summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-07-08gpio/langwell_gpio: ack the correct bit for langwell gpio interruptsMathias Nyman1-1/+1
The wrong bit was masked when acking langwell gpio interrupts. Reason for maskig the wrong bit was probably because__ffs() and ffs() functions return bit indexes differently (0..31 vs 1..32) This fixes langwell based devices from hanging when a gpio interrupt is triggered and undoes the breakage which occurred in change set 732063b92bb727b27e61580ce278dddefe31c6ad Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
2011-07-08Merge branch 'master' of ↵John W. Linville16-42/+92
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into for-davem
2011-07-08ARM: S3C2440: fix section mismatch on mini2440Wolfram Sang1-1/+1
If mini2440_init() is in __init, mini2440_parse_features() should also be in __init. Fixes: (.text+0x9adc): Section mismatch in reference from the function mini2440_parse_features.clone.0() to the (unknown reference) .init.data:(unknown) The function mini2440_parse_features.clone.0() references the (unknown reference) __initdata (unknown). Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Cc: Michel Pollet <buserror@gmail.com> Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
2011-07-08ARM: S3C24XX: drop return codes in void function of dma.cWolfram Sang1-3/+1
Commit bb072c3c (ARM / Samsung: Use struct syscore_ops for "core" power management) turned s3c2410_dma_resume_chan() from int to void. So, drop the actual return values, too. Fixes: arch/arm/plat-s3c24xx/dma.c: In function 's3c2410_dma_resume_chan': arch/arm/plat-s3c24xx/dma.c:1238:3: warning: 'return' with a value, in function returning void arch/arm/plat-s3c24xx/dma.c:1250:2: warning: 'return' with a value, in function returning void Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Acked-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
2011-07-08ARM: S3C24XX: don't use uninitialized variable in dma.cWolfram Sang1-6/+2
Commit 8970ef47 (S3C24XX: Remove hardware specific registers from DMA calls) removed the parameter dcon in s3c2410_dma_config() and calculates it on its own. So the debug-output for the old parameter can go, too. Fixes: arch/arm/plat-s3c24xx/dma.c: In function 's3c2410_dma_config': arch/arm/plat-s3c24xx/dma.c:1030:2: warning: 'dcon' is used uninitialized in this function Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Cc: Ben Dooks <ben-linux@fluff.org> Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
2011-07-08cifs: factor smb_vol allocation out of cifs_setup_volume_infoJeff Layton3-33/+33
Signed-off-by: Jeff Layton <jlayton@redhat.com> Reviewed-by: Pavel Shilovsky <piastryyy@gmail.com> Signed-off-by: Steve French <sfrench@us.ibm.com>
2011-07-08SUNRPC: Fix a race between work-queue and rpc_killall_tasksTrond Myklebust1-16/+11
Since rpc_killall_tasks may modify the rpc_task's tk_action field without any locking, we need to be careful when dereferencing it. Reported-by: Ben Greear <greearb@candelatech.com> Tested-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Cc: stable@kernel.org
2011-07-08Merge branch 'for-30-rc5/all-i2c' of git://git.fluff.org/bjdooks/linuxLinus Torvalds3-6/+17
* 'for-30-rc5/all-i2c' of git://git.fluff.org/bjdooks/linux: i2c-bfin-twi: abort transfer is MEM bit is reset unexpectedly i2c-s3c2410: Remove useless break code i2c-s3c2410: Fix typo 'i2s' -> 'i2c' i2c: tegra: Assign unused slave address
2011-07-08drm/i915: Enable GPU reset on Ivybridge.Kenneth Graunke1-0/+1
According to the hardware documentation, GDRST is exactly the same as on Sandybridge. So simply enable the existing code. Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-07-08Merge branch 'usb-linus' of ↵Linus Torvalds1-1/+8
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: USB: additional regression fix for device removal
2011-07-08sctp: Enforce retransmission limit during shutdownThomas Graf5-13/+62
When initiating a graceful shutdown while having data chunks on the retransmission queue with a peer which is in zero window mode the shutdown is never completed because the retransmission error count is reset periodically by the following two rules: - Do not timeout association while doing zero window probe. - Reset overall error count when a heartbeat request has been acknowledged. The graceful shutdown will wait for all outstanding TSN to be acknowledged before sending the SHUTDOWN request. This never happens due to the peer's zero window not acknowledging the continuously retransmitted data chunks. Although the error counter is incremented for each failed retransmission, the receiving of the SACK announcing the zero window clears the error count again immediately. Also heartbeat requests continue to be sent periodically. The peer acknowledges these requests causing the error counter to be reset as well. This patch changes behaviour to only reset the overall error counter for the above rules while not in shutdown. After reaching the maximum number of retransmission attempts, the T5 shutdown guard timer is scheduled to give the receiver some additional time to recover. The timer is stopped as soon as the receiver acknowledges any data. The issue can be easily reproduced by establishing a sctp association over the loopback device, constantly queueing data at the sender while not reading any at the receiver. Wait for the window to reach zero, then initiate a shutdown by killing both processes simultaneously. The association will never be freed and the chunks on the retransmission queue will be retransmitted indefinitely. Signed-off-by: Thomas Graf <tgraf@infradead.org> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-08drm/i915/dp: manage sink power state if possibleJesse Barnes1-0/+35
On sinks with a DPCD rev of 1.1 or greater, we can send sink power management commands to address 0x600 per section 5.1.5 of the DisplayPort 1.1a spec. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-07-08drm/i915/dp: consolidate AUX retry codeJesse Barnes1-21/+30
When checking link status during a hot plug event or detecting sink presence, we need to retry 3 times per the spec (section 9.1 of the 1.1a DisplayPort spec). Consolidate the retry code into a native_aux_read_retry function for use by get_link_status and _detect. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-07-08drm/i915/dp: remove DPMS mode tracking from DPJesse Barnes1-5/+1
We currently use this when a hot plug event is received, only checking the link status and re-training if we had previously configured a link. However if we want to preserve the DP configuration across both hot plug and DPMS events (which we do for userspace apps that don't respond to hot plug uevents), we need to unconditionally check the link and try to bring it up on hot plug. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-07-08drm/i915/dp: try to read receiver capabilities 3 times when detectingJesse Barnes1-5/+10
If ->detect is called too soon after a hot plug event, the sink may not be ready yet. So try up to 3 times with 1ms sleeps in between tries to get the data (spec dictates that receivers must be ready to respond within 1ms and that sources should try 3 times). See section 9.1 of the 1.1a DisplayPort spec. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-07-08drm/i915/dp: read more receiver capability bits on hotplugJesse Barnes1-0/+11
When a hotplug event is received, we need to check the receiver cap bits in case they've changed (as they might with a hub or chain config). Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-07-08drm/i915/dp: use DP DPCD defines when looking at DPCD valuesJesse Barnes1-8/+10
Makes it easier to search for DP related constants. Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-07-08drm/i915/dp: retry link status read 3 times on failureJesse Barnes1-7/+13
Especially after a hotplug or power status change, the sink may not reply immediately to a link status query. So retry 3 times per the spec to really make sure nothing is there. See section 9.1 of the 1.1a DisplayPort spec. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2011-07-08USB: additional regression fix for device removalAlan Stern1-1/+8
Commit e534c5b831c8b8e9f5edee5c8a37753c808b80dc (USB: fix regression occurring during device removal) didn't go far enough. It failed to take into account that when a driver claims multiple interfaces, it may release them all at the same time. As a result, some interfaces can get released before they are unregistered, and we deadlock trying to acquire the bandwidth_mutex that we already own. This patch (asl478) handles this case by setting the "unregistering" flag on all the interfaces before removing any of them. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Cc: stable <stable@kernel.org> Tested-by: Éric Piel <eric.piel@tremplin-utc.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-07-08[media] msp3400: fill in v4l2_tuner based on vt->type fieldHans Verkuil1-5/+7
The vt->type field determines how the msp3400 should fill in the tuner data, not whether the msp3400 is in radio mode or not. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-08Merge branch 'pm-fixes' of ↵Linus Torvalds1-1/+5
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6 * 'pm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6: PM / Hibernate: Fix free_unnecessary_pages()
2011-07-08Merge branch 'for-linus' of git://git.kernel.dk/linux-blockLinus Torvalds6-25/+39
* 'for-linus' of git://git.kernel.dk/linux-block: drbd: we should write meta data updates with FLUSH FUA drbd: fix limit define, we support 1 PiByte now drbd: when receive times out on meta socket, also check last receive time on data socket drbd: account bitmap IO during resync as resync-(related-)-io drbd: don't cond_resched_lock with IRQs disabled drbd: add missing spinlock to bitmap receive drbd: Use the correct max_bio_size when creating resync requests cfq-iosched: make code consistent cfq-iosched: fix a rcu warning
2011-07-08FS-Cache: Add a helper to bulk uncache pages on an inodeDavid Howells5-5/+85
Add an FS-Cache helper to bulk uncache pages on an inode. This will only work for the circumstance where the pages in the cache correspond 1:1 with the pages attached to an inode's page cache. This is required for CIFS and NFS: When disabling inode cookie, we were returning the cookie and setting cifsi->fscache to NULL but failed to invalidate any previously mapped pages. This resulted in "Bad page state" errors and manifested in other kind of errors when running fsstress. Fix it by uncaching mapped pages when we disable the inode cookie. This patch should fix the following oops and "Bad page state" errors seen during fsstress testing. ------------[ cut here ]------------ kernel BUG at fs/cachefiles/namei.c:201! invalid opcode: 0000 [#1] SMP Pid: 5, comm: kworker/u:0 Not tainted 2.6.38.7-30.fc15.x86_64 #1 Bochs Bochs RIP: 0010: cachefiles_walk_to_object+0x436/0x745 [cachefiles] RSP: 0018:ffff88002ce6dd00 EFLAGS: 00010282 RAX: ffff88002ef165f0 RBX: ffff88001811f500 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000282 RBP: ffff88002ce6dda0 R08: 0000000000000100 R09: ffffffff81b3a300 R10: 0000ffff00066c0a R11: 0000000000000003 R12: ffff88002ae54840 R13: ffff88002ae54840 R14: ffff880029c29c00 R15: ffff88001811f4b0 FS: 00007f394dd32720(0000) GS:ffff88002ef00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00007fffcb62ddf8 CR3: 000000001825f000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process kworker/u:0 (pid: 5, threadinfo ffff88002ce6c000, task ffff88002ce55cc0) Stack: 0000000000000246 ffff88002ce55cc0 ffff88002ce6dd58 ffff88001815dc00 ffff8800185246c0 ffff88001811f618 ffff880029c29d18 ffff88001811f380 ffff88002ce6dd50 ffffffff814757e4 ffff88002ce6dda0 ffffffff8106ac56 Call Trace: cachefiles_lookup_object+0x78/0xd4 [cachefiles] fscache_lookup_object+0x131/0x16d [fscache] fscache_object_work_func+0x1bc/0x669 [fscache] process_one_work+0x186/0x298 worker_thread+0xda/0x15d kthread+0x84/0x8c kernel_thread_helper+0x4/0x10 RIP cachefiles_walk_to_object+0x436/0x745 [cachefiles] ---[ end trace 1d481c9af1804caa ]--- I tested the uncaching by the following means: (1) Create a big file on my NFS server (104857600 bytes). (2) Read the file into the cache with md5sum on the NFS client. Look in /proc/fs/fscache/stats: Pages : mrk=25601 unc=0 (3) Open the file for read/write ("bash 5<>/warthog/bigfile"). Look in proc again: Pages : mrk=25601 unc=25601 Reported-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-and-Tested-by: Suresh Jayaraman <sjayaraman@suse.de> cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-07-08[media] tuner-core.c: don't change type field in g_tuner or g_frequencyHans Verkuil1-19/+19
The tuner core should not silently change the type field in g_tuner and g_frequency. If the tuner is in a different mode than the one that was requested, then just fill in what you can and don't attempt to read afc, signal or rxsubchans values. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-08Merge branch 'stable/bug.fixes' of ↵Linus Torvalds1-28/+28
git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen * 'stable/bug.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: xen/pci: Move check for acpi_sci_override_gsi to xen_setup_acpi_sci.
2011-07-08Merge branch 'x86-urgent-for-linus' of ↵Linus Torvalds6-3/+36
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: Don't use the EFI reboot method by default x86, suspend: Restore MISC_ENABLE MSR in realmode wakeup x86, reboot: Acer Aspire One A110 reboot quirk x86-32, NUMA: Fix boot regression caused by NUMA init unification on highmem machines
2011-07-08Merge branches 'core-urgent-for-linus', 'perf-urgent-for-linus' and ↵Linus Torvalds5-17/+24
'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: debugobjects: Fix boot crash when kmemleak and debugobjects enabled * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: jump_label: Fix jump_label update for modules oprofile, x86: Fix race in nmi handler while starting counters * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: Disable (revert) SCHED_LOAD_SCALE increase sched, cgroups: Fix MIN_SHARES on 64-bit boxen
2011-07-08Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds37-165/+256
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (31 commits) sctp: fix missing send up SCTP_SENDER_DRY_EVENT when subscribe it net: refine {udp|tcp|sctp}_mem limits vmxnet3: round down # of queues to power of two net: sh_eth: fix the parameter for the ETHER of SH7757 net: sh_eth: fix cannot work half-duplex mode net: vlan: enable soft features regardless of underlying device vmxnet3: fix starving rx ring whenoc_skb kb fails bridge: Always flood broadcast packets greth: greth_set_mac_add would corrupt the MAC address. net: bind() fix error return on wrong address family natsemi: silence dma-debug warnings net: 8139too: Initial necessary vlan_features to support vlan Fix call trace when interrupts are disabled while sleeping function kzalloc is called qlge:Version change to v1.00.00.29 qlge: Fix printk priority so chip fatal errors are always reported. qlge:Fix crash caused by mailbox execution on wedged chip. xfrm4: Don't call icmp_send on local error ipv4: Don't use ufo handling on later transformed packets xfrm: Remove family arg from xfrm_bundle_ok ipv6: Don't put artificial limit on routing table size. ...
2011-07-07[media] cx18/ivtv: fix g_tuner supportHans Verkuil2-12/+4
The driver shouldn't override vt->type, and the tuner name should be based on vt->type as well. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] tuner-core: power up tuner when called with s_power(1)Hans Verkuil1-3/+7
Drivers must be able to rely on s_power to power up subdevices. Note that at this moment no driver attempts to power up tuners. This probably isn't surprising since s_power(1) was never implemented in tuner-core.c until now. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] v4l2-ioctl.c: check for valid tuner type in S_HW_FREQ_SEEKHans Verkuil1-3/+9
Prohibit attempts to change the tuner to a type that is different from the device node the ioctl is called from. I.e. the type must be RADIO for a radio node and ANALOG_TV for a video/vbi node. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] tuner-core: simplify the standard fixupHans Verkuil1-65/+28
Get rid of a number of unnecessary tuner_dbg messages by simplifying the std fixup function. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] tuner-core/v4l2-subdev: document that the type field has to be filled inHans Verkuil2-0/+36
The tuner ops g_frequency, g_tuner and s_tuner require that the tuner type field is filled in. Document this. The tuner-core doc is based on a patch from Mauro Carvalho Chehab <mchehab@redhat.com>. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] v4l2-subdev.h: remove unused s_mode tuner opHans Verkuil1-4/+1
s_mode is no longer used, so remove it. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] feature-removal-schedule: change in how radio device nodes are handledHans Verkuil1-0/+22
Radio devices have weird side-effects when used with combined TV/radio tuners and the V4L2 spec is ambiguous on how it should work. This results in inconsistent driver behavior which makes life hard for everyone. Be more strict in when and how the switch between radio and tv mode takes place and make sure all drivers behave the same. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] bttv: fix s_tuner for radioHans Verkuil1-1/+1
Fix typo: g_tuner should have been s_tuner. Tested with a bttv card. Cc: stable@kernel.org Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] pvrusb2: fix g/s_tuner supportHans Verkuil1-0/+4
The tuner-core subdev requires that the type field of v4l2_tuner is filled in correctly. This is done in v4l2-ioctl.c, but pvrusb2 doesn't use that yet, so we have to do it manually based on whether the current input is radio or not. Tested with my pvrusb2. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Mike Isely <isely@pobox.com> Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] v4l2-ioctl.c: prefill tuner type for g_frequency and g/s_tunerHans Verkuil1-0/+6
The subdevs are supposed to receive a valid tuner type for the g_frequency and g/s_tuner subdev ops. Some drivers do this, others don't. So prefill this in v4l2-ioctl.c based on whether the device node from which this is called is a radio node or not. The spec does not require applications to fill in the type, and if they leave it at 0 then the 'check_mode' call in tuner-core.c will return an error and the ioctl does nothing. Cc: stable@kernel.org Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] tuner-core: fix tuner_resume: use t->mode instead of t->typeHans Verkuil1-1/+1
set_mode is called with t->type, which is the tuner type. Instead, use t->mode which is the actual tuner mode (i.e. radio vs tv). Cc: stable@kernel.org Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07[media] tuner-core: fix s_std and s_tunerHans Verkuil1-28/+31
Both s_std and s_tuner are broken because set_mode_freq is called before the new std (for s_std) and audmode (for s_tuner) are set. This patch splits set_mode_freq in a set_mode and a set_freq and in s_std/s_tuner first calls set_mode, and if that returns 0 (i.e. the mode is supported) then they set t->std/t->audmode and call set_freq. This fixes a bug where changing std or audmode would actually change it to the previous value. Discovered while testing analog TV standards for cx18 with a tda18271 tuner. Cc: stable@kernel.org Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-07-07mac80211: fix TKIP replay vulnerabilityJohannes Berg1-3/+13
Unlike CCMP, the presence or absence of the QoS field doesn't change the encryption, only the TID is used. When no QoS field is present, zero is used as the TID value. This means that it is possible for an attacker to take a QoS packet with TID 0 and replay it as a non-QoS packet. Unfortunately, mac80211 uses different IVs for checking the validity of the packet's TKIP IV when it checks TID 0 and when it checks non-QoS packets. This means it is vulnerable to this replay attack. To fix this, use the same replay counter for TID 0 and non-QoS packets by overriding the rx->queue value to 0 if it is 16 (non-QoS). This is a minimal fix for now. I caused this issue in commit 1411f9b531f0a910cd1c85a337737c1e6ffbae6a Author: Johannes Berg <johannes@sipsolutions.net> Date: Thu Jul 10 10:11:02 2008 +0200 mac80211: fix RX sequence number check while fixing a sequence number issue (there, a separate counter needs to be used). Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-07mac80211: fix ie memory allocation for scheduled scansLuciano Coelho1-1/+2
We were not allocating memory for the IEs passed in the scheduled_scan request and this was causing memory corruption (buffer overflow). Signed-off-by: Luciano Coelho <coelho@ti.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-07ssb: fix init regression of hostmode PCI coreRafał Miłecki1-9/+9
Our workarounds seem to be clientmode PCI specific. Using SPROM workaround on SoC resulted in Oops: Data bus error, epc == 8017ed58, ra == 80225838 Oops[#1]: Cpu 0 $ 0 : 00000000 10008000 b8000000 00000001 $ 4 : 80293b5c 00000caa ffffffff 00000000 $ 8 : 0000000a 00000003 00000001 696d6d20 $12 : ffffffff 00000000 00000000 ffffffff $16 : 802d0140 b8004800 802c0000 00000000 $20 : 00000000 802c0000 00000000 802d04d4 $24 : 00000018 80151a00 $28 : 81816000 81817df8 8029bda0 80225838 Hi : 00000000 Lo : 00000000 epc : 8017ed58 ssb_ssb_read16+0x48/0x60 Not tainted ra : 80225838 ssb_pcicore_init+0x54/0x3b4 Reported-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Tested-by: Hauke Mehrtens <hauke@hauke-m.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-07ASoC: ak4642: fixup snd_soc_update_bits mask for PW_MGMT2Kuninori Morimoto1-1/+1
mask didn't cover update-data Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Acked-by: Liam Girdwood <lrg@ti.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Cc: stable@kernel.org
2011-07-07xen/pci: Move check for acpi_sci_override_gsi to xen_setup_acpi_sci.Konrad Rzeszutek Wilk1-28/+28
Previously we would check for acpi_sci_override_gsi == gsi every time a PCI device was enabled. That works during early bootup, but later on it could lead to triggering unnecessarily the acpi_gsi_to_irq(..) lookup. The reason is that acpi_sci_override_gsi was declared in __initdata and after early bootup could contain bogus values. This patch moves the check for acpi_sci_override_gsi to the site where the ACPI SCI is preset. CC: stable@kernel.org Reported-by: Raghavendra D Prabhu <rprabhu@wnohang.net> Tested-by: Raghavendra D Prabhu <rprabhu@wnohang.net> [http://lists.xensource.com/archives/html/xen-devel/2011-07/msg00154.html] Suggested-by: Ian Campbell <ijc@hellion.org.uk> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2011-07-07genirq: replace irq_gc_ack() with {set,clr}_bit variants (fwd)Simon Guinot6-7/+22
This fixes a regression introduced by e59347a "arm: orion: Use generic irq chip". Depending on the device, interrupts acknowledgement is done by setting or by clearing a dedicated register. Replace irq_gc_ack() with some {set,clr}_bit variants allows to handle both cases. Note that this patch affects the following SoCs: Davinci, Samsung and Orion. Except for this last, the change is minor: irq_gc_ack() is just renamed into irq_gc_ack_set_bit(). For the Orion SoCs, the edge GPIO interrupts support is currently broken. irq_gc_ack() try to acknowledge a such interrupt by setting the corresponding cause register bit. The Orion GPIO device expect the opposite. To fix this issue, the irq_gc_ack_clr_bit() variant is used. Tested on Network Space v2. Reported-by: Joey Oravec <joravec@drewtech.com> Signed-off-by: Simon Guinot <sguinot@lacie.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2011-07-07platform-drivers-x86: set backlight type to BACKLIGHT_PLATFORMAxel Lin2-0/+2
Some newly added drivers do not set backlight type, as a result /sys/class/backlight/<backlight>/type shows incorrect backlight type. Signed-off-by: Axel Lin <axel.lin@gmail.com> Cc: Corentin Chary <corentin.chary@gmail.com> Cc: Yin Kangkai <kangkai.yin@intel.com> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2011-07-07thinkpad-acpi: handle HKEY 0x4010, 0x4011 eventsHenrique de Moraes Holschuh2-9/+37
Handle events 0x4010 and 0x4011 so that we do not pester users about them. These events report when the thinkpad is docked/undocked to a native hotplug dock (i.e. one that does not need ACPI handling, nor is represented in the ACPI device tree). Such docks are based on USB 2.0/3.0, and also work as port replicators. We really want a proper dock class to report these, or at least new input EV_SW events. Since it is not clear which one to use yet, keep reporting them as vendor-specific ThinkPad events. WARNING: As defined by the thinkpad-acpi sysfs ABI rules of engagement, the vendor-specific events will be REMOVED as soon as generic events are made available (duplicate events are a big problem), with an appropriate update to the thinkpad-acpi sysfs/event ABI versioning. Userspace is already prepared to provide easy backwards compatibility for such changes when convenient to the distro (see acpi-fakekey). * Event 0x4010: docking to hotplug dock/port replicator * Event 0x4011: undocking from hotplug dock/port replicator Typical usecase would be to trigger display reconfiguration. Reports mention T410, T510, and series 3 docks/port replicators. Special thanks to Robert de Rooy for his extensive report and analysis of the situation. http://www.thinkwiki.org/wiki/ThinkPad_Port_Replicator_Series_3 http://www.thinkwiki.org/wiki/ThinkPad_Mini_Dock_Series_3 http://www.thinkwiki.org/wiki/ThinkPad_Mini_Dock_Plus_Series_3 http://www.thinkwiki.org/wiki/ThinkPad_Mini_Dock_Plus_Series_3_for_Mobile_Workstations http://lenovoblogs.com/insidethebox/?p=290 Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br> Cc: Matthew Garrett <mjg59@srcf.ucam.org> Reported-by: Claudius Hubig <claudiushubig@chubig.net> Reported-by: Doctor Bill <docbill@gmail.com> Reported-by: Korte Noack <gbk.noack@gmx.de> Reported-by: Robert de Rooy <robert.de.rooy@gmail.com> Reported-by: Sebastian Will <swill@csail.mit.edu> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2011-07-07drivers/platform/x86: Fix memory leakAndre Bartke1-1/+3
data is not freed in the error case of compal_probe(). Signed-off-by: Andre Bartke <andre.bartke@gmail.com> Signed-off-by: Matthew Garrett <mjg@redhat.com>
2011-07-07thinkpad-acpi: handle some new HKEY 0x60xx eventsHenrique de Moraes Holschuh2-5/+26
Handle some user interface events from the newer Lenovo models. We are likely to do something smart with these events in the future, for now, hide the ones we are already certain about from the user and userspace both. * Events 0x6000 and 0x6005 are key-related. 0x6005 is not properly identified yet. Ignore these events, and do not report them. * Event 0x6040 has not been properly identified yet, and we don't know if it is important (looks like it isn't, but still...). Keep reporting it. * Change the message the driver outputs on unknown 0x6xxx events, as all recent events are not related to thermal alarms. Degrade log level from ALERT to WARNING. Thanks to all users who reported these events or asked about them in a number of mailing lists. Your help is highly appreciated, even if I did took a lot of time to act on them. For that I apologise. I will list those that identified the reasons for the events as "reported-by", and I apologise in advance if I leave anyone out: it was not done on purpose, I made the mistake of not properly tagging all event report emails separately, and might have missed some. Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br> Reported-by: Markus Malkusch <markus@malkusch.de> Reported-by: Peter Giles <g1l3sp@gmail.com> Signed-off-by: Matthew Garrett <mjg@redhat.com>