--- /dev/null
+From cab1e0a36c9dd0b0671fb84197ed294513f5adc1 Mon Sep 17 00:00:00 2001
+From: Markus Pargmann <mpa@pengutronix.de>
+Date: Fri, 29 Mar 2013 16:20:09 +0100
+Subject: ARM: clk-imx35: Bugfix iomux clock
+
+From: Markus Pargmann <mpa@pengutronix.de>
+
+commit cab1e0a36c9dd0b0671fb84197ed294513f5adc1 upstream.
+
+This patch enables iomuxc_gate clock. It is necessary to be able to
+reconfigure iomux pads. Without this clock enabled, the
+clk_disable_unused function will disable this clock and the iomux pads
+are not configurable anymore. This happens at every boot. After a reboot
+(watchdog system reset) the clock is not enabled again, so all iomux pad
+reconfigurations in boot code are without effect.
+
+The iomux pads should be always configurable, so this patch always
+enables it.
+
+Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Cc: Lingzhu Xiang <lxiang@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/clk-imx35.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-imx/clk-imx35.c
++++ b/arch/arm/mach-imx/clk-imx35.c
+@@ -266,6 +266,7 @@ int __init mx35_clocks_init()
+ clk_prepare_enable(clk[iim_gate]);
+ clk_prepare_enable(clk[emi_gate]);
+ clk_prepare_enable(clk[max_gate]);
++ clk_prepare_enable(clk[iomuxc_gate]);
+
+ /*
+ * SCC is needed to boot via mmc after a watchdog reset. The clock code
--- /dev/null
+From 5dc2eb7da1e387e31ce54f54af580c6a6f512ca6 Mon Sep 17 00:00:00 2001
+From: Sascha Hauer <s.hauer@pengutronix.de>
+Date: Tue, 26 Feb 2013 10:55:18 +0100
+Subject: ARM: i.MX35: enable MAX clock
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+commit 5dc2eb7da1e387e31ce54f54af580c6a6f512ca6 upstream.
+
+The i.MX35 has two bits per clock gate which are decoded as follows:
+ 0b00 -> clock off
+ 0b01 -> clock is on in run mode, off in wait/doze
+ 0b10 -> clock is on in run/wait mode, off in doze
+ 0b11 -> clock is always on
+
+The reset value for the MAX clock is 0b10.
+
+The MAX clock is needed by the SoC, yet unused in the Kernel, so the
+common clock framework will disable it during late init time. It will
+only disable clocks though which it detects as being turned on. This
+detection is made depending on the lower bit of the gate. If the reset
+value has been altered by the bootloader to 0b11 the clock framework
+will detect the clock as turned on, yet unused, hence it will turn it
+off and the system locks up.
+
+This patch turns the MAX clock on unconditionally making the Kernel
+independent of the bootloader.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Lingzhu Xiang <lxiang@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/clk-imx35.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-imx/clk-imx35.c
++++ b/arch/arm/mach-imx/clk-imx35.c
+@@ -265,6 +265,7 @@ int __init mx35_clocks_init()
+ clk_prepare_enable(clk[gpio3_gate]);
+ clk_prepare_enable(clk[iim_gate]);
+ clk_prepare_enable(clk[emi_gate]);
++ clk_prepare_enable(clk[max_gate]);
+
+ /*
+ * SCC is needed to boot via mmc after a watchdog reset. The clock code
--- /dev/null
+From 383efcd00053ec40023010ce5034bd702e7ab373 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 18 Mar 2013 12:22:34 -0700
+Subject: sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 383efcd00053ec40023010ce5034bd702e7ab373 upstream.
+
+try_to_wake_up_local() should only be invoked to wake up another
+task in the same runqueue and BUG_ON()s are used to enforce the
+rule. Missing try_to_wake_up_local() can stall workqueue
+execution but such stalls are likely to be finite either by
+another work item being queued or the one blocked getting
+unblocked. There's no reason to trigger BUG while holding rq
+lock crashing the whole system.
+
+Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20130318192234.GD3042@htj.dyndns.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sched/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1488,8 +1488,10 @@ static void try_to_wake_up_local(struct
+ {
+ struct rq *rq = task_rq(p);
+
+- BUG_ON(rq != this_rq());
+- BUG_ON(p == current);
++ if (WARN_ON_ONCE(rq != this_rq()) ||
++ WARN_ON_ONCE(p == current))
++ return;
++
+ lockdep_assert_held(&rq->lock);
+
+ if (!raw_spin_trylock(&p->pi_lock)) {
--- /dev/null
+From fd9b86d37a600488dbd80fe60cca46b822bff1cd Mon Sep 17 00:00:00 2001
+From: libin <huawei.libin@huawei.com>
+Date: Mon, 8 Apr 2013 14:39:12 +0800
+Subject: sched/debug: Fix sd->*_idx limit range avoiding overflow
+
+From: libin <huawei.libin@huawei.com>
+
+commit fd9b86d37a600488dbd80fe60cca46b822bff1cd upstream.
+
+Commit 201c373e8e ("sched/debug: Limit sd->*_idx range on
+sysctl") was an incomplete bug fix.
+
+This patch fixes sd->*_idx limit range to [0 ~ CPU_LOAD_IDX_MAX-1]
+avoiding array overflow caused by setting sd->*_idx to CPU_LOAD_IDX_MAX
+on sysctl.
+
+Signed-off-by: Libin <huawei.libin@huawei.com>
+Cc: <jiang.liu@huawei.com>
+Cc: <guohanjun@huawei.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/51626610.2040607@huawei.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sched/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4950,7 +4950,7 @@ static void sd_free_ctl_entry(struct ctl
+ }
+
+ static int min_load_idx = 0;
+-static int max_load_idx = CPU_LOAD_IDX_MAX;
++static int max_load_idx = CPU_LOAD_IDX_MAX-1;
+
+ static void
+ set_table_entry(struct ctl_table *entry,
kvm-x86-convert-msr_kvm_system_time-to-use-gfn_to_hva_cache-functions-cve-2013-1797.patch
kvm-fix-bounds-checking-in-ioapic-indirect-register-reads-cve-2013-1798.patch
kvm-allow-cross-page-reads-and-writes-from-cached-translations.patch
+arm-i.mx35-enable-max-clock.patch
+arm-clk-imx35-bugfix-iomux-clock.patch
+tg3-add-57766-device-support.patch
+sched-convert-bug_on-s-in-try_to_wake_up_local-to-warn_on_once-s.patch
+sched-debug-fix-sd-_idx-limit-range-avoiding-overflow.patch
--- /dev/null
+From d3f677afb8076d09d090ff0a5d1229c9dd9f136e Mon Sep 17 00:00:00 2001
+From: Matt Carlson <mcarlson@broadcom.com>
+Date: Thu, 14 Feb 2013 14:27:51 +0000
+Subject: tg3: Add 57766 device support.
+
+From: Matt Carlson <mcarlson@broadcom.com>
+
+commit d3f677afb8076d09d090ff0a5d1229c9dd9f136e upstream.
+
+The patch also adds a couple of fixes
+
+ - For the 57766 and non Ax versions of 57765, bootcode needs to setup
+ the PCIE Fast Training Sequence (FTS) value to prevent transmit hangs.
+ Unfortunately, it does not have enough room in the selfboot case (i.e.
+ devices with no NVRAM). The driver needs to implement this.
+
+ - For performance reasons, the 2k DMA engine mode on the 57766 should
+ be enabled and dma size limited to 2k for standard sized packets.
+
+Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
+Signed-off-by: Michael Chan <mchan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/tg3.c | 18 +++++++++++++++++-
+ drivers/net/ethernet/broadcom/tg3.h | 2 ++
+ 2 files changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -330,6 +330,7 @@ static DEFINE_PCI_DEVICE_TABLE(tg3_pci_t
+ {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5719)},
+ {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5720)},
+ {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57762)},
++ {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57766)},
+ {PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9DXX)},
+ {PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9MXX)},
+ {PCI_DEVICE(PCI_VENDOR_ID_ALTIMA, PCI_DEVICE_ID_ALTIMA_AC1000)},
+@@ -9103,7 +9104,14 @@ static int tg3_reset_hw(struct tg3 *tp,
+ }
+
+ if (GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_57765_AX) {
+- u32 grc_mode = tr32(GRC_MODE);
++ u32 grc_mode;
++
++ /* Fix transmit hangs */
++ val = tr32(TG3_CPMU_PADRNG_CTL);
++ val |= TG3_CPMU_PADRNG_CTL_RDIV2;
++ tw32(TG3_CPMU_PADRNG_CTL, val);
++
++ grc_mode = tr32(GRC_MODE);
+
+ /* Access the lower 1K of DL PCIE block registers. */
+ val = grc_mode & ~GRC_MODE_PCIE_PORT_MASK;
+@@ -9413,6 +9421,14 @@ static int tg3_reset_hw(struct tg3 *tp,
+ if (tg3_flag(tp, PCI_EXPRESS))
+ rdmac_mode |= RDMAC_MODE_FIFO_LONG_BURST;
+
++ if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57766) {
++ tp->dma_limit = 0;
++ if (tp->dev->mtu <= ETH_DATA_LEN) {
++ rdmac_mode |= RDMAC_MODE_JMB_2K_MMRR;
++ tp->dma_limit = TG3_TX_BD_DMA_MAX_2K;
++ }
++ }
++
+ if (tg3_flag(tp, HW_TSO_1) ||
+ tg3_flag(tp, HW_TSO_2) ||
+ tg3_flag(tp, HW_TSO_3))
+--- a/drivers/net/ethernet/broadcom/tg3.h
++++ b/drivers/net/ethernet/broadcom/tg3.h
+@@ -1159,6 +1159,8 @@
+ #define CPMU_MUTEX_GNT_DRIVER 0x00001000
+ #define TG3_CPMU_PHY_STRAP 0x00003664
+ #define TG3_CPMU_PHY_STRAP_IS_SERDES 0x00000020
++#define TG3_CPMU_PADRNG_CTL 0x00003668
++#define TG3_CPMU_PADRNG_CTL_RDIV2 0x00040000
+ /* 0x3664 --> 0x36b0 unused */
+
+ #define TG3_CPMU_EEE_MODE 0x000036b0