--- /dev/null
+From e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 Mon Sep 17 00:00:00 2001
+From: Matthew Leach <matthew.leach@arm.com>
+Date: Tue, 11 Sep 2012 17:56:57 +0100
+Subject: ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores
+
+From: Matthew Leach <matthew.leach@arm.com>
+
+commit e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 upstream.
+
+This patch zeroes the SCTLR.TRE bit prior to setting the mapping as
+cacheable for ARMv7 cores in the decompressor, ensuring that the
+memory region attributes are obtained from the C and B bits, not from
+the page tables.
+
+Cc: Nicolas Pitre <nico@fluxnic.net>
+Reviewed-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Matthew Leach <matthew.leach@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/compressed/head.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -653,6 +653,7 @@ __armv7_mmu_cache_on:
+ mcrne p15, 0, r0, c8, c7, 0 @ flush I,D TLBs
+ #endif
+ mrc p15, 0, r0, c1, c0, 0 @ read control reg
++ bic r0, r0, #1 << 28 @ clear SCTLR.TRE
+ orr r0, r0, #0x5000 @ I-cache enable, RR cache replacement
+ orr r0, r0, #0x003c @ write buffer
+ #ifdef CONFIG_MMU
--- /dev/null
+From 35495173e1df621dff0e9a244accbe32cd28a98f Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@freescale.com>
+Date: Sun, 16 Sep 2012 22:28:35 -0300
+Subject: ARM: imx: armadillo5x0: Fix illegal register access
+
+From: Fabio Estevam <fabio.estevam@freescale.com>
+
+commit 35495173e1df621dff0e9a244accbe32cd28a98f upstream.
+
+Since commit eb92044eb (ARM i.MX3: Make ccm base address a variable )
+it is necessary to pass the CCM register base as a variable.
+
+Fix the CCM register access in mach-armadillo5x0 by passing mx3_ccm_base and
+avoid illegal accesses.
+
+Also applies to v3.5
+
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/mach-armadillo5x0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mach-imx/mach-armadillo5x0.c
++++ b/arch/arm/mach-imx/mach-armadillo5x0.c
+@@ -526,7 +526,8 @@ static void __init armadillo5x0_init(voi
+ imx31_add_mxc_nand(&armadillo5x0_nand_board_info);
+
+ /* set NAND page size to 2k if not configured via boot mode pins */
+- __raw_writel(__raw_readl(MXC_CCM_RCSR) | (1 << 30), MXC_CCM_RCSR);
++ __raw_writel(__raw_readl(mx3_ccm_base + MXC_CCM_RCSR) |
++ (1 << 30), mx3_ccm_base + MXC_CCM_RCSR);
+
+ /* RTC */
+ /* Get RTC IRQ and register the chip */
--- /dev/null
+From 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a Mon Sep 17 00:00:00 2001
+From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
+Date: Fri, 14 Sep 2012 16:34:46 -0300
+Subject: Bluetooth: Fix not removing power_off delayed work
+
+From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
+
+commit 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a upstream.
+
+For example, when a usb reset is received (I could reproduce it
+running something very similar to this[1] in a loop) it could be
+that the device is unregistered while the power_off delayed work
+is still scheduled to run.
+
+Backtrace:
+
+WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
+Hardware name: To Be Filled By O.E.M.
+ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26
+Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper
+Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2
+Call Trace:
+ [<ffffffff8124cc00>] ? free_obj_work+0x57/0x91
+ [<ffffffff81058f88>] warn_slowpath_common+0x7e/0x97
+ [<ffffffff81059035>] warn_slowpath_fmt+0x41/0x43
+ [<ffffffff8124ccb6>] debug_print_object+0x7c/0x8d
+ [<ffffffff8106e3ec>] ? __queue_work+0x259/0x259
+ [<ffffffff8124d63e>] ? debug_check_no_obj_freed+0x6f/0x1b5
+ [<ffffffff8124d667>] debug_check_no_obj_freed+0x98/0x1b5
+ [<ffffffffa00aa031>] ? bt_host_release+0x10/0x1e [bluetooth]
+ [<ffffffff810fc035>] kfree+0x90/0xe6
+ [<ffffffffa00aa031>] bt_host_release+0x10/0x1e [bluetooth]
+ [<ffffffff812ec2f9>] device_release+0x4a/0x7e
+ [<ffffffff8123ef57>] kobject_release+0x11d/0x154
+ [<ffffffff8123ed98>] kobject_put+0x4a/0x4f
+ [<ffffffff812ec0d9>] put_device+0x12/0x14
+ [<ffffffffa009472b>] hci_free_dev+0x22/0x26 [bluetooth]
+ [<ffffffffa0280dd0>] btusb_disconnect+0x96/0x9f [btusb]
+ [<ffffffff813581b4>] usb_unbind_interface+0x57/0x106
+ [<ffffffff812ef988>] __device_release_driver+0x83/0xd6
+ [<ffffffff812ef9fb>] device_release_driver+0x20/0x2d
+ [<ffffffff813582a7>] usb_driver_release_interface+0x44/0x7b
+ [<ffffffff81358795>] usb_forced_unbind_intf+0x45/0x4e
+ [<ffffffff8134f959>] usb_reset_device+0xa6/0x12e
+ [<ffffffff8135df86>] usbdev_do_ioctl+0x319/0xe20
+ [<ffffffff81203244>] ? avc_has_perm_flags+0xc9/0x12e
+ [<ffffffff812031a0>] ? avc_has_perm_flags+0x25/0x12e
+ [<ffffffff81050101>] ? do_page_fault+0x31e/0x3a1
+ [<ffffffff8135eaa6>] usbdev_ioctl+0x9/0xd
+ [<ffffffff811126b1>] vfs_ioctl+0x21/0x34
+ [<ffffffff81112f7b>] do_vfs_ioctl+0x408/0x44b
+ [<ffffffff81208d45>] ? file_has_perm+0x76/0x81
+ [<ffffffff8111300f>] sys_ioctl+0x51/0x76
+ [<ffffffff8158db22>] system_call_fastpath+0x16/0x1b
+
+[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c
+
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -753,6 +753,8 @@ static int hci_dev_do_close(struct hci_d
+
+ cancel_work_sync(&hdev->le_scan);
+
++ cancel_delayed_work(&hdev->power_off);
++
+ hci_req_cancel(hdev, ENODEV);
+ hci_req_lock(hdev);
+
--- /dev/null
+From 562fcc246ebe31ade6e1be08585673b9b2785498 Mon Sep 17 00:00:00 2001
+From: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
+Date: Wed, 29 Aug 2012 10:02:09 +0200
+Subject: Bluetooth: mgmt: Fix enabling LE while powered off
+
+From: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
+
+commit 562fcc246ebe31ade6e1be08585673b9b2785498 upstream.
+
+When new BT USB adapter is plugged in it's configured while still being powered
+off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't
+write changes to controller. As a result it's not possible to start device
+discovery session on LE controller as it uses interleaved discovery which
+requires LE Supported Host flag in extended features.
+
+This patch ensures HCI Write LE Host Supported is sent when Set Powered is
+called to power on controller and clear HCI_AUTO_OFF flag.
+
+Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
+Acked-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/mgmt.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -2885,6 +2885,16 @@ int mgmt_powered(struct hci_dev *hdev, u
+ hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
+ }
+
++ if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
++ struct hci_cp_write_le_host_supported cp;
++
++ cp.le = 1;
++ cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
++
++ hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
++ sizeof(cp), &cp);
++ }
++
+ update_class(hdev);
+ update_name(hdev, hdev->dev_name);
+ update_eir(hdev);
--- /dev/null
+From 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 Mon Sep 17 00:00:00 2001
+From: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
+Date: Wed, 29 Aug 2012 10:02:08 +0200
+Subject: Bluetooth: mgmt: Fix enabling SSP while powered off
+
+From: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
+
+commit 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 upstream.
+
+When new BT USB adapter is plugged in it's configured while still being powered
+off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't
+write changes to controller. As a result remote devices won't use Secure Simple
+Pairing with our device due to SSP Host Support flag disabled in extended
+features and may also reject SSP attempt from our side (with possible fallback
+to legacy pairing).
+
+This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is
+called to power on controller and clear HCI_AUTO_OFF flag.
+
+Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
+Acked-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/mgmt.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -2879,6 +2879,12 @@ int mgmt_powered(struct hci_dev *hdev, u
+ if (scan)
+ hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+
++ if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
++ u8 ssp = 1;
++
++ hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
++ }
++
+ update_class(hdev);
+ update_name(hdev, hdev->dev_name);
+ update_eir(hdev);
--- /dev/null
+From be8cfc4af15cf611dfeb66a1fb5df43d5f1e280a Mon Sep 17 00:00:00 2001
+From: Mark Salter <msalter@redhat.com>
+Date: Mon, 24 Sep 2012 17:17:38 -0700
+Subject: c/r: prctl: fix build error for no-MMU case
+
+From: Mark Salter <msalter@redhat.com>
+
+commit be8cfc4af15cf611dfeb66a1fb5df43d5f1e280a upstream.
+
+Commit 1ad75b9e1628 ("c/r: prctl: add minimal address test to
+PR_SET_MM") added some address checking to prctl_set_mm() used by
+checkpoint-restore. This causes a build error for no-MMU systems:
+
+ kernel/sys.c: In function 'prctl_set_mm':
+ kernel/sys.c:1868:34: error: 'mmap_min_addr' undeclared (first use in this function)
+
+The test for mmap_min_addr doesn't make a lot of sense for no-MMU code
+as noted in commit 6e1415467614 ("NOMMU: Optimise away the
+{dac_,}mmap_min_addr tests").
+
+This patch defines mmap_min_addr as 0UL in the no-MMU case so that the
+compiler will optimize away tests for "addr < mmap_min_addr".
+
+Signed-off-by: Mark Salter <msalter@redhat.com>
+Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/security.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -118,6 +118,7 @@ void reset_security_ops(void);
+ extern unsigned long mmap_min_addr;
+ extern unsigned long dac_mmap_min_addr;
+ #else
++#define mmap_min_addr 0UL
+ #define dac_mmap_min_addr 0UL
+ #endif
+
--- /dev/null
+From 308b135e4fcc00c80c07e0e04e7afa8edf78583c Mon Sep 17 00:00:00 2001
+From: Toshi Kani <toshi.kani@hp.com>
+Date: Mon, 27 Aug 2012 12:52:24 -0600
+Subject: hpwdt: Fix kdump issue in hpwdt
+
+From: Toshi Kani <toshi.kani@hp.com>
+
+commit 308b135e4fcc00c80c07e0e04e7afa8edf78583c upstream.
+
+kdump can be interrupted by watchdog timer when the timer is left
+activated on the crash kernel. Changed the hpwdt driver to disable
+watchdog timer at boot-time. This assures that watchdog timer is
+disabled until /dev/watchdog is opened, and prevents watchdog timer
+to be left running on the crash kernel.
+
+Signed-off-by: Toshi Kani <toshi.kani@hp.com>
+Tested-by: Lisa Mitchell <lisa.mitchell@hp.com>
+Signed-off-by: Thomas Mingarelli <Thomas.Mingarelli@hp.com>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/watchdog/hpwdt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/watchdog/hpwdt.c
++++ b/drivers/watchdog/hpwdt.c
+@@ -814,6 +814,9 @@ static int __devinit hpwdt_init_one(stru
+ hpwdt_timer_reg = pci_mem_addr + 0x70;
+ hpwdt_timer_con = pci_mem_addr + 0x72;
+
++ /* Make sure that timer is disabled until /dev/watchdog is opened */
++ hpwdt_stop();
++
+ /* Make sure that we have a valid soft_margin */
+ if (hpwdt_change_timer(soft_margin))
+ hpwdt_change_timer(DEFAULT_MARGIN);
--- /dev/null
+From 8669cf6793bb38307a30fb6b9565ddc8840ebd3f Mon Sep 17 00:00:00 2001
+From: Anisse Astier <anisse@astier.eu>
+Date: Wed, 19 Sep 2012 11:10:48 -0700
+Subject: Input: i8042 - disable mux on Toshiba C850D
+
+From: Anisse Astier <anisse@astier.eu>
+
+commit 8669cf6793bb38307a30fb6b9565ddc8840ebd3f upstream.
+
+On Toshiba Satellite C850D, the touchpad and the keyboard might randomly
+not work at boot. Preventing MUX mode activation solves this issue.
+
+Signed-off-by: Anisse Astier <anisse@astier.eu>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/serio/i8042-x86ia64io.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -335,6 +335,12 @@ static const struct dmi_system_id __init
+ },
+ {
+ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
++ },
++ },
++ {
++ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
+ },
--- /dev/null
+From af89fa3986b9d034a286544ab1ed95096496a2f9 Mon Sep 17 00:00:00 2001
+From: Jovi Zhang <bookjovi@gmail.com>
+Date: Wed, 22 Aug 2012 10:34:08 +0800
+Subject: MIPS: mm: Add compound tail page _mapcount when mapped
+
+From: Jovi Zhang <bookjovi@gmail.com>
+
+commit af89fa3986b9d034a286544ab1ed95096496a2f9 upstream.
+
+See commit b6999b191 which did the same modification for x86's mm/gup,
+
+Quote from commit b6999b191:
+ "If compound pages are used and the page is a
+ tail page, gup_huge_pmd() increases _mapcount to record tail page are
+ mapped while gup_huge_pud does not do that."
+
+[ralf@linux-mips.org: fixed rejects caused by the original patch getting
+linewrapped.]
+
+Signed-off-by: Jovi Zhang <boojovi@gmail.com>
+Cc: Youquan Song <youquan.song@intel.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Patchwork: https://patchwork.linux-mips.org/patch/4291/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/mm/gup.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/mm/gup.c
++++ b/arch/mips/mm/gup.c
+@@ -152,6 +152,8 @@ static int gup_huge_pud(pud_t pud, unsig
+ do {
+ VM_BUG_ON(compound_head(page) != head);
+ pages[*nr] = page;
++ if (PageTail(page))
++ get_huge_page_tail(page);
+ (*nr)++;
+ page++;
+ refs++;
--- /dev/null
+From bad9ac2d7f878a31cf1ae8c1ee3768077d222bcb Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter@amd.com>
+Date: Wed, 25 Jul 2012 19:12:45 +0200
+Subject: perf/x86/ibs: Check syscall attribute flags
+
+From: Robert Richter <robert.richter@amd.com>
+
+commit bad9ac2d7f878a31cf1ae8c1ee3768077d222bcb upstream.
+
+Current implementation simply ignores attribute flags. Thus, there is
+no notification to userland of unsupported features. Check syscall's
+attribute flags to let userland know if a feature is supported by the
+kernel. This is also needed to distinguish between future kernels what
+might support a feature.
+
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/r/20120910093018.GO8285@erda.amd.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_amd_ibs.c | 12 ++++++++++++
+ include/linux/perf_event.h | 2 ++
+ 2 files changed, 14 insertions(+)
+
+--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
++++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+@@ -207,6 +207,15 @@ static int perf_ibs_precise_event(struct
+ return -EOPNOTSUPP;
+ }
+
++static const struct perf_event_attr ibs_notsupp = {
++ .exclude_user = 1,
++ .exclude_kernel = 1,
++ .exclude_hv = 1,
++ .exclude_idle = 1,
++ .exclude_host = 1,
++ .exclude_guest = 1,
++};
++
+ static int perf_ibs_init(struct perf_event *event)
+ {
+ struct hw_perf_event *hwc = &event->hw;
+@@ -227,6 +236,9 @@ static int perf_ibs_init(struct perf_eve
+ if (event->pmu != &perf_ibs->pmu)
+ return -ENOENT;
+
++ if (perf_flags(&event->attr) & perf_flags(&ibs_notsupp))
++ return -EINVAL;
++
+ if (config & ~perf_ibs->config_mask)
+ return -EINVAL;
+
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -274,6 +274,8 @@ struct perf_event_attr {
+ __u64 branch_sample_type; /* enum branch_sample_type */
+ };
+
++#define perf_flags(attr) (*(&(attr)->read_format + 1))
++
+ /*
+ * Ioctls that can be done on a perf event fd:
+ */
--- /dev/null
+From 022e1d0680c7b4366017393417b8758be5abcee8 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 11 Sep 2012 11:11:13 -0500
+Subject: rtlwifi: rtl8192ce: Log message that B_CUT device may not work
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 022e1d0680c7b4366017393417b8758be5abcee8 upstream.
+
+There are a number of problems that occur for the latest version
+of the Realtek RTL8188CE device with the in-kernel driver. These
+include selection of the wrong firmware, and system lockup. A full
+fix is known, but is too invasive for inclusion in stable. This patch
+fixes the problem with loading the wrong firmware, and logs a message
+that the device may not work for kernels 3.6 and older.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Anisse Astier <anisse@astier.eu>
+Cc: Li Chaoming <chaoming_li@realsil.com.cn>
+Tested-by: Anisse Astier <anisse@astier.eu>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ce/def.h | 1 +
+ drivers/net/wireless/rtlwifi/rtl8192ce/hw.c | 12 ++++++++++--
+ drivers/net/wireless/rtlwifi/rtl8192ce/sw.c | 6 ++++--
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+@@ -117,6 +117,7 @@
+
+ #define CHIP_VER_B BIT(4)
+ #define CHIP_92C_BITMASK BIT(0)
++#define CHIP_UNKNOWN BIT(7)
+ #define CHIP_92C_1T2R 0x03
+ #define CHIP_92C 0x01
+ #define CHIP_88C 0x00
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+@@ -995,8 +995,16 @@ static enum version_8192c _rtl92ce_read_
+ version = (value32 & TYPE_ID) ? VERSION_A_CHIP_92C :
+ VERSION_A_CHIP_88C;
+ } else {
+- version = (value32 & TYPE_ID) ? VERSION_B_CHIP_92C :
+- VERSION_B_CHIP_88C;
++ version = (enum version_8192c) (CHIP_VER_B |
++ ((value32 & TYPE_ID) ? CHIP_92C_BITMASK : 0) |
++ ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0));
++ if ((!IS_CHIP_VENDOR_UMC(version)) && (value32 &
++ CHIP_VER_RTL_MASK)) {
++ version = (enum version_8192c)(version |
++ ((((value32 & CHIP_VER_RTL_MASK) == BIT(12))
++ ? CHIP_VENDOR_UMC_B_CUT : CHIP_UNKNOWN) |
++ CHIP_VENDOR_UMC));
++ }
+ }
+
+ switch (version) {
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211
+
+ /* request fw */
+ if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
+- !IS_92C_SERIAL(rtlhal->version))
++ !IS_92C_SERIAL(rtlhal->version)) {
+ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin";
+- else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version))
++ } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) {
+ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin";
++ pr_info("****** This B_CUT device may not work with kernels 3.6 and earlier\n");
++ }
+
+ rtlpriv->max_fw_size = 0x4000;
+ pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
--- /dev/null
+From d6532207116307eb7ecbfa7b9e02c53230096a50 Mon Sep 17 00:00:00 2001
+From: Eddie Wai <eddie.wai@broadcom.com>
+Date: Tue, 21 Aug 2012 10:35:53 -0700
+Subject: SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload
+
+From: Eddie Wai <eddie.wai@broadcom.com>
+
+commit d6532207116307eb7ecbfa7b9e02c53230096a50 upstream.
+
+This patch fixes the following kernel panic invoked by uninitialized fields
+in the chip initialization for the 1G bnx2 iSCSI offload.
+
+One of the bits in the chip initialization is being used by the latest
+firmware to control overflow packets. When this control bit gets enabled
+erroneously, it would ultimately result in a bad packet placement which would
+cause the bnx2 driver to dereference a NULL ptr in the placement handler.
+
+This can happen under certain stress I/O environment under the Linux
+iSCSI offload operation.
+
+This change only affects Broadcom's 5709 chipset.
+
+Unable to handle kernel NULL pointer dereference at 0000000000000008 RIP:
+ [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5
+Pid: 0, comm: swapper Tainted: G ---- 2.6.18-333.el5debug #2
+RIP: 0010:[<ffffffff881f0e7d>] [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5
+RSP: 0018:ffff8101b575bd50 EFLAGS: 00010216
+RAX: 0000000000000005 RBX: ffff81007c5fb180 RCX: 0000000000000000
+RDX: 0000000000000ffc RSI: 00000000817e8000 RDI: 0000000000000220
+RBP: ffff81015bbd7ec0 R08: ffff8100817e9000 R09: 0000000000000000
+R10: ffff81007c5fb180 R11: 00000000000000c8 R12: 000000007a25a010
+R13: 0000000000000000 R14: 0000000000000005 R15: ffff810159f80558
+FS: 0000000000000000(0000) GS:ffff8101afebc240(0000) knlGS:0000000000000000
+CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
+CR2: 0000000000000008 CR3: 0000000000201000 CR4: 00000000000006a0
+Process swapper (pid: 0, threadinfo ffff8101b5754000, task ffff8101afebd820)
+Stack: 000000000000000b ffff810159f80000 0000000000000040 ffff810159f80520
+ ffff810159f80500 00cf00cf8008e84b ffffc200100939e0 ffff810009035b20
+ 0000502900000000 000000be00000001 ffff8100817e7810 00d08101b575bea8
+Call Trace:
+ <IRQ> [<ffffffff8008e0d0>] show_schedstat+0x1c2/0x25b
+ [<ffffffff881f1886>] :bnx2:bnx2_poll+0xf6/0x231
+ [<ffffffff8000c9b9>] net_rx_action+0xac/0x1b1
+ [<ffffffff800125a0>] __do_softirq+0x89/0x133
+ [<ffffffff8005e30c>] call_softirq+0x1c/0x28
+ [<ffffffff8006d5de>] do_softirq+0x2c/0x7d
+ [<ffffffff8006d46e>] do_IRQ+0xee/0xf7
+ [<ffffffff8005d625>] ret_from_intr+0x0/0xa
+ <EOI> [<ffffffff801a5780>] acpi_processor_idle_simple+0x1c5/0x341
+ [<ffffffff801a573d>] acpi_processor_idle_simple+0x182/0x341
+ [<ffffffff801a55bb>] acpi_processor_idle_simple+0x0/0x341
+ [<ffffffff80049560>] cpu_idle+0x95/0xb8
+ [<ffffffff80078b1c>] start_secondary+0x479/0x488
+
+Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/bnx2i/bnx2i_hwi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
+@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct
+ int rc = 0;
+ u64 mask64;
+
++ memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
++ memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
++
+ bnx2i_adjust_qp_size(hba);
+
+ iscsi_init.flags =
--- /dev/null
+From 256d0eaac87da1e993190846064f339f4c7a63f5 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Fri, 14 Sep 2012 16:34:25 -0500
+Subject: SCSI: hpsa: fix handling of protocol error
+
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+
+commit 256d0eaac87da1e993190846064f339f4c7a63f5 upstream.
+
+If a command status of CMD_PROTOCOL_ERR is received, this
+information should be conveyed to the SCSI mid layer, not
+dropped on the floor. CMD_PROTOCOL_ERR may be received
+from the Smart Array for any commands destined for an external
+RAID controller such as a P2000, or commands destined for tape
+drives or CD/DVD-ROM drives, if for instance a cable is
+disconnected. This mostly affects multipath configurations, as
+disconnecting a cable on a non-multipath configuration is not
+going to do anything good regardless of whether CMD_PROTOCOL_ERR
+is handled correctly or not. Not handling CMD_PROTOCOL_ERR
+correctly in a multipath configaration involving external RAID
+controllers may cause data corruption, so this is quite a serious
+bug. This bug should not normally cause a problem for direct
+attached disk storage.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/hpsa.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -1315,8 +1315,9 @@ static void complete_scsi_command(struct
+ }
+ break;
+ case CMD_PROTOCOL_ERR:
++ cmd->result = DID_ERROR << 16;
+ dev_warn(&h->pdev->dev, "cp %p has "
+- "protocol error \n", cp);
++ "protocol error\n", cp);
+ break;
+ case CMD_HARDWARE_ERR:
+ cmd->result = DID_ERROR << 16;
--- /dev/null
+From 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 Mon Sep 17 00:00:00 2001
+From: James Bottomley <jbottomley@parallels.com>
+Date: Thu, 21 Jun 2012 07:50:02 +0000
+Subject: SCSI: lpfc: fix problems with -Werror
+
+From: James Bottomley <jbottomley@parallels.com>
+
+commit 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 upstream.
+
+Commit d38bd3aef ("Add -Werror compilation flag") is causing build breakage
+with random gcc incarnations. These look like gcc problems, but we shouldn't
+break the build because of a bad gcc. Fix this by adding a make flag
+
+WARNINGS_BECOME_ERRORS=1
+
+which is the same as aic7xxx uses so ordinarily the build doesn't use -Werror
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Cc: Alex Iannicelli <alex.iannicelli@emulex.com>
+Cc: James Smart <james.smart@emulex.com>
+Cc: Jonathan Nieder <jrnieder@gmail.com>
+Cc: Mike Pagano <mpagano@gentoo.org>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+
+---
+ drivers/scsi/lpfc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/lpfc/Makefile
++++ b/drivers/scsi/lpfc/Makefile
+@@ -22,7 +22,9 @@
+ ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage
+ ccflags-$(GCOV) += -O0
+
++ifdef WARNINGS_BECOME_ERRORS
+ ccflags-y += -Werror
++endif
+
+ obj-$(CONFIG_SCSI_LPFC) := lpfc.o
+
--- /dev/null
+From 10cce6d8b5af0b32bc4254ae4a28423a74c0921c Mon Sep 17 00:00:00 2001
+From: "sreekanth.reddy@lsi.com" <sreekanth.reddy@lsi.com>
+Date: Wed, 22 Aug 2012 16:55:13 +0530
+Subject: SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA
+
+From: "sreekanth.reddy@lsi.com" <sreekanth.reddy@lsi.com>
+
+commit 10cce6d8b5af0b32bc4254ae4a28423a74c0921c upstream.
+
+This patch checks whether HBA is SAS2008 B0 controller.
+if it is a SAS2008 B0 controller then it use IO-APIC interrupt instead of MSIX,
+as SAS2008 B0 controller doesn't support MSIX interrupts.
+
+[jejb: fix whitespace problems]
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -1209,6 +1209,13 @@ _base_check_enable_msix(struct MPT2SAS_A
+ u16 message_control;
+
+
++ /* Check whether controller SAS2008 B0 controller,
++ if it is SAS2008 B0 controller use IO-APIC instead of MSIX */
++ if (ioc->pdev->device == MPI2_MFGPAGE_DEVID_SAS2008 &&
++ ioc->pdev->revision == 0x01) {
++ return -EINVAL;
++ }
++
+ base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX);
+ if (!base) {
+ dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "
--- /dev/null
+From 27e99ade81368e6fdda3212bff9345177cf9e57a Mon Sep 17 00:00:00 2001
+From: Wang Sen <senwang@linux.vnet.ibm.com>
+Date: Mon, 30 Jul 2012 14:25:06 +0800
+Subject: SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list
+
+From: Wang Sen <senwang@linux.vnet.ibm.com>
+
+commit 27e99ade81368e6fdda3212bff9345177cf9e57a upstream.
+
+When using the commands below to write some data to a virtio-scsi LUN of the
+QEMU guest(32-bit) with 1G physical memory(qemu -m 1024), the qemu will crash.
+
+ # sudo mkfs.ext4 /dev/sdb (/dev/sdb is the virtio-scsi LUN.)
+ # sudo mount /dev/sdb /mnt
+ # dd if=/dev/zero of=/mnt/file bs=1M count=1024
+
+In current implementation, sg_set_buf is called to add buffers to sg list which
+is put into the virtqueue eventually. But if there are some HighMem pages in
+table->sgl you can not get virtual address by sg_virt. So, sg_virt(sg_elem) may
+return NULL value. This will cause QEMU exit when virtqueue_map_sg is called
+in QEMU because an invalid GPA is passed by virtqueue.
+
+Two solutions are discussed here:
+http://lkml.indiana.edu/hypermail/linux/kernel/1207.3/00675.html
+
+Finally, value assignment approach was adopted because:
+
+Value assignment creates a well-formed scatterlist, because the termination
+marker in source sg_list has been set in blk_rq_map_sg(). The last entry of the
+source sg_list is just copied to the the last entry in destination list. Note
+that, for now, virtio_ring does not care about the form of the scatterlist and
+simply processes the first out_num + in_num consecutive elements of the sg[]
+array.
+
+I have tested the patch on my workstation. QEMU would not crash any more.
+
+Signed-off-by: Wang Sen <senwang@linux.vnet.ibm.com>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/virtio_scsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -198,7 +198,7 @@ static void virtscsi_map_sgl(struct scat
+ int i;
+
+ for_each_sg(table->sgl, sg_elem, table->nents, i)
+- sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length);
++ sg[idx++] = *sg_elem;
+
+ *p_idx = idx;
+ }
mac80211-clear-bssid-on-auth-assoc-failure.patch
brcmfmac-fix-big-endian-bug-in-i-scan.patch
brcmfmac-fix-big-endian-host-configuration-data.patch
+scsi-lpfc-fix-problems-with-werror.patch
+scsi-mpt2sas-fix-for-issue-unable-to-boot-from-the-drive-connected-to-hba.patch
+scsi-bnx2i-fixed-null-ptr-deference-for-1g-bnx2-linux-iscsi-offload.patch
+scsi-hpsa-fix-handling-of-protocol-error.patch
+scsi-scsi-virtio-scsi-fix-address-translation-failure-of-highmem-pages-used-by-sg-list.patch
+bluetooth-mgmt-fix-enabling-ssp-while-powered-off.patch
+bluetooth-fix-not-removing-power_off-delayed-work.patch
+bluetooth-mgmt-fix-enabling-le-while-powered-off.patch
+c-r-prctl-fix-build-error-for-no-mmu-case.patch
+hpwdt-fix-kdump-issue-in-hpwdt.patch
+arm-imx-armadillo5x0-fix-illegal-register-access.patch
+arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch
+tracing-don-t-call-page_to_pfn-if-page-is-null.patch
+input-i8042-disable-mux-on-toshiba-c850d.patch
+mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch
+perf-x86-ibs-check-syscall-attribute-flags.patch
+rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch
--- /dev/null
+From 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa Mon Sep 17 00:00:00 2001
+From: Wen Congyang <wency@cn.fujitsu.com>
+Date: Thu, 20 Sep 2012 14:04:47 +0800
+Subject: tracing: Don't call page_to_pfn() if page is NULL
+
+From: Wen Congyang <wency@cn.fujitsu.com>
+
+commit 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa upstream.
+
+When allocating memory fails, page is NULL. page_to_pfn() will
+cause the kernel panicked if we don't use sparsemem vmemmap.
+
+Link: http://lkml.kernel.org/r/505AB1FF.8020104@cn.fujitsu.com
+
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Mel Gorman <mel@csn.ul.ie>
+Reviewed-by: Minchan Kim <minchan@kernel.org>
+Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/trace/events/kmem.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/trace/events/kmem.h
++++ b/include/trace/events/kmem.h
+@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc,
+
+ TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s",
+ __entry->page,
+- page_to_pfn(__entry->page),
++ __entry->page ? page_to_pfn(__entry->page) : 0,
+ __entry->order,
+ __entry->migratetype,
+ show_gfp_flags(__entry->gfp_flags))
+@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page,
+
+ TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d",
+ __entry->page,
+- page_to_pfn(__entry->page),
++ __entry->page ? page_to_pfn(__entry->page) : 0,
+ __entry->order,
+ __entry->migratetype,
+ __entry->order == 0)
projects / thirdparty / kernel / stable-queue.git / commitdiff
