summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2014-04-30ARM: clps711x: Add cpuidle driverAlexander Shiyan3-0/+71
Add cpuidle support for ARM Cirrus Logic CLPS711X CPUs. This CPU has an unique internal register and write to this location will put the system into the Idle State by halting the clock to the processor until an interrupt is generated. Signed-off-by: Alexander Shiyan <shc_work@mail.ru> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
2014-04-27Merge branch 'irq-urgent-for-linus' of ↵Linus Torvalds2-11/+9
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A slighlty large fix for a subtle issue in the CPU hotplug code of certain ARM SoCs, where the not yet online cpu needs to setup the cpu local timer and needs to set the interrupt affinity to itself. Setting interrupt affinity to a not online cpu is prohibited and therefor the timer interrupt ends up on the wrong cpu, which leads to nasty complications. The SoC folks tried to hack around that in the SoC code in some more than nasty ways. The proper solution is to have a way to enforce the affinity setting to a not online cpu. The core patch to the genirq code provides that facility and the follow up patches make use of it in the GIC interrupt controller and the exynos timer driver. The change to the core code has no implications to existing users, except for the rename of the locked function and therefor the necessary fixup in mips/cavium. Aside of that, no runtime impact is possible, as none of the existing interrupt chips implements anything which depends on the force argument of the irq_set_affinity() callback" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource: Exynos_mct: Register clock event after request_irq() clocksource: Exynos_mct: Use irq_force_affinity() in cpu bringup irqchip: Gic: Support forced affinity setting genirq: Allow forcing cpu affinity of interrupts
2014-04-27Merge tag 'tty-3.15-rc3' of ↵Linus Torvalds5-34/+55
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are a few tty/serial fixes for 3.15-rc3 that resolve a number of reported issues in the 8250 and samsung serial drivers, as well as a character loss fix for the tty core that was caused by the lock removal patches a release ago" * tag 'tty-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial_core: fix uart PORT_UNKNOWN handling serial: samsung: Change barrier() to cpu_relax() in console output serial: samsung: don't check config for every character serial: samsung: Use the passed in "port", fixing kgdb w/ no console serial: 8250: Fix thread unsafe __dma_tx_complete function 8250_core: Fix unwanted TX chars write tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc
2014-04-27Merge tag 'staging-3.15-rc3' of ↵Linus Torvalds7-17/+57
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging / IIO driver fixes from Greg KH: "Here are some small staging and IIO driver fixes for 3.15-rc3. Nothing major at all, just some assorted issues that people have reported" * tag 'staging-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private data iio: adc: mxs-lradc: fix warning when buidling on avr32 iio: cm36651: Fix i2c client leak and possible NULL pointer dereference iio: querying buffer scan_mask should return 0/1 staging:iio:ad2s1200 fix a missing break iio: adc: at91_adc: correct default shtim value ARM: at91: at91sam9260: change at91_adc name ARM: at91: at91sam9g45: change at91_adc name iio: cm32181: Fix read integration time function iio: adc: at91_adc: Repair broken platform_data support
2014-04-27Merge tag 'usb-3.15-rc3' of ↵Linus Torvalds28-162/+288
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of USB fixes for 3.15-rc3. The majority are gadget fixes, as we didn't get any of those in for 3.15-rc2. The others are all over the place, and there's a number of new device id addtions as well." * tag 'usb-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (35 commits) usb: option: add and update a number of CMOTech devices usb: option: add Alcatel L800MA usb: option: add Olivetti Olicard 500 usb: qcserial: add Sierra Wireless MC7305/MC7355 usb: qcserial: add Sierra Wireless MC73xx usb: qcserial: add Sierra Wireless EM7355 USB: io_ti: fix firmware download on big-endian machines usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PM xhci: extend quirk for Renesas cards xhci: Switch Intel Lynx Point ports to EHCI on shutdown. usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb phy: core: make NULL a valid phy reference if !CONFIG_GENERIC_PHY phy: fix kernel oops in phy_lookup() phy: restore OMAP_CONTROL_PHY dependencies phy: exynos: fix building as a module USB: serial: fix sysfs-attribute removal deadlock usb: wusbcore: fix panic in wusbhc_chid_set usb: wusbcore: convert nested lock to use spin_lock instead of spin_lock_irq uwb: don't call spin_unlock_irq in a USB completion handler usb: chipidea: coordinate usb phy initialization for different phy type ...
2014-04-27Merge tag 'pm+acpi-3.15-rc3' of ↵Linus Torvalds8-20/+184
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI and power management fixes from Rafael Wysocki: "These include a fix for a recent ACPI regression related to device notifications, intel_idle fix related to IvyTown support, fix for a buffer size issue in ACPICA, PM core fix related to the "freeze" sleep state, four fixes for various types of breakage in cpufreq drivers, a PNP workaround for a wrong memory region size in ACPI tables, and a fix and cleanup for the ACPI tools Makefile. Specifics: - Fix for broken ACPI notifications on some systems caused by a recent ACPI hotplug commit that blocked the propagation of unknown type notifications to device drivers inadvertently. - intel_idle fix to make the IvyTown C-states handling (added recently) work as intended which now is broken due to missing braces. From Christoph Jaeger. - ACPICA fix to make it allocate buffers of the right sizes for the Generic Serial Bus operation region access. From Lv Zheng. - PM core fix unblocking cpuidle before entering the "freeze" sleep state which causes that state to be able to actually save more energy than runtime idle. - Configuration and build fixes for the highbank and powernv cpufreq drivers from Kefeng Wang and Srivatsa S Bhat. - Coccinelle warning fix related to error pointers for the unicore32 cpufreq driver from Duan Jiong. - Integer overflow fix for the ppc-corenet cpufreq driver from Geert Uytterhoeven. - Workaround for BIOSes that don't report the entire Intel MCH area in their ACPI tables from Bjorn Helgaas. - ACPI tools Makefile fix and cleanup from Thomas Renninger" * tag 'pm+acpi-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / notify: Do not block unknown type notifications in root handler PNP: Work around BIOS defects in Intel MCH area reporting cpufreq: highbank: fix ARM_HIGHBANK_CPUFREQ dependency warning cpufreq: ppc: Fix integer overflow in expression cpufreq, powernv: Fix build failure on UP cpufreq: unicore32: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERO PM / suspend: Make cpuidle work in the "freeze" state intel_idle: fix IVT idle state table setting ACPICA: Fix buffer allocation issue for generic_serial_bus region accesses. tools/power/acpi: Minor bugfixes
2014-04-26Merge branches 'pnp' and 'acpi-hotplug'Rafael J. Wysocki2-3/+81
* pnp: PNP: Work around BIOS defects in Intel MCH area reporting * acpi-hotplug: ACPI / notify: Do not block unknown type notifications in root handler
2014-04-26Merge tag 'hwmon-for-linus' of ↵Linus Torvalds2-15/+74
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - ltc2945: Don't unecessarily crash kernel on implementation error - vexpress: Fix 'name' and 'label' attributes * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ltc2945) Don't crash the kernel unnecessarily hwmon: (vexpress) Avoid creating non-existing attributes hwmon: (vexpress) Use legal hwmon device names
2014-04-26Merge tag 'scsi-fixes' of ↵Linus Torvalds3-6/+20
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a set of seven fixes, three (hpsa) and free'd command references correcting bugs in the last round of updates and the remaining four correcting problems within the SCSI error handler that was causing a deadlock within USB" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: [SCSI] More USB deadlock fixes [SCSI] Fix USB deadlock caused by SCSI error handling [SCSI] Fix command result state propagation [SCSI] Fix spurious request sense in error handling [SCSI] don't reference freed command in scsi_prep_return [SCSI] don't reference freed command in scsi_init_sgtable [SCSI] hpsa: fix NULL dereference in hpsa_put_ctlr_into_performant_mode()
2014-04-26Merge tag 'fixes-3.15-rc3' of ↵Linus Torvalds3-13/+11
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Arnd Bergmann: "Since we didn't get around to collect fixes in time for -rc2 over the easter vacation, this one is unfortunately a bit larger than we'd like for an -rc3 merge. A large set of the changes is in the device tree sources, so I'm splitting out the description between code changes and DT changes. Aside from omap and versatile express, the actual code bugs are and trivial. Here is an overview: imx: - fix video clock settings - fix one clock refcounting bug omap: - update defconfig for renamed USB PHY driver - fix error handling in gpmc - fix N900 video initialization regression - fix reression in hwmod code from missing braces - fix am43xx and omap3 clocks - remove bogus write to voltage control register pxa: - fix build regression from 3.13 header cleanup rockchip: - fix a misleading printk string shmobile: - fix incorrect sound setting on multiple machines spear: - remove incorrect __init section annotation tegra: - remove a stale Kconfig entry u300: - update defconfig ux500: - enable common wireless and sensor drivers in defconfig - more defconfig updates vexpress: - fix voltage calculation for opp - fix reboot hang and warning - fix out-of-bounds array access - improve error handling in clock driver overall: - always select CLKSRC_OF in multiplatform builds And these are the devicetree related changes: imx: - add missing #clock-cell properties - fix pinctrl setting in imx6sl-evk - fix video endpoint on imx53 - remove obsolete lvds-channel nodes (multiple patches) - add missing second stmpe node - fix usb host mode on dmo-edmqmx6 (multiple patches) - fix gic node #address-cells to match usage - add missing legacy IRQ map for PCIe - fix microsom pincontrol setting for rgmii - fix fatal typo in touchscreen DT usage for mx5 - list all RAM present on m53evk and mx53qsb omap: - fix bug in DT handling of gpmc external bus - add DT for older revision of beagleboard - fix regression after DT node name fixes - remove obsolete properties for gpmc - fix pinmux comment to match DT it refers to - fix newly added dra7xx clock node data - add missing clock for USB PHY mvebu: - add missing clock for mdio node - fix nonstandard vendor prefixes on i2c nodes rockchip: - fix pin control setting for uart shmobile: - fix typo in DT data for pin control (multiple patches) - fix gic node #address-cells to match usage tegra: - fix clock and uart DT representation to match hardware zynq: - add DT nodes for newly added driver - add DT properties required for cpufreq-ondemand overall: - restore alphabetic order in Makefile - grammar fixes in bindings" * tag 'fixes-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (66 commits) ARM: vexpress/TC2: Convert OPP voltage to uV before storing power/reset: vexpress: Fix restart/power off operation dt: tegra: remove non-existent clock IDs clk: tegra: remove non-existent clocks ARM: tegra: remove UART5/UARTE from tegra124.dtsi ARM: tegra: remove TEGRA_EMC_SCALING_ENABLE ARM: Tidy up DTB Makefile entries ARM: fix missing CLKSRC_OF on multi-platform ARM: spear: add __init to spear_clocksource_init() ARM: pxa: hx4700.h: include "irqs.h" for PXA_NR_BUILTIN_GPIO arm/mach-vexpress: array accessed out of bounds clk: vexpress: NULL dereference on error path ARM: OMAP2+: Fix GPMC remap for devices using an offset ARM: zynq: dt: Add I2C nodes to Zynq device tree ARM: zynq: DT: Add 'clock-latency' property ARM: OMAP2+: Fix oops for GPMC free ARM: dts: Add support for the BeagleBoard xM A/B ARM: dts: Grammar /that will/it will/ ARM: dts: Grammar /is uses/ is used/ ARM: OMAP2+: Fix config name for USB3 PHY ...
2014-04-25usb: option: add and update a number of CMOTech devicesBjørn Mork1-4/+70
A number of older CMOTech modems are based on Qualcomm chips. The blacklisted interfaces are QMI/wwan. Reported-by: Lars Melin <larsm17@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25usb: option: add Alcatel L800MABjørn Mork1-0/+3
Device interface layout: 0: ff/ff/ff - serial 1: ff/00/00 - serial AT+PPP 2: ff/ff/ff - QMI/wwan 3: 08/06/50 - storage Cc: <stable@vger.kernel.org> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25usb: option: add Olivetti Olicard 500Bjørn Mork1-0/+4
Device interface layout: 0: ff/ff/ff - serial 1: ff/ff/ff - serial AT+PPP 2: 08/06/50 - storage 3: ff/ff/ff - serial 4: ff/ff/ff - QMI/wwan Cc: <stable@vger.kernel.org> Reported-by: Julio Araujo <julio.araujo@wllctel.com.br> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25usb: qcserial: add Sierra Wireless MC7305/MC7355Bjørn Mork1-0/+3
Cc: <stable@vger.kernel.org> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25usb: qcserial: add Sierra Wireless MC73xxBjørn Mork1-0/+3
Cc: <stable@vger.kernel.org> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25usb: qcserial: add Sierra Wireless EM7355Bjørn Mork1-0/+3
Cc: <stable@vger.kernel.org> Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25USB: io_ti: fix firmware download on big-endian machinesJohan Hovold1-17/+33
During firmware download the device expects memory addresses in big-endian byte order. As the wIndex parameter which hold the address is sent in little-endian byte order regardless of host byte order, we need to use swab16 rather than cpu_to_be16. Also make sure to handle the struct ti_i2c_desc size parameter which is returned in little-endian byte order. Reported-by: Ludovic Drolez <ldrolez@debian.org> Tested-by: Ludovic Drolez <ldrolez@debian.org> Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25usb/xhci: fix compilation warning when !CONFIG_PCI && !CONFIG_PMDavid Cohen1-3/+3
When CONFIG_PCI and CONFIG_PM are not selected, xhci.c gets this warning: drivers/usb/host/xhci.c:409:13: warning: ‘xhci_msix_sync_irqs’ defined but not used [-Wunused-function] Instead of creating nested #ifdefs, this patch fixes it by defining the xHCI PCI stubs as inline. This warning has been in since 3.2 kernel and was caused by commit 421aa841a134f6a743111cf44d0c6d3b45e3cf8c "usb/xhci: hide MSI code behind PCI bars", but wasn't noticed until 3.13 when a configuration with these options was tried Signed-off-by: David Cohen <david.a.cohen@linux.intel.com> Cc: stable@vger.kernel.org # 3.2 Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25xhci: extend quirk for Renesas cardsIgor Gnatenko1-3/+1
After suspend another Renesas PCI-X USB 3.0 card doesn't work. [root@fedora-20 ~]# lspci -vmnnd 1912: Device: 03:00.0 Class: USB controller [0c03] Vendor: Renesas Technology Corp. [1912] Device: uPD720202 USB 3.0 Host Controller [0015] SVendor: Renesas Technology Corp. [1912] SDevice: uPD720202 USB 3.0 Host Controller [0015] Rev: 02 ProgIf: 30 This patch should be applied to stable kernel 3.14 that contain the commit 1aa9578c1a9450fb21501c4f549f5b1edb557e6d "xhci: Fix resume issues on Renesas chips in Samsung laptops" Reported-and-tested-by: Anatoly Kharchenko <rfr-bugs@yandex.ru> Reference: http://redmine.russianfedora.pro/issues/1315 Signed-off-by: Igor Gnatenko <i.gnatenko.brain@gmail.com> Cc: stable@vger.kernel.org # 3.14 Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25xhci: Switch Intel Lynx Point ports to EHCI on shutdown.Denis Turischev1-0/+2
The same issue like with Panther Point chipsets. If the USB ports are switched to xHCI on shutdown, the xHCI host will send a spurious interrupt, which will wake the system. Some BIOS have work around for this, but not all. One example is Compulab's mini-desktop, the Intense-PC2. The bug can be avoided if the USB ports are switched back to EHCI on shutdown. This patch should be backported to stable kernels as old as 3.12, that contain the commit 638298dc66ea36623dbc2757a24fc2c4ab41b016 "xhci: Fix spurious wakeups after S5 on Haswell" Signed-off-by: Denis Turischev <denis@compulab.co.il> Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25usb: xhci: Prefer endpoint context dequeue pointer over stopped_trbJulius Werner3-39/+31
We have observed a rare cycle state desync bug after Set TR Dequeue Pointer commands on Intel LynxPoint xHCs (resulting in an endpoint that doesn't fetch new TRBs and thus an unresponsive USB device). It always triggers when a previous Set TR Dequeue Pointer command has set the pointer to the final Link TRB of a segment, and then another URB gets enqueued and cancelled again before it can be completed. Further investigation showed that the xHC had returned the Link TRB in the TRB Pointer field of the Transfer Event (CC == Stopped -- Length Invalid), but when xhci_find_new_dequeue_state() later accesses the Endpoint Context's TR Dequeue Pointer field it is set to the first TRB of the next segment. The driver expects those two values to be the same in this situation, and uses the cycle state of the latter together with the address of the former. This should be fine according to the XHCI specification, since the endpoint ring should be stopped when returning the Transfer Event and thus should not advance over the Link TRB before it gets restarted. However, real-world XHCI implementations apparently don't really care that much about these details, so the driver should follow a more defensive approach to try to work around HC spec violations. This patch removes the stopped_trb variable that had been used to store the TRB Pointer from the last Transfer Event of a stopped TRB. Instead, xhci_find_new_dequeue_state() now relies only on the Endpoint Context, requiring a small amount of additional processing to find the virtual address corresponding to the TR Dequeue Pointer. Some other parts of the function were slightly rearranged to better fit into this model. This patch should be backported to kernels as old as 2.6.31 that contain the commit ae636747146ea97efa18e04576acd3416e2514f5 "USB: xhci: URB cancellation support." Signed-off-by: Julius Werner <jwerner@chromium.org> Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25serial_core: fix uart PORT_UNKNOWN handlingThomas Pfaff1-18/+21
While porting a RS485 driver from 2.6.29 to 3.14, i noticed that the serial tty driver could break it by using uart ports that it does not own : 1. uart_change_pm ist called during uart_open and calls the uart pm function without checking for PORT_UNKNOWN. The fix is to move uart_change_pm from uart_open to uart_port_startup. 2. The return code from the uart request_port call in uart_set_info is not handled properly, leading to the situation that the serial driver also thinks it owns the uart ports. This can triggered by doing following actions : setserial /dev/ttyS0 uart none # release the uart ports modprobe lirc-serial # or any other device that uses the uart setserial /dev/ttyS0 uart 16550 # gives no error and the uart tty driver # can use the ports as well Signed-off-by: Thomas Pfaff <tpfaff@pcs.com> Reviewed-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25serial: samsung: Change barrier() to cpu_relax() in console outputDoug Anderson1-1/+1
The two functions to write out to the console (one used in normal console mode and one in polling console mode) were slightly different. One used a barrier() in its loop and the other a cpu_relax(). The barrier() really doesn't do anything since we're using rd_regl() to read the port anyway. Switch it to cpu_relax() to make things consistent. No known bugs / issues are fixed by this change--it just makes things more consistent. Signed-off-by: Doug Anderson <dianders@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25serial: samsung: don't check config for every characterDoug Anderson1-5/+6
The s3c24xx_serial_console_putchar() is _only_ ever used by s3c24xx_serial_console_write() and is called in a loop (indirectly through uart_console_write()). There's no reason to call s3c24xx_port_configured() for every iteration through the loop. Move it outside the loop. Signed-off-by: Doug Anderson <dianders@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25serial: samsung: Use the passed in "port", fixing kgdb w/ no consoleDoug Anderson1-6/+6
The two functions in the samsung serial driver used for writing characters out to the port were inconsistent about whether they used the passed in "port" or the global "cons_uart". There was no reason to use the global and the use of the global in s3c24xx_serial_put_poll_char() caused a crash in the case where you used the serial port for kgdboc but not for console. Fix it so we used the passed in variable. Note that this doesn't fix all problems with the samsung serial driver. Specifically: * s3c24xx_serial_console_putchar() is still 99% identical to s3c24xx_serial_put_poll_char() (the function signature is different, but that's about it). A future patch will make them slightly less identical and judging by other serial drivers we may need yet more differences eventually. * The samsung serial driver still doesn't allow you to have more than one console port since it still uses the global cons_uart in s3c24xx_serial_console_write(). Signed-off-by: Doug Anderson <dianders@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25serial: 8250: Fix thread unsafe __dma_tx_complete functionLoic Poulain1-2/+7
__dma_tx_complete is not protected against concurrent call of serial8250_tx_dma. it can lead to circular tail index corruption or parallel call of serial_tx_dma on the same data portion. This patch fixes this issue by holding the port lock. Signed-off-by: Loic Poulain <loic.poulain@intel.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-258250_core: Fix unwanted TX chars writeLoic Poulain1-1/+1
On transmit-hold-register empty, serial8250_tx_chars should be called only if we don't use DMA. DMA has its own tx cycle. Signed-off-by: Loic Poulain <loic.poulain@intel.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25tty: Fix race condition between __tty_buffer_request_room and flush_to_ldiscManfred Schlaegl1-2/+14
The race was introduced while development of linux-3.11 by e8437d7ecbc50198705331449367d401ebb3181f and e9975fdec0138f1b2a85b9624e41660abd9865d4. Originally it was found and reproduced on linux-3.12.15 and linux-3.12.15-rt25, by sending 500 byte blocks with 115kbaud to the target uart in a loop with 100 milliseconds delay. In short: 1. The consumer flush_to_ldisc is on to remove the head tty_buffer. 2. The producer adds a number of bytes, so that a new tty_buffer must be allocated and added by __tty_buffer_request_room. 3. The consumer removes the head tty_buffer element, without handling newly committed data. Detailed example: * Initial buffer: * Head, Tail -> 0: used=250; commit=250; read=240; next=NULL * Consumer: ''flush_to_ldisc'' * consumed 10 Byte * buffer: * Head, Tail -> 0: used=250; commit=250; read=250; next=NULL {{{ count = head->commit - head->read; // count = 0 if (!count) { // enter // INTERRUPTED BY PRODUCER -> if (head->next == NULL) break; buf->head = head->next; tty_buffer_free(port, head); continue; } }}} * Producer: tty_insert_flip_... 10 bytes + tty_flip_buffer_push * buffer: * Head, Tail -> 0: used=250; commit=250; read=250; next=NULL * added 6 bytes: head-element filled to maximum. * buffer: * Head, Tail -> 0: used=256; commit=250; read=250; next=NULL * added 4 bytes: __tty_buffer_request_room is called * buffer: * Head -> 0: used=256; commit=256; read=250; next=1 * Tail -> 1: used=4; commit=0; read=250 next=NULL * push (tty_flip_buffer_push) * buffer: * Head -> 0: used=256; commit=256; read=250; next=1 * Tail -> 1: used=4; commit=4; read=250 next=NULL * Consumer {{{ count = head->commit - head->read; if (!count) { // INTERRUPTED BY PRODUCER <- if (head->next == NULL) // -> no break break; buf->head = head->next; tty_buffer_free(port, head); // ERROR: tty_buffer head freed -> 6 bytes lost continue; } }}} This patch reintroduces a spin_lock to protect this case. Perhaps later a lock-less solution could be found. Signed-off-by: Manfred Schlaegl <manfred.schlaegl@gmx.at> Cc: stable <stable@vger.kernel.org> # 3.11 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-25Merge tag 'vexpress/fixes-for-3.15' of ↵Arnd Bergmann736-26008/+7314
git://git.linaro.org/people/pawel.moll/linux into fixes ARM Versatile Express fixes for 3.15 This series contains straight-forward fixes for different Versatile Express infrastructure drivers: - NULL pointer dereference on the error path in the clk driver - out of boundary array access in the dcscb driver - broken restart/power off implementation - mis-interpreted voltage unit in the spc driver * tag 'vexpress/fixes-for-3.15' of git://git.linaro.org/people/pawel.moll/linux: ARM: vexpress/TC2: Convert OPP voltage to uV before storing power/reset: vexpress: Fix restart/power off operation arm/mach-vexpress: array accessed out of bounds clk: vexpress: NULL dereference on error path Includes an update to 3.15-rc2 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-04-24phy: fix kernel oops in phy_lookup()Sergei Shtylyov1-0/+3
The kernel oopses in phy_lookup() due to 'phy->init_data' being NULL if we register PHYs from a device tree probing driver and then call phy_get() on a device that has no representation in the device tree (e.g. a PCI device). Checking the pointer before dereferening it and skipping an interation if it's NULL prevents this kernel oops. Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24phy: restore OMAP_CONTROL_PHY dependenciesJean Delvare1-0/+1
When OMAP_CONTROL_USB was renamed to OMAP_CONTROL_PHY (commit 14da699b), its dependencies were lost in the process. Nothing in the commit message indicates that this removal was intentional, so I think it was by accident and the dependencies should be restored. Signed-off-by: Jean Delvare <jdelvare@suse.de> Acked-by: Roger Quadros <rogerq@ti.com> Cc: Felipe Balbi <balbi@ti.com> Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24phy: exynos: fix building as a moduleArnd Bergmann1-4/+5
The top-level phy-samsung-usb2 driver may be configured as a loadable module, which currently causes link errors because of the dependency on the exynos{5250,4x12,4210}_usb2_phy_config symbol. Solving this could be achieved by exporting these symbols, but as the SoC-specific parts of the driver are not currently built as modules, it seems better to just link everything into one module and avoid the need for the export. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Kamil Debski <k.debski@samsung.com> Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24USB: serial: fix sysfs-attribute removal deadlockJohan Hovold1-1/+3
Fix driver new_id sysfs-attribute removal deadlock by making sure to not hold any locks that the attribute operations grab when removing the attribute. Specifically, usb_serial_deregister holds the table mutex when deregistering the driver, which includes removing the new_id attribute. This can lead to a deadlock as writing to new_id increments the attribute's active count before trying to grab the same mutex in usb_serial_probe. The deadlock can easily be triggered by inserting a sleep in usb_serial_deregister and writing the id of an unbound device to new_id during module unload. As the table mutex (in this case) is used to prevent subdriver unload during probe, it should be sufficient to only hold the lock while manipulating the usb-serial driver list during deregister. A racing probe will then either fail to find a matching subdriver or fail to get the corresponding module reference. Since v3.15-rc1 this also triggers the following lockdep warning: ====================================================== [ INFO: possible circular locking dependency detected ] 3.15.0-rc2 #123 Tainted: G W ------------------------------------------------------- modprobe/190 is trying to acquire lock: (s_active#4){++++.+}, at: [<c0167aa0>] kernfs_remove_by_name_ns+0x4c/0x94 but task is already holding lock: (table_lock){+.+.+.}, at: [<bf004d84>] usb_serial_deregister+0x3c/0x78 [usbserial] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (table_lock){+.+.+.}: [<c0075f84>] __lock_acquire+0x1694/0x1ce4 [<c0076de8>] lock_acquire+0xb4/0x154 [<c03af3cc>] _raw_spin_lock+0x4c/0x5c [<c02bbc24>] usb_store_new_id+0x14c/0x1ac [<bf007eb4>] new_id_store+0x68/0x70 [usbserial] [<c025f568>] drv_attr_store+0x30/0x3c [<c01690e0>] sysfs_kf_write+0x5c/0x60 [<c01682c0>] kernfs_fop_write+0xd4/0x194 [<c010881c>] vfs_write+0xbc/0x198 [<c0108e4c>] SyS_write+0x4c/0xa0 [<c000f880>] ret_fast_syscall+0x0/0x48 -> #0 (s_active#4){++++.+}: [<c03a7a28>] print_circular_bug+0x68/0x2f8 [<c0076218>] __lock_acquire+0x1928/0x1ce4 [<c0076de8>] lock_acquire+0xb4/0x154 [<c0166b70>] __kernfs_remove+0x254/0x310 [<c0167aa0>] kernfs_remove_by_name_ns+0x4c/0x94 [<c0169fb8>] remove_files.isra.1+0x48/0x84 [<c016a2fc>] sysfs_remove_group+0x58/0xac [<c016a414>] sysfs_remove_groups+0x34/0x44 [<c02623b8>] driver_remove_groups+0x1c/0x20 [<c0260e9c>] bus_remove_driver+0x3c/0xe4 [<c026235c>] driver_unregister+0x38/0x58 [<bf007fb4>] usb_serial_bus_deregister+0x84/0x88 [usbserial] [<bf004db4>] usb_serial_deregister+0x6c/0x78 [usbserial] [<bf005330>] usb_serial_deregister_drivers+0x2c/0x4c [usbserial] [<bf016618>] usb_serial_module_exit+0x14/0x1c [sierra] [<c009d6cc>] SyS_delete_module+0x184/0x210 [<c000f880>] ret_fast_syscall+0x0/0x48 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(table_lock); lock(s_active#4); lock(table_lock); lock(s_active#4); *** DEADLOCK *** 1 lock held by modprobe/190: #0: (table_lock){+.+.+.}, at: [<bf004d84>] usb_serial_deregister+0x3c/0x78 [usbserial] stack backtrace: CPU: 0 PID: 190 Comm: modprobe Tainted: G W 3.15.0-rc2 #123 [<c0015e10>] (unwind_backtrace) from [<c0013728>] (show_stack+0x20/0x24) [<c0013728>] (show_stack) from [<c03a9a54>] (dump_stack+0x24/0x28) [<c03a9a54>] (dump_stack) from [<c03a7cac>] (print_circular_bug+0x2ec/0x2f8) [<c03a7cac>] (print_circular_bug) from [<c0076218>] (__lock_acquire+0x1928/0x1ce4) [<c0076218>] (__lock_acquire) from [<c0076de8>] (lock_acquire+0xb4/0x154) [<c0076de8>] (lock_acquire) from [<c0166b70>] (__kernfs_remove+0x254/0x310) [<c0166b70>] (__kernfs_remove) from [<c0167aa0>] (kernfs_remove_by_name_ns+0x4c/0x94) [<c0167aa0>] (kernfs_remove_by_name_ns) from [<c0169fb8>] (remove_files.isra.1+0x48/0x84) [<c0169fb8>] (remove_files.isra.1) from [<c016a2fc>] (sysfs_remove_group+0x58/0xac) [<c016a2fc>] (sysfs_remove_group) from [<c016a414>] (sysfs_remove_groups+0x34/0x44) [<c016a414>] (sysfs_remove_groups) from [<c02623b8>] (driver_remove_groups+0x1c/0x20) [<c02623b8>] (driver_remove_groups) from [<c0260e9c>] (bus_remove_driver+0x3c/0xe4) [<c0260e9c>] (bus_remove_driver) from [<c026235c>] (driver_unregister+0x38/0x58) [<c026235c>] (driver_unregister) from [<bf007fb4>] (usb_serial_bus_deregister+0x84/0x88 [usbserial]) [<bf007fb4>] (usb_serial_bus_deregister [usbserial]) from [<bf004db4>] (usb_serial_deregister+0x6c/0x78 [usbserial]) [<bf004db4>] (usb_serial_deregister [usbserial]) from [<bf005330>] (usb_serial_deregister_drivers+0x2c/0x4c [usbserial]) [<bf005330>] (usb_serial_deregister_drivers [usbserial]) from [<bf016618>] (usb_serial_module_exit+0x14/0x1c [sierra]) [<bf016618>] (usb_serial_module_exit [sierra]) from [<c009d6cc>] (SyS_delete_module+0x184/0x210) [<c009d6cc>] (SyS_delete_module) from [<c000f880>] (ret_fast_syscall+0x0/0x48) Signed-off-by: Johan Hovold <jhovold@gmail.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24usb: wusbcore: fix panic in wusbhc_chid_setThomas Pugliese1-1/+1
If no valid CHID value has previously been set on an HWA, writing a value of all zeros will cause a kernel panic in uwb_radio_stop because wusbhc->uwb_rc has not been set. This patch skips the call to uwb_radio_stop if wusbhc->uwb_rc has not been initialized. Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24usb: wusbcore: convert nested lock to use spin_lock instead of spin_lock_irqThomas Pugliese1-2/+2
Nesting a spin_lock_irq/unlock_irq inside a lock that has already disabled interrupts will enable interrupts before we are ready when spin_unlock_irq is called. This patch converts the inner lock to use spin_lock and spin_unlock instead. Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24uwb: don't call spin_unlock_irq in a USB completion handlerThomas Pugliese1-4/+5
This patch converts the use of spin_lock_irq/spin_unlock_irq to spin_lock_irqsave/spin_unlock_irqrestore in uwb_rc_set_drp_cmd_done which is called from a USB completion handler. There are also whitespace cleanups to make checkpatch.pl happy. Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24usb: chipidea: coordinate usb phy initialization for different phy typePeter Chen1-3/+34
For internal PHY (like UTMI), the phy clock may from internal pll, it is on/off on the fly, the access PORTSC.PTS will hang without phy clock. So, the usb_phy_init which will open phy clock needs to be called before hw_phymode_configure. See: http://marc.info/?l=linux-arm-kernel&m=139350618732108&w=2 For external PHY (like ulpi), it needs to configure portsc.pts before visit viewport, or the viewport can't be visited. so phy_phymode_configure needs to be called before usb_phy_init. See: cd0b42c2a6d2a74244f0053f8960f5dad5842278 It may not the best solution, but it can work for all situations. Cc: Sascha Hauer <s.hauer@pengutronix.de> Cc: Chris Ruehl <chris.ruehl@gtsys.com.hk> Cc: shc_work@mail.ru Cc: denis@eukrea.com Cc: festevam@gmail.com Cc: stable <stable@vger.kernel.org> # 3.14 Signed-off-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-04-24Merge tag 'fixes-for-v3.15-rc3' of ↵Greg Kroah-Hartman13-81/+78
git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v3.15-rc3 Quite a few fixes this time since I lost v3.15-rc2 window. Most fixes are MUSB which learned to remove its debugfs directories properly, got a fix for PHY handling and now knows that it should make sure its clocks aren't gated before trying to access registers. ffs got a race fix between ffs_epfile_io() and ffs_func_eps_disable(). dwc3 got a fix for system suspend/resume and now only iterates over valid endpoints when trying to resize TX fifos. usb_get_phy() now will properly return an error if try_module_get() fails. We also have a revert for a NAPI conversion on the ethernet gadget which was causing a kernel BUG. Signed-of-by: Felipe Balbi <balbi@ti.com>
2014-04-24Merge tag 'regulator-v3.15-rc2' of ↵Linus Torvalds1-56/+20
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of things here: - Fixes for pbias that didn't make it in during the merge window due to the driver coming in via MMC. The conversion to use helpers is a fix as it implements list_voltage() which the main user (MMC) relies on for correct functioning. - Change the !REGULATOR stub for optional regulators to return an error rather than a dummy; this is more in keeping with the intended use of optional regulators and fixes some issues seen MMC where it got confused by a dummy being provided" * tag 'regulator-v3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: Return error in get optional stub regulator: pbias: Convert to use regmap helper functions regulator: pbias: Fix is_enabled callback implementation
2014-04-24Merge tag 'spi-v3.15-rc2' of ↵Linus Torvalds4-5/+23
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few driver specific fixes here: - SH HSPI was dealing with its clocks incorrectly which meant it didn't work on some SoCs, fixing this also requires a small fix to one of the SoC clock trees to avoid breaking existing users. - The SiRF driver appears to have had several quality problems, it's fairly new and not widely used so this isn't too worrying. - A brute force fix for excessive locking in the Atmel driver, it needs further investigation but this deals with the immediate issue. - A build fix for the Blackfin driver" * tag 'spi-v3.15-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: atmel: Fix scheduling while atomic bug spi: sh-hspi: Do not specifically request shyway_clk clock ARM: shmobile: r8a7778: Use clks as MSTP007 parent spi: sirf: make GPIO chipselect function work well spi: sirf: set SPI controller in RISC IO chipselect mode spi: sirf: correct TXFIFO empty interrupt status bit spi: bfin5xx: fix build error
2014-04-24ACPI / notify: Do not block unknown type notifications in root handlerRafael J. Wysocki1-3/+2
Commit 1a699476e258 "ACPI / hotplug / PCI: Hotplug notifications from acpi_bus_notify()" changed the root notify handler, acpi_bus_notify(), to block unknown type norifications, but it overlooked the fact that they might be propagated to drivers via the ->notify() callback. Fix the problem by allowing drivers to receive unknown type notifications via ->notify() as before. Fixes: 1a699476e258 (ACPI / hotplug / PCI: Hotplug notifications from acpi_bus_notify()) Reported-and-tested-by: Mantas Mikulėnas <grawity@gmail.com> Reported-and-tested-by: Sitsofe Wheeler <sitsofe@yahoo.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-24Merge branch 'for-3.15-fixes' of ↵Linus Torvalds7-37/+59
git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata Pull libata fixes from Tejun Heo: "Dan updated tag allocation to accomodate devices which choke when tags jump back and forth. Quite a few ahci MSI related fixes. A couple config dependency fixes and other misc fixes" * 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: libata/ahci: accommodate tag ordered controllers ahci: Do not receive interrupts sent by dummy ports ahci: Use pci_enable_msi_exact() instead of pci_enable_msi_range() ahci: Ensure "MSI Revert to Single Message" mode is not enforced ahci: do not request irq for dummy port pata_samsung_cf: fix ata_host_activate() failure handling pata_arasan_cf: fix ata_host_activate() failure handling ata: fix i.MX AHCI driver dependencies pata_at91: fix ata_host_activate() failure handling libata: Update queued trim blacklist for M5x0 drives libata: make AHCI_XGENE depend on PHY_XGENE
2014-04-24power/reset: vexpress: Fix restart/power off operationPawel Moll1-9/+10
The restart/power off implementation in the vexpress driver used to obtain the config function when necessary. This was wrong in two respects: 1. It required memory allocation with disabled interrupts (it worked, but lockdep - when enabled - reported warnings). 2. Used jiffies-based timeout, while jiffies are not running at this stage of system shutdown (therefore a config transaction error - if happened - would have never be reported). Fixed by pre-allocating the config function per device and using mdelay for timeout. Signed-off-by: Pawel Moll <pawel.moll@arm.com>
2014-04-24clk: tegra: remove non-existent clocksStephen Warren1-3/+0
The Tegra124 clock driver currently provides 3 clocks that don't actually exist; 2 for NAND and one for UART5/UARTE. Delete these. Cc: <stable@vger.kernel.org> Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-04-24hwmon: (ltc2945) Don't crash the kernel unnecessarilyGuenter Roeck1-3/+3
An implementation error should not crash the kernel if it is avoidable. Replace BUG() with WARN_ONCE(). Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2014-04-24hwmon: (vexpress) Avoid creating non-existing attributesPawel Moll1-3/+19
The 'label' attribute was always created but returned -ENOENT if there is no label and such behaviour is undefined from libsensors' point of view. Fixed by providing is_visible method in the attributes group, so the attribute is not created at all when unnecessary. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Pawel Moll <pawel.moll@arm.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2014-04-24hwmon: (vexpress) Use legal hwmon device namesPawel Moll1-9/+52
The driver used to directly us a DT 'compatible' property for the 'name' attribute of the hwmon devices. Unfortunately it contains '-' which is illegal in this context. It messes up libsensors and thus every application using it. Fixed by providing equivalent (and simpler) name strings. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Pawel Moll <pawel.moll@arm.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2014-04-24clk: vexpress: NULL dereference on error pathDan Carpenter1-1/+1
If the allocation fails then we dereference the NULL in the error path. Just return directly. Fixes: ed27ff1db869 ('clk: Versatile Express clock generators ("osc") driver') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Pawel Moll <pawel.moll@arm.com>
2014-04-24PNP: Work around BIOS defects in Intel MCH area reportingBjorn Helgaas1-0/+79
Work around BIOSes that don't report the entire Intel MCH area. MCHBAR is not an architected PCI BAR, so MCH space is usually reported as a PNP0C02 resource. The MCH space was once 16KB, but is 32KB in newer parts. Some BIOSes still report a PNP0C02 resource that is only 16KB, which means the rest of the MCH space is consumed but unreported. This can cause resource map sanity check warnings or (theoretically) a device conflict if we assigned the unreported space to another device. The Intel perf event uncore driver tripped over this when it claimed the MCH region: resource map sanity check conflict: 0xfed10000 0xfed15fff 0xfed10000 0xfed13fff pnp 00:01 Info: mapping multiple BARs. Your kernel is fine. To prevent this, if we find a PNP0C02 resource that covers part of the MCH space, extend it to cover the entire space. References: http://lkml.kernel.org/r/20140224162400.GE16457@pd.tnic Reported-and-tested-by: Borislav Petkov <bp@alien8.de> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Borislav Petkov <bp@suse.de> Acked-by: Stephane Eranian <eranian@google.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-04-24staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private dataH Hartley Sweeten1-6/+3
In usbdux_ao_cmd(), the channels for the command are transfered from the cmd->chanlist and stored in the private data 'ao_chanlist'. The channel numbers are bit-shifted when stored so that they become the "command" that is transfered to the device. The channel to command conversion results in the 'ao_chanlist' having these values for the channels: channel 0 -> ao_chanlist = 0x00 channel 1 -> ao_chanlist = 0x40 channel 2 -> ao_chanlist = 0x80 channel 3 -> ao_chanlist = 0xc0 The problem is, the usbduxsub_ao_isoc_irq() function uses the 'chan' value from 'ao_chanlist' to access the 'ao_readback' array in the private data. So instead of accessing the array as 0, 1, 2, 3, it accesses it as 0x00, 0x40, 0x80, 0xc0. Fix this by storing the raw channel number in 'ao_chanlist' and doing the bit-shift when creating the command. Fixes: a998a3db530bff80 "staging: comedi: usbdux: cleanup the private data 'outBuffer'" Cc: stable <stable@vger.kernel.org> # 3.12 Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Acked-by: Bernd Porr <mail@berndporr.me.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>