summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2010-07-05powerpc/fsl-booke: Move loadcam_entry back to asm code to fix SMP ftraceKumar Gala
commit 78f622377f7d31d988db350a43c5689dd5f31876 upstream. When we build with ftrace enabled its possible that loadcam_entry would have used the stack pointer (even though the code doesn't need it). We call loadcam_entry in __secondary_start before the stack is setup. To ensure that loadcam_entry doesn't use the stack pointer the easiest solution is to just have it in asm code. Signed-off-by: Kumar Gala <galak@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05powerpc/fsl-booke: Fix InstructionTLBError execute permission checkLi Yang
commit 78e2e68a2b79f394b7cd61e07987a8a89af907f7 upstream. In CONFIG_PTE_64BIT the PTE format has unique permission bits for user and supervisor execute. However on !CONFIG_PTE_64BIT we overload the supervisor bit to imply user execute with _PAGE_USER set. This allows us to use the same permission check mask for user or supervisor code on !CONFIG_PTE_64BIT. However, on CONFIG_PTE_64BIT we map _PAGE_EXEC to _PAGE_BAP_UX so we need a different permission mask based on the fault coming from a kernel address or user space. Without unique permission masks we see issues like the following with modules: Unable to handle kernel paging request for instruction fetch Faulting instruction address: 0xf938d040 Oops: Kernel access of bad area, sig: 11 [#1] Signed-off-by: Li Yang <leoli@freescale.com> Signed-off-by: Jin Qing <b24347@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05powerpc: Fix ioremap_flags() with book3e pte definitionBenjamin Herrenschmidt
commit 55052eeca6d71d76f7c3f156c0501814d8e5e6d3 upstream. We can't just clear the user read permission in book3e pte, because that will also clear supervisor read permission. This surely isn't desired. Fix the problem by adding the supervisor read back. BenH: Slightly simplified the ifdef and applied to ppc64 too Signed-off-by: Li Yang <leoli@freescale.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Kumar Gala <galak@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05powerpc/pseries: Make query_cpu_stopped callable outside hotplug cpuMichael Neuling
commit f8b67691828321f5c85bb853283aa101ae673130 upstream. This moves query_cpu_stopped() out of the hotplug cpu code and into smp.c so it can called in other places and renames it to smp_query_cpu_stopped(). It also cleans up the return values by adding some #defines Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05powerpc/pseries: Only call start-cpu when a CPU is stoppedMichael Neuling
commit aef40e87d866355ffd279ab21021de733242d0d5 upstream. Currently we always call start-cpu irrespective of if the CPU is stopped or not. Unfortunatley on POWER7, firmware seems to not like start-cpu being called when a cpu already been started. This was not the case on POWER6 and earlier. This patch checks to see if the CPU is stopped or not via an query-cpu-stopped-state call, and only calls start-cpu on CPUs which are stopped. This fixes a bug with kexec on POWER7 on PHYP where only the primary thread would make it to the second kernel. Reported-by: Ankita Garg <ankita@linux.vnet.ibm.com> Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05powerpc: Fix handling of strncmp with zero lenJeff Mahoney
commit 637a99022fb119b90fb281715d13172f0394fc12 upstream. Commit 0119536c, which added the assembly version of strncmp to powerpc, mentions that it adds two instructions to the version from boot/string.S to allow it to handle len=0. Unfortunately, it doesn't always return 0 when that is the case. The length is passed in r5, but the return value is passed back in r3. In certain cases, this will happen to work. Otherwise it will pass back the address of the first string as the return value. This patch lifts the len <= 0 handling code from memcpy to handle that case. Reported by: Christian_Sellars@symantec.com Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05drm/radeon/kms: release AGP bridge at suspendJerome Glisse
commit 10b06122afcc78468bd1d009633cb71e528acdc5 upstream. I think it's good to release the AGP bridge at suspend and reacquire it at resume. Also fix : https://bugzilla.kernel.org/show_bug.cgi?id=15969 Signed-off-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05drm/radeon/kms/atom: fix typo in LVDS panel info parsingAlex Deucher
commit 1ff26a3604d0292988d4cade0e49ba9918dbfd46 upstream. Fixes LVDS issues on some laptops; notably laptops with 2048x1536 panels. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05drm/radeon/kms: reset ddc_bus in object header parsingAlex Deucher
commit 2bfcc0fc698d550689ef020c73b2d977b73e728c upstream. Some LVDS connectors don't have a ddc bus, so reset the ddc bus to invalid before parsing the next connector to avoid using stale ddc bus data. Should fix fdo bug 28164. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05drm/edid: Fix 1024x768@85HzAdam Jackson
commit 61dd98fad58f945ed720ba132681acb58fcee015 upstream. Having hsync both start and end on pixel 1072 ain't gonna work very well. Matches the X server's list. Signed-off-by: Adam Jackson <ajax@redhat.com> Tested-By: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05drm/radeon/kms: don't default display priority to high on rs4xxAlex Deucher
commit 45737447ed160faaba036c0709226bf9057f7b72 upstream. Seems to cause issues with the sound hardware. Fixes kernel bug 15982: https://bugzilla.kernel.org/show_bug.cgi?id=15982 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05PCI: Disable MSI for MCP55 on P5N32-E SLIBen Hutchings
commit e4146bb9088c01c8b6e82be11f0c371f8aff023c upstream. As reported in <http://bugs.debian.org/552299>, MSI appears to be broken for this on-board device. We already have a quirk for the P5N32-SLI Premium; extend it to cover both variants of the board. Reported-by: Romain DEGEZ <romain.degez@smartjog.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05PCI quirks: disable msi on AMD rs4xx internal gfx bridgesAlex Deucher
commit 9313ff450400e6a2ab10fe6b9bdb12a828329410 upstream. Doesn't work reliably for internal gfx. Fixes kernel bug https://bugzilla.kernel.org/show_bug.cgi?id=15626. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05can: Fix SJA1000 command register writes on SMP systemsOliver Hartkopp
commit 57c8a456640fa3ca777652f11f2db4179a3e66b6 upstream. The SJA1000 command register is concurrently written in the rx-path to free the receive buffer _and_ in the tx-path to start the transmission. The SJA1000 data sheet, 6.4.4 COMMAND REGISTER (CMR) states: "Between two commands at least one internal clock cycle is needed in order to proceed. The internal clock is half of the external oscillator frequency." On SMP systems the current implementation leads to a write stall in the tx-path, which can be solved by adding some general locking and some time to settle the write_reg() operation for the command register. Thanks to Klaus Hitschler for the original fix and detailed problem description. This patch applies on net-2.6 and (with some offsets) on net-next-2.6 . Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Acked-by: Wolfgang Grandegger <wg@grandegger.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05drivers/base/cpu.c: fix the output from /sys/devices/system/cpu/offlineJan Beulich
commit cdc6e3d3968052cebb2f2ddcd742bff29fbd1a90 upstream. Without CONFIG_CPUMASK_OFFSTACK, simply inverting cpu_online_mask leads to CPUs beyond nr_cpu_ids to be displayed twice and CPUs not even possible to be displayed as offline. Signed-off-by: Jan Beulich <jbeulich@novell.com> Cc: Andi Kleen <ak@linux.intel.com> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05libsas: fix deref before check in commit 70b25f890ceJames Bottomley
commit 1b4d0d8ea7b3cbd107f345ab766416f9b38ce66a upstream. commit 70b25f890ce9f0520c64075ce9225a5b020a513e Author: Tejun Heo <tj@kernel.org> Date: Thu Apr 15 09:00:08 2010 +0900 [SCSI] fix locking around blk_abort_request() Introduced a reference before check problem, fix this by moving the lock shorthand code to be right at the point of actual use. Reported-by: Dan Carpenter <error27@gmail.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: James Bottomley <James.Bottomley@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05drm/i915: Reject bind_to_gtt() early if object > apertureChris Wilson
commit 654fc6073f68efa3b6c466825749e73e7fbb92cd upstream. If the object is bigger than the entire aperture, reject it early before evicting everything in a vain attempt to find space. v2: Use E2BIG as suggested by Owain G. Ainsworth. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05ath9k_hw: fix hardware deinitSujith
commit 736b3a27b3c50c4a23717b802240435a69e8d0ff upstream. Without this you will get a panic if the device initialization fails. Also, free ath_hw instance properly. ath9k_hw_deinit() shouldn't do it. Signed-off-by: Sujith <Sujith.Manoharan@atheros.com> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05mac80211: fix handling of 4-address-mode in ieee80211_change_ifaceFelix Fietkau
commit f7917af92024d43bc20bc1afc92de27b0bd0f50b upstream. A misplaced interface type check bails out too early if the interface is not in monitor mode. This patch moves it to the right place, so that it only covers changes to the monitor flags. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05mac80211: fix rts threshold checkShanyu Zhao
commit a2c40249a36d0b4d76d1caf6bf806e4ae5b06e8a upstream. Currently whenever rts thresold is set, every packet will use RTS protection no matter its size exceeds the threshold or not. This is due to a bug in the rts threshold check. if (len > tx->local->hw.wiphy->rts_threshold) { txrc.rts = rts = true; } Basically it is comparing an int (len) and a u32 (rts_threshold), and the variable len is assigned as: len = min_t(int, tx->skb->len + FCS_LEN, tx->local->hw.wiphy->frag_threshold); However, when frag_threshold is "-1", len is always "-1", which is 0xffffffff therefore rts is always set to true. Signed-off-by: Shanyu Zhao <shanyu.zhao@intel.com> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05mac80211: Fix robust management frame handling (MFP)Jouni Malinen
commit d211e90e28a074447584729018a39910d691d1a8 upstream. Commit e34e09401ee9888dd662b2fca5d607794a56daf2 incorrectly removed use of ieee80211_has_protected() from the management frame case and in practice, made this validation drop all Action frames when MFP is enabled. This should have only been done for frames with Protected field set to zero. Signed-off-by: Jouni Malinen <j@w1.fi> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05mac80211: give warning if building w/out rate ctrl algorithmAndres Salomon
commit c2ef355bf3ef0b8006b96128726684fba47ac928 upstream. I discovered that if EMBEDDED=y, one can accidentally build a mac80211 stack and drivers w/ no rate control algorithm. For drivers like RTL8187 that don't supply their own RC algorithms, this will cause ieee80211_register_hw to fail (making the driver unusable). This will tell kconfig to provide a warning if no rate control algorithms have been selected. That'll at least warn the user; users that know that their drivers supply a rate control algorithm can safely ignore the warning, and those who don't know (or who expect to be using multiple drivers) can select a default RC algorithm. Signed-off-by: Andres Salomon <dilinger@collabora.co.uk> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05fbdev: section cleanup in w100fbHenrik Kretzschmar
commit fb6cb3270af8f2ad3dd556906a9c52aa85754849 upstream. Fix up the section in the w100fb driver, by moving: * w100fb_remove() from .text to .devexit.text * w100_get_xtal_table() from .text to .devinit.text * w100fb_init() from .devinit.text to .init.text Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05fbdev: section cleanup in arcfbHenrik Kretzschmar
commit bd9b5caf8616501d2ab6f17210b11f81ea7546eb upstream. Fix the sections in the arcfb driver, by moving: * the variables arcfb_fix and arcfb_var from .init.data to .devinit.data * arcfb_remove() from .text to .devexit.text This fixes the following warnings issued by modpost: WARNING: drivers/video/built-in.o(.devinit.text+0x543): Section mismatch in reference from the function arcfb_probe() to the variable .init.data:arcfb_var The function __devinit arcfb_probe() references a variable __initdata arcfb_var. If arcfb_var is only used by arcfb_probe then annotate arcfb_var with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x558): Section mismatch in reference from the function arcfb_probe() to the variable .init.data:arcfb_fix The function __devinit arcfb_probe() references a variable __initdata arcfb_fix. If arcfb_fix is only used by arcfb_probe then annotate arcfb_fix with a matching annotation. Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05fbdev: section cleanup in vga16fbHenrik Kretzschmar
commit ad1458464cbbe6935be6e20d70920301733158af upstream. Fix up the sections in the vga16fb driver, by moving: * the variables vga16_defined and vga16fb from .init.data to .devinit.data * vga16fb_setup() from .text to .init.text * vga16fb_remove() from .text. to .devexit.text This fixes the following warnings issued by modpost: WARNING: drivers/video/built-in.o(.devinit.text+0x1a420): Section mismatch in re ference from the function vga16fb_probe() to the (unknown reference) .init.data: (unknown) The function __devinit vga16fb_probe() references a (unknown reference) __initdata (unknown). If (unknown) is only used by vga16fb_probe then annotate (unknown) with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x1a437): Section mismatch in reference from the function vga16fb_probe() to the variable .init.data:vga16fb_defined The function __devinit vga16fb_probe() references a variable __initdata vga16fb_defined. If vga16fb_defined is only used by vga16fb_probe then annotate vga16fb_defined with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x1a457): Section mismatch in reference from the function vga16fb_probe() to the variable .init.data:vga16fb_fix The function __devinit vga16fb_probe() references a variable __initdata vga16fb_fix. If vga16fb_fix is only used by vga16fb_probe then annotate vga16fb_fix with a matching annotation. Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05fbdev: section cleanup in vfbHenrik Kretzschmar
commit 3cc04971661e37e7de6fbf9808ede554b5e1cb4e upstream. Fix up the section in the vfb driver, by moving the variables vfb_default and vfb_fix from .init.data to .devinit.data This fixes the following warnings issued by modpost: WARNING: drivers/video/vfb.o(.devinit.text+0xf8): Section mismatch in reference from the function vfb_probe() to the variable .init.data:vfb_default The function __devinit vfb_probe() references a variable __initdata vfb_default. If vfb_default is only used by vfb_probe then annotate vfb_default with a matching annotation. WARNING: drivers/video/vfb.o(.devinit.text+0x114): Section mismatch in reference from the function vfb_probe() to the variable .init.data:vfb_fix The function __devinit vfb_probe() references a variable __initdata vfb_fix. If vfb_fix is only used by vfb_probe then annotate vfb_fix with a matching annotation. Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05fbdev: section cleanup in hgafbHenrik Kretzschmar
commit e217e6e39f62e47f7e659b715235dbd57df480f8 upstream. Fix up the sections in the hgafb driver, by * moving hga_default_var and hga_fix from .init.data to .devinit.data * moving hga_detect() from .init.text to .devinit.text * moving hga_fb_remove() from .text to .devexit.text This fixes the following warnings issued by modpost: WARNING: drivers/video/hgafb.o(.devinit.text+0x18): Section mismatch in referenc e from the function hgafb_probe() to the function .init.text:hga_card_detect() The function __devinit hgafb_probe() references a function __init hga_card_detect(). If hga_card_detect is only used by hgafb_probe then annotate hga_card_detect with a matching annotation. WARNING: drivers/video/hgafb.o(.devinit.text+0xfe): Section mismatch in referenc e from the function hgafb_probe() to the variable .init.data:hga_fix The function __devinit hgafb_probe() references a variable __initdata hga_fix. If hga_fix is only used by hgafb_probe then annotate hga_fix with a matching annotation. WARNING: drivers/video/hgafb.o(.devinit.text+0x105): Section mismatch in reference from the function hgafb_probe() to the variable .init.data:hga_default_var The function __devinit hgafb_probe() references a variable __initdata hga_default_var. If hga_default_var is only used by hgafb_probe then annotate hga_default_var with a matching annotation. Signed-off-by: Henrik Kretzschmar <henne@nachtwindheim.de> Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05ath5k: consistently use rx_bufsize for RX DMABruno Randolf
commit b5eae9ff5ba6d76de19286dd6429acd7cde3f79d upstream. We should use the same buffer size we set up for DMA also in the hardware descriptor. Previously we used common->rx_bufsize for setting up the DMA mapping, but used skb_tailroom(skb) for the size we tell to the hardware in the descriptor itself. The problem is that skb_tailroom(skb) can give us a larger value than the size we set up for DMA before. This allows the hardware to write into memory locations not set up for DMA. In practice this should rarely happen because all packets should be smaller than the maximum 802.11 packet size. On the tested platform rx_bufsize is 2528, and we allocated an skb of 2559 bytes length (including padding for cache alignment) but sbk_tailroom() was 2592. Just consistently use rx_bufsize for all RX DMA memory sizes. Also use the return value of the descriptor setup function. Signed-off-by: Bruno Randolf <br1@einfach.org> Reviewed-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: xHCI: Fix wrong usage of macro TRB_TYPEAndiry Xu
commit 54b5acf3acb7a1f83ec281d111d3e2812cd7ad9d upstream. Macro TRB_TYPE is misused in some places. Fix the wrong usage. Signed-off-by: Andiry Xu <andiry.xu@amd.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: xhci: Fix check for room on the ring.Sarah Sharp
commit 44ebd037c54f80db3121ac9f5fe6e677b76e11d5 upstream. The length of the scatter gather list a driver can enqueue is limited by the bus' sg_tablesize to 62 entries. Each entry will be described by at least one transfer request block (TRB). If the entry's buffer crosses a 64KB boundary, then that entry will have to be described by two or more TRBs. So even if the USB device driver respects sg_tablesize, the whole scatter list may take more than 62 TRBs to describe, and won't fit on the ring. Don't assume that an empty ring means there is enough room on the transfer ring. The old code would unconditionally queue this too-large transfer, and over write the beginning of the transfer. This would mean the cycle bit was unchanged in those overwritten transfers, causing the hardware to think it didn't own the TRBs, and the host would seem to hang. Now drivers may see submit_urb() fail with -ENOMEM if the transfers are too big to fit on the ring. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: xhci: Limit bus sg_tablesize to 62 TRBs.Sarah Sharp
commit bc88d2eba5e19d10dd546e428314909d889b3b6a upstream. When a scatter-gather list is enqueued to the xHCI driver, it translates each entry into a transfer request block (TRB). Only 63 TRBs can be used per ring segment, and there must be one additional TRB reserved to make sure the hardware does not think the ring is empty (so the enqueue pointer doesn't equal the dequeue pointer). Limit the bus sg_tablesize to 62 TRBs. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: xhci: Fix issue with set interface after stall.Sarah Sharp
commit 1624ae1c19e227096ba85bfc389d9b99cb6f7dde upstream. When the USB core installs a new interface, it unconditionally clears the halts on all the endpoints on the new interface. Usually the xHCI host needs to know when an endpoint is reset, so it can change its internal endpoint state. In this case, it doesn't care, because the endpoints were never halted in the first place. To avoid issuing a redundant Reset Endpoint command, the xHCI driver looks at xhci_virt_ep->stopped_td to determine if the endpoint was actually halted. However, the functions that handle the stall never set that variable to NULL after it dealt with the stall. So if an endpoint stalled and a Reset Endpoint command completed, and then the class driver tried to install a new alternate setting, the xHCI driver would access the old xhci_virt_ep->stopped_td pointer. A similar problem occurs if the endpoint has been stopped to cancel a transfer. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: EHCI: fix controller wakeup flag settings during suspendAlan Stern
commit 16032c4f5b291af541e9114a09ea20ff5a0dc474 upstream. This patch (as1380) fixes a bug in the wakeup settings for EHCI host controllers. When the controller is suspended, if it isn't enabled for remote wakeup then we have to turn off all the port wakeup flags. Disabling PCI PME# isn't good enough, because some systems (Intel) evidently use alternate wakeup signalling paths. In addition, the patch improves the handling of the Intel Moorestown hardware by performing various power-up and power-down delays just once instead of once for each port (i.e., the delays are moved outside of the port loops). This requires extra code, but the total delay time is reduced. There are also a few additional minor cleanups. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-by: Ondrej Zary <linux@rainbow-software.org> CC: Alek Du <alek.du@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: EHCI: clear PHCD before resumingAlek Du
commit eab80de01cb398419ef3305f35abcb367c647c8b upstream. This is a bug fix for PHCD (phy clock disable) low power feature: After PHCD is set, any write to PORTSC register is illegal, so when resume ports, clear PHCD bit first. Signed-off-by: Alek Du <alek.du@intel.com> Cc: David Brownell <dbrownell@users.sourceforge.net> Cc: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: FHCI: cq_get() should check kfifo_out()'s return valueAnton Vorontsov
commit 7f1cccd3ec8789e52897bc34420ca81a5e2edeab upstream. Since commit 7acd72eb85f1c7a15e8b5eb554994949241737f1 ("kfifo: rename kfifo_put... into kfifo_in... and kfifo_get... into kfifo_out..."), kfifo_out() is marked __must_check, and that causes gcc to produce lots of warnings like this: CC drivers/usb/host/fhci-mem.o In file included from drivers/usb/host/fhci-hcd.c:34: drivers/usb/host/fhci.h: In function 'cq_get': drivers/usb/host/fhci.h:520: warning: ignoring return value of 'kfifo_out', declared with attribute warn_unused_result ... This patch fixes the issue by properly checking the return value. Signed-off-by: Anton Vorontsov <avorontsov@mvista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: fix usbmon and DMA mapping for scatter-gather URBsAlan Stern
commit ff9c895f07d36193c75533bda8193bde8ca99d02 upstream. This patch (as1368) fixes a rather obscure bug in usbmon: When tracing URBs sent by the scatter-gather library, it accesses the data buffers while they are still mapped for DMA. The solution is to move the mapping and unmapping out of the s-g library and into the usual place in hcd.c. This requires the addition of new URB flag bits to describe the kind of mapping needed, since we have to call dma_map_sg() if the HCD supports native scatter-gather operation and dma_map_page() if it doesn't. The nice thing about having the new flags is that they simplify the testing for unmapping. The patch removes the only caller of usb_buffer_[un]map_sg(), so those functions are #if'ed out. A later patch will remove them entirely. As a result of this change, urb->sg will be set in situations where it wasn't set previously. Hence the xhci and whci drivers are adjusted to test urb->num_sgs instead, which retains its original meaning and is nonzero only when the HCD has to handle a scatterlist. Finally, even when a submission error occurs we don't want to hand URBs to usbmon before they are unmapped. The submission path is rearranged so that map_urb_for_dma() is called only for non-root-hub URBs and unmap_urb_for_dma() is called immediately after a submission error. This simplifies the error handling. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: unusual-dev: Add bad sense flag for Appotech ax203 based picture framesHans de Goede
commit a78f4f1a16d87f3d33158d036af94e48e32f8aad upstream. These Appotech controllers are found in Picture Frames, they provide a (buggy) emulation of a cdrom drive which contains the windows software Uploading of pictures happens over the corresponding /dev/sg device. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: mxc: gadget: Fix bitfield for calculating maximum packet sizeDinh Nguyen
commit 88e3b59b5adce5b12e205af0e34d518ba0dcdc0c upstream. The max packet length bit mask used for isochronous endpoints should be 0x7FF instead of 0x8FF. 0x8FF will actually clear higher-order bits in the max packet length field. This patch applies to 2.6.34-rc6. Signed-off-by: Dinh Nguyen <Dinh.Nguyen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: qcaux: add Samsung U520 device IDDan Williams
commit f5cddcd0995366f15d2b6b0df556a2cd99fa806e upstream. Another CDC-ACM + vendor specific interface layout. Signed-off-by: Dan Williams <dcbw@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: kl5usb105: fix memory leakJohan Hovold
commit 313b0d80c1717ffe8f64b455a4d323996748b91a upstream. Private data was not freed on error path in startup. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: ir-usb: fix double freeJohan Hovold
commit 2ff78c0c2b67120c8e503268da3f177cae2228a2 upstream. If the user specifies a custom bulk buffer size we get a double free at port release. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: option.c: OLIVETTI OLICARD100 supportNils Radtke
commit 86234d4975ce084d14711283a3bfc69305f97602 upstream. This patch adds support for an olivetti olicard100 HЅDPA usb-stick. This device is a zeroCD one with ID 0b3c:c700 that needs switching via eject or usb-modeswitch with MessageContent="5553424312345678000000000000061b000000030000000000000000000000". After switching it has ID 0b3c:c000 and provides 5 serial ports ttyUSB[0-4]. Port 0 (modem) and 4 are interrupt ports. Signed-off-by: Nils Radtke <lkml@Think-Future.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: option: add PID for ZTE productzhao1980ming
commit a71ee85e1d74e862d68cc9b2f2ab6a806d2550c9 upstream. this patch adds ZTE modem devices Signed-off-by: Joey <zhao.ming9@zte.com.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: tty: fix incorrect use of tty_insert_flip_string_fixed_flagJohan Hovold
commit 70ced221cc9f041481f129e63cc5b1dedb0ff959 upstream. Fix regression introduced by commit a108bfcb372d8c4452701039308fb95747911c59 (USB: tty: Prune uses of tty_request_room in the USB layer) which broke three drivers (cypress_m8, digi_acceleport and spcp8x5) through incorrect use of tty_insert_flip_string_fixed_flag. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: kobil: fix memory leakJohan Hovold
commit c0f631d1948658b27349545b2cbcb4b32f010c7a upstream. An urb transfer buffer is allocated at every open but was never freed. This driver is a bit of a mess... Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: CP210x New Device IDs 11 New device IDsCraig Shelley
commit eefd9029fde4d90d59804eeb54880ab8db5c1866 upstream. Signed-off-by: Craig Shelley <craig@microtron.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05USB: visor: fix memory leakJohan Hovold
commit 199b113978015309dd02c69844c19a1be3f4dbcf upstream. Fix memory leak for some devices (Sony Clie 3.5) due to port private data not being freed on release. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05ARM: 6135/1: mx21/devices: fix USBOTG resourceWolfram Sang
commit e1695307e6b85477afd2421d3b4891ca5bea8300 upstream. It got a typo from 988addf82e4c03739375279de73929580a2d4a6a. Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05ar9170usb: fix panic triggered by undersized rxstream bufferChristian Lamparter
commit 879999cec9489f8942ebce3ec1b5f23ef948dda7 upstream. While ar9170's USB transport packet size is currently set to 8KiB, the PHY is capable of receiving AMPDUs with up to 64KiB. Such a large frame will be split over several rx URBs and exceed the previously allocated space for rx stream reconstruction. This patch increases the buffer size to 64KiB which is in fact the phy & rx stream designed size limit. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=15591 Reported-by: Christian Mehlis <mehlis@inf.fu-berlin.de> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-07-05ar9170usb: add a couple more USB IDsChristian Lamparter
commit 94d0bbe849190255b93fede8eb46809a38f9b8bf upstream. This patch adds the following 5 entries to the usbid device table: * Netgear WNA1000 * Proxim ORiNOCO Dual Band 802.11n USB Adapter * 3Com Dual Band 802.11n USB Adapter * H3C Dual Band 802.11n USB Adapter * WNC Generic 11n USB dongle Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
generated by cgit v1.2.3 (git 2.0.4) at 2024-10-06 23:53:01 +0000