftdi driver.
Added extra comments to make clear what devices it are.

Signed-off-by: Pieter Maes <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: usb-storage: unusual_devs entry for Coby MP3 player
Alan Stern [Tue, 25 Jan 2011 18:07:04 +0000 (13:07 -0500)]
USB: usb-storage: unusual_devs entry for Coby MP3 player

commit 3ea3c9b5a8464ec8223125f95e5dddb3bfd02a39 upstream.

This patch (as1444) adds an unusual_devs entry for an MP3 player from
Coby electronics.  The device has two nasty bugs.

Signed-off-by: Alan Stern <>
Tested-by: Jasper Mackenzie <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: usb-storage: unusual_devs entry for CamSport Evo
Alan Stern [Mon, 3 Jan 2011 21:47:49 +0000 (16:47 -0500)]
USB: usb-storage: unusual_devs entry for CamSport Evo

commit 12f68c480c7155a66bd2a76ab2fef28dd5f93fa2 upstream.

This patch (as1438) adds an unusual_devs entry for the MagicPixel
FW_Omega2 chip, used in the CamSport Evo camera.  The firmware
incorrectly reports a vendor-specific bDeviceClass.

Signed-off-by: Alan Stern <>
Reported-by: <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: usb-storage: unusual_devs update for TrekStor DataStation maxi g.u external...
Richard Schütz [Wed, 22 Dec 2010 13:28:56 +0000 (14:28 +0100)]
USB: usb-storage: unusual_devs update for TrekStor DataStation maxi g.u external hard drive enclosure

commit 7e1e7bd9dbd469267b6e6de1bf8d71a7d65ce86a upstream.

The TrekStor DataStation maxi g.u external hard drive enclosure uses a
JMicron USB to SATA chip which needs the US_FL_IGNORE_RESIDUE flag to work

Signed-off-by: Richard Schütz <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: usb-storage: unusual_devs update for Cypress ATACB
Richard Schütz [Sun, 19 Dec 2010 20:18:38 +0000 (21:18 +0100)]
USB: usb-storage: unusual_devs update for Cypress ATACB

commit cae41118f50ef0c431e13159df6d7dd8bbd54004 upstream.

New device ID added for unusual Cypress ATACB device.

Signed-off-by: Richard Schütz <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: qcaux: add Pantech UML290 device ID
Dan Williams [Fri, 31 Dec 2010 16:51:51 +0000 (10:51 -0600)]
USB: qcaux: add Pantech UML290 device ID

commit a58861fbde2a350df4d27fc62fb42905669b37ce upstream.

Another CDC-ACM + vendor specific interface layout for the QCDM port.

Signed-off-by: Dan Williams <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: CP210x Removed incorrect device ID
Craig Shelley [Sun, 2 Jan 2011 21:59:08 +0000 (21:59 +0000)]
USB: CP210x Removed incorrect device ID

commit 9926c0df7b31b2128eebe92e0e2b052f380ea464 upstream.

Device ID removed 0x10C4/0x8149 for West Mountain Radio Computerized
Battery Analyzer.  This device is actually based on a SiLabs C8051Fxxx,
see for further info.

Signed-off-by: Craig Shelley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: CP210x Add two device IDs
Craig Shelley [Sun, 2 Jan 2011 21:51:46 +0000 (21:51 +0000)]
USB: CP210x Add two device IDs

commit faea63f7ccfddfb8fc19798799fcd38c58415172 upstream.

Device Ids added for IRZ Automation Teleport SG-10 GSM/GPRS Modem and
DekTec DTA Plus VHF/UHF Booster/Attenuator.

Signed-off-by: Craig Shelley <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoUSB: serial: handle Data Carrier Detect changes
Libor Pechacek [Fri, 14 Jan 2011 13:30:21 +0000 (14:30 +0100)]
USB: serial: handle Data Carrier Detect changes

commit d14fc1a74e846d7851f24fc9519fe87dc12a1231 upstream.

Alan's commit 335f8514f200e63d689113d29cb7253a5c282967 introduced
.carrier_raised function in several drivers.  That also means
tty_port_block_til_ready can now suspend the process trying to open the serial
port when Carrier Detect is low and put it into tty_port.open_wait queue.  We
need to wake up the process when Carrier Detect goes high and trigger TTY
hangup when CD goes low.

Some of the devices do not report modem status line changes, or at least we
don't understand the status message, so for those we remove .carrier_raised

Signed-off-by: Libor Pechacek <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agohwmon: (applesmc) Relax the severity of device init failure
Henrik Rydberg [Tue, 9 Nov 2010 15:15:02 +0000 (15:15 +0000)]
hwmon: (applesmc) Relax the severity of device init failure

commit 2344cd0c2e9ea8f3037be11fb997ddbeda0237ca upstream.

The device init is used to reset the accelerometer. Failure to reset
is not severe enough to stop loading the module or to resume from
hibernation.  This patch relaxes failure to a warning and drops
output in case of success.

Signed-off-by: Henrik Rydberg <>
Signed-off-by: Guenter Roeck <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agohwmon: (applesmc) Add MacBookAir3,1(3,2) support
Edgar Hucek [Tue, 9 Nov 2010 15:15:01 +0000 (15:15 +0000)]
hwmon: (applesmc) Add MacBookAir3,1(3,2) support

commit 132af03233b493101a53010383b5abb5b9ff1e51 upstream.

This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the
applesmc driver.

[ minor cleanup]
Signed-off-by: Edgar Hucek <>
Signed-off-by: Henrik Rydberg <>
Signed-off-by: Guenter Roeck <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agohwmon: (via686a) Initialize fan_div values
Jean Delvare [Wed, 12 Jan 2011 20:55:09 +0000 (21:55 +0100)]
hwmon: (via686a) Initialize fan_div values

commit f790674d3f87df6390828ac21a7d1530f71b59c8 upstream.

Functions set_fan_min() and set_fan_div() assume that the fan_div
values have already been read from the register. The driver currently
doesn't initialize them at load time, they are only set when function
via686a_update_device() is called. This means that set_fan_min() and
set_fan_div() misbehave if, for example, "sensors -s" is called
before any monitoring application (e.g. "sensors") is has been run.

Fix the problem by always initializing the fan_div values at device
bind time.

Signed-off-by: Jean Delvare <>
Acked-by: Guenter Roeck <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoatl1: fix oops when changing tx/rx ring params
J. K. Cliburn [Sat, 1 Jan 2011 05:02:12 +0000 (05:02 +0000)]
atl1: fix oops when changing tx/rx ring params

commit 2f32c867219734b06abc980d4812f67b6d6fe517 upstream.

Commit 3f5a2a713aad28480d86b0add00c68484b54febc zeroes out the statistics
message block (SMB) and coalescing message block (CMB) when adapter ring
resources are freed.  This is desirable behavior, but, as a side effect,
the commit leads to an oops when atl1_set_ringparam() attempts to alter
the number of rx or tx elements in the ring buffer (by using ethtool
-G, for example).  We don't want SMB or CMB to change during this

Modify atl1_set_ringparam() to preserve SMB and CMB when changing ring

Signed-off-by: Jay Cliburn <>
Reported-by: Tõnu Raitviir <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoALSA: snd-usb-us122l: Fix missing NULL checks
Karsten Wiese [Tue, 4 Jan 2011 00:20:37 +0000 (01:20 +0100)]
ALSA: snd-usb-us122l: Fix missing NULL checks

commit cdce2db74e156fbd9a2dc3c7b246166f8b70955b upstream.

Fix missing NULL checks in usb_stream_hwdep_poll() and usb_stream_hwdep_ioctl().
Wake up poll waiters before returning from usb_stream_hwdep_ioctl().

Signed-off-by: Karsten Wiese <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoALSA: snd-usb-us122l: Fix MIDI output
Karsten Wiese [Mon, 3 Jan 2011 01:41:58 +0000 (02:41 +0100)]
ALSA: snd-usb-us122l: Fix MIDI output

commit 921eebdc18c82268eab446592191b39e35d031d6 upstream.

The US-122L always reads 9 bytes per urb unless they are set to 0xFD.

Signed-off-by: Karsten Wiese <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agostaging: rt2870sta: Add ID for Linksys WUSB100v2
Larry Finger [Thu, 13 Jan 2011 04:24:28 +0000 (22:24 -0600)]
staging: rt2870sta: Add ID for Linksys WUSB100v2

commit 27c82819a5a42f08fc0f787ab1b0c129cbdda801 upstream.

This device was tested with rt2870sta by setting new_id.

Signed-off-by: Larry Finger <>
Tested-by: Brian Ormond <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agort2x00: add device id for windy31 usb device
Greg Kroah-Hartman [Tue, 25 Jan 2011 09:42:29 +0000 (17:42 +0800)]
rt2x00: add device id for windy31 usb device

commit 9c4cf6d94fb362c27a24df5223ed6e327eb7279a upstream.

This patch adds the device id for the windy31 USB device to the rt73usb

Thanks to Ralf Flaxa for reporting this and providing testing and a
sample device.

Reported-by: Ralf Flaxa <>
Tested-by: Ralf Flaxa <>
Signed-off-by: Greg Kroah-Hartman <>
Acked-by: Ivo van Doorn <>
Signed-off-by: John W. Linville <>
7 years agoUSB: EHCI: ASPM quirk of ISOC on AMD SB800
Alex He [Tue, 7 Dec 2010 02:10:08 +0000 (10:10 +0800)]
USB: EHCI: ASPM quirk of ISOC on AMD SB800

commit 05570297ecbe834b1756b522412b68eaffb9ab11 upstream.

When ASPM PM Feature is enabled on UMI link, devices that use ISOC stream of
data transfer may be exposed to longer latency causing less than optimal per-
formance of the device. The longer latencies are normal and are due to link
wake time coming out of low power state which happens frequently to save
power when the link is not active.
The following code will make exception for certain features of ASPM to be by
passed and keep the logic normal state only when the ISOC device is connected
and active. This change will allow the device to run at optimal performance
yet minimize the impact on overall power savings.

Signed-off-by: Alex He <>
Acked-by: David Brownell <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agostaging: usbip: remove double giveback of URB
Márton Németh [Mon, 13 Dec 2010 20:59:09 +0000 (21:59 +0100)]
staging: usbip: remove double giveback of URB

commit 7571f089d7522a95c103558faf313c7af8856ceb upstream.

In the vhci_urb_dequeue() function the TCP connection is checked twice.
Each time when the TCP connection is closed the URB is unlinked and given
back. Remove the second attempt of unlinking and giving back of the URB completely.

This patch fixes the bug described at .

Signed-off-by: Márton Németh <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoLinux
Greg Kroah-Hartman [Fri, 7 Jan 2011 22:39:58 +0000 (14:39 -0800)]

7 years agogspca - sonixj: Add a flag in the driver_info table
Jean-Francois Moine [Tue, 14 Dec 2010 19:15:37 +0000 (16:15 -0300)]
gspca - sonixj: Add a flag in the driver_info table

commit c6c14330717f9850b4b4c054b81424b9979cd07d upstream.

Signed-off-by: Jean-François Moine <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agogspca - sonixj: Set the flag for some devices
Jean-Francois Moine [Tue, 14 Dec 2010 19:16:16 +0000 (16:16 -0300)]
gspca - sonixj: Set the flag for some devices

commit b2272a49e7df37732d73988f00468ce31e1ebc92 upstream.

The flag PDN_INV indicates that the sensor pin S_PWR_DN has not the same
value as other webcams with the same sensor. For now, only two webcams have
been so detected: the Microsoft's VX1000 and VX3000.

Signed-off-by: Jean-François Moine <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoorinoco: initialise priv->hw before assigning the interrupt
David Kilroy [Tue, 7 Dec 2010 18:50:42 +0000 (18:50 +0000)]
orinoco: initialise priv->hw before assigning the interrupt

commit 229bd792be0bad245b78ed8f119952733a4752e5 upstream.

The interrupt handler takes a lock - but since commit bcad6e80f3f this
lock goes through an indirection specified in the hermes_t structure.
We must therefore initialise the structure before setting up the
interrupt handler.

Fix orinoco_cs and spectrum_cs


Bisected by: Matt Domsch <>
Signed-off by: David Kilroy <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoDon't export format_by_forcc on two different drivers
Mauro Carvalho Chehab [Thu, 2 Dec 2010 03:57:03 +0000 (01:57 -0200)]
Don't export format_by_forcc on two different drivers

commit a757ee2216211278680dd8ac869aabe7b4a9970d upstream.

Drivers should append their name on exported symbols, to avoid
conflicts with allyesconfig:

drivers/staging/built-in.o: In function `format_by_fourcc':
/home/v4l/work_trees/linus/drivers/staging/cx25821/cx25821-video.c:96: multiple definition of `format_by_fourcc'
drivers/media/built-in.o:/home/v4l/work_trees/linus/drivers/media/common/saa7146_video.c:88: first defined here

Let's rename both occurences with a small shellscript:

for i in drivers/staging/cx25821/*.[ch]; do sed s,format_by_fourcc,cx25821_format_by_fourcc,g <$i >a && mv a $i; done
for i in drivers/media/common/saa7146*.[ch]; do sed s,format_by_fourcc,saa7146_format_by_fourcc,g <$i >a && mv a $i; done
for i in include/media/saa7146*.[ch]; do sed s,format_by_fourcc,saa7146_format_by_fourcc,g <$i >a && mv a $i; done

Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agomx2_camera: fix pixel clock polarity configuration
Baruch Siach [Wed, 27 Oct 2010 07:03:52 +0000 (04:03 -0300)]
mx2_camera: fix pixel clock polarity configuration

commit 42cc37fe20cc680fb58fe12ae5ba718d683b8ca2 upstream.

When SOCAM_PCLK_SAMPLE_FALLING, just leave CSICR1_REDGE unset, otherwise we get
the inverted behaviour.

Signed-off-by: Baruch Siach <>
Signed-off-by: Guennadi Liakhovetski <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoposix-cpu-timers: workaround to suppress the problems with mt exec
Oleg Nesterov [Fri, 5 Nov 2010 15:53:42 +0000 (16:53 +0100)]
posix-cpu-timers: workaround to suppress the problems with mt exec

commit e0a70217107e6f9844628120412cb27bb4cea194 upstream.

posix-cpu-timers.c correctly assumes that the dying process does
posix_cpu_timers_exit_group() and removes all !CPUCLOCK_PERTHREAD
timers from signal->cpu_timers list.

But, it also assumes that timer->it.cpu.task is always the group
leader, and thus the dead ->task means the dead thread group.

This is obviously not true after de_thread() changes the leader.
After that almost every posix_cpu_timer_ method has problems.

It is not simple to fix this bug correctly. First of all, I think
that timer->it.cpu should use struct pid instead of task_struct.
Also, the locking should be reworked completely. In particular,
tasklist_lock should not be used at all. This all needs a lot of
nontrivial and hard-to-test changes.

Change __exit_signal() to do posix_cpu_timers_exit_group() when
the old leader dies during exec. This is not the fix, just the
temporary hack to hide the problem for 2.6.37 and stable. IOW,
this is obviously wrong but this is what we currently have anyway:
cpu timers do not work after mt exec.

In theory this change adds another race. The exiting leader can
detach the timers which were attached to the new leader. However,
the window between de_thread() and release_task() is small, we
can pretend that sys_timer_create() was called before de_thread().

Signed-off-by: Oleg Nesterov <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agox86/microcode: Fix double vfree() and remove redundant pointer checks before vfree()
Jesper Juhl [Sat, 25 Dec 2010 18:57:41 +0000 (19:57 +0100)]
x86/microcode: Fix double vfree() and remove redundant pointer checks before vfree()

commit 5cdd2de0a76d0ac47f107c8a7b32d75d25768dc1 upstream.

In arch/x86/kernel/microcode_intel.c::generic_load_microcode()
we have  this:

while (leftover) {
if (get_ucode_data(mc, ucode_ptr, mc_size) ||
    microcode_sanity_check(mc) < 0) {

if (mc)

This will cause a double free of 'mc'. This patch fixes that by
just  removing the vfree() call in the loop since 'mc' will be
freed nicely just  after we break out of the loop.

There's also a second change in the patch. I noticed a lot of
checks for  pointers being NULL before passing them to vfree().
That's completely  redundant since vfree() deals gracefully with
being passed a NULL pointer.  Removing the redundant checks
yields a nice size decrease for the object  file.

Size before the patch:
   text    data     bss     dec     hex filename
   4578     240    1032    5850    16da arch/x86/kernel/microcode_intel.o
Size after the patch:
   text    data     bss     dec     hex filename
   4489     240     984    5713    1651 arch/x86/kernel/microcode_intel.o

Signed-off-by: Jesper Juhl <>
Acked-by: Tigran Aivazian <>
Cc: Shaohua Li <>
LKML-Reference: <>
Signed-off-by: Ingo Molnar <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoblock: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead
Martin K. Petersen [Wed, 1 Dec 2010 18:41:49 +0000 (19:41 +0100)]
block: Deprecate QUEUE_FLAG_CLUSTER and use queue_limits instead

commit e692cb668fdd5a712c6ed2a2d6f2a36ee83997b4 upstream.

When stacking devices, a request_queue is not always available. This
forced us to have a no_cluster flag in the queue_limits that could be
used as a carrier until the request_queue had been set up for a

There were several problems with that approach. First of all it was up
to the stacking device to remember to set queue flag after stacking had
completed. Also, the queue flag and the queue limits had to be kept in
sync at all times. We got that wrong, which could lead to us issuing
commands that went beyond the max scatterlist limit set by the driver.

The proper fix is to avoid having two flags for tracking the same thing.
We deprecate QUEUE_FLAG_CLUSTER and use the queue limit directly in the
block layer merging functions. The queue_limit 'no_cluster' is turned
into 'cluster' to avoid double negatives and to ease stacking.
Clustering defaults to being enabled as before. The queue flag logic is
removed from the stacking function, and explicitly setting the cluster
flag is no longer necessary in DM and MD.

Reported-by: Ed Lin <>
Signed-off-by: Martin K. Petersen <>
Acked-by: Mike Snitzer <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoSched: fix skip_clock_update optimization
Mike Galbraith [Wed, 8 Dec 2010 10:05:42 +0000 (11:05 +0100)]
Sched: fix skip_clock_update optimization

commit f26f9aff6aaf67e9a430d16c266f91b13a5bff64 upstream.

idle_balance() drops/retakes rq->lock, leaving the previous task
vulnerable to set_tsk_need_resched().  Clear it after we return
from balancing instead, and in setup_thread_stack() as well, so
no successfully descheduled or never scheduled task has it set.

Need resched confused the skip_clock_update logic, which assumes
that the next call to update_rq_clock() will come nearly immediately
after being set.  Make the optimization robust against the waking
a sleeper before it sucessfully deschedules case by checking that
the current task has not been dequeued before setting the flag,
since it is that useless clock update we're trying to save, and
clear unconditionally in schedule() proper instead of conditionally
in put_prev_task().

Signed-off-by: Mike Galbraith <>
Reported-by: Bjoern B. Brandenburg <>
Tested-by: Yong Zhang <>
Signed-off-by: Peter Zijlstra <>
LKML-Reference: <>
Signed-off-by: Ingo Molnar <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120
Daniel T Chen [Tue, 28 Dec 2010 22:20:02 +0000 (17:20 -0500)]
ALSA: hda: Use LPIB quirk for Dell Inspiron m101z/1120

commit e03fa055bc126e536c7f65862e08a9b143138ea9 upstream.

Sjoerd Simons reports that, without using position_fix=1, recording
experiences overruns. Work around that by applying the LPIB quirk
for his hardware.

Reported-and-tested-by: Sjoerd Simons <>
Signed-off-by: Daniel T Chen <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agomac80211: fix mesh forwarding
Johannes Berg [Wed, 22 Dec 2010 09:15:07 +0000 (10:15 +0100)]
mac80211: fix mesh forwarding

commit b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 upstream.

Under memory pressure, the mac80211 mesh code
may helpfully print a message that it failed
to clone a mesh frame and then will proceed
to crash trying to use it anyway. Fix that.

Signed-off-by: Johannes Berg <>
Acked-by: Javier Cardona <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agolibata-sff: fix HSM_ST_ERR handling in __ata_sff_port_intr()
Tejun Heo [Fri, 3 Dec 2010 14:19:13 +0000 (15:19 +0100)]
libata-sff: fix HSM_ST_ERR handling in __ata_sff_port_intr()

commit 687a993339c4f3a63654746230da3aab8bbdbffd upstream.

While separating out BMDMA irq handler from SFF, commit c3b28894
(libata-sff: separate out BMDMA irq handler) incorrectly made
__ata_sff_port_intr() consider an IRQ to be an idle one if the host
state was transitioned to HSM_ST_ERR by ata_bmdma_port_intr().

This makes BMDMA drivers ignore IRQs reporting host bus error which
leads to timeouts instead of triggering EH immediately.  Fix it by
making __ata_sff_port_intr() consider the IRQ to be an idle one iff
the state is HSM_ST_IDLE.  This is equivalent to adding HSM_ST_ERR to
the "break"ing case but less error-prone.

Signed-off-by: Tejun Heo <>
Reported-by: Antonio Toma <>
Signed-off-by: Jeff Garzik <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoima: fix add LSM rule bug
Mimi Zohar [Mon, 3 Jan 2011 22:59:10 +0000 (14:59 -0800)]
ima: fix add LSM rule bug

commit 867c20265459d30a01b021a9c1e81fb4c5832aa9 upstream.

If security_filter_rule_init() doesn't return a rule, then not everything
is as fine as the return code implies.

This bug only occurs when the LSM (eg. SELinux) is disabled at runtime.

Adding an empty LSM rule causes ima_match_rules() to always succeed,
ignoring any remaining rules.

 default IMA TCB policy:
  dont_measure fsmagic=0x9fa0
  dont_measure fsmagic=0x62656572
  dont_measure fsmagic=0x64626720
  dont_measure fsmagic=0x01021994
  dont_measure fsmagic=0x73636673

  < LSM specific rule >
  dont_measure obj_type=var_log_t

  measure func=BPRM_CHECK
  measure func=FILE_MMAP mask=MAY_EXEC
  measure func=FILE_CHECK mask=MAY_READ uid=0

Thus without the patch, with the boot parameters 'tcb selinux=0', adding
the above 'dont_measure obj_type=var_log_t' rule to the default IMA TCB
measurement policy, would result in nothing being measured.  The patch
prevents the default TCB policy from being replaced.

Signed-off-by: Mimi Zohar <>
Cc: James Morris <>
Acked-by: Serge Hallyn <>
Cc: David Safford <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agomv_xor: fix race in tasklet function
Saeed Bishara [Tue, 21 Dec 2010 14:53:39 +0000 (16:53 +0200)]
mv_xor: fix race in tasklet function

commit 8333f65ef094e47020cd01452b4637e7daf5a77f upstream.

use mv_xor_slot_cleanup() instead of __mv_xor_slot_cleanup() as the former function
aquires the spin lock that needed to protect the drivers data.

Signed-off-by: Saeed Bishara <>
Signed-off-by: Dan Williams <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoKVM: Fix OSXSAVE after migration
Sheng Yang [Wed, 8 Dec 2010 02:49:43 +0000 (10:49 +0800)]
KVM: Fix OSXSAVE after migration

commit 3ea3aa8cf67d3bbe00a19b6a4013d19efa7d0f41 upstream.

CPUID's OSXSAVE is a mirror of CR4.OSXSAVE bit. We need to update the CPUID
after migration.

Signed-off-by: Sheng Yang <>
Signed-off-by: Avi Kivity <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoKVM: SVM: Do not report xsave in supported cpuid
Joerg Roedel [Tue, 7 Dec 2010 16:15:05 +0000 (17:15 +0100)]
KVM: SVM: Do not report xsave in supported cpuid

commit 24d1b15f72abe3465e871d11cfc9dc34d1aab8b2 upstream.

To support xsave properly for the guest the SVM module need
software support for it. As long as this is not present do
not report the xsave as supported feature in cpuid.
As a side-effect this patch moves the bit() helper function
into the x86.h file so that it can be used in svm.c too.

Signed-off-by: Joerg Roedel <>
Signed-off-by: Avi Kivity <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agoKVM: enlarge number of possible CPUID leaves
Andre Przywara [Wed, 1 Dec 2010 11:17:44 +0000 (12:17 +0100)]
KVM: enlarge number of possible CPUID leaves

commit 73c1160ce377d8fc6d84cb630ebf9658808bec49 upstream.

Currently the number of CPUID leaves KVM handles is limited to 40.
My desktop machine (AthlonII) already has 35 and future CPUs will
expand this well beyond the limit. Extend the limit to 80 to make
room for future processors.

Signed-off-by: Andre Przywara <>
Signed-off-by: Avi Kivity <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agosound: Prevent buffer overflow in OSS load_mixer_volumes
Dan Rosenberg [Sat, 25 Dec 2010 21:23:40 +0000 (16:23 -0500)]
sound: Prevent buffer overflow in OSS load_mixer_volumes

commit d81a12bc29ae4038770e05dce4ab7f26fd5880fb upstream.

The load_mixer_volumes() function, which can be triggered by
unprivileged users via the SOUND_MIXER_SETLEVELS ioctl, is vulnerable to
a buffer overflow.  Because the provided "name" argument isn't
guaranteed to be NULL terminated at the expected 32 bytes, it's possible
to overflow past the end of the last element in the mixer_vols array.
Further exploitation can result in an arbitrary kernel write (via
subsequent calls to load_mixer_volumes()) leading to privilege
escalation, or arbitrary kernel reads via get_mixer_levels().  In
addition, the strcmp() may leak bytes beyond the mixer_vols array.

Signed-off-by: Dan Rosenberg <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agomemcg: fix wrong VM_BUG_ON() in try_charge()'s mm->owner check
KAMEZAWA Hiroyuki [Wed, 29 Dec 2010 22:07:11 +0000 (14:07 -0800)]
memcg: fix wrong VM_BUG_ON() in try_charge()'s mm->owner check

commit ebb76ce16daf6908dc030dec1c00827d37129fe5 upstream.

At __mem_cgroup_try_charge(), VM_BUG_ON(!mm->owner) is checked.
But as commented in mem_cgroup_from_task(), mm->owner can be NULL
in some racy case. This check of VM_BUG_ON() is bad.

A possible story to hit this is at swapoff()->try_to_unuse(). It passes
mm_struct to mem_cgroup_try_charge_swapin() while mm->owner is NULL. If we
can't get proper mem_cgroup from swap_cgroup information, mm->owner is used
as charge target and we see NULL.

Cc: Daisuke Nishimura <>
Cc: KOSAKI Motohiro <>
Reported-by: Hugh Dickins <>
Reported-by: Thomas Meyer <>
Signed-off-by: KAMEZAWA Hiroyuki <>
Reviewed-by: Balbir Singh <>
Signed-off-by: Hugh Dickins <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agodrm/i915, intel_ips: When i915 loads after IPS, make IPS relink to i915.
Eric Anholt [Tue, 21 Dec 2010 02:40:06 +0000 (18:40 -0800)]
drm/i915, intel_ips: When i915 loads after IPS, make IPS relink to i915.

commit 63ee41d794d9c555f84205517a68509848988760 upstream.

The IPS driver is designed to be able to run detached from i915 and
just not enable GPU turbo in that case, in order to avoid module
dependencies between the two drivers.  This means that we don't know
what the load order between the two is going to be, and we had
previously only supported IPS after (optionally) i915, but not i915
after IPS.  If the wrong order was chosen, you'd get no GPU turbo, and
something like half the possible graphics performance.

Signed-off-by: Eric Anholt <>
Signed-off-by: Chris Wilson <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agodrm/i915/dp: Fix I2C/EDID handling with active DisplayPort to DVI converter
David Flynn [Wed, 8 Dec 2010 16:10:21 +0000 (16:10 +0000)]
drm/i915/dp: Fix I2C/EDID handling with active DisplayPort to DVI converter

commit 8316f33766a82907c694267ff911e45e256f09f9 upstream.

The DisplayPort standard (1.1a) states that:
  The I2C-over-AUX Reply field is valid only when Native AUX CH Reply
  field is AUX_ACK (00). When Native AUX CH Reply field is not 00, then,
  I2C-over-AUX Reply field must be 00 and be ignored.

This fixes broken EDID reading when using an active DisplayPort to
duallink DVI converter.  If the AUX CH replier chooses to defer the
transaction, a short read occurs and erroneous data is returned as
the i2c reply due to a lack of length checking and failure to check
for AUX ACK.

As a result, broken EDIDs can look like:
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f    0123456789abcdef
00: bc bc bc ff bc bc bc ff bc bc bc ac bc bc bc 45    ???.???.???????E
10: bc bc bc 10 bc bc bc 34 bc bc bc ee bc bc bc 4c    ???????4???????L
20: bc bc bc 50 bc bc bc 00 bc bc bc 40 bc bc bc 00    ???P???.???@???.
30: bc bc bc 01 bc bc bc 01 bc bc bc a0 bc bc bc 40    ???????????????@
40: bc bc bc 00 bc bc bc 00 bc bc bc 00 bc bc bc 55    ???.???.???.???U
50: bc bc bc 35 bc bc bc 31 bc bc bc 20 bc bc bc fc    ???5???1??? ????
60: bc bc bc 4c bc bc bc 34 bc bc bc 46 bc bc bc 00    ???L???4???F???.
70: bc bc bc 38 bc bc bc 11 bc bc bc 20 bc bc bc 20    ???8??????? ???
80: bc bc bc ff bc bc bc ff bc bc bc ff bc bc bc ff    ???.???.???.???.

which can lead to:
[drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder
[drm:drm_edid_block_valid] *ERROR* Raw EDID:
<3>30 30 30 30 30 30 30 32 38 32 30 32 63 63 31 61  000000028202cc1a
<3>28 00 02 8c 00 00 00 00 18 00 00 00 00 00 00 00  (...............
<3>20 4c 61 73 74 20 62 65 61 63 6f 6e 3a 20 33 32   Last beacon: 32
<3>32 30 6d 73 20 61 67 6f 46 00 05 8c 00 00 00 00  20ms agoF.......
<3>36 00 00 00 00 00 00 00 00 0c 57 69 2d 46 69 20  6.........Wi-Fi
<3>52 6f 75 74 65 72 01 08 82 84 8b 96 24 30 48 6c  Router......$0Hl
<3>03 01 01 06 02 00 00 2a 01 00 2f 01 00 32 04 0c  .......*../..2..
<3>12 18 60 dd 09 00 10 18 02 00 00 01 00 00 18 00  ..`.............

Signed-off-by: David Flynn <>
[ickle: fix up some surrounding checkpatch warnings]
Signed-off-by: Chris Wilson <>
Signed-off-by: Greg Kroah-Hartman <>
7 years agodrm/radeon/kms: reorder display resume to avoid problems
Alex Deucher [Mon, 20 Dec 2010 16:22:29 +0000 (11:22 -0500)]
drm/radeon/kms: reorder display resume to avoid problems

commit a93f344d3c04e4b84490c65f2a574387c593be40 upstream.

On resume, we were attemping to unblank the displays before the
timing and plls had be reprogrammed which led to atom timeouts
waiting for things that are not yet programmed.  Re-program
the mode first, then reset the dpms state.

This fixes the infamous atombios timeouts on resume.

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
Signed-off-by: Greg Kroah-Hartman <>