Commit graph

336008 commits

Author SHA1 Message Date
John W. Linville
e734207fee Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes 2012-11-14 14:16:54 -05:00
John W. Linville
bd2a813074 Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 2012-11-14 14:15:43 -05:00
Takashi Iwai
10e44239f6 ALSA: usb-audio: Fix mutex deadlock at disconnection
The recent change for USB-audio disconnection race fixes introduced a
mutex deadlock again.  There is a circular dependency between
chip->shutdown_rwsem and pcm->open_mutex, depicted like below, when a
device is opened during the disconnection operation:

A. snd_usb_audio_disconnect() ->
     card.c::register_mutex ->
       chip->shutdown_rwsem (write) ->
         snd_card_disconnect() ->
           pcm.c::register_mutex ->
             pcm->open_mutex

B. snd_pcm_open() ->
     pcm->open_mutex ->
       snd_usb_pcm_open() ->
         chip->shutdown_rwsem (read)

Since the chip->shutdown_rwsem protection in the case A is required
only for turning on the chip->shutdown flag and it doesn't have to be
taken for the whole operation, we can reduce its window in
snd_usb_audio_disconnect().

Reported-by: Jiri Slaby <jslaby@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-11-14 15:29:09 +01:00
Charles Keepax
23ff2f0f61 regulator: core: Avoid deadlock when regulator_register fails
When regulator_register fails and exits through the scrub path the
regulator_put function was called whilst holding the
regulator_list_mutex, causing deadlock.

This patch adds a private version of the regulator_put function which
can be safely called whilst holding the mutex, replacing the
aforementioned call.

Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2012-11-14 19:01:15 +09:00
Dan Carpenter
effded75e2 ALSA: fm801: precedence bug in snd_fm801_tea575x_get_pins()
There is a precedence bug because | has higher precedence than ?:.  This
code was cut and pasted and I fixed a similar bug a few days ago.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-11-14 09:34:28 +01:00
Alexander Duyck
1ba56fb45a vxlan: Update hard_header_len based on lowerdev when instantiating VXLAN
In the event of a VXLAN device being linked to a device that has a
hard_header_len greater than that of standard ethernet we could end up with
the hard_header_len not being large enough for outgoing frames.  In order to
prevent this we should update the length when a lowerdev is provided.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 18:19:50 -05:00
Rami Rosen
eb5ce43997 vxlan: fix a typo.
Use eXtensible and not eXtensiable in the comment on top.

Signed-off-by: Rami Rosen <ramirose@gmail.com>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 17:14:06 -05:00
Guenter Roeck
aa1e3e81e7 i2c-mux-pinctrl: Fix probe error path
When allocating the memory for i2c busses, the code checked the wrong
variable and thus never detected if there was a memory error.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable@vger.kernel.org
Signed-off-by: Jean Delvare <khali@linux-fr.org>
2012-11-13 22:27:19 +01:00
Jean Delvare
d85c8a6ab2 MAINTAINERS: i2c: 7 years, this is it
I have been maintaining the i2c subsystem for 7 years now, it's about
time to let someone else take over. Just before I leave, I would like
to thank several individuals who made this possible at all:

* Greg Kroah-Hartman, for his faith in my potential subsystem
  maintainer skills. Greg, I hope I met your expectations.
* Late David Brownell, for helping me convert the i2c subsystem to the
  standard device driver model. Rest in peace David, we're missing you.
* Ben Dooks, for stepping in when I asked for someone to take care of
  the huge flow of new i2c adapter drivers for embedded systems.
* Wolfram Sang, for joining the crew when it became clear that there
  was more review work than Ben and myself could deal with.

I hope I did not forget anyone, please forgive me if I did.

Another big thank is due to Wolfram again, who quickly proposed to
take over as the main i2c subsystem maintainer. This will allow for a
smooth and fast transition.

Note that I will keep maintaining all I2C/SMBus controller drivers for
PC systems as well as a few others. I am hereby updating MAINTAINERS
accordingly. I'll also keep maintaining user-space i2c-tools.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Ben Dooks <ben-linux@fluff.org>
Acked-by: Wolfram Sang <w.sang@pengutronix.de>
2012-11-13 22:27:19 +01:00
Colin Cross
d38e0e3fed Revert "Staging: Android alarm: IOCTL command encoding fix"
Commit 6bd4a5d96c changed the
ANDROID_ALARM_GET_TIME ioctls from IOW to IOR.  While technically
correct, the _IOC_DIR bits are ignored by alarm_ioctl, so the
commit breaks a userspace ABI used by all existing Android devices
for a purely cosmetic reason.  Revert it.

Cc: stable <stable@vger.kernel.org>
Cc: Dae S. Kim <dae@velatum.com>
Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-11-13 13:04:43 -08:00
Hannes Frederic Sowa
d4596bad2a ipv6: setsockopt(IPIPPROTO_IPV6, IPV6_MINHOPCOUNT) forgot to set return value
Cc: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 14:38:47 -05:00
Kirill Smelkov
73e212fc48 doc/net: Fix typo in netdev-features.txt
Signed-off-by: Kirill Smelkov <kirr@mns.spb.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 14:37:48 -05:00
Alexander Duyck
52b702ffa5 vxlan: Fix error that was resulting in VXLAN MTU size being 10 bytes too large
This change fixes an issue I found where VXLAN frames were fragmented when
they were up to the VXLAN MTU size.  I root caused the issue to the fact that
the headroom was 4 + 20 + 8 + 8.  This math doesn't appear to be correct
because we are not inserting a VLAN header, but instead a 2nd Ethernet header.
As such the math for the overhead should be 20 + 8 + 8 + 14 to account for the
extra headers that are inserted for VXLAN.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 14:36:50 -05:00
Eric Dumazet
bd090dfc63 tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming()
We added support for RFC 5961 in latest kernels but TCP fails
to perform exhaustive check of ACK sequence.

We can update our view of peer tsval from a frame that is
later discarded by tcp_ack()

This makes timestamps enabled sessions vulnerable to injection of
a high tsval : peers start an ACK storm, since the victim
sends a dupack each time it receives an ACK from the other peer.

As tcp_validate_incoming() is called before tcp_ack(), we should
not peform tcp_replace_ts_recent() from it, and let callers do it
at the right time.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Nandita Dukkipati <nanditad@google.com>
Cc: H.K. Jerry Chu <hkchu@google.com>
Cc: Romain Francoise <romain@orebokech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 14:35:17 -05:00
Bjørn Mork
bbc8d9228e net: cdc_ncm: add Huawei devices
A number of Huawei 3G and LTE modems implement a CDC NCM function,
including the necessary functional descriptors, but using a non
standard interface layout and class/subclass/protocol codes.

These devices can be handled by this driver with only a minor
change to the probing logic, allowing a single combined control
and data interface.  This works because the devices
- include a CDC Union descriptor labelling the combined
  interface as both master and slave, and
- have an alternate setting  for the bulk endpoints on the
  combined interface.

The 3G/LTE network connection is managed by vendor specific AT
commands on a serial function in the same composite device.
Handling the managment function is out of the scope of this
driver.  It will be handled by an appropriate USB serial
driver.

Reported-and-Tested-by: Olof Ermis <olof.ermis@gmail.com>
Reported-and-Tested-by: Tommy Cheng <tommy7765@yahoo.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 14:33:28 -05:00
Ursula Braun
7702745b15 qeth: set new mac even if old mac is gone
If the set_mac_address() function of qeth is invoked, qeth deletes
the old mac address first on OSA. Only if deletion returns
successfully the new mac address is set on OSA. Deletion may return
with a return value "MAC not found on OSA". In this case qeth
should continue setting the new mac address.

When the OSA cable is pulled, OSA forgets any set mac address. If
the OSA network interface acts as a slave to a bonding master
interface, bonding can invoke the set_mac_address function for
failover purposes and depends on successful setting of the new mac
address even though the old mac address could no longer be deleted.

Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 14:31:21 -05:00
Stefan Raspl
a134884ac0 qeth: Fix IPA_CMD_QIPASSIST return code handling
Return codes of IPA_CMD_QIPASSIST are not checked, especially the ones which
indicate that the command is not supported. As a result, the device driver
would not enable all available features on older card generations.
This patch adds proper checking and sets the bare minimum in the supported
functions flags to avoid follow-on errors.

Signed-off-by: Stefan Raspl <raspl@linux.vnet.ibm.com>
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Reviewed-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 14:31:21 -05:00
Steve Glendinning
80928805ba smsc95xx: set MII_BUSY bit to read/write PHY regs
The device datasheet specifies the BUSY bit must be set when reading
or writing phy registers.  This patch ensures we do that.

Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-13 14:25:50 -05:00
Greg Kroah-Hartman
e592c5d0b7 Revert "USB/host: Cleanup unneccessary irq disable code"
This reverts commit 73d4066055.

Martin Steigerwald reported that this change caused a hard lockup when
using USB if threadirqs are enabled.  Thomas pointed out that this patch
is incorrect, and can cause problems.  So revert it to get the
previously working functionality back.

Reported-by: Martin Steigerwald <Martin@lichtvoll.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Chuansheng Liu <chuansheng.liu@intel.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-11-13 10:52:52 -08:00
Dan Williams
c0bc309887 USB: option: add Alcatel X220/X500D USB IDs
Signed-off-by: Dan Williams <dcbw@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-11-13 10:45:16 -08:00
Dan Williams
fcb21645f1 USB: option: add Novatel E362 and Dell Wireless 5800 USB IDs
The Dell 5800 appears to be a simple rebrand of the Novatel E362.

Signed-off-by: Dan Williams <dcbw@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-11-13 10:45:16 -08:00
Bjørn Mork
f0e3e35c90 USB: keyspan: fix typo causing GPF on open
Commit f79b2d0f (USB: keyspan: fix NULL-pointer dereferences and
memory leaks) had a small typo which made the driver use wrong
offsets when mapping serial port private data.  This results in
in a GPF when the port is opened.

Reported-by: Richard <richjunk@pacbell.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-11-13 10:45:16 -08:00
Greg Kroah-Hartman
b240add62c Merge 3.7-rc5 into usb-next
This pulls in the 3.7-rc5 branch into usb-next
2012-11-13 10:33:29 -08:00
Ralf Baechle
225ae5fd9a MIPS: Malta: Fix interupt number of CBUS UART.
The CBUS UART's interrupt number was wrong conflicting with the interrupt
being tied to the Intel PIIX4.  Since the PIIX4's interrupt is registered
before the CBUS UART which is not being used on most systems this would
not be noticed.

Attempts to open the ttyS2 CBUS UART would result in:

genirq: Flags mismatch irq 18. 00000000 (serial) vs. 00010000 (XT-PIC cascade)
serial_link_irq_chain: request failed: -16 for irq: 18

Qemu was written to match the kernel so will need to be fixed also.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2012-11-13 14:50:15 +01:00
Jani Nikula
2f4f649a69 drm/i915: do not ignore eDP bpc settings from vbt
There are laptops out there that need the eDP bpc from VBT. This is
effectively a revert of

commit 4344b813f1
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Fri Aug 10 11:10:20 2012 +0200

    drm/i915: ignore eDP bpc settings from vbt

but putting the VBT check after the EDID check to see them both in dmesg if
this clamps more than the EDID. We have enough history with bpc clamping to
warrant the extra debug info.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47641
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=56401
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-11-13 13:15:42 +01:00
Heiko Carstens
4bffbb3455 s390/mm: have 16 byte aligned struct pages
Select HAVE_ALIGNED_STRUCT_PAGE on s390, so that the slub allocator can make
use of compare and swap double for lockless updates. This increases the size
of struct page to 64 bytes (instead of 56 bytes), however the performance gain
justifies the increased size:

- now excactly four struct pages fit into a single cache line; the
  case that accessing a struct page causes two cache line loads
  does not exist anymore.
- calculating the offset of a struct page within the memmap array
  is only a simple shift instead of a more expensive multiplication.

A "hackbench 200 process 200" run on a 32 cpu system did show an 8% runtime
improvement.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2012-11-13 11:03:09 +01:00
Heiko Carstens
516bad44b9 s390/gup: fix access_ok() usage in __get_user_pages_fast()
access_ok() returns always "true" on s390. Therefore all access_ok()
invocations are rather pointless.
However when walking page tables we need to make sure that everything
is within bounds of the ASCE limit of the task's address space.
So remove the access_ok() call and add the same check we have in
get_user_pages_fast().

Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2012-11-13 11:02:28 +01:00
Heiko Carstens
d55c4c613f s390/gup: add missing TASK_SIZE check to get_user_pages_fast()
When walking page tables we need to make sure that everything
is within bounds of the ASCE limit of the task's address space.
Otherwise we might calculate e.g. a pud pointer which is not
within a pud and dereference it.
So check against TASK_SIZE (which is the ASCE limit) before
walking page tables.

Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2012-11-13 11:02:26 +01:00
Dan Carpenter
d2153a1595 ALSA: es1968: precedence bug in snd_es1968_tea575x_get_pins()
I don't think this works as intended.  '|' higher precedence than ?: so
the bitwize OR "0 | (val & STR_MOST)" is a no-op.

I have re-written it to be more clear.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-11-13 08:51:47 +01:00
Takashi Iwai
6214b54cbf ASoC: Fixes for v3.7
A few small fixes plus a large but simple change for WM5102 which writes
 out a bunch of register updates to the device when we enable the clock
 as recommended following chip evaluation.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQoeX6AAoJELSic+t+oim9Yg8P/j49T5obxIXTZNMmMjrdc//f
 xM61/gLoRfVtY2deHdAzpUw6OSUOCQ0iVuasQalmnz2KNb/htzXXT+npjwPo93ok
 QZ4NBiMVJdOj/8m2u64K7flcGv2/llj2kvrj+8HmAI7KZ++zXMbBPVmvCSz0NpBL
 tFyd4zQ5Fp7n4MCDiQ7fRKwgUbbkwuW4jm/R4YEJS0tOrEgy0vG4MP/v8oEYcu/f
 tsOo0cMo8yESwpsy+fzfzqw7WS8LW/nKJJkRkYkO96YvgpDKbiPHadTJZDZ/+vg4
 uDpNOcLP2t7cRV5kh0fIQpjPYxtDFeV9HCua/2NcDwSRbIn2gd4/vP08q8iZeZK7
 F7c7VCZs9LgWnur0+RxS/yvlQJD0hmFEnaYobMXsULTZs4cRceigkBWOBSThG19y
 iCxRdy0XLaog4yTHb5Aql0szAQ8PkxdtOP7JoyF0nUQn9hwinISWtgyxfHzHXWKb
 SZHh2RLyzyyBWDh8VVBr4VM6q6WbQzS5MzS1IHipphoMGuGRKwQ5huPb048XjThB
 w1suZvX8aMw1vJy2au/d38P4891c9qUBA4woNqd1r+xrYOBAw8VPw7c5CxCyBgIg
 RUuCjEy/4RTkiXrhKzJA0kHmLXJKb53i2yNtzwe+w1lG6zdnhqGIuuHqLmdm89fL
 qgm/dUv6FIXhkMxtYz0+
 =3xEm
 -----END PGP SIGNATURE-----

Merge tag 'asoc-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v3.7

A few small fixes plus a large but simple change for WM5102 which writes
out a bunch of register updates to the device when we enable the clock
as recommended following chip evaluation.
2012-11-13 07:48:07 +01:00
Mark Brown
ba027da8eb Merge branches 'fix/arizona', 'fix/core', 'fix/cs42l52', 'fix/mxs', 'fix/samsung' and 'fix/wm8978' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into tmp 2012-11-13 15:13:29 +09:00
Linus Torvalds
9924a1992a Merge git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull KVM fix from Marcelo Tosatti:
 "A correction for user triggerable oops"

* git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit set (CVE-2012-4461)
2012-11-12 17:37:53 -08:00
Linus Torvalds
946edc47b6 Missing clkdev entries are causing regressions on the U8500 platform.
This pull request contains those missing clkdev entries which are needed
 to boot that platform.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJQoT87AAoJEDqPOy9afJhJRyYP/0SVLiDlDMZ6bm3UqzKsqY4V
 QhlSZQAJo/7FFRATeB7hGVAwayYSnzOcXMPvViCWGPe/30cva+IN7HzUbqvMHOfL
 vBfSBIMZT9nqC74gQe8QytKuGG1Aysw4bzhDxLiePxB7yEtMMJ22yoabVQfQSsuS
 U09pJ1jfAwNkLFLOwdDGgmx+xajPp3VVQRUC0R5mE/S/MowC1KPjRPZJZZwUPrjf
 WXKKXYd2tv7d6IoZ9kPbgu5zsEqdF5a+GHkTuYlJw3Zk1VEOZuFLVAmskyyX9hvi
 t6609gsyxch+nxFaz0BYV1Cf/fCcvLgL/oRAGbtspiiJL7IOwBbV7ojfNHd+3Pju
 CNh0B1aRE0QrIv5cvcvdOA9VtLo1yyOjWpo5o2iwcSiD0d+txyztb5p16tTausSt
 7LRxNdvt7aT9SsxtGLMa/PLlyRO+HSW8BKUo3Y84ZiwxJGGyIqv07tQd0jhlwXzv
 OZtFe63f7MeWc/MwuAFBkSQM7UGMtHpyWuZJ2EGwnHCPssq1D7yzTWLLI3n3fgin
 G1kIQklQwS+SrkjQGzZyYo436Dt3uJJ4mmCsrHypjfg6dUEYphkuucwJs3aiWNNX
 YzIBAKKr9rQWKaYx7vqYe/0Jg3jxnGpAnYqurI1jCJJ0xQhQ5BMksdMehUclujRw
 VRvnAZn5oKQVUGPnpVjE
 =VC2a
 -----END PGP SIGNATURE-----

Merge tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux

Pull ux500 clk fixes from Mike Turquette:
 "Missing clkdev entries are causing regressions on the U8500 platform.
  This pull request contains those missing clkdev entries which are
  needed to boot that platform."

* tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux:
  clk: ux500: Register slimbus clock lookups for u8500
  clk: ux500: Update rtc clock lookup for u8500
  clk: ux500: Register msp clock lookups for u8500
  clk: ux500: Register ssp clock lookups for u8500
  clk: ux500: Register i2c clock lookups for u8500
2012-11-12 17:05:53 -08:00
Linus Torvalds
70c80dfd57 Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
Pull menuconfig portability fix from Michal Marek:
 "Here is a fix for v3.7 that makes menuconfig compile again on systems
  whose C library is lacking CIRCLEQ_* macros.  I thought I sent it
  earlier, but apparently I did not."

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  menuconfig: Replace CIRCLEQ by list_head-style lists.
2012-11-12 17:04:57 -08:00
Linus Torvalds
9dce781768 Merge branch 'fixes-for-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds
Pull LED fix from Bryan Wu.

* 'fixes-for-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds:
  ledtrig-cpu: kill useless mutex to fix sleep in atomic context
2012-11-12 17:03:28 -08:00
Linus Torvalds
b0db954c04 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull futex fix from Thomas Gleixner:
 "Single fix for a long standing futex race when taking over a futex
  whose owner died.  You can end up with two owners, which violates
  quite some rules."

* 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Handle futex_pi OWNER_DIED take over correctly
2012-11-12 17:02:21 -08:00
Petr Matousek
6d1068b3a9 KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit set (CVE-2012-4461)
On hosts without the XSAVE support unprivileged local user can trigger
oops similar to the one below by setting X86_CR4_OSXSAVE bit in guest
cr4 register using KVM_SET_SREGS ioctl and later issuing KVM_RUN
ioctl.

invalid opcode: 0000 [] SMP
Modules linked in: tun ip6table_filter ip6_tables ebtable_nat ebtables
...
Pid: 24935, comm: zoog_kvm_monito Tainted: G      D      3.2.0-3-686-pae
EIP: 0060:[<f8b9550c>] EFLAGS: 00210246 CPU: 0
EIP is at kvm_arch_vcpu_ioctl_run+0x92a/0xd13 [kvm]
EAX: 00000001 EBX: 000f387e ECX: 00000000 EDX: 00000000
ESI: 00000000 EDI: 00000000 EBP: ef5a0060 ESP: d7c63e70
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process zoog_kvm_monito (pid: 24935, ti=d7c62000 task=ed84a0c0
task.ti=d7c62000)
Stack:
 00000001 f70a1200 f8b940a9 ef5a0060 00000000 00200202 f8769009 00000000
 ef5a0060 000f387e eda5c020 8722f9c8 00015bae 00000000 ed84a0c0 ed84a0c0
 c12bf02d 0000ae80 ef7f8740 fffffffb f359b740 ef5a0060 f8b85dc1 0000ae80
Call Trace:
 [<f8b940a9>] ? kvm_arch_vcpu_ioctl_set_sregs+0x2fe/0x308 [kvm]
...
 [<c12bfb44>] ? syscall_call+0x7/0xb
Code: 89 e8 e8 14 ee ff ff ba 00 00 04 00 89 e8 e8 98 48 ff ff 85 c0 74
1e 83 7d 48 00 75 18 8b 85 08 07 00 00 31 c9 8b 95 0c 07 00 00 <0f> 01
d1 c7 45 48 01 00 00 00 c7 45 1c 01 00 00 00 0f ae f0 89
EIP: [<f8b9550c>] kvm_arch_vcpu_ioctl_run+0x92a/0xd13 [kvm] SS:ESP
0068:d7c63e70

QEMU first retrieves the supported features via KVM_GET_SUPPORTED_CPUID
and then sets them later. So guest's X86_FEATURE_XSAVE should be masked
out on hosts without X86_FEATURE_XSAVE, making kvm_set_cr4 with
X86_CR4_OSXSAVE fail. Userspaces that allow specifying guest cpuid with
X86_FEATURE_XSAVE even on hosts that do not support it, might be
susceptible to this attack from inside the guest as well.

Allow setting X86_CR4_OSXSAVE bit only if host has XSAVE support.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2012-11-12 21:16:45 -02:00
Greg Kroah-Hartman
51f1206f60 xHCI patches for 3.8
Hi Greg,
 
 Here's some xHCI bug fixes.  There's nothing major in here that can't
 wait for 3.8.  The NULL pointer deref that commit 68e5254 fixes hasn't
 ever been reported in the three years that the xHCI driver has been
 available, so it can wait a few more weeks.
 
 There's two quirk updates, one for Fresco Logic (commit bba18e3) and one
 for xHCI hosts with the TI redriver (commit b0e4e60).  Commit 4525c0a
 makes the xHCI driver work correctly on the SiBridge xHCI host (and
 perhaps other 1.0 xHCI host controllers).  Commit 392a07a fixes a bug in
 the Intel Panther Point xHCI host bandwidth checking checking.
 
 Commits 2611bd1 and 77b8476 are trivial cleanup patches.
 
 Sarah Sharp
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJQoWZQAAoJEBMGWMLi1Gc53l8P/R05/ZTz+2VsdiotzqOnvJVJ
 b3h2ja4YLy5rtcU5nyn8yEISJVKVowt4w+J9lEVWj8ZtbLptAvQlUjM+2HCdgrTr
 RF5p4Y+5Wa0BHosqya4YPkQFu2ZMEDqgkpbfNU4q0hjrJEwUiB8XNfN2CqoO9RNk
 wQhEISQzhL2bmlgoKejlaU+csW4F1RZ1778SIWS/mj6zqtwc5JBn5J8o/DavJehk
 b2BGCRTKTtVnnP+N5LcWuJQg1tdi48ngigqo0VOqxjFTZ/w5YMLDZfXOBy/91lTI
 8i6hKwU1/LH5hPQf+e8K9H3TbiVUg3TAe7UovstPd9UrVS0xbNgKydjhP0y6/Ozy
 4TnmaQK4IQEGUVwzYLwIKCRrEZ32CNPIzm+ZU82MsMJH2rB0pP4yp1Gcu/IXTQJg
 wAyRNeheKiz6HqYeWE5ZuGK8h8Sodd+LJQeMl+ma/mlx6LvI/wpas8U13qTyOXsV
 E2UzqP4LrnMWtF8sEVnHa85hLvpdYLJDHMGrHHCb2OIgBuVmmf+U+xq7bZBIdeHZ
 iF66czS3ltdgXzimZfHpdTU/i12j3wGQ+si+b5d5GjjgBPJsQTecZD0GtOX4kQ5d
 3roFyW8JY7IEVT8dNRtJsi5sG+DOmtFWycCxA0BicTqa1VVahQoBCQY6UYtce5yD
 b0F5ZWeaGmee9zXSgpWD
 =aiNz
 -----END PGP SIGNATURE-----

Merge tag 'for-usb-next-2012-11-12' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-next

XHCI patches from Sarah:

 "xHCI patches for 3.8

  Hi Greg,

  Here's some xHCI bug fixes.  There's nothing major in here that can't
  wait for 3.8.  The NULL pointer deref that commit 68e5254 fixes hasn't
  ever been reported in the three years that the xHCI driver has been
  available, so it can wait a few more weeks.

  There's two quirk updates, one for Fresco Logic (commit bba18e3) and one
  for xHCI hosts with the TI redriver (commit b0e4e60).  Commit 4525c0a
  makes the xHCI driver work correctly on the SiBridge xHCI host (and
  perhaps other 1.0 xHCI host controllers).  Commit 392a07a fixes a bug in
  the Intel Panther Point xHCI host bandwidth checking checking.

  Commits 2611bd1 and 77b8476 are trivial cleanup patches.

  Sarah Sharp"
2012-11-12 15:09:46 -08:00
Fabio Estevam
2d4d07b97c ARM: boot: Fix usage of kecho
Since commit edc88ceb0 (ARM: be really quiet when building with 'make -s') the
following output is generated when building a kernel for ARM:

echo '  Kernel: arch/arm/boot/Image is ready'
  Kernel: arch/arm/boot/Image is ready
  Building modules, stage 2.
echo '  Kernel: arch/arm/boot/zImage is ready'
  Kernel: arch/arm/boot/zImage is ready

As per Documentation/kbuild/makefiles.txt the correct way of using kecho is
'@$(kecho)'.

Make this change so no more unwanted 'echo' messages are displayed.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2012-11-12 23:22:54 +01:00
Arnd Bergmann
c9af5b76ef Minor OMAP PM and hwmod fixes for v3.7-rc series via
Kevin Hilman and Paul Walmsley.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQmXAHAAoJEBvUPslcq6Vz3GUP/RRDpRcsJUh0wQMA+MYDdPJf
 dVcYYczUPn7LCZEXsWVHiwOA0BxR+TQ1N7trUyGkj1cgGo3ImUatDHT9Czy1zZQs
 8fpb+2kkNoxhEeWkxYT6LZZ+RuwGfo6mruJSCX1ZCf8oblW8QqduNLjCJGViEc/J
 WFuuFb+ucSvqJWsD5L3Bma4/rkYhAx20MjoLWEh69WUUdVip1/YTZCT9ui7wRFin
 afvq2USSEacQBaPbY+rMOOJU13YK9pNLU5+kgiRyoQ63BIoI4Wl1smDa0NoyYoFO
 S8cIekRtXZQTUCp+r4IDz5ZTJ24Lu7ywMaawrQlHuKShxLaPTHJZAKSxcCg0pEdc
 gDj1FJ65PczSMryos6WR6M0kqInfJK8SGlGVUe9y3wV5kFKOrc/G3e1Vi8/xbBFn
 J9dkriQJ5Xf0w4VpfY4yy1TAQAWnHPunucFUMLKUXWwAnk4eSxRgz/zZBvj7xbey
 6oNre4W/fHXnF8YE1wLIsrqQJq9pOIQc9jz22/knjF0jjhQU1alFyJ6MhyINIH0o
 gJv1rO+VWfhsG/ECYd01E7ChG+9bATWjJpPHHB6brC24VLNgcDUlrJurvuGhNU8d
 5P+/6OKenBj+hHWuiWIpFY+jIkG9NRcq2QIPEkFVIvfDHZ34H5FTB89d1Kw3hLSX
 /0h4NvAA4aK8oJuItOhI
 =pyxl
 -----END PGP SIGNATURE-----

Merge tag 'omap-for-v3.7-rc4/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

From Tony Lindgren <tony@atomide.com>:

Minor OMAP PM and hwmod fixes for v3.7-rc series via
Kevin Hilman and Paul Walmsley.

* tag 'omap-for-v3.7-rc4/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: OMAP4: PM: fix regulator name for VDD_MPU
  ARM: OMAP4: hwmod data: do not enable or reset the McPDM during kernel init
  ARM: OMAP2+: hwmod: add flag to prevent hwmod code from touching IP block during init
  ARM: OMAP: hwmod: wait for sysreset complete after enabling hwmod
  ARM: OMAP2+: clockdomain: Fix OMAP4 ISS clk domain to support only SWSUP
  ARM: OMAP2+: PM: add missing newline to VC warning message

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2012-11-12 22:41:39 +01:00
Felipe Balbi
77b847677e usb: host: xhci: move HC_STATE_SUSPENDED check to xhci_suspend()
that check will have to be done by all users
of xhci_suspend() so it sounds a lot better to
move the check to xhci_suspend() in order to
avoid code duplication.

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
2012-11-12 11:45:34 -08:00
Alexis R. Cortes
b0e4e606ff usb: host: xhci: Stricter conditional for Z1 system models for Compliance Mode Patch
This minor patch creates a more stricter conditional for the Z1 sytems for applying
the Compliance Mode Patch, this to avoid the quirk to be applied to models that
contain a "Z1" in their dmi product string but are different from Z1 systems.

This patch should be backported to stable kernels as old as 3.2, that
contain the commit 71c731a296 "usb: host:
xhci: Fix Compliance Mode on SN65LVPE502CP Hardware"

Signed-off-by: Alexis R. Cortes <alexis.cortes@ti.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org
2012-11-12 11:45:32 -08:00
Sarah Sharp
bba18e33f2 xhci: Extend Fresco Logic MSI quirk.
Ali reports that plugging a device into the Fresco Logic xHCI host with
PCI device ID 1400 produces an IRQ error:

 do_IRQ: 3.176 No irq handler for vector (irq -1)

Other early Fresco Logic host revisions don't support MSI, even though
their PCI config space claims they do.  Extend the quirk to disabling
MSI to this chipset revision.  Also enable the short transfer quirk,
since it's likely this revision also has that quirk, and it should be
harmless to enable.

04:00.0 0c03: 1b73:1400 (rev 01) (prog-if 30 [XHCI])
        Subsystem: 1d5c:1000
        Physical Slot: 3
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
        Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 0, Cache Line Size: 64 bytes
        Interrupt: pin A routed to IRQ 51
        Region 0: Memory at d4600000 (32-bit, non-prefetchable) [size=64K]
        Capabilities: [50] Power Management version 3
                Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold-)
                Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
        Capabilities: [68] MSI: Enable+ Count=1/1 Maskable- 64bit+
                Address: 00000000feeff00c  Data: 41b1
        Capabilities: [80] Express (v1) Endpoint, MSI 00
                DevCap: MaxPayload 128 bytes, PhantFunc 0, Latency L0s <2us, L1 <32us
                        ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset-
                DevCtl: Report errors: Correctable- Non-Fatal- Fatal- Unsupported-
                        RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+
                        MaxPayload 128 bytes, MaxReadReq 512 bytes
                DevSta: CorrErr- UncorrErr- FatalErr- UnsuppReq- AuxPwr- TransPend-
                LnkCap: Port , Speed 2.5GT/s, Width x1, ASPM L0s L1, Latency L0 unlimited, L1 unlimited
                        ClockPM- Surprise- LLActRep- BwNot-
                LnkCtl: ASPM Disabled; RCB 64 bytes Disabled- Retrain- CommClk+
                        ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
                LnkSta: Speed 2.5GT/s, Width x1, TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
        Kernel driver in use: xhci_hcd

This patch should be backported to stable kernels as old as 2.6.36, that
contain the commit f5182b4155 "xhci:
Disable MSI for some Fresco Logic hosts."

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: A Sh <smr.ash1991@gmail.com>
Tested-by: A Sh <smr.ash1991@gmail.com>
Cc: stable@vger.kernel.org
2012-11-12 11:45:31 -08:00
Julius Werner
68e5254adb xhci: fix null-pointer dereference when destroying half-built segment rings
xhci_alloc_segments_for_ring() builds a list of xhci_segments and links
the tail to head at the end (forming a ring). When it bails out for OOM
reasons half-way through, it tries to destroy its half-built list with
xhci_free_segments_for_ring(), even though it is not a ring yet. This
causes a null-pointer dereference upon hitting the last element.

Furthermore, one of its callers (xhci_ring_alloc()) mistakenly believes
the output parameters to be valid upon this kind of OOM failure, and
calls xhci_ring_free() on them. Since the (incomplete) list/ring should
already be destroyed in that case, this would lead to a use after free.

This patch fixes those issues by having xhci_alloc_segments_for_ring()
destroy its half-built, non-circular list manually and destroying the
invalid struct xhci_ring in xhci_ring_alloc() with a plain kfree().

This patch should be backported to kernels as old as 2.6.31, that
contains the commit 0ebbab3742 "USB: xhci:
Ring allocation and initialization."

A separate patch will need to be developed for kernels older than 3.4,
since the ring allocation code was refactored in that kernel.

Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org
2012-11-12 11:45:29 -08:00
Sarah Sharp
4525c0a10d xHCI: Fix TD Size calculation on 1.0 hosts.
The xHCI 1.0 specification made a change to the TD Size field in TRBs.
The value is now the number of packets that remain to be sent in the TD,
not including this TRB.  The TD Size value for the last TRB in a TD must
always be zero.

The xHCI function xhci_v1_0_td_remainder() attempts to calculate this,
but it gets it wrong.  First, it erroneously reuses the old
xhci_td_remainder function, which will right shift the value by 10.  The
xHCI 1.0 spec as of June 2011 says nothing about right shifting by 10.
Second, it does not set the TD size for the last TRB in a TD to zero.

Third, it uses roundup instead of DIV_ROUND_UP.  The total packet count
is supposed to be the total number of bytes in this TD, divided by the
max packet size, rounded up.  DIV_ROUND_UP is the right function to use
in that case.

With the old code, a TD on an endpoint with max packet size 1024 would
be set up like so:
TRB 1, TRB length = 600 bytes, TD size = 0
TRB 1, TRB length = 200 bytes, TD size = 0
TRB 1, TRB length = 100 bytes, TD size = 0

With the new code, the TD would be set up like this:
TRB 1, TRB length = 600 bytes, TD size = 1
TRB 1, TRB length = 200 bytes, TD size = 1
TRB 1, TRB length = 100 bytes, TD size = 0

This commit should be backported to kernels as old as 3.0, that contain
the commit 4da6e6f247 "xhci 1.0: Update TD
size field format."

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Chintan Mehta <chintan.mehta@sibridgetech.com>
Reported-by: Shimmer Huang <shimmering.h@gmail.com>
Tested-by: Bhavik Kothari <bhavik.kothari@sibridgetech.com>
Tested-by: Shimmer Huang <shimmering.h@gmail.com>
Cc: stable@vger.kernel.org
2012-11-12 11:45:28 -08:00
Sarah Sharp
392a07ae33 xhci: Fix conditional check in bandwidth calculation.
David reports that at drivers/usb/host/xhci.c:2257:

static bool xhci_is_sync_in_ep(unsigned int ep_type)
{
    return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
}

The static analyser cppcheck says

[linux-3.7-rc2/drivers/usb/host/xhci.c:2257]: (style) Redundant condition: If ep_type == 5, the comparison ep_type != 7 is always true.

Maybe the original programmer intention was something like

static bool xhci_is_sync_in_ep(unsigned int ep_type)
{
    return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
}

Fix this.

This patch should be backported to stable kernels as old as 3.2, that
contain the commit 2b69899934 "xhci: USB
3.0 BW checking."

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: David Binderman <dcb314@hotmail.com>
Cc: stable@vger.kernel.org
2012-11-12 11:45:26 -08:00
Sarah Sharp
2611bd189e xhci: Avoid global symbol pollution with handshake.
Non-static xHCI driver symbols should start with the "xhci_" prefix, in
order to avoid namespace pollution.  Rename the "handshake" function to
"xhci_handshake".

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Ben Hutchings <ben@decadent.org.uk>
2012-11-12 11:44:25 -08:00
Jani Nikula
d0ddfbd3d1 drm/i915/sdvo: clean up connectors on intel_sdvo_init() failures
Any failures in intel_sdvo_init() after the intel_sdvo_setup_output() call
left behind ghost connectors, attached (with a dangling pointer) to the
sdvo that has been cleaned up and freed. Properly destroy any connectors
attached to the encoder.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=46381
CC: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Cc: stable@vger.kernel.org
Tested-by: bjo@nord-west.org
[danvet: added a comment to explain why we need to clean up connectors
even when sdvo_output_setup fails.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-11-12 20:12:49 +01:00
Ulf Hansson
3d93067803 clk: ux500: Register slimbus clock lookups for u8500
At the same time the prcc bit for the kclk is corrected to
bit 8 instead of 3.

Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
2012-11-12 10:20:23 -08:00
Ulf Hansson
d4915cf5f6 clk: ux500: Update rtc clock lookup for u8500
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
2012-11-12 10:20:22 -08:00