--- /dev/null
+From 7c8a3679e3d8e9d92d58f282161760a0e247df97 Mon Sep 17 00:00:00 2001
+From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+Date: Tue, 15 Oct 2013 16:42:19 -0600
+Subject: elevator: acquire q->sysfs_lock in elevator_change()
+
+From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+
+commit 7c8a3679e3d8e9d92d58f282161760a0e247df97 upstream.
+
+Add locking of q->sysfs_lock into elevator_change() (an exported function)
+to ensure it is held to protect q->elevator from elevator_init(), even if
+elevator_change() is called from non-sysfs paths.
+sysfs path (elv_iosched_store) uses __elevator_change(), non-locking
+version, as the lock is already taken by elv_iosched_store().
+
+Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Cc: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/elevator.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -965,7 +965,7 @@ fail_init:
+ /*
+ * Switch this queue to the given IO scheduler.
+ */
+-int elevator_change(struct request_queue *q, const char *name)
++static int __elevator_change(struct request_queue *q, const char *name)
+ {
+ char elevator_name[ELV_NAME_MAX];
+ struct elevator_type *e;
+@@ -987,6 +987,18 @@ int elevator_change(struct request_queue
+
+ return elevator_switch(q, e);
+ }
++
++int elevator_change(struct request_queue *q, const char *name)
++{
++ int ret;
++
++ /* Protect q->elevator from elevator_init() */
++ mutex_lock(&q->sysfs_lock);
++ ret = __elevator_change(q, name);
++ mutex_unlock(&q->sysfs_lock);
++
++ return ret;
++}
+ EXPORT_SYMBOL(elevator_change);
+
+ ssize_t elv_iosched_store(struct request_queue *q, const char *name,
+@@ -997,7 +1009,7 @@ ssize_t elv_iosched_store(struct request
+ if (!q->elevator)
+ return count;
+
+- ret = elevator_change(q, name);
++ ret = __elevator_change(q, name);
+ if (!ret)
+ return count;
+
--- /dev/null
+From eb1c160b22655fd4ec44be732d6594fd1b1e44f4 Mon Sep 17 00:00:00 2001
+From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+Date: Tue, 15 Oct 2013 16:42:16 -0600
+Subject: elevator: Fix a race in elevator switching and md device initialization
+
+From: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+
+commit eb1c160b22655fd4ec44be732d6594fd1b1e44f4 upstream.
+
+The soft lockup below happens at the boot time of the system using dm
+multipath and the udev rules to switch scheduler.
+
+[ 356.127001] BUG: soft lockup - CPU#3 stuck for 22s! [sh:483]
+[ 356.127001] RIP: 0010:[<ffffffff81072a7d>] [<ffffffff81072a7d>] lock_timer_base.isra.35+0x1d/0x50
+...
+[ 356.127001] Call Trace:
+[ 356.127001] [<ffffffff81073810>] try_to_del_timer_sync+0x20/0x70
+[ 356.127001] [<ffffffff8118b08a>] ? kmem_cache_alloc_node_trace+0x20a/0x230
+[ 356.127001] [<ffffffff810738b2>] del_timer_sync+0x52/0x60
+[ 356.127001] [<ffffffff812ece22>] cfq_exit_queue+0x32/0xf0
+[ 356.127001] [<ffffffff812c98df>] elevator_exit+0x2f/0x50
+[ 356.127001] [<ffffffff812c9f21>] elevator_change+0xf1/0x1c0
+[ 356.127001] [<ffffffff812caa50>] elv_iosched_store+0x20/0x50
+[ 356.127001] [<ffffffff812d1d09>] queue_attr_store+0x59/0xb0
+[ 356.127001] [<ffffffff812143f6>] sysfs_write_file+0xc6/0x140
+[ 356.127001] [<ffffffff811a326d>] vfs_write+0xbd/0x1e0
+[ 356.127001] [<ffffffff811a3ca9>] SyS_write+0x49/0xa0
+[ 356.127001] [<ffffffff8164e899>] system_call_fastpath+0x16/0x1b
+
+This is caused by a race between md device initialization by multipathd and
+shell script to switch the scheduler using sysfs.
+
+ - multipathd:
+ SyS_ioctl -> do_vfs_ioctl -> dm_ctl_ioctl -> ctl_ioctl -> table_load
+ -> dm_setup_md_queue -> blk_init_allocated_queue -> elevator_init
+ q->elevator = elevator_alloc(q, e); // not yet initialized
+
+ - sh -c 'echo deadline > /sys/$DEVPATH/queue/scheduler':
+ elevator_switch (in the call trace above)
+ struct elevator_queue *old = q->elevator;
+ q->elevator = elevator_alloc(q, new_e);
+ elevator_exit(old); // lockup! (*)
+
+ - multipathd: (cont.)
+ err = e->ops.elevator_init_fn(q); // init fails; q->elevator is modified
+
+(*) When del_timer_sync() is called, lock_timer_base() will loop infinitely
+while timer->base == NULL. In this case, as timer will never initialized,
+it results in lockup.
+
+This patch introduces acquisition of q->sysfs_lock around elevator_init()
+into blk_init_allocated_queue(), to provide mutual exclusion between
+initialization of the q->scheduler and switching of the scheduler.
+
+This should fix this bugzilla:
+https://bugzilla.redhat.com/show_bug.cgi?id=902012
+
+Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@hds.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Cc: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-core.c | 10 +++++++++-
+ block/elevator.c | 6 ++++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -741,9 +741,17 @@ blk_init_allocated_queue(struct request_
+
+ q->sg_reserved_size = INT_MAX;
+
++ /* Protect q->elevator from elevator_change */
++ mutex_lock(&q->sysfs_lock);
++
+ /* init elevator */
+- if (elevator_init(q, NULL))
++ if (elevator_init(q, NULL)) {
++ mutex_unlock(&q->sysfs_lock);
+ return NULL;
++ }
++
++ mutex_unlock(&q->sysfs_lock);
++
+ return q;
+ }
+ EXPORT_SYMBOL(blk_init_allocated_queue);
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -186,6 +186,12 @@ int elevator_init(struct request_queue *
+ struct elevator_type *e = NULL;
+ int err;
+
++ /*
++ * q->sysfs_lock must be held to provide mutual exclusion between
++ * elevator_switch() and here.
++ */
++ lockdep_assert_held(&q->sysfs_lock);
++
+ if (unlikely(q->elevator))
+ return 0;
+
--- /dev/null
+From 403cfb53fb450d53751fdc7ee0cd6652419612cf Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.de>
+Date: Wed, 25 Sep 2013 09:42:55 +0200
+Subject: HID: hid-elo: some systems cannot stomach work around
+
+From: Oliver Neukum <oneukum@suse.de>
+
+commit 403cfb53fb450d53751fdc7ee0cd6652419612cf upstream.
+
+Some systems although they have firmware class 'M', which usually
+needs a work around to not crash, must not be subjected to the
+work around because the work around crashes them. They cannot be
+told apart by their own device descriptor, but as they are part
+of compound devices, can be identified by looking at their siblings.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-elo.c | 35 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 34 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-elo.c
++++ b/drivers/hid/hid-elo.c
+@@ -181,7 +181,40 @@ fail:
+ */
+ static bool elo_broken_firmware(struct usb_device *dev)
+ {
+- return use_fw_quirk && le16_to_cpu(dev->descriptor.bcdDevice) == 0x10d;
++ struct usb_device *hub = dev->parent;
++ struct usb_device *child = NULL;
++ u16 fw_lvl = le16_to_cpu(dev->descriptor.bcdDevice);
++ u16 child_vid, child_pid;
++ int i;
++
++ if (!use_fw_quirk)
++ return false;
++ if (fw_lvl != 0x10d)
++ return false;
++
++ /* iterate sibling devices of the touch controller */
++ usb_hub_for_each_child(hub, i, child) {
++ child_vid = le16_to_cpu(child->descriptor.idVendor);
++ child_pid = le16_to_cpu(child->descriptor.idProduct);
++
++ /*
++ * If one of the devices below is present attached as a sibling of
++ * the touch controller then this is a newer IBM 4820 monitor that
++ * does not need the IBM-requested workaround if fw level is
++ * 0x010d - aka 'M'.
++ * No other HW can have this combination.
++ */
++ if (child_vid==0x04b3) {
++ switch (child_pid) {
++ case 0x4676: /* 4820 21x Video */
++ case 0x4677: /* 4820 51x Video */
++ case 0x4678: /* 4820 2Lx Video */
++ case 0x4679: /* 4820 5Lx Video */
++ return false;
++ }
++ }
++ }
++ return true;
+ }
+
+ static int elo_probe(struct hid_device *hdev, const struct hid_device_id *id)
--- /dev/null
+From 348cbaa800f8161168b20f85f72abb541c145132 Mon Sep 17 00:00:00 2001
+From: Simon Wood <simon@mungewell.org>
+Date: Thu, 10 Oct 2013 08:20:13 -0600
+Subject: HID: lg: fix Report Descriptor for Logitech MOMO Force (Black)
+
+From: Simon Wood <simon@mungewell.org>
+
+commit 348cbaa800f8161168b20f85f72abb541c145132 upstream.
+
+By default the Logitech MOMO Force (Black) presents a combined accel/brake
+axis ('Y'). This patch modifies the HID descriptor to present seperate
+accel/brake axes ('Y' and 'Z').
+
+Signed-off-by: Simon Wood <simon@mungewell.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-lg.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 58 insertions(+)
+
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -47,6 +47,7 @@
+ #define DFP_RDESC_ORIG_SIZE 97
+ #define FV_RDESC_ORIG_SIZE 130
+ #define MOMO_RDESC_ORIG_SIZE 87
++#define MOMO2_RDESC_ORIG_SIZE 87
+
+ /* Fixed report descriptors for Logitech Driving Force (and Pro)
+ * wheel controllers
+@@ -284,6 +285,54 @@ static __u8 momo_rdesc_fixed[] = {
+ 0xC0 /* End Collection */
+ };
+
++static __u8 momo2_rdesc_fixed[] = {
++0x05, 0x01, /* Usage Page (Desktop), */
++0x09, 0x04, /* Usage (Joystik), */
++0xA1, 0x01, /* Collection (Application), */
++0xA1, 0x02, /* Collection (Logical), */
++0x95, 0x01, /* Report Count (1), */
++0x75, 0x0A, /* Report Size (10), */
++0x15, 0x00, /* Logical Minimum (0), */
++0x26, 0xFF, 0x03, /* Logical Maximum (1023), */
++0x35, 0x00, /* Physical Minimum (0), */
++0x46, 0xFF, 0x03, /* Physical Maximum (1023), */
++0x09, 0x30, /* Usage (X), */
++0x81, 0x02, /* Input (Variable), */
++0x95, 0x0A, /* Report Count (10), */
++0x75, 0x01, /* Report Size (1), */
++0x25, 0x01, /* Logical Maximum (1), */
++0x45, 0x01, /* Physical Maximum (1), */
++0x05, 0x09, /* Usage Page (Button), */
++0x19, 0x01, /* Usage Minimum (01h), */
++0x29, 0x0A, /* Usage Maximum (0Ah), */
++0x81, 0x02, /* Input (Variable), */
++0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
++0x09, 0x00, /* Usage (00h), */
++0x95, 0x04, /* Report Count (4), */
++0x81, 0x02, /* Input (Variable), */
++0x95, 0x01, /* Report Count (1), */
++0x75, 0x08, /* Report Size (8), */
++0x26, 0xFF, 0x00, /* Logical Maximum (255), */
++0x46, 0xFF, 0x00, /* Physical Maximum (255), */
++0x09, 0x01, /* Usage (01h), */
++0x81, 0x02, /* Input (Variable), */
++0x05, 0x01, /* Usage Page (Desktop), */
++0x09, 0x31, /* Usage (Y), */
++0x81, 0x02, /* Input (Variable), */
++0x09, 0x32, /* Usage (Z), */
++0x81, 0x02, /* Input (Variable), */
++0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
++0x09, 0x00, /* Usage (00h), */
++0x81, 0x02, /* Input (Variable), */
++0xC0, /* End Collection, */
++0xA1, 0x02, /* Collection (Logical), */
++0x09, 0x02, /* Usage (02h), */
++0x95, 0x07, /* Report Count (7), */
++0x91, 0x02, /* Output (Variable), */
++0xC0, /* End Collection, */
++0xC0 /* End Collection */
++};
++
+ /*
+ * Certain Logitech keyboards send in report #3 keys which are far
+ * above the logical maximum described in descriptor. This extends
+@@ -343,6 +392,15 @@ static __u8 *lg_report_fixup(struct hid_
+ }
+ break;
+
++ case USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2:
++ if (*rsize == MOMO2_RDESC_ORIG_SIZE) {
++ hid_info(hdev,
++ "fixing up Logitech Momo Racing Force (Black) report descriptor\n");
++ rdesc = momo2_rdesc_fixed;
++ *rsize = sizeof(momo2_rdesc_fixed);
++ }
++ break;
++
+ case USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL:
+ if (*rsize == FV_RDESC_ORIG_SIZE) {
+ hid_info(hdev,
--- /dev/null
+From 05104a4e8713b27291c7bb49c1e7e68b4e243571 Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Fri, 27 Sep 2013 12:53:35 -0400
+Subject: iommu: Remove stack trace from broken irq remapping warning
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+commit 05104a4e8713b27291c7bb49c1e7e68b4e243571 upstream.
+
+The warning for the irq remapping broken check in intel_irq_remapping.c is
+pretty pointless. We need the warning, but we know where its comming from, the
+stack trace will always be the same, and it needlessly triggers things like
+Abrt. This changes the warning to just print a text warning about BIOS being
+broken, without the stack trace, then sets the appropriate taint bit. Since we
+automatically disable irq remapping, theres no need to contiue making Abrt jump
+at this problem
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+CC: Joerg Roedel <joro@8bytes.org>
+CC: Bjorn Helgaas <bhelgaas@google.com>
+CC: Andy Lutomirski <luto@amacapital.net>
+CC: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+CC: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+Signed-off-by: Joerg Roedel <joro@8bytes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel_irq_remapping.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -525,12 +525,13 @@ static int __init intel_irq_remapping_su
+ if (disable_irq_remap)
+ return 0;
+ if (irq_remap_broken) {
+- WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND,
+- "This system BIOS has enabled interrupt remapping\n"
+- "on a chipset that contains an erratum making that\n"
+- "feature unstable. To maintain system stability\n"
+- "interrupt remapping is being disabled. Please\n"
+- "contact your BIOS vendor for an update\n");
++ printk(KERN_WARNING
++ "This system BIOS has enabled interrupt remapping\n"
++ "on a chipset that contains an erratum making that\n"
++ "feature unstable. To maintain system stability\n"
++ "interrupt remapping is being disabled. Please\n"
++ "contact your BIOS vendor for an update\n");
++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ disable_irq_remap = 1;
+ return 0;
+ }
--- /dev/null
+From f9423606ade08653dd8a43334f0a7fb45504c5cc Mon Sep 17 00:00:00 2001
+From: Julian Stecklina <jsteckli@os.inf.tu-dresden.de>
+Date: Wed, 9 Oct 2013 10:03:52 +0200
+Subject: iommu/vt-d: Fixed interaction of VFIO_IOMMU_MAP_DMA with IOMMU address limits
+
+From: Julian Stecklina <jsteckli@os.inf.tu-dresden.de>
+
+commit f9423606ade08653dd8a43334f0a7fb45504c5cc upstream.
+
+The BUG_ON in drivers/iommu/intel-iommu.c:785 can be triggered from userspace via
+VFIO by calling the VFIO_IOMMU_MAP_DMA ioctl on a vfio device with any address
+beyond the addressing capabilities of the IOMMU. The problem is that the ioctl code
+calls iommu_iova_to_phys before it calls iommu_map. iommu_map handles the case that
+it gets addresses beyond the addressing capabilities of its IOMMU.
+intel_iommu_iova_to_phys does not.
+
+This patch fixes iommu_iova_to_phys to return NULL for addresses beyond what the
+IOMMU can handle. This in turn causes the ioctl call to fail in iommu_map and
+(correctly) return EFAULT to the user with a helpful warning message in the kernel
+log.
+
+Signed-off-by: Julian Stecklina <jsteckli@os.inf.tu-dresden.de>
+Acked-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Joerg Roedel <joro@8bytes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -782,7 +782,11 @@ static struct dma_pte *pfn_to_dma_pte(st
+ int offset;
+
+ BUG_ON(!domain->pgd);
+- BUG_ON(addr_width < BITS_PER_LONG && pfn >> addr_width);
++
++ if (addr_width < BITS_PER_LONG && pfn >> addr_width)
++ /* Address beyond IOMMU's addressing capabilities. */
++ return NULL;
++
+ parent = domain->pgd;
+
+ while (level > 0) {
--- /dev/null
+From a97ad0c4b447a132a322cedc3a5f7fa4cab4b304 Mon Sep 17 00:00:00 2001
+From: Miroslav Lichvar <mlichvar@redhat.com>
+Date: Thu, 1 Aug 2013 19:31:35 +0200
+Subject: ntp: Make periodic RTC update more reliable
+
+From: Miroslav Lichvar <mlichvar@redhat.com>
+
+commit a97ad0c4b447a132a322cedc3a5f7fa4cab4b304 upstream.
+
+The current code requires that the scheduled update of the RTC happens
+in the closest tick to the half of the second. This seems to be
+difficult to achieve reliably. The scheduled work may be missing the
+target time by a tick or two and be constantly rescheduled every second.
+
+Relax the limit to 10 ticks. As a typical RTC drifts in the 11-minute
+update interval by several milliseconds, this shouldn't affect the
+overall accuracy of the RTC much.
+
+Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Cc: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/ntp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -475,6 +475,7 @@ static void sync_cmos_clock(struct work_
+ * called as close as possible to 500 ms before the new second starts.
+ * This code is run on a timer. If the clock is set, that timer
+ * may not expire at the correct time. Thus, we adjust...
++ * We want the clock to be within a couple of ticks from the target.
+ */
+ if (!ntp_synced()) {
+ /*
+@@ -485,7 +486,7 @@ static void sync_cmos_clock(struct work_
+ }
+
+ getnstimeofday(&now);
+- if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec / 2) {
++ if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec * 5) {
+ struct timespec adjust = now;
+
+ fail = -ENODEV;
--- /dev/null
+From 3b9b74baa1af2952d719735b4a4a34706a593948 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 25 Sep 2013 15:34:55 +0200
+Subject: rt2800: add support for radio chip RF3070
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 3b9b74baa1af2952d719735b4a4a34706a593948 upstream.
+
+Add support for new RF chip ID: 3070. It seems to be the same as 5370,
+maybe vendor just put wrong value on the eeprom, but add this id anyway
+since devices with it showed on the marked.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2800.h | 2 ++
+ drivers/net/wireless/rt2x00/rt2800lib.c | 8 +++++++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800.h
++++ b/drivers/net/wireless/rt2x00/rt2800.h
+@@ -52,6 +52,7 @@
+ * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392)
+ * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662)
+ * RF5592 2.4G/5G 2T2R
++ * RF3070 2.4G 1T1R
+ * RF5360 2.4G 1T1R
+ * RF5370 2.4G 1T1R
+ * RF5390 2.4G 1T1R
+@@ -70,6 +71,7 @@
+ #define RF3322 0x000c
+ #define RF3053 0x000d
+ #define RF5592 0x000f
++#define RF3070 0x3070
+ #define RF3290 0x3290
+ #define RF5360 0x5360
+ #define RF5370 0x5370
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -3152,6 +3152,7 @@ static void rt2800_config_channel(struct
+ case RF3322:
+ rt2800_config_channel_rf3322(rt2x00dev, conf, rf, info);
+ break;
++ case RF3070:
+ case RF5360:
+ case RF5370:
+ case RF5372:
+@@ -3166,7 +3167,8 @@ static void rt2800_config_channel(struct
+ rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
+ }
+
+- if (rt2x00_rf(rt2x00dev, RF3290) ||
++ if (rt2x00_rf(rt2x00dev, RF3070) ||
++ rt2x00_rf(rt2x00dev, RF3290) ||
+ rt2x00_rf(rt2x00dev, RF3322) ||
+ rt2x00_rf(rt2x00dev, RF5360) ||
+ rt2x00_rf(rt2x00dev, RF5370) ||
+@@ -4264,6 +4266,7 @@ void rt2800_vco_calibration(struct rt2x0
+ rt2800_rfcsr_write(rt2x00dev, 7, rfcsr);
+ break;
+ case RF3053:
++ case RF3070:
+ case RF3290:
+ case RF5360:
+ case RF5370:
+@@ -7024,6 +7027,7 @@ static int rt2800_init_eeprom(struct rt2
+ case RF3022:
+ case RF3052:
+ case RF3053:
++ case RF3070:
+ case RF3290:
+ case RF3320:
+ case RF3322:
+@@ -7546,6 +7550,7 @@ static int rt2800_probe_hw_mode(struct r
+ rt2x00_rf(rt2x00dev, RF2020) ||
+ rt2x00_rf(rt2x00dev, RF3021) ||
+ rt2x00_rf(rt2x00dev, RF3022) ||
++ rt2x00_rf(rt2x00dev, RF3070) ||
+ rt2x00_rf(rt2x00dev, RF3290) ||
+ rt2x00_rf(rt2x00dev, RF3320) ||
+ rt2x00_rf(rt2x00dev, RF3322) ||
+@@ -7674,6 +7679,7 @@ static int rt2800_probe_hw_mode(struct r
+ case RF3320:
+ case RF3052:
+ case RF3053:
++ case RF3070:
+ case RF3290:
+ case RF5360:
+ case RF5370:
xfs-add-capability-check-to-free-eofblocks-ioctl.patch
mm-numa-return-the-number-of-base-pages-altered-by-protection-changes.patch
md-raid5-use-conf-device_lock-protect-changing-of-multi-thread-resources.patch
+usb-musb-davinci-fix-resources-passed-to-musb-driver-for-dm6467.patch
+usb-wusbcore-change-wa_segs_max-to-a-legal-value.patch
+video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch
+hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch
+hid-hid-elo-some-systems-cannot-stomach-work-around.patch
+iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch
+iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch
+rt2800-add-support-for-radio-chip-rf3070.patch
+elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch
+elevator-acquire-q-sysfs_lock-in-elevator_change.patch
+ntp-make-periodic-rtc-update-more-reliable.patch
--- /dev/null
+From ea78201e2e08f8a91e30100c4c4a908b5cf295fc Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Sun, 22 Sep 2013 01:43:58 +0400
+Subject: usb: musb: davinci: fix resources passed to MUSB driver for DM6467
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+commit ea78201e2e08f8a91e30100c4c4a908b5cf295fc upstream.
+
+After commit 09fc7d22b024692b2fe8a943b246de1af307132b (usb: musb: fix incorrect
+usage of resource pointer), CPPI DMA driver on DaVinci DM6467 can't detect its
+dedicated IRQ and so the MUSB IRQ is erroneously used instead. This is because
+only 2 resources are passed to the MUSB driver from the DaVinci glue layer, so
+fix this by always copying 3 resources (it's safe since a placeholder for the
+3rd resource is always there) and passing 'pdev->num_resources' instead of the
+size of musb_resources[] to platform_device_add_resources().
+
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/usb/musb/davinci.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/musb/davinci.c
++++ b/drivers/usb/musb/davinci.c
+@@ -509,7 +509,7 @@ static u64 davinci_dmamask = DMA_BIT_MAS
+
+ static int davinci_probe(struct platform_device *pdev)
+ {
+- struct resource musb_resources[2];
++ struct resource musb_resources[3];
+ struct musb_hdrc_platform_data *pdata = dev_get_platdata(&pdev->dev);
+ struct platform_device *musb;
+ struct davinci_glue *glue;
+@@ -567,6 +567,15 @@ static int davinci_probe(struct platform
+ musb_resources[1].end = pdev->resource[1].end;
+ musb_resources[1].flags = pdev->resource[1].flags;
+
++ /*
++ * For DM6467 3 resources are passed. A placeholder for the 3rd
++ * resource is always there, so it's safe to always copy it...
++ */
++ musb_resources[2].name = pdev->resource[2].name;
++ musb_resources[2].start = pdev->resource[2].start;
++ musb_resources[2].end = pdev->resource[2].end;
++ musb_resources[2].flags = pdev->resource[2].flags;
++
+ ret = platform_device_add_resources(musb, musb_resources,
+ ARRAY_SIZE(musb_resources));
+ if (ret) {
--- /dev/null
+From f74b75e7f920c700636cccca669c7d16d12e9202 Mon Sep 17 00:00:00 2001
+From: Thomas Pugliese <thomas.pugliese@gmail.com>
+Date: Wed, 23 Oct 2013 14:44:29 -0500
+Subject: usb: wusbcore: change WA_SEGS_MAX to a legal value
+
+From: Thomas Pugliese <thomas.pugliese@gmail.com>
+
+commit f74b75e7f920c700636cccca669c7d16d12e9202 upstream.
+
+change WA_SEGS_MAX to a number that is legal according to the WUSB
+spec.
+
+Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/usb/wusbcore/wa-xfer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/wusbcore/wa-xfer.c
++++ b/drivers/usb/wusbcore/wa-xfer.c
+@@ -91,7 +91,8 @@
+ #include "wusbhc.h"
+
+ enum {
+- WA_SEGS_MAX = 255,
++ /* [WUSB] section 8.3.3 allocates 7 bits for the segment index. */
++ WA_SEGS_MAX = 128,
+ };
+
+ enum wa_seg_status {
+@@ -446,7 +447,7 @@ static ssize_t __wa_xfer_setup_sizes(str
+ }
+ xfer->seg_size = (xfer->seg_size / maxpktsize) * maxpktsize;
+ xfer->segs = DIV_ROUND_UP(urb->transfer_buffer_length, xfer->seg_size);
+- if (xfer->segs >= WA_SEGS_MAX) {
++ if (xfer->segs > WA_SEGS_MAX) {
+ dev_err(dev, "BUG? ops, number of segments %d bigger than %d\n",
+ (int)(urb->transfer_buffer_length / xfer->seg_size),
+ WA_SEGS_MAX);
--- /dev/null
+From 2ab68ec927310dc488f3403bb48f9e4ad00a9491 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Tue, 19 Nov 2013 14:25:36 -0500
+Subject: video: kyro: fix incorrect sizes when copying to userspace
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit 2ab68ec927310dc488f3403bb48f9e4ad00a9491 upstream.
+
+kyro would copy u32s and specify sizeof(unsigned long) as the size to copy.
+
+This would copy more data than intended and cause memory corruption and might
+leak kernel memory.
+
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/kyro/fbdev.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/kyro/fbdev.c
++++ b/drivers/video/kyro/fbdev.c
+@@ -625,15 +625,15 @@ static int kyrofb_ioctl(struct fb_info *
+ }
+ break;
+ case KYRO_IOCTL_UVSTRIDE:
+- if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long)))
++ if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(deviceInfo.ulOverlayUVStride)))
+ return -EFAULT;
+ break;
+ case KYRO_IOCTL_STRIDE:
+- if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long)))
++ if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(deviceInfo.ulOverlayStride)))
+ return -EFAULT;
+ break;
+ case KYRO_IOCTL_OVERLAY_OFFSET:
+- if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long)))
++ if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(deviceInfo.ulOverlayOffset)))
+ return -EFAULT;
+ break;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
