--- /dev/null
+From 83f72151352791836a1b9c1542614cc9bf71ac61 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 9 Sep 2013 10:20:48 +0200
+Subject: ALSA: hda - Add Toshiba Satellite C870 to MSI blacklist
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 83f72151352791836a1b9c1542614cc9bf71ac61 upstream.
+
+Toshiba Satellite C870 shows interrupt problems occasionally when
+certain mixer controls like "Mic Switch" is toggled. This seems
+worked around by not using MSI.
+
+Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=833585
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -3376,6 +3376,7 @@ static struct snd_pci_quirk msi_black_li
+ SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
+ SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
++ SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
+ SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
+ SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
+ {}
--- /dev/null
+From 18e391862cceaf43ddb8eb5cca05e1a83abdebaa Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@iki.fi>
+Date: Sun, 1 Sep 2013 14:36:47 +0300
+Subject: ALSA: hda - hdmi: Fallback to ALSA allocation when selecting CA
+
+From: Anssi Hannula <anssi.hannula@iki.fi>
+
+commit 18e391862cceaf43ddb8eb5cca05e1a83abdebaa upstream.
+
+hdmi_channel_allocation() tries to find a HDMI channel allocation that
+matches the number channels in the playback stream and contains only
+speakers that the HDMI sink has reported as available via EDID. If no
+such allocation is found, 0 (stereo audio) is used.
+
+Using CA 0 causes the audio causes the sink to discard everything except
+the first two channels (front left and front right).
+
+However, the sink may be capable of receiving more channels than it has
+speakers (and then perform downmix or discard the extra channels), in
+which case it is preferable to use a CA that contains extra channels
+than to use CA 0 which discards all the non-stereo channels.
+
+Additionally, it seems that HBR (HD) passthrough output does not work on
+Intel HDMI codecs when CA is set to 0 (possibly the codec zeroes
+channels not present in CA). This happens with all receivers that report
+a 5.1 speaker mask since a HBR stream is carried on 8 channels to the
+codec.
+
+Add a fallback in the CA selection so that the CA channel count at least
+matches the stream channel count, even if the stream contains channels
+not present in the sink speaker descriptor.
+
+Thanks to GrimGriefer at OpenELEC forums for discovering that changing
+the sink speaker mask allowed HBR output.
+
+Reported-by: GrimGriefer
+Reported-by: Ashecrow
+Reported-by: Frank Zafka <kafkaesque1978@gmail.com>
+Reported-by: Peter Frühberger <fritsch@xbmc.org>
+Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -553,6 +553,17 @@ static int hdmi_channel_allocation(struc
+ }
+ }
+
++ if (!ca) {
++ /* if there was no match, select the regular ALSA channel
++ * allocation with the matching number of channels */
++ for (i = 0; i < ARRAY_SIZE(channel_allocations); i++) {
++ if (channels == channel_allocations[i].channels) {
++ ca = channel_allocations[i].ca_index;
++ break;
++ }
++ }
++ }
++
+ snd_print_channel_allocation(eld->info.spk_alloc, buf, sizeof(buf));
+ snd_printdd("HDMI: select CA 0x%x for %d-channel allocation: %s\n",
+ ca, channels, buf);
--- /dev/null
+From b054087dbacee30a9dddaef2c9a96312146be04e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 2 Sep 2013 12:33:02 +0200
+Subject: ALSA: hda - Re-setup HDMI pin and audio infoframe on stream switches
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b054087dbacee30a9dddaef2c9a96312146be04e upstream.
+
+When the transcoder:port mapping on Haswell HDMI/DP audio is changed
+during the stream playback, the sound gets lost. Typically this
+problem is seen when the user switches the graphics mode from eDP+DP
+to DP-only configuration, where CRTC 1 is used for DP in the former
+while CRTC 0 is used for the latter.
+
+The graphics controller notifies the change via the normal ELD update
+procedure, so we get the intrinsic event. For enabling the sound
+again, the HDMI audio driver needs to reset the pin and set up the
+audio infoframe again.
+
+This patch achieves it by:
+- keep the current status of channels and info frame setup in per_pin
+ struct,
+- check the reconnection in the intrinsic event handler,
+- reset the pin and the re-invoke hdmi_setup_audio_infoframe()
+ accordingly.
+
+The hdmi_setup_audio_infoframe() function has been changed, too, so
+that it can be invoked without passing the substream instance.
+
+The patch is mostly based on the work by Mengdong Lin.
+
+Cc: Mengdong Lin <mengdong.lin@intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 41 +++++++++++++++++++++++++++++++----------
+ 1 file changed, 31 insertions(+), 10 deletions(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -67,6 +67,8 @@ struct hdmi_spec_per_pin {
+ struct delayed_work work;
+ struct snd_kcontrol *eld_ctl;
+ int repoll_count;
++ bool setup; /* the stream has been set up by prepare callback */
++ int channels; /* current number of channels */
+ bool non_pcm;
+ bool chmap_set; /* channel-map override by ALSA API? */
+ unsigned char chmap[8]; /* ALSA API channel-map */
+@@ -868,18 +870,19 @@ static bool hdmi_infoframe_uptodate(stru
+ return true;
+ }
+
+-static void hdmi_setup_audio_infoframe(struct hda_codec *codec, int pin_idx,
+- bool non_pcm,
+- struct snd_pcm_substream *substream)
++static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
++ struct hdmi_spec_per_pin *per_pin,
++ bool non_pcm)
+ {
+- struct hdmi_spec *spec = codec->spec;
+- struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+ hda_nid_t pin_nid = per_pin->pin_nid;
+- int channels = substream->runtime->channels;
++ int channels = per_pin->channels;
+ struct hdmi_eld *eld;
+ int ca;
+ union audio_infoframe ai;
+
++ if (!channels)
++ return;
++
+ eld = &per_pin->sink_eld;
+ if (!eld->monitor_present)
+ return;
+@@ -1329,6 +1332,7 @@ static void hdmi_present_sense(struct hd
+ eld_changed = true;
+ }
+ if (update_eld) {
++ bool old_eld_valid = pin_eld->eld_valid;
+ pin_eld->eld_valid = eld->eld_valid;
+ eld_changed = pin_eld->eld_size != eld->eld_size ||
+ memcmp(pin_eld->eld_buffer, eld->eld_buffer,
+@@ -1338,6 +1342,18 @@ static void hdmi_present_sense(struct hd
+ eld->eld_size);
+ pin_eld->eld_size = eld->eld_size;
+ pin_eld->info = eld->info;
++
++ /* Haswell-specific workaround: re-setup when the transcoder is
++ * changed during the stream playback
++ */
++ if (codec->vendor_id == 0x80862807 &&
++ eld->eld_valid && !old_eld_valid && per_pin->setup) {
++ snd_hda_codec_write(codec, pin_nid, 0,
++ AC_VERB_SET_AMP_GAIN_MUTE,
++ AMP_OUT_UNMUTE);
++ hdmi_setup_audio_infoframe(codec, per_pin,
++ per_pin->non_pcm);
++ }
+ }
+ mutex_unlock(&pin_eld->lock);
+
+@@ -1510,14 +1526,17 @@ static int generic_hdmi_playback_pcm_pre
+ hda_nid_t cvt_nid = hinfo->nid;
+ struct hdmi_spec *spec = codec->spec;
+ int pin_idx = hinfo_to_pin_index(spec, hinfo);
+- hda_nid_t pin_nid = get_pin(spec, pin_idx)->pin_nid;
++ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
++ hda_nid_t pin_nid = per_pin->pin_nid;
+ bool non_pcm;
+
+ non_pcm = check_non_pcm_per_cvt(codec, cvt_nid);
++ per_pin->channels = substream->runtime->channels;
++ per_pin->setup = true;
+
+ hdmi_set_channel_count(codec, cvt_nid, substream->runtime->channels);
+
+- hdmi_setup_audio_infoframe(codec, pin_idx, non_pcm, substream);
++ hdmi_setup_audio_infoframe(codec, per_pin, non_pcm);
+
+ return hdmi_setup_stream(codec, cvt_nid, pin_nid, stream_tag, format);
+ }
+@@ -1557,6 +1576,9 @@ static int hdmi_pcm_close(struct hda_pcm
+ snd_hda_spdif_ctls_unassign(codec, pin_idx);
+ per_pin->chmap_set = false;
+ memset(per_pin->chmap, 0, sizeof(per_pin->chmap));
++
++ per_pin->setup = false;
++ per_pin->channels = 0;
+ }
+
+ return 0;
+@@ -1692,8 +1714,7 @@ static int hdmi_chmap_ctl_put(struct snd
+ per_pin->chmap_set = true;
+ memcpy(per_pin->chmap, chmap, sizeof(chmap));
+ if (prepared)
+- hdmi_setup_audio_infoframe(codec, pin_idx, per_pin->non_pcm,
+- substream);
++ hdmi_setup_audio_infoframe(codec, per_pin, per_pin->non_pcm);
+
+ return 0;
+ }
--- /dev/null
+From 026d5b07c03458f9c0ccd19c3850564a5409c325 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 6 Aug 2013 14:18:10 +0200
+Subject: ath9k: always clear ps filter bit on new assoc
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 026d5b07c03458f9c0ccd19c3850564a5409c325 upstream.
+
+Otherwise in some cases, EAPOL frames might be filtered during the
+initial handshake, causing delays and assoc failures.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2602,6 +2602,7 @@ void ath_tx_node_init(struct ath_softc *
+ for (acno = 0, ac = &an->ac[acno];
+ acno < IEEE80211_NUM_ACS; acno++, ac++) {
+ ac->sched = false;
++ ac->clear_ps_filter = true;
+ ac->txq = sc->tx.txq_map[acno];
+ INIT_LIST_HEAD(&ac->tid_q);
+ }
--- /dev/null
+From a1c781bb20ac1e03280e420abd47a99eb8bbdd3b Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 13 Aug 2013 12:33:28 +0200
+Subject: ath9k: avoid accessing MRC registers on single-chain devices
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit a1c781bb20ac1e03280e420abd47a99eb8bbdd3b upstream.
+
+They are not implemented, and accessing them might trigger errors
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_phy.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+@@ -1173,6 +1173,10 @@ skip_ws_det:
+ * is_on == 0 means MRC CCK is OFF (more noise imm)
+ */
+ bool is_on = param ? 1 : 0;
++
++ if (ah->caps.rx_chainmask == 1)
++ break;
++
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
+ AR_PHY_MRC_CCK_ENABLE, is_on);
+ REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
--- /dev/null
+From e96542e55a2aacf4bdeccfe2f17b77c4895b4df2 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sat, 10 Aug 2013 15:59:15 +0200
+Subject: ath9k: fix rx descriptor related race condition
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit e96542e55a2aacf4bdeccfe2f17b77c4895b4df2 upstream.
+
+Similar to a race condition that exists in the tx path, the hardware
+might re-read the 'next' pointer of a descriptor of the last completed
+frame. This only affects non-EDMA (pre-AR93xx) devices.
+
+To deal with this race, defer clearing and re-linking a completed rx
+descriptor until the next one has been processed.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ath9k.h | 5 +----
+ drivers/net/wireless/ath/ath9k/recv.c | 17 +++++++++++++----
+ 2 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -79,10 +79,6 @@ struct ath_config {
+ sizeof(struct ath_buf_state)); \
+ } while (0)
+
+-#define ATH_RXBUF_RESET(_bf) do { \
+- (_bf)->bf_stale = false; \
+- } while (0)
+-
+ /**
+ * enum buffer_type - Buffer type flags
+ *
+@@ -317,6 +313,7 @@ struct ath_rx {
+ struct ath_descdma rxdma;
+ struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
+
++ struct ath_buf *buf_hold;
+ struct sk_buff *frag;
+
+ u32 ampdu_ref;
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_s
+ struct ath_desc *ds;
+ struct sk_buff *skb;
+
+- ATH_RXBUF_RESET(bf);
+-
+ ds = bf->bf_desc;
+ ds->ds_link = 0; /* link to null */
+ ds->ds_data = bf->bf_buf_addr;
+@@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_s
+ sc->rx.rxlink = &ds->ds_link;
+ }
+
++static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
++{
++ if (sc->rx.buf_hold)
++ ath_rx_buf_link(sc, sc->rx.buf_hold);
++
++ sc->rx.buf_hold = bf;
++}
++
+ static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
+ {
+ /* XXX block beacon interrupts */
+@@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct
+
+ skb = bf->bf_mpdu;
+
+- ATH_RXBUF_RESET(bf);
+ memset(skb->data, 0, ah->caps.rx_status_len);
+ dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+ ah->caps.rx_status_len, DMA_TO_DEVICE);
+@@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
+ if (list_empty(&sc->rx.rxbuf))
+ goto start_recv;
+
++ sc->rx.buf_hold = NULL;
+ sc->rx.rxlink = NULL;
+ list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
+ ath_rx_buf_link(sc, bf);
+@@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_b
+ }
+
+ bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
++ if (bf == sc->rx.buf_hold)
++ return NULL;
++
+ ds = bf->bf_desc;
+
+ /*
+@@ -1375,7 +1384,7 @@ requeue:
+ if (edma) {
+ ath_rx_edma_buf_link(sc, qtype);
+ } else {
+- ath_rx_buf_link(sc, bf);
++ ath_rx_buf_relink(sc, bf);
+ ath9k_hw_rxena(ah);
+ }
+ } while (1);
--- /dev/null
+From 67d0cf50bd32b66eab709871714e55725ee30ce4 Mon Sep 17 00:00:00 2001
+From: "John W. Linville" <linville@tuxdriver.com>
+Date: Fri, 9 Aug 2013 13:36:21 -0400
+Subject: brcmsmac: Fix WARNING caused by lack of calls to dma_mapping_error()
+
+From: "John W. Linville" <linville@tuxdriver.com>
+
+commit 67d0cf50bd32b66eab709871714e55725ee30ce4 upstream.
+
+The driver fails to check the results of DMA mapping in twp places,
+which results in the following warning:
+
+[ 28.078515] ------------[ cut here ]------------
+[ 28.078529] WARNING: at lib/dma-debug.c:937 check_unmap+0x47e/0x930()
+[ 28.078533] bcma-pci-bridge 0000:0e:00.0: DMA-API: device driver failed to check map error[device address=0x00000000b5d60d6c] [size=1876 bytes] [mapped as
+ single]
+[ 28.078536] Modules linked in: bnep bluetooth vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) ipv6 b43 brcmsmac rtl8192cu rtl8192c_common rtlwifi mac802
+11 brcmutil cfg80211 snd_hda_codec_conexant rng_core snd_hda_intel kvm_amd snd_hda_codec ssb kvm mmc_core snd_pcm snd_seq snd_timer snd_seq_device snd k8temp
+ cordic joydev serio_raw hwmon sr_mod sg pcmcia pcmcia_core soundcore cdrom i2c_nforce2 i2c_core forcedeth bcma snd_page_alloc autofs4 ext4 jbd2 mbcache crc1
+6 scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh_emc scsi_dh ata_generic pata_amd
+[ 28.078602] CPU: 1 PID: 2570 Comm: NetworkManager Tainted: G O 3.10.0-rc7-wl+ #42
+[ 28.078605] Hardware name: Hewlett-Packard HP Pavilion dv2700 Notebook PC/30D6, BIOS F.27 11/27/2008
+[ 28.078607] 0000000000000009 ffff8800bbb03ad8 ffffffff8144f898 ffff8800bbb03b18
+[ 28.078612] ffffffff8103e1eb 0000000000000002 ffff8800b719f480 ffff8800b7b9c010
+[ 28.078617] ffffffff824204c0 ffffffff81754d57 0000000000000754 ffff8800bbb03b78
+[ 28.078622] Call Trace:
+[ 28.078624] <IRQ> [<ffffffff8144f898>] dump_stack+0x19/0x1b
+[ 28.078634] [<ffffffff8103e1eb>] warn_slowpath_common+0x6b/0xa0
+[ 28.078638] [<ffffffff8103e2c1>] warn_slowpath_fmt+0x41/0x50
+[ 28.078650] [<ffffffff8122d7ae>] check_unmap+0x47e/0x930
+[ 28.078655] [<ffffffff8122de4c>] debug_dma_unmap_page+0x5c/0x70
+[ 28.078679] [<ffffffffa04a808c>] dma64_getnextrxp+0x10c/0x190 [brcmsmac]
+[ 28.078691] [<ffffffffa04a9042>] dma_rx+0x62/0x240 [brcmsmac]
+[ 28.078707] [<ffffffffa0479101>] brcms_c_dpc+0x211/0x9d0 [brcmsmac]
+[ 28.078717] [<ffffffffa046d927>] ? brcms_dpc+0x27/0xf0 [brcmsmac]
+[ 28.078731] [<ffffffffa046d947>] brcms_dpc+0x47/0xf0 [brcmsmac]
+[ 28.078736] [<ffffffff81047dcc>] tasklet_action+0x6c/0xf0
+--snip--
+[ 28.078974] [<ffffffff813891bd>] SyS_sendmsg+0xd/0x20
+[ 28.078979] [<ffffffff81455c24>] tracesys+0xdd/0xe2
+[ 28.078982] ---[ end trace 6164d1a08148e9c8 ]---
+[ 28.078984] Mapped at:
+[ 28.078985] [<ffffffff8122c8fd>] debug_dma_map_page+0x9d/0x150
+[ 28.078989] [<ffffffffa04a9322>] dma_rxfill+0x102/0x3d0 [brcmsmac]
+[ 28.079001] [<ffffffffa047a13d>] brcms_c_init+0x87d/0x1100 [brcmsmac]
+[ 28.079010] [<ffffffffa046d851>] brcms_init+0x21/0x30 [brcmsmac]
+[ 28.079018] [<ffffffffa04786e0>] brcms_c_up+0x150/0x430 [brcmsmac]
+
+As the patch adds a new failure mechanism to dma_rxfill(). When I changed the
+comment at the start of the routine to add that information, I also polished
+the wording.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Brett Rudley <brudley@broadcom.com>
+Cc: Franky (Zhenhui) Lin <frankyl@broadcom.com>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: brcm80211-dev-list@broadcom.com
+Acked-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmsmac/dma.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+@@ -1015,9 +1015,10 @@ static bool dma64_txidle(struct dma_info
+
+ /*
+ * post receive buffers
+- * return false is refill failed completely and ring is empty this will stall
+- * the rx dma and user might want to call rxfill again asap. This unlikely
+- * happens on memory-rich NIC, but often on memory-constrained dongle
++ * Return false if refill failed completely or dma mapping failed. The ring
++ * is empty, which will stall the rx dma and user might want to call rxfill
++ * again asap. This is unlikely to happen on a memory-rich NIC, but often on
++ * memory-constrained dongle.
+ */
+ bool dma_rxfill(struct dma_pub *pub)
+ {
+@@ -1078,6 +1079,8 @@ bool dma_rxfill(struct dma_pub *pub)
+
+ pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
+ DMA_FROM_DEVICE);
++ if (dma_mapping_error(di->dmadev, pa))
++ return false;
+
+ /* save the free packet pointer */
+ di->rxp[rxout] = p;
+@@ -1284,7 +1287,11 @@ static void dma_txenq(struct dma_info *d
+
+ /* get physical address of buffer start */
+ pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
+-
++ /* if mapping failed, free skb */
++ if (dma_mapping_error(di->dmadev, pa)) {
++ brcmu_pkt_buf_free_skb(p);
++ return;
++ }
+ /* With a DMA segment list, Descriptor table is filled
+ * using the segment list instead of looping over
+ * buffers in multi-chain DMA. Therefore, EOF for SGLIST
--- /dev/null
+From 5f1132b2ba8c873f25982cf45917e8455fb6c962 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 17 Aug 2013 10:02:33 -0400
+Subject: ext4: fix ext4_writepages() in presence of truncate
+
+From: Jan Kara <jack@suse.cz>
+
+commit 5f1132b2ba8c873f25982cf45917e8455fb6c962 upstream.
+
+Inode size can arbitrarily change while writeback is in progress. When
+ext4_writepages() has prepared a long extent for mapping and truncate
+then reduces i_size, mpage_map_and_submit_buffers() will always map just
+one buffer in a page instead of all of them due to lblk < blocks check.
+So we end up not using all blocks we've allocated (thus leaking them)
+and also delalloc accounting goes wrong manifesting as a warning like:
+
+ext4_da_release_space:1333: ext4_da_release_space: ino 12, to_free 1
+with only 0 reserved data blocks
+
+Note that the problem can happen only when blocksize < pagesize because
+otherwise we have only a single buffer in the page.
+
+Fix the problem by removing the size check from the mapping loop. We
+have an extent allocated so we have to use it all before checking for
+i_size. We also rename add_page_bufs_to_extent() to
+mpage_process_page_bufs() and make that function submit the page for IO
+if all buffers (upto EOF) in it are mapped.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Reported-by: Zheng Liu <gnehzuil.liu@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/inode.c | 107 ++++++++++++++++++++++++++++++++++----------------------
+ 1 file changed, 66 insertions(+), 41 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1890,6 +1890,26 @@ static int ext4_writepage(struct page *p
+ return ret;
+ }
+
++static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
++{
++ int len;
++ loff_t size = i_size_read(mpd->inode);
++ int err;
++
++ BUG_ON(page->index != mpd->first_page);
++ if (page->index == size >> PAGE_CACHE_SHIFT)
++ len = size & ~PAGE_CACHE_MASK;
++ else
++ len = PAGE_CACHE_SIZE;
++ clear_page_dirty_for_io(page);
++ err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc);
++ if (!err)
++ mpd->wbc->nr_to_write--;
++ mpd->first_page++;
++
++ return err;
++}
++
+ #define BH_FLAGS ((1 << BH_Unwritten) | (1 << BH_Delay))
+
+ /*
+@@ -1948,12 +1968,29 @@ static bool mpage_add_bh_to_extent(struc
+ return false;
+ }
+
+-static bool add_page_bufs_to_extent(struct mpage_da_data *mpd,
+- struct buffer_head *head,
+- struct buffer_head *bh,
+- ext4_lblk_t lblk)
++/*
++ * mpage_process_page_bufs - submit page buffers for IO or add them to extent
++ *
++ * @mpd - extent of blocks for mapping
++ * @head - the first buffer in the page
++ * @bh - buffer we should start processing from
++ * @lblk - logical number of the block in the file corresponding to @bh
++ *
++ * Walk through page buffers from @bh upto @head (exclusive) and either submit
++ * the page for IO if all buffers in this page were mapped and there's no
++ * accumulated extent of buffers to map or add buffers in the page to the
++ * extent of buffers to map. The function returns 1 if the caller can continue
++ * by processing the next page, 0 if it should stop adding buffers to the
++ * extent to map because we cannot extend it anymore. It can also return value
++ * < 0 in case of error during IO submission.
++ */
++static int mpage_process_page_bufs(struct mpage_da_data *mpd,
++ struct buffer_head *head,
++ struct buffer_head *bh,
++ ext4_lblk_t lblk)
+ {
+ struct inode *inode = mpd->inode;
++ int err;
+ ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1)
+ >> inode->i_blkbits;
+
+@@ -1963,32 +2000,18 @@ static bool add_page_bufs_to_extent(stru
+ if (lblk >= blocks || !mpage_add_bh_to_extent(mpd, lblk, bh)) {
+ /* Found extent to map? */
+ if (mpd->map.m_len)
+- return false;
++ return 0;
+ /* Everything mapped so far and we hit EOF */
+- return true;
++ break;
+ }
+ } while (lblk++, (bh = bh->b_this_page) != head);
+- return true;
+-}
+-
+-static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
+-{
+- int len;
+- loff_t size = i_size_read(mpd->inode);
+- int err;
+-
+- BUG_ON(page->index != mpd->first_page);
+- if (page->index == size >> PAGE_CACHE_SHIFT)
+- len = size & ~PAGE_CACHE_MASK;
+- else
+- len = PAGE_CACHE_SIZE;
+- clear_page_dirty_for_io(page);
+- err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc);
+- if (!err)
+- mpd->wbc->nr_to_write--;
+- mpd->first_page++;
+-
+- return err;
++ /* So far everything mapped? Submit the page for IO. */
++ if (mpd->map.m_len == 0) {
++ err = mpage_submit_page(mpd, head->b_page);
++ if (err < 0)
++ return err;
++ }
++ return lblk < blocks;
+ }
+
+ /*
+@@ -2012,8 +2035,6 @@ static int mpage_map_and_submit_buffers(
+ struct inode *inode = mpd->inode;
+ struct buffer_head *head, *bh;
+ int bpp_bits = PAGE_CACHE_SHIFT - inode->i_blkbits;
+- ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1)
+- >> inode->i_blkbits;
+ pgoff_t start, end;
+ ext4_lblk_t lblk;
+ sector_t pblock;
+@@ -2048,18 +2069,26 @@ static int mpage_map_and_submit_buffers(
+ */
+ mpd->map.m_len = 0;
+ mpd->map.m_flags = 0;
+- add_page_bufs_to_extent(mpd, head, bh,
+- lblk);
++ /*
++ * FIXME: If dioread_nolock supports
++ * blocksize < pagesize, we need to make
++ * sure we add size mapped so far to
++ * io_end->size as the following call
++ * can submit the page for IO.
++ */
++ err = mpage_process_page_bufs(mpd, head,
++ bh, lblk);
+ pagevec_release(&pvec);
+- return 0;
++ if (err > 0)
++ err = 0;
++ return err;
+ }
+ if (buffer_delay(bh)) {
+ clear_buffer_delay(bh);
+ bh->b_blocknr = pblock++;
+ }
+ clear_buffer_unwritten(bh);
+- } while (++lblk < blocks &&
+- (bh = bh->b_this_page) != head);
++ } while (lblk++, (bh = bh->b_this_page) != head);
+
+ /*
+ * FIXME: This is going to break if dioread_nolock
+@@ -2328,14 +2357,10 @@ static int mpage_prepare_extent_to_map(s
+ lblk = ((ext4_lblk_t)page->index) <<
+ (PAGE_CACHE_SHIFT - blkbits);
+ head = page_buffers(page);
+- if (!add_page_bufs_to_extent(mpd, head, head, lblk))
++ err = mpage_process_page_bufs(mpd, head, head, lblk);
++ if (err <= 0)
+ goto out;
+- /* So far everything mapped? Submit the page for IO. */
+- if (mpd->map.m_len == 0) {
+- err = mpage_submit_page(mpd, page);
+- if (err < 0)
+- goto out;
+- }
++ err = 0;
+
+ /*
+ * Accumulated enough dirty pages? This doesn't apply
--- /dev/null
+From 09930042a2e94cf8ee79d22943915612c1e4ba51 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 17 Aug 2013 09:57:56 -0400
+Subject: ext4: move test whether extent to map can be extended to one place
+
+From: Jan Kara <jack@suse.cz>
+
+commit 09930042a2e94cf8ee79d22943915612c1e4ba51 upstream.
+
+Currently the logic whether the current buffer can be added to an extent
+of buffers to map is split between mpage_add_bh_to_extent() and
+add_page_bufs_to_extent(). Move the whole logic to
+mpage_add_bh_to_extent() which makes things a bit more straightforward
+and make following i_size fixes easier.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/inode.c | 49 +++++++++++++++++++++++++++++--------------------
+ 1 file changed, 29 insertions(+), 20 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1904,34 +1904,48 @@ static int ext4_writepage(struct page *p
+ *
+ * @mpd - extent of blocks
+ * @lblk - logical number of the block in the file
+- * @b_state - b_state of the buffer head added
++ * @bh - buffer head we want to add to the extent
+ *
+- * the function is used to collect contig. blocks in same state
++ * The function is used to collect contig. blocks in the same state. If the
++ * buffer doesn't require mapping for writeback and we haven't started the
++ * extent of buffers to map yet, the function returns 'true' immediately - the
++ * caller can write the buffer right away. Otherwise the function returns true
++ * if the block has been added to the extent, false if the block couldn't be
++ * added.
+ */
+-static int mpage_add_bh_to_extent(struct mpage_da_data *mpd, ext4_lblk_t lblk,
+- unsigned long b_state)
++static bool mpage_add_bh_to_extent(struct mpage_da_data *mpd, ext4_lblk_t lblk,
++ struct buffer_head *bh)
+ {
+ struct ext4_map_blocks *map = &mpd->map;
+
+- /* Don't go larger than mballoc is willing to allocate */
+- if (map->m_len >= MAX_WRITEPAGES_EXTENT_LEN)
+- return 0;
++ /* Buffer that doesn't need mapping for writeback? */
++ if (!buffer_dirty(bh) || !buffer_mapped(bh) ||
++ (!buffer_delay(bh) && !buffer_unwritten(bh))) {
++ /* So far no extent to map => we write the buffer right away */
++ if (map->m_len == 0)
++ return true;
++ return false;
++ }
+
+ /* First block in the extent? */
+ if (map->m_len == 0) {
+ map->m_lblk = lblk;
+ map->m_len = 1;
+- map->m_flags = b_state & BH_FLAGS;
+- return 1;
++ map->m_flags = bh->b_state & BH_FLAGS;
++ return true;
+ }
+
++ /* Don't go larger than mballoc is willing to allocate */
++ if (map->m_len >= MAX_WRITEPAGES_EXTENT_LEN)
++ return false;
++
+ /* Can we merge the block to our big extent? */
+ if (lblk == map->m_lblk + map->m_len &&
+- (b_state & BH_FLAGS) == map->m_flags) {
++ (bh->b_state & BH_FLAGS) == map->m_flags) {
+ map->m_len++;
+- return 1;
++ return true;
+ }
+- return 0;
++ return false;
+ }
+
+ static bool add_page_bufs_to_extent(struct mpage_da_data *mpd,
+@@ -1946,18 +1960,13 @@ static bool add_page_bufs_to_extent(stru
+ do {
+ BUG_ON(buffer_locked(bh));
+
+- if (!buffer_dirty(bh) || !buffer_mapped(bh) ||
+- (!buffer_delay(bh) && !buffer_unwritten(bh)) ||
+- lblk >= blocks) {
++ if (lblk >= blocks || !mpage_add_bh_to_extent(mpd, lblk, bh)) {
+ /* Found extent to map? */
+ if (mpd->map.m_len)
+ return false;
+- if (lblk >= blocks)
+- return true;
+- continue;
++ /* Everything mapped so far and we hit EOF */
++ return true;
+ }
+- if (!mpage_add_bh_to_extent(mpd, lblk, bh->b_state))
+- return false;
+ } while (lblk++, (bh = bh->b_this_page) != head);
+ return true;
+ }
--- /dev/null
+From 5208386c501276df18fee464e21d3c58d2d79517 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 17 Aug 2013 10:07:17 -0400
+Subject: ext4: simplify truncation code in ext4_setattr()
+
+From: Jan Kara <jack@suse.cz>
+
+commit 5208386c501276df18fee464e21d3c58d2d79517 upstream.
+
+Merge conditions in ext4_setattr() handling inode size changes, also
+move ext4_begin_ordered_truncate() call somewhat earlier because it
+simplifies error recovery in case of failure. Also add error handling in
+case i_disksize update fails.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/inode.c | 109 +++++++++++++++++++++++++-------------------------------
+ 1 file changed, 49 insertions(+), 60 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4600,7 +4600,9 @@ int ext4_setattr(struct dentry *dentry,
+ ext4_journal_stop(handle);
+ }
+
+- if (attr->ia_valid & ATTR_SIZE) {
++ if (attr->ia_valid & ATTR_SIZE && attr->ia_size != inode->i_size) {
++ handle_t *handle;
++ loff_t oldsize = inode->i_size;
+
+ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+@@ -4608,73 +4610,60 @@ int ext4_setattr(struct dentry *dentry,
+ if (attr->ia_size > sbi->s_bitmap_maxbytes)
+ return -EFBIG;
+ }
+- }
+-
+- if (S_ISREG(inode->i_mode) &&
+- attr->ia_valid & ATTR_SIZE &&
+- (attr->ia_size < inode->i_size)) {
+- handle_t *handle;
+-
+- handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
+- if (IS_ERR(handle)) {
+- error = PTR_ERR(handle);
+- goto err_out;
+- }
+- if (ext4_handle_valid(handle)) {
+- error = ext4_orphan_add(handle, inode);
+- orphan = 1;
+- }
+- EXT4_I(inode)->i_disksize = attr->ia_size;
+- rc = ext4_mark_inode_dirty(handle, inode);
+- if (!error)
+- error = rc;
+- ext4_journal_stop(handle);
+-
+- if (ext4_should_order_data(inode)) {
+- error = ext4_begin_ordered_truncate(inode,
++ if (S_ISREG(inode->i_mode) &&
++ (attr->ia_size < inode->i_size)) {
++ if (ext4_should_order_data(inode)) {
++ error = ext4_begin_ordered_truncate(inode,
+ attr->ia_size);
+- if (error) {
+- /* Do as much error cleanup as possible */
+- handle = ext4_journal_start(inode,
+- EXT4_HT_INODE, 3);
+- if (IS_ERR(handle)) {
+- ext4_orphan_del(NULL, inode);
++ if (error)
+ goto err_out;
+- }
+- ext4_orphan_del(handle, inode);
+- orphan = 0;
+- ext4_journal_stop(handle);
++ }
++ handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
++ if (IS_ERR(handle)) {
++ error = PTR_ERR(handle);
++ goto err_out;
++ }
++ if (ext4_handle_valid(handle)) {
++ error = ext4_orphan_add(handle, inode);
++ orphan = 1;
++ }
++ EXT4_I(inode)->i_disksize = attr->ia_size;
++ rc = ext4_mark_inode_dirty(handle, inode);
++ if (!error)
++ error = rc;
++ ext4_journal_stop(handle);
++ if (error) {
++ ext4_orphan_del(NULL, inode);
+ goto err_out;
+ }
+ }
+- }
+-
+- if (attr->ia_valid & ATTR_SIZE) {
+- if (attr->ia_size != inode->i_size) {
+- loff_t oldsize = inode->i_size;
+
+- i_size_write(inode, attr->ia_size);
+- /*
+- * Blocks are going to be removed from the inode. Wait
+- * for dio in flight. Temporarily disable
+- * dioread_nolock to prevent livelock.
+- */
+- if (orphan) {
+- if (!ext4_should_journal_data(inode)) {
+- ext4_inode_block_unlocked_dio(inode);
+- inode_dio_wait(inode);
+- ext4_inode_resume_unlocked_dio(inode);
+- } else
+- ext4_wait_for_tail_page_commit(inode);
+- }
+- /*
+- * Truncate pagecache after we've waited for commit
+- * in data=journal mode to make pages freeable.
+- */
+- truncate_pagecache(inode, oldsize, inode->i_size);
++ i_size_write(inode, attr->ia_size);
++ /*
++ * Blocks are going to be removed from the inode. Wait
++ * for dio in flight. Temporarily disable
++ * dioread_nolock to prevent livelock.
++ */
++ if (orphan) {
++ if (!ext4_should_journal_data(inode)) {
++ ext4_inode_block_unlocked_dio(inode);
++ inode_dio_wait(inode);
++ ext4_inode_resume_unlocked_dio(inode);
++ } else
++ ext4_wait_for_tail_page_commit(inode);
+ }
+- ext4_truncate(inode);
++ /*
++ * Truncate pagecache after we've waited for commit
++ * in data=journal mode to make pages freeable.
++ */
++ truncate_pagecache(inode, oldsize, inode->i_size);
+ }
++ /*
++ * We want to call ext4_truncate() even if attr->ia_size ==
++ * inode->i_size for cases like truncation of fallocated space
++ */
++ if (attr->ia_valid & ATTR_SIZE)
++ ext4_truncate(inode);
+
+ if (!rc) {
+ setattr_copy(inode, attr);
--- /dev/null
+From 8c89cc17b91992845bd635813cd162fe8dfcec6e Mon Sep 17 00:00:00 2001
+From: Henrik Rydberg <rydberg@euromail.se>
+Date: Sun, 1 Sep 2013 15:31:44 +0200
+Subject: HID: Correct the USB IDs for the new Macbook Air 6
+
+From: Henrik Rydberg <rydberg@euromail.se>
+
+commit 8c89cc17b91992845bd635813cd162fe8dfcec6e upstream.
+
+A recent patch (9d9a04ee) added support for the new machine, but got
+the sequence of USB ids wrong. Reports from both Ian and Linus T show
+that the 0x0291 id is for ISO, not ANSI, which should have the missing
+number 0x0290. This patchs moves the three numbers accordingly, fixing
+the problem.
+
+Reported-and-tested-by: Ian Munsie <darkstarsword@gmail.com>
+Tested-by: Linus G Thiel <linus@hanssonlarsson.se>
+Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-ids.h | 6 +++---
+ drivers/input/mouse/bcm5974.c | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,9 +135,9 @@
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS 0x023b
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI 0x0255
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO 0x0256
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292
+ #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY 0x030a
+ #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY 0x030b
+ #define USB_DEVICE_ID_APPLE_IRCONTROL 0x8240
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -89,9 +89,9 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_ISO 0x025a
+ #define USB_DEVICE_ID_APPLE_WELLSPRING7A_JIS 0x025b
+ /* MacbookAir6,2 (unibody, June 2013) */
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0291
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0292
+-#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0293
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291
++#define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292
+
+ #define BCM5974_DEVICE(prod) { \
+ .match_flags = (USB_DEVICE_ID_MATCH_DEVICE | \
--- /dev/null
+From 06bb5219118fb098f4b0c7dcb484b28a52bf1c14 Mon Sep 17 00:00:00 2001
+From: Stefan Kriwanek <dev@stefankriwanek.de>
+Date: Sun, 25 Aug 2013 10:46:13 +0200
+Subject: HID: Fix Speedlink VAD Cezanne support for some devices
+
+From: Stefan Kriwanek <dev@stefankriwanek.de>
+
+commit 06bb5219118fb098f4b0c7dcb484b28a52bf1c14 upstream.
+
+Some devices of the "Speedlink VAD Cezanne" model need more aggressive fixing
+than already done.
+
+I made sure through testing that this patch would not interfere with the proper
+working of a device that is bug-free. (The driver drops EV_REL events with
+abs(val) >= 256, which are not achievable even on the highest laser resolution
+hardware setting.)
+
+Signed-off-by: Stefan Kriwanek <mail@stefankriwanek.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-speedlink.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/hid/hid-speedlink.c
++++ b/drivers/hid/hid-speedlink.c
+@@ -3,7 +3,7 @@
+ * Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
+ * the HID descriptor.
+ *
+- * Copyright (c) 2011 Stefan Kriwanek <mail@stefankriwanek.de>
++ * Copyright (c) 2011, 2013 Stefan Kriwanek <dev@stefankriwanek.de>
+ */
+
+ /*
+@@ -46,8 +46,13 @@ static int speedlink_event(struct hid_de
+ struct hid_usage *usage, __s32 value)
+ {
+ /* No other conditions due to usage_table. */
+- /* Fix "jumpy" cursor (invalid events sent by device). */
+- if (value == 256)
++
++ /* This fixes the "jumpy" cursor occuring due to invalid events sent
++ * by the device. Some devices only send them with value==+256, others
++ * don't. However, catching abs(value)>=256 is restrictive enough not
++ * to interfere with devices that were bug-free (has been tested).
++ */
++ if (abs(value) >= 256)
+ return 1;
+ /* Drop useless distance 0 events (on button clicks etc.) as well */
+ if (value == 0)
--- /dev/null
+From 0adb9c2c5ed42f199cb2a630c37d18dee385fae2 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Mon, 15 Jul 2013 10:12:18 +0200
+Subject: HID: kye: Add report fixup for Genius Gx Imperator Keyboard
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit 0adb9c2c5ed42f199cb2a630c37d18dee385fae2 upstream.
+
+Genius Gx Imperator Keyboard presents the same problem in its report
+descriptors than Genius Gila Gaming Mouse.
+Use the same fixup for both.
+
+Fixes:
+https://bugzilla.redhat.com/show_bug.cgi?id=928561
+
+Reported-and-tested-by: Honza Brazdil <jbrazdil@redhat.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-kye.c | 45 ++++++++++++++++++++++++++++-----------------
+ 3 files changed, 30 insertions(+), 17 deletions(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1597,6 +1597,7 @@ static const struct hid_device_id hid_ha
+ { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_I405X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -482,6 +482,7 @@
+ #define USB_VENDOR_ID_KYE 0x0458
+ #define USB_DEVICE_ID_KYE_ERGO_525V 0x0087
+ #define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE 0x0138
++#define USB_DEVICE_ID_GENIUS_GX_IMPERATOR 0x4018
+ #define USB_DEVICE_ID_KYE_GPEN_560 0x5003
+ #define USB_DEVICE_ID_KYE_EASYPEN_I405X 0x5010
+ #define USB_DEVICE_ID_KYE_MOUSEPEN_I608X 0x5011
+--- a/drivers/hid/hid-kye.c
++++ b/drivers/hid/hid-kye.c
+@@ -268,6 +268,26 @@ static __u8 easypen_m610x_rdesc_fixed[]
+ 0xC0 /* End Collection */
+ };
+
++static __u8 *kye_consumer_control_fixup(struct hid_device *hdev, __u8 *rdesc,
++ unsigned int *rsize, int offset, const char *device_name) {
++ /*
++ * the fixup that need to be done:
++ * - change Usage Maximum in the Comsumer Control
++ * (report ID 3) to a reasonable value
++ */
++ if (*rsize >= offset + 31 &&
++ /* Usage Page (Consumer Devices) */
++ rdesc[offset] == 0x05 && rdesc[offset + 1] == 0x0c &&
++ /* Usage (Consumer Control) */
++ rdesc[offset + 2] == 0x09 && rdesc[offset + 3] == 0x01 &&
++ /* Usage Maximum > 12287 */
++ rdesc[offset + 10] == 0x2a && rdesc[offset + 12] > 0x2f) {
++ hid_info(hdev, "fixing up %s report descriptor\n", device_name);
++ rdesc[offset + 12] = 0x2f;
++ }
++ return rdesc;
++}
++
+ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+@@ -315,23 +335,12 @@ static __u8 *kye_report_fixup(struct hid
+ }
+ break;
+ case USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE:
+- /*
+- * the fixup that need to be done:
+- * - change Usage Maximum in the Comsumer Control
+- * (report ID 3) to a reasonable value
+- */
+- if (*rsize >= 135 &&
+- /* Usage Page (Consumer Devices) */
+- rdesc[104] == 0x05 && rdesc[105] == 0x0c &&
+- /* Usage (Consumer Control) */
+- rdesc[106] == 0x09 && rdesc[107] == 0x01 &&
+- /* Usage Maximum > 12287 */
+- rdesc[114] == 0x2a && rdesc[116] > 0x2f) {
+- hid_info(hdev,
+- "fixing up Genius Gila Gaming Mouse "
+- "report descriptor\n");
+- rdesc[116] = 0x2f;
+- }
++ rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
++ "Genius Gila Gaming Mouse");
++ break;
++ case USB_DEVICE_ID_GENIUS_GX_IMPERATOR:
++ rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 83,
++ "Genius Gx Imperator Keyboard");
+ break;
+ }
+ return rdesc;
+@@ -428,6 +437,8 @@ static const struct hid_device_id kye_de
+ USB_DEVICE_ID_KYE_EASYPEN_M610X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+ USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
++ USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, kye_devices);
--- /dev/null
+From 412f30105ec6735224535791eed5cdc02888ecb4 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 28 Aug 2013 22:30:49 +0200
+Subject: HID: pantherlord: validate output report details
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 412f30105ec6735224535791eed5cdc02888ecb4 upstream.
+
+A HID device could send a malicious output report that would cause the
+pantherlord HID driver to write beyond the output report allocation
+during initialization, causing a heap overflow:
+
+[ 310.939483] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003
+...
+[ 315.980774] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten
+
+CVE-2013-2892
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-pl.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-pl.c
++++ b/drivers/hid/hid-pl.c
+@@ -132,8 +132,14 @@ static int plff_init(struct hid_device *
+ strong = &report->field[0]->value[2];
+ weak = &report->field[0]->value[3];
+ debug("detected single-field device");
+- } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
+- report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
++ } else if (report->field[0]->maxusage == 1 &&
++ report->field[0]->usage[0].hid ==
++ (HID_UP_LED | 0x43) &&
++ report->maxfield >= 4 &&
++ report->field[0]->report_count >= 1 &&
++ report->field[1]->report_count >= 1 &&
++ report->field[2]->report_count >= 1 &&
++ report->field[3]->report_count >= 1) {
+ report->field[0]->value[0] = 0x00;
+ report->field[1]->value[0] = 0x00;
+ strong = &report->field[2]->value[0];
--- /dev/null
+From a6be8569b6705cbc26e7ae1a8be476067cc5a78b Mon Sep 17 00:00:00 2001
+From: David Herrmann <dh.herrmann@gmail.com>
+Date: Sun, 4 Aug 2013 18:50:10 +0200
+Subject: HID: wiimote: work around broken DRM_KAI on GEN10
+
+From: David Herrmann <dh.herrmann@gmail.com>
+
+commit a6be8569b6705cbc26e7ae1a8be476067cc5a78b upstream.
+
+GEN10 and earlier devices seem to not support DRM_KAI if we run in basic
+IR mode. Use DRM_KAIE instead. This might increases overhead slightly as
+the extension port is read and streamed but we stream accelerometer data
+constantly, too, so this is negligible.
+
+Note that our parsers are hardcoded on IR-formats, so we cannot actually
+use 96-bit IR DRMs for basic IR data. We would have to adjust the parsers.
+But as only GEN20 and newer support this, we simply avoid mixed DRMs.
+
+This fixes a bug where GEN10 devices didn't provide IR data if
+accelerometer and IR are enabled simultaneously. As a workaround, you can
+enable DRM_KAIE without this patch via (disables device power-management):
+ echo "37" >/sys/kernel/debug/hid/<dev>/drm
+
+Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
+Reported-by: Nicolas Adenis-Lamarre <nicolas.adenis.lamarre@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-wiimote-core.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/hid/hid-wiimote-core.c
++++ b/drivers/hid/hid-wiimote-core.c
+@@ -212,10 +212,12 @@ static __u8 select_drm(struct wiimote_da
+
+ if (ir == WIIPROTO_FLAG_IR_BASIC) {
+ if (wdata->state.flags & WIIPROTO_FLAG_ACCEL) {
+- if (ext)
+- return WIIPROTO_REQ_DRM_KAIE;
+- else
+- return WIIPROTO_REQ_DRM_KAI;
++ /* GEN10 and ealier devices bind IR formats to DRMs.
++ * Hence, we cannot use DRM_KAI here as it might be
++ * bound to IR_EXT. Use DRM_KAIE unconditionally so we
++ * work with all devices and our parsers can use the
++ * fixed formats, too. */
++ return WIIPROTO_REQ_DRM_KAIE;
+ } else {
+ return WIIPROTO_REQ_DRM_KIE;
+ }
--- /dev/null
+From d70b7616d9080ec9f868fbd31db5fd4341435d61 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 23 Aug 2013 15:48:48 +0200
+Subject: mac80211: ignore (E)CSA in probe response frames
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit d70b7616d9080ec9f868fbd31db5fd4341435d61 upstream.
+
+Seth reports that some APs, notably the Netgear WNDAP360, send
+invalid ECSA IEs in probe response frames with the operating
+class and channel number both set to zero, even when no channel
+switch is being done. As a result, any scan while connected to
+such an AP results in the connection being dropped.
+
+Fix this by ignoring any channel switch announcment in probe
+response frames entirely, since we're connected to the AP we
+will be receiving a beacon (and maybe even an action frame) if
+a channel switch is done, which is sufficient.
+
+Reported-by: Seth Forshee <seth.forshee@canonical.com>
+Tested-by: Seth Forshee <seth.forshee@canonical.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/mlme.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2851,14 +2851,6 @@ static void ieee80211_rx_bss_info(struct
+ ieee80211_rx_bss_put(local, bss);
+ sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
+ }
+-
+- if (!sdata->u.mgd.associated ||
+- !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
+- return;
+-
+- ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
+- elems, true);
+-
+ }
+
+
+@@ -3147,6 +3139,9 @@ static void ieee80211_rx_mgmt_beacon(str
+
+ ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
+
++ ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
++ &elems, true);
++
+ if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
+ elems.wmm_param_len))
+ changed |= BSS_CHANGED_QOS;
--- /dev/null
+From 714086029116b6b0a34e67ba1dd2f0d1cf26770c Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Wed, 4 Sep 2013 16:21:18 +0200
+Subject: net: mvneta: properly disable HW PHY polling and ensure adjust_link() works
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+commit 714086029116b6b0a34e67ba1dd2f0d1cf26770c upstream.
+
+This commit fixes a long-standing bug that has been reported by many
+users: on some Armada 370 platforms, only the network interface that
+has been used in U-Boot to tftp the kernel works properly in
+Linux. The other network interfaces can see a 'link up', but are
+unable to transmit data. The reports were generally made on the Armada
+370-based Mirabox, but have also been given on the Armada 370-RD
+board.
+
+The network MAC in the Armada 370/XP (supported by the mvneta driver
+in Linux) has a functionality that allows it to continuously poll the
+PHY and directly update the MAC configuration accordingly (speed,
+duplex, etc.). The very first versions of the driver submitted for
+review were using this hardware mechanism, but due to this, the driver
+was not integrated with the kernel phylib. Following reviews, the
+driver was changed to use the phylib, and therefore a software based
+polling. In software based polling, Linux regularly talks to the PHY
+over the MDIO bus, and sees if the link status has changed. If it's
+the case then the adjust_link() callback of the driver is called to
+update the MAC configuration accordingly.
+
+However, it turns out that the adjust_link() callback was not
+configuring the hardware in a completely correct way: while it was
+setting the speed and duplex bits correctly, it wasn't telling the
+hardware to actually take into account those bits rather than what the
+hardware-based PHY polling mechanism has concluded. So, in fact the
+adjust_link() callback was basically a no-op.
+
+However, the network happened to be working because on the network
+interfaces used by U-Boot for tftp on Armada 370 platforms because the
+hardware PHY polling was enabled by the bootloader, and left enabled
+by Linux. However, the second network interface not used for tftp (or
+both network interfaces if the kernel is loaded from USB, NAND or SD
+card) didn't had the hardware PHY polling enabled.
+
+This patch fixes this situation by:
+
+ (1) Making sure that the hardware PHY polling is disabled by clearing
+ the MVNETA_PHY_POLLING_ENABLE bit in the MVNETA_UNIT_CONTROL
+ register in the driver ->probe() function.
+
+ (2) Making sure that the duplex and speed selections made by the
+ adjust_link() callback are taken into account by clearing the
+ MVNETA_GMAC_AN_SPEED_EN and MVNETA_GMAC_AN_DUPLEX_EN bits in the
+ MVNETA_GMAC_AUTONEG_CONFIG register.
+
+This patch has been tested on Armada 370 Mirabox, and now both network
+interfaces are usable after boot.
+
+[ Problem introduced by commit c5aff18 ("net: mvneta: driver for
+ Marvell Armada 370/XP network unit") ]
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Cc: Jochen De Smet <jochen.armkernel@leahnim.org>
+Cc: Peter Sanford <psanford@nearbuy.io>
+Cc: Ethan Tuttle <ethan@ethantuttle.com>
+Cc: Chény Yves-Gael <yves@cheny.fr>
+Cc: Ryan Press <ryan@presslab.us>
+Cc: Simon Guinot <simon.guinot@sequanux.org>
+Cc: vdonnefort@lacie.com
+Acked-by: Jason Cooper <jason@lakedaemon.net>
+Tested-by: Vincent Donnefort <vdonnefort@gmail.com>
+Tested-by: Yves-Gael Cheny <yves@cheny.fr>
+Tested-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/marvell/mvneta.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -138,7 +138,9 @@
+ #define MVNETA_GMAC_FORCE_LINK_PASS BIT(1)
+ #define MVNETA_GMAC_CONFIG_MII_SPEED BIT(5)
+ #define MVNETA_GMAC_CONFIG_GMII_SPEED BIT(6)
++#define MVNETA_GMAC_AN_SPEED_EN BIT(7)
+ #define MVNETA_GMAC_CONFIG_FULL_DUPLEX BIT(12)
++#define MVNETA_GMAC_AN_DUPLEX_EN BIT(13)
+ #define MVNETA_MIB_COUNTERS_BASE 0x3080
+ #define MVNETA_MIB_LATE_COLLISION 0x7c
+ #define MVNETA_DA_FILT_SPEC_MCAST 0x3400
+@@ -915,6 +917,13 @@ static void mvneta_defaults_set(struct m
+ /* Assign port SDMA configuration */
+ mvreg_write(pp, MVNETA_SDMA_CONFIG, val);
+
++ /* Disable PHY polling in hardware, since we're using the
++ * kernel phylib to do this.
++ */
++ val = mvreg_read(pp, MVNETA_UNIT_CONTROL);
++ val &= ~MVNETA_PHY_POLLING_ENABLE;
++ mvreg_write(pp, MVNETA_UNIT_CONTROL, val);
++
+ mvneta_set_ucast_table(pp, -1);
+ mvneta_set_special_mcast_table(pp, -1);
+ mvneta_set_other_mcast_table(pp, -1);
+@@ -2307,7 +2316,9 @@ static void mvneta_adjust_link(struct ne
+ val = mvreg_read(pp, MVNETA_GMAC_AUTONEG_CONFIG);
+ val &= ~(MVNETA_GMAC_CONFIG_MII_SPEED |
+ MVNETA_GMAC_CONFIG_GMII_SPEED |
+- MVNETA_GMAC_CONFIG_FULL_DUPLEX);
++ MVNETA_GMAC_CONFIG_FULL_DUPLEX |
++ MVNETA_GMAC_AN_SPEED_EN |
++ MVNETA_GMAC_AN_DUPLEX_EN);
+
+ if (phydev->duplex)
+ val |= MVNETA_GMAC_CONFIG_FULL_DUPLEX;
--- /dev/null
+From 05d3534a321d7fe4524b3b83bb20318282f3ec2c Mon Sep 17 00:00:00 2001
+From: Boris BREZILLON <b.brezillon@overkiz.com>
+Date: Tue, 27 Aug 2013 15:19:21 +0200
+Subject: pinctrl: at91: fix get_pullup/down function return
+
+From: Boris BREZILLON <b.brezillon@overkiz.com>
+
+commit 05d3534a321d7fe4524b3b83bb20318282f3ec2c upstream.
+
+In PIO_PUSR and PIO_PPDSR register if a given bit is set 1 this means the
+pullup/down for this pin (pin is represented as a bit position) is
+disabled.
+
+Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/pinctrl-at91.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -325,7 +325,7 @@ static void at91_mux_disable_interrupt(v
+
+ static unsigned at91_mux_get_pullup(void __iomem *pio, unsigned pin)
+ {
+- return (readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1;
++ return !((readl_relaxed(pio + PIO_PUSR) >> pin) & 0x1);
+ }
+
+ static void at91_mux_set_pullup(void __iomem *pio, unsigned mask, bool on)
+@@ -445,7 +445,7 @@ static void at91_mux_pio3_set_debounce(v
+
+ static bool at91_mux_pio3_get_pulldown(void __iomem *pio, unsigned pin)
+ {
+- return (__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1;
++ return !((__raw_readl(pio + PIO_PPDSR) >> pin) & 0x1);
+ }
+
+ static void at91_mux_pio3_set_pulldown(void __iomem *pio, unsigned mask, bool is_on)
x86-amd_nb-clarify-f15h-model-30h-gart-and-l3-support.patch
x86-mce-pay-no-attention-to-f-bit-in-mcacod-when-parsing-uc-errors.patch
sched-x86-optimize-switch_mm-for-multi-threaded-workloads.patch
+alsa-hda-re-setup-hdmi-pin-and-audio-infoframe-on-stream-switches.patch
+alsa-hda-hdmi-fallback-to-alsa-allocation-when-selecting-ca.patch
+alsa-hda-add-toshiba-satellite-c870-to-msi-blacklist.patch
+pinctrl-at91-fix-get_pullup-down-function-return.patch
+ext4-move-test-whether-extent-to-map-can-be-extended-to-one-place.patch
+ext4-fix-ext4_writepages-in-presence-of-truncate.patch
+ext4-simplify-truncation-code-in-ext4_setattr.patch
+mac80211-ignore-e-csa-in-probe-response-frames.patch
+brcmsmac-fix-warning-caused-by-lack-of-calls-to-dma_mapping_error.patch
+ath9k-always-clear-ps-filter-bit-on-new-assoc.patch
+ath9k-fix-rx-descriptor-related-race-condition.patch
+ath9k-avoid-accessing-mrc-registers-on-single-chain-devices.patch
+net-mvneta-properly-disable-hw-phy-polling-and-ensure-adjust_link-works.patch
+hid-correct-the-usb-ids-for-the-new-macbook-air-6.patch
+hid-pantherlord-validate-output-report-details.patch
+hid-kye-add-report-fixup-for-genius-gx-imperator-keyboard.patch
+hid-wiimote-work-around-broken-drm_kai-on-gen10.patch
+hid-fix-speedlink-vad-cezanne-support-for-some-devices.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
