--- /dev/null
+From a950549c675f2c8c504469dec7d780da8a6433dc Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Tue, 21 May 2013 15:25:11 +0530
+Subject: ARC: copy_(to|from)_user() to honor usermode-access permissions
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit a950549c675f2c8c504469dec7d780da8a6433dc upstream.
+
+This manifested as grep failing psuedo-randomly:
+
+-------------->8---------------------
+[ARCLinux]$ ip address show lo | grep inet
+[ARCLinux]$ ip address show lo | grep inet
+[ARCLinux]$ ip address show lo | grep inet
+[ARCLinux]$
+[ARCLinux]$ ip address show lo | grep inet
+ inet 127.0.0.1/8 scope host lo
+-------------->8---------------------
+
+ARC700 MMU provides fully orthogonal permission bits per page:
+Ur, Uw, Ux, Kr, Kw, Kx
+
+The user mode page permission templates used to have all Kernel mode
+access bits enabled.
+This caused a tricky race condition observed with uClibc buffered file
+read and UNIX pipes.
+
+1. Read access to an anon mapped page in libc .bss: write-protected
+ zero_page mapped: TLB Entry installed with Ur + K[rwx]
+
+2. grep calls libc:getc() -> buffered read layer calls read(2) with the
+ internal read buffer in same .bss page.
+ The read() call is on STDIN which has been redirected to a pipe.
+ read(2) => sys_read() => pipe_read() => copy_to_user()
+
+3. Since page has Kernel-write permission (despite being user-mode
+ write-protected), copy_to_user() suceeds w/o taking a MMU TLB-Miss
+ Exception (page-fault for ARC). core-MM is unaware that kernel
+ erroneously wrote to the reserved read-only zero-page (BUG #1)
+
+4. Control returns to userspace which now does a write to same .bss page
+ Since Linux MM is not aware that page has been modified by kernel, it
+ simply reassigns a new writable zero-init page to mapping, loosing the
+ prior write by kernel - effectively zero'ing out the libc read buffer
+ under the hood - hence grep doesn't see right data (BUG #2)
+
+The fix is to make all kernel-mode access permissions mirror the
+user-mode ones. Note that the kernel still has full access to pages,
+when accessed directly (w/o MMU) - this fix ensures that kernel-mode
+access in copy_to_from() path uses the same faulting access model as for
+pure user accesses to keep MM fully aware of page state.
+
+The issue is peudo-random because it only shows up if the TLB entry
+installed in #1 is present at the time of #3. If it is evicted out, due
+to TLB pressure or some-such, then copy_to_user() does take a TLB Miss
+Exception, with a routine write-to-anon COW processing installing a
+fresh page for kernel writes and also usable as it is in userspace.
+
+Further the issue was dormant for so long as it depends on where the
+libc internal read buffer (in .bss) is mapped at runtime.
+If it happens to reside in file-backed data mapping of libc (in the
+page-aligned slack space trailing the file backed data), loader zero
+padding the slack space, does the early cow page replacement, setting
+things up at the very beginning itself.
+
+With gcc 4.8 based builds, the libc buffer got pushed out to a real
+anon mapping which triggers the issue.
+
+Reported-by: Anton Kolesov <akolesov@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/include/asm/pgtable.h | 26 +++++++++++++++-----------
+ arch/arc/include/asm/tlb.h | 2 +-
+ arch/arc/mm/tlbex.S | 6 +++---
+ 3 files changed, 19 insertions(+), 15 deletions(-)
+
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -57,9 +57,9 @@
+
+ #define _PAGE_ACCESSED (1<<1) /* Page is accessed (S) */
+ #define _PAGE_CACHEABLE (1<<2) /* Page is cached (H) */
+-#define _PAGE_EXECUTE (1<<3) /* Page has user execute perm (H) */
+-#define _PAGE_WRITE (1<<4) /* Page has user write perm (H) */
+-#define _PAGE_READ (1<<5) /* Page has user read perm (H) */
++#define _PAGE_U_EXECUTE (1<<3) /* Page has user execute perm (H) */
++#define _PAGE_U_WRITE (1<<4) /* Page has user write perm (H) */
++#define _PAGE_U_READ (1<<5) /* Page has user read perm (H) */
+ #define _PAGE_K_EXECUTE (1<<6) /* Page has kernel execute perm (H) */
+ #define _PAGE_K_WRITE (1<<7) /* Page has kernel write perm (H) */
+ #define _PAGE_K_READ (1<<8) /* Page has kernel perm (H) */
+@@ -72,9 +72,9 @@
+
+ /* PD1 */
+ #define _PAGE_CACHEABLE (1<<0) /* Page is cached (H) */
+-#define _PAGE_EXECUTE (1<<1) /* Page has user execute perm (H) */
+-#define _PAGE_WRITE (1<<2) /* Page has user write perm (H) */
+-#define _PAGE_READ (1<<3) /* Page has user read perm (H) */
++#define _PAGE_U_EXECUTE (1<<1) /* Page has user execute perm (H) */
++#define _PAGE_U_WRITE (1<<2) /* Page has user write perm (H) */
++#define _PAGE_U_READ (1<<3) /* Page has user read perm (H) */
+ #define _PAGE_K_EXECUTE (1<<4) /* Page has kernel execute perm (H) */
+ #define _PAGE_K_WRITE (1<<5) /* Page has kernel write perm (H) */
+ #define _PAGE_K_READ (1<<6) /* Page has kernel perm (H) */
+@@ -93,7 +93,8 @@
+ #endif
+
+ /* Kernel allowed all permissions for all pages */
+-#define _K_PAGE_PERMS (_PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ)
++#define _K_PAGE_PERMS (_PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ | \
++ _PAGE_GLOBAL | _PAGE_PRESENT)
+
+ #ifdef CONFIG_ARC_CACHE_PAGES
+ #define _PAGE_DEF_CACHEABLE _PAGE_CACHEABLE
+@@ -106,7 +107,11 @@
+ * -by default cached, unless config otherwise
+ * -present in memory
+ */
+-#define ___DEF (_PAGE_PRESENT | _K_PAGE_PERMS | _PAGE_DEF_CACHEABLE)
++#define ___DEF (_PAGE_PRESENT | _PAGE_DEF_CACHEABLE)
++
++#define _PAGE_READ (_PAGE_U_READ | _PAGE_K_READ)
++#define _PAGE_WRITE (_PAGE_U_WRITE | _PAGE_K_WRITE)
++#define _PAGE_EXECUTE (_PAGE_U_EXECUTE | _PAGE_K_EXECUTE)
+
+ /* Set of bits not changed in pte_modify */
+ #define _PAGE_CHG_MASK (PAGE_MASK | _PAGE_ACCESSED | _PAGE_MODIFIED)
+@@ -125,11 +130,10 @@
+ * kernel vaddr space - visible in all addr spaces, but kernel mode only
+ * Thus Global, all-kernel-access, no-user-access, cached
+ */
+-#define PAGE_KERNEL __pgprot(___DEF | _PAGE_GLOBAL)
++#define PAGE_KERNEL __pgprot(_K_PAGE_PERMS | _PAGE_DEF_CACHEABLE)
+
+ /* ioremap */
+-#define PAGE_KERNEL_NO_CACHE __pgprot(_PAGE_PRESENT | _K_PAGE_PERMS | \
+- _PAGE_GLOBAL)
++#define PAGE_KERNEL_NO_CACHE __pgprot(_K_PAGE_PERMS)
+
+ /**************************************************************************
+ * Mapping of vm_flags (Generic VM) to PTE flags (arch specific)
+--- a/arch/arc/include/asm/tlb.h
++++ b/arch/arc/include/asm/tlb.h
+@@ -16,7 +16,7 @@
+ /* Masks for actual TLB "PD"s */
+ #define PTE_BITS_IN_PD0 (_PAGE_GLOBAL | _PAGE_PRESENT)
+ #define PTE_BITS_IN_PD1 (PAGE_MASK | _PAGE_CACHEABLE | \
+- _PAGE_EXECUTE | _PAGE_WRITE | _PAGE_READ | \
++ _PAGE_U_EXECUTE | _PAGE_U_WRITE | _PAGE_U_READ | \
+ _PAGE_K_EXECUTE | _PAGE_K_WRITE | _PAGE_K_READ)
+
+ #ifndef __ASSEMBLY__
+--- a/arch/arc/mm/tlbex.S
++++ b/arch/arc/mm/tlbex.S
+@@ -277,7 +277,7 @@ ARC_ENTRY EV_TLBMissI
+ ;----------------------------------------------------------------
+ ; VERIFY_PTE: Check if PTE permissions approp for executing code
+ cmp_s r2, VMALLOC_START
+- mov.lo r2, (_PAGE_PRESENT | _PAGE_READ | _PAGE_EXECUTE)
++ mov.lo r2, (_PAGE_PRESENT | _PAGE_U_READ | _PAGE_U_EXECUTE)
+ mov.hs r2, (_PAGE_PRESENT | _PAGE_K_READ | _PAGE_K_EXECUTE)
+
+ and r3, r0, r2 ; Mask out NON Flag bits from PTE
+@@ -320,9 +320,9 @@ ARC_ENTRY EV_TLBMissD
+ mov_s r2, 0
+ lr r3, [ecr]
+ btst_s r3, ECR_C_BIT_DTLB_LD_MISS ; Read Access
+- or.nz r2, r2, _PAGE_READ ; chk for Read flag in PTE
++ or.nz r2, r2, _PAGE_U_READ ; chk for Read flag in PTE
+ btst_s r3, ECR_C_BIT_DTLB_ST_MISS ; Write Access
+- or.nz r2, r2, _PAGE_WRITE ; chk for Write flag in PTE
++ or.nz r2, r2, _PAGE_U_WRITE ; chk for Write flag in PTE
+ ; Above laddering takes care of XCHG access
+ ; which is both Read and Write
+
--- /dev/null
+From 934fc24df10abfd5aff533d0d044a17669d77d79 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@gmail.com>
+Date: Wed, 15 May 2013 10:46:30 +0100
+Subject: ARM: 7723/1: crypto: sha1-armv4-large.S: fix SP handling
+
+From: Ard Biesheuvel <ard.biesheuvel@gmail.com>
+
+commit 934fc24df10abfd5aff533d0d044a17669d77d79 upstream.
+
+Make the SHA1 asm code ABI conformant by making sure all stack
+accesses occur above the stack pointer.
+
+Origin:
+http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1a9d60d2
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/crypto/sha1-armv4-large.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/crypto/sha1-armv4-large.S
++++ b/arch/arm/crypto/sha1-armv4-large.S
+@@ -195,6 +195,7 @@ ENTRY(sha1_block_data_order)
+ add r3,r3,r10 @ E+=F_00_19(B,C,D)
+ cmp r14,sp
+ bne .L_00_15 @ [((11+4)*5+2)*3]
++ sub sp,sp,#25*4
+ #if __ARM_ARCH__<7
+ ldrb r10,[r1,#2]
+ ldrb r9,[r1,#3]
+@@ -290,7 +291,6 @@ ENTRY(sha1_block_data_order)
+ add r3,r3,r10 @ E+=F_00_19(B,C,D)
+
+ ldr r8,.LK_20_39 @ [+15+16*4]
+- sub sp,sp,#25*4
+ cmn sp,#0 @ [+3], clear carry to denote 20_39
+ .L_20_39_or_60_79:
+ ldr r9,[r14,#15*4]
--- /dev/null
+From a6d25f4c951b8b28f2eaec6f891ff834622532f2 Mon Sep 17 00:00:00 2001
+From: Vaibhav Hiremath <hvaibhav@ti.com>
+Date: Wed, 27 Mar 2013 15:34:26 +0530
+Subject: ARM: AM33XX: Add missing .clkdm_name to clkdiv32k_ick clock
+
+From: Vaibhav Hiremath <hvaibhav@ti.com>
+
+commit a6d25f4c951b8b28f2eaec6f891ff834622532f2 upstream.
+
+It is required to enable respective clock-domain before
+enabling any clock/module inside that clock-domain.
+
+During common-clock migration, .clkdm_name field got missed
+for "clkdiv32k_ick" clock, which leaves "clk_24mhz_clkdm"
+unused; so it will be disabled even if childs of this clock-domain
+is enabled, which keeps child modules in idle mode.
+
+This fixes the kernel crash observed on AM335xEVM-SK platform,
+where clkdiv32_ick clock is being used as a gpio debounce clock
+and since clkdiv32k_ick is in idle mode it leads to below crash -
+
+Crash Log:
+==========
+[ 2.598347] Unhandled fault: external abort on non-linefetch (0x1028) at
+0xfa1ac150
+[ 2.606434] Internal error: : 1028 [#1] SMP ARM
+[ 2.611207] Modules linked in:
+[ 2.614449] CPU: 0 Not tainted (3.8.4-01382-g1f449cd-dirty #4)
+[ 2.620973] PC is at _set_gpio_debounce+0x60/0x104
+[ 2.626025] LR is at clk_enable+0x30/0x3c
+
+Signed-off-by: Vaibhav Hiremath <hvaibhav@ti.com>
+Cc: Rajendra Nayak <rnayak@ti.com>
+Acked-by: Paul Walmsley <paul@pwsan.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/cclock33xx_data.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/mach-omap2/cclock33xx_data.c
++++ b/arch/arm/mach-omap2/cclock33xx_data.c
+@@ -446,9 +446,29 @@ DEFINE_CLK_GATE(cefuse_fck, "sys_clkin_c
+ */
+ DEFINE_CLK_FIXED_FACTOR(clkdiv32k_ck, "clk_24mhz", &clk_24mhz, 0x0, 1, 732);
+
+-DEFINE_CLK_GATE(clkdiv32k_ick, "clkdiv32k_ck", &clkdiv32k_ck, 0x0,
+- AM33XX_CM_PER_CLKDIV32K_CLKCTRL, AM33XX_MODULEMODE_SWCTRL_SHIFT,
+- 0x0, NULL);
++static struct clk clkdiv32k_ick;
++
++static const char *clkdiv32k_ick_parent_names[] = {
++ "clkdiv32k_ck",
++};
++
++static const struct clk_ops clkdiv32k_ick_ops = {
++ .enable = &omap2_dflt_clk_enable,
++ .disable = &omap2_dflt_clk_disable,
++ .is_enabled = &omap2_dflt_clk_is_enabled,
++ .init = &omap2_init_clk_clkdm,
++};
++
++static struct clk_hw_omap clkdiv32k_ick_hw = {
++ .hw = {
++ .clk = &clkdiv32k_ick,
++ },
++ .enable_reg = AM33XX_CM_PER_CLKDIV32K_CLKCTRL,
++ .enable_bit = AM33XX_MODULEMODE_SWCTRL_SHIFT,
++ .clkdm_name = "clk_24mhz_clkdm",
++};
++
++DEFINE_STRUCT_CLK(clkdiv32k_ick, clkdiv32k_ick_parent_names, clkdiv32k_ick_ops);
+
+ /* "usbotg_fck" is an additional clock and not really a modulemode */
+ DEFINE_CLK_GATE(usbotg_fck, "dpll_per_ck", &dpll_per_ck, 0x0,
--- /dev/null
+From f6d35d67d0a5c159f767a20f4fcc1d295a7314b1 Mon Sep 17 00:00:00 2001
+From: Boris BREZILLON <b.brezillon@overkiz.com>
+Date: Thu, 23 May 2013 18:01:21 +0200
+Subject: ARM: at91/dt: fix macb pinctrl_macb_rmii_mii_alt definition
+
+From: Boris BREZILLON <b.brezillon@overkiz.com>
+
+commit f6d35d67d0a5c159f767a20f4fcc1d295a7314b1 upstream.
+
+The PA24 pin is wrongly assigned to peripheral B.
+In the current config there is 2 ETX3 pins (PA11 and PA24) and
+no ETXER pin (PA22).
+
+Signed-off-by: Boris BREZILLON <b.brezillon@overkiz.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91sam9260.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/at91sam9260.dtsi
++++ b/arch/arm/boot/dts/at91sam9260.dtsi
+@@ -264,7 +264,7 @@
+ atmel,pins =
+ <0 10 0x2 0x0 /* PA10 periph B */
+ 0 11 0x2 0x0 /* PA11 periph B */
+- 0 24 0x2 0x0 /* PA24 periph B */
++ 0 22 0x2 0x0 /* PA22 periph B */
+ 0 25 0x2 0x0 /* PA25 periph B */
+ 0 26 0x2 0x0 /* PA26 periph B */
+ 0 27 0x2 0x0 /* PA27 periph B */
--- /dev/null
+From b7a8ca5173ef9aa55fa039d7c216426ff0b25a12 Mon Sep 17 00:00:00 2001
+From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Date: Wed, 15 May 2013 12:12:33 +0200
+Subject: ARM: at91: rm9200 fix time support
+
+From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+
+commit b7a8ca5173ef9aa55fa039d7c216426ff0b25a12 upstream.
+
+since commit 838a2ae80a6ab52139fb1bf0a93ea8c5eff94488
+Author: Shawn Guo <shawn.guo@linaro.org>
+Date: Sat Jan 12 11:50:05 2013 +0000
+
+ARM: use clockevents_config_and_register() where possible
+
+The timer is wrongly configured and result in a nice crash
+so revert it on rm9200 timer.
+
+Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Cc: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-at91/at91rm9200_time.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-at91/at91rm9200_time.c
++++ b/arch/arm/mach-at91/at91rm9200_time.c
+@@ -174,6 +174,7 @@ clkevt32k_next_event(unsigned long delta
+ static struct clock_event_device clkevt = {
+ .name = "at91_tick",
+ .features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
++ .shift = 32,
+ .rating = 150,
+ .set_next_event = clkevt32k_next_event,
+ .set_mode = clkevt32k_mode,
+@@ -264,9 +265,11 @@ void __init at91rm9200_timer_init(void)
+ at91_st_write(AT91_ST_RTMR, 1);
+
+ /* Setup timer clockevent, with minimum of two ticks (important!!) */
++ clkevt.mult = div_sc(AT91_SLOW_CLOCK, NSEC_PER_SEC, clkevt.shift);
++ clkevt.max_delta_ns = clockevent_delta2ns(AT91_ST_ALMV, &clkevt);
++ clkevt.min_delta_ns = clockevent_delta2ns(2, &clkevt) + 1;
+ clkevt.cpumask = cpumask_of(0);
+- clockevents_config_and_register(&clkevt, AT91_SLOW_CLOCK,
+- 2, AT91_ST_ALMV);
++ clockevents_register_device(&clkevt);
+
+ /* register clocksource */
+ clocksource_register_hz(&clk32k, AT91_SLOW_CLOCK);
--- /dev/null
+From 9349d00fc3ff2b110dc07d9f5d06abfeac300c19 Mon Sep 17 00:00:00 2001
+From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Date: Tue, 7 May 2013 22:06:57 +0200
+Subject: ARM: at91/trivial: fix model name for SAM9X25-EK
+
+From: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+
+commit 9349d00fc3ff2b110dc07d9f5d06abfeac300c19 upstream.
+
+Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91sam9x25ek.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/at91sam9x25ek.dts
++++ b/arch/arm/boot/dts/at91sam9x25ek.dts
+@@ -11,6 +11,6 @@
+ /include/ "at91sam9x5ek.dtsi"
+
+ / {
+- model = "Atmel AT91SAM9G25-EK";
++ model = "Atmel AT91SAM9X25-EK";
+ compatible = "atmel,at91sam9x25ek", "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9";
+ };
--- /dev/null
+From 0f497039276fa2ca2ca324236848bb15c8c775dc Mon Sep 17 00:00:00 2001
+From: jean-philippe francois <jp.francois@cynove.com>
+Date: Thu, 16 May 2013 11:25:07 -0700
+Subject: ARM: OMAP: fix __init section mismatch for _enable_preprogram
+
+From: jean-philippe francois <jp.francois@cynove.com>
+
+commit 0f497039276fa2ca2ca324236848bb15c8c775dc upstream.
+
+_enable_preprogram is marked as __init, but is called from _enable
+which is not. Without this patch, the board oopses after init. Tested
+on custom hardware and on beagle board xM. Otherwise we can get:
+
+Unable to handle kernel paging request at virtual address 000b0012
+pgd = cf968000
+*pgd=8fb06831, *pte=00000000, *ppte=00000000
+PREEMPT ARM
+Modules linked in:
+CPU: 0 Not tainted (3.9.0 #2)
+PC is at _enable_preprogram+0x1c/0x24
+LR is at omap_hwmod_enable+0x34/0x60
+ psr: 80000093
+sp : cf95de08 ip : 00002de5 fp : bec33d4c
+r10: 00000000 r9 : 00000002 r8 : b6dd2c78
+r7 : 00000004 r6 : 00000000 r5 : a0000013 r4 : cf95c000
+r3 : 00000000 r2 : b6dd2c7c r1 : 00000000 r0 : 000b0012
+Flags: Nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
+Control: 10c5387d Table: 8f968019 DAC: 00000015
+Process otpcmd (pid: 607, stack limit = 0xcf95c230)
+Stack: (0xcf95de08 to 0xcf95e000)
+de00: 00000001 cf91f840 00000000 c001d6fc 00000002 cf91f840
+de20: cf8f7e10 c001de54 cf8f7e10 c001de78 c001de68 c01d5e80 00000000 cf8f7e10
+de40: cf8f7e10 c01d5f28 cf8f7e10 c0530d30 00000000 c01d6f28 00000000 c0088664
+de60: b6ea1000 cfb05284 cf95c000 00000001 cf95c000 60000013 00000001 cf95dee4
+de80: cf870050 c01d7308 cf870010 cf870050 00000001 c0278b14 c0526f28 00000000
+dea0: cf870050 ffff8e18 00000001 cf95dee4 00000000 c0274f7c cf870050 00000001
+dec0: cf95dee4 cf1d8484 000000e0 c0276464 00000008 cf9c0000 00000007 c0276980
+dee0: cf9c0000 00000064 00000008 cf1d8404 cf1d8400 c01cc05c 0000270a cf1d8504
+df00: 00000023 cf1d8484 00000007 c01cc670 00000bdd 00000001 00000000 cf449e60
+df20: cf1dde70 cf1d8400 bec33d18 cf1d8504 c0246f00 00000003 cf95c000 00000000
+df40: bec33d4c c01cd078 00000003 cf1d8504 00000081 c01cbcb8 bec33d18 00000003
+df60: bec33d18 c00a9034 00002000 c00a9c68 cf92fe00 00000003 c0246f00 cf92fe00
+df80: 00000000 c00a9cb0 00000003 00000000 00008e70 00000000 b6f17000 00000036
+dfa0: c000e484 c000e300 00008e70 00000000 00000003 c0246f00 bec33d18 bec33d18
+dfc0: 00008e70 00000000 b6f17000 00000036 00000000 00000000 b6f6d000 bec33d4c
+dfe0: b6ea1bd0 bec33d0c 00008c9c b6ea1bdc 60000010 00000003 00000000 00000000
+(_omap_device_enable_hwmods+0x20/0x34)
+(omap_device_enable+0x3c/0x50)
+(_od_runtime_resume+0x10/0x1c)
+(__rpm_callback+0x54/0x98)
+(rpm_callback+0x64/0x7c)
+(rpm_resume+0x434/0x554)
+(__pm_runtime_resume+0x48/0x74)
+(omap_i2c_xfer+0x28/0xe8)
+(__i2c_transfer+0x3c/0x78)
+(i2c_transfer+0x6c/0xc0)
+(i2c_master_send+0x38/0x48)
+(sha204p_send_command+0x60/0x9c)
+(sha204c_send_and_receive+0x5c/0x1e0)
+(sha204m_read+0x94/0xa0)
+(otp_do_read+0x50/0xa4)
+(vfs_ioctl+0x24/0x40)
+(do_vfs_ioctl+0x1b0/0x1c0)
+(sys_ioctl+0x38/0x54)
+(ret_fast_syscall+0x0/0x30)
+Code: e1a08002 ea000009 e598003c e592c05c (e7904003)
+
+Signed-off-by: Jean-Philippe Fran=C3=A7ois <jp.francois@cynove.com>
+Acked-by: Kevin Hilman <khilman@linaro.org>
+[tony@atomide.com: updated description with oops]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2066,7 +2066,7 @@ static int _omap4_get_context_lost(struc
+ * do so is present in the hwmod data, then call it and pass along the
+ * return value; otherwise, return 0.
+ */
+-static int __init _enable_preprogram(struct omap_hwmod *oh)
++static int _enable_preprogram(struct omap_hwmod *oh)
+ {
+ if (!oh->class->enable_preprogram)
+ return 0;
--- /dev/null
+From 2b8b2797142c7951e635c6eec5d1705ee9bc45c5 Mon Sep 17 00:00:00 2001
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Date: Sun, 19 May 2013 22:12:43 +0200
+Subject: ARM: plat-orion: Fix num_resources and id for ge10 and ge11
+
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+
+commit 2b8b2797142c7951e635c6eec5d1705ee9bc45c5 upstream.
+
+When platform data were moved from arch/arm/mach-mv78xx0/common.c to
+arch/arm/plat-orion/common.c with the commit "7e3819d ARM: orion:
+Consolidate ethernet platform data", there were few typo made on
+gigabit Ethernet interface ge10 and ge11. This commit writes back
+their initial value, which allows to use this interfaces again.
+
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Acked-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/plat-orion/common.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/plat-orion/common.c
++++ b/arch/arm/plat-orion/common.c
+@@ -373,7 +373,7 @@ static struct resource orion_ge10_shared
+
+ static struct platform_device orion_ge10_shared = {
+ .name = MV643XX_ETH_SHARED_NAME,
+- .id = 1,
++ .id = 2,
+ .dev = {
+ .platform_data = &orion_ge10_shared_data,
+ },
+@@ -388,8 +388,8 @@ static struct resource orion_ge10_resour
+
+ static struct platform_device orion_ge10 = {
+ .name = MV643XX_ETH_NAME,
+- .id = 1,
+- .num_resources = 2,
++ .id = 2,
++ .num_resources = 1,
+ .resource = orion_ge10_resources,
+ .dev = {
+ .coherent_dma_mask = DMA_BIT_MASK(32),
+@@ -425,7 +425,7 @@ static struct resource orion_ge11_shared
+
+ static struct platform_device orion_ge11_shared = {
+ .name = MV643XX_ETH_SHARED_NAME,
+- .id = 1,
++ .id = 3,
+ .dev = {
+ .platform_data = &orion_ge11_shared_data,
+ },
+@@ -440,8 +440,8 @@ static struct resource orion_ge11_resour
+
+ static struct platform_device orion_ge11 = {
+ .name = MV643XX_ETH_NAME,
+- .id = 1,
+- .num_resources = 2,
++ .id = 3,
++ .num_resources = 1,
+ .resource = orion_ge11_resources,
+ .dev = {
+ .coherent_dma_mask = DMA_BIT_MASK(32),
--- /dev/null
+From e248ad30204eff6559b4d2d94d49d9d46c08185a Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 16 May 2013 10:24:28 +0200
+Subject: cfg80211: fix sending WoWLAN TCP wakeup settings
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit e248ad30204eff6559b4d2d94d49d9d46c08185a upstream.
+
+The code sending the current WoWLAN TCP wakeup settings in
+nl80211_send_wowlan_tcp() is not closing the nested attribute,
+thus causing the parser to get confused on the receiver side
+in userspace (iw). Fix this.
+
+Reported-by: Deepak Arora <deepakx.arora@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/nl80211.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -7177,6 +7177,8 @@ static int nl80211_send_wowlan_tcp(struc
+ &tcp->payload_tok))
+ return -ENOBUFS;
+
++ nla_nest_end(msg, nl_tcp);
++
+ return 0;
+ }
+
--- /dev/null
+From 03cd7e4e1ea16cd151c799a33b5ca1fd41a464df Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 10 May 2013 19:23:40 +0200
+Subject: cfg80211: fix wiphy_register error path
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 03cd7e4e1ea16cd151c799a33b5ca1fd41a464df upstream.
+
+If rfkill_register() fails in wiphy_register() the struct device
+is unregistered but everything else isn't (regulatory, debugfs)
+and we even leave the wiphy instance on all internal lists even
+though it will likely be freed soon, which is clearly a problem.
+Fix this by cleaning up properly.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/core.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -638,17 +638,21 @@ int wiphy_register(struct wiphy *wiphy)
+ * cfg80211_mutex lock
+ */
+ res = rfkill_register(rdev->rfkill);
+- if (res)
+- goto out_rm_dev;
++ if (res) {
++ device_del(&rdev->wiphy.dev);
++
++ mutex_lock(&cfg80211_mutex);
++ debugfs_remove_recursive(rdev->wiphy.debugfsdir);
++ list_del_rcu(&rdev->list);
++ wiphy_regulatory_deregister(wiphy);
++ mutex_unlock(&cfg80211_mutex);
++ return res;
++ }
+
+ rtnl_lock();
+ rdev->wiphy.registered = true;
+ rtnl_unlock();
+ return 0;
+-
+-out_rm_dev:
+- device_del(&rdev->wiphy.dev);
+- return res;
+ }
+ EXPORT_SYMBOL(wiphy_register);
+
--- /dev/null
+From a92eecbbeaf01ea2267751569dd3301248513915 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 29 Apr 2013 12:09:14 +0200
+Subject: cfg80211: fix WoWLAN wakeup tracing
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit a92eecbbeaf01ea2267751569dd3301248513915 upstream.
+
+If the device reports a non-wireless wakeup reason, the
+tracing code crashes trying to dereference a NULL pointer.
+Fix this by checking the pointer on all accesses and also
+add a non_wireless tag to the event.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/trace.h | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -2386,6 +2386,7 @@ TRACE_EVENT(cfg80211_report_wowlan_wakeu
+ TP_STRUCT__entry(
+ WIPHY_ENTRY
+ WDEV_ENTRY
++ __field(bool, non_wireless)
+ __field(bool, disconnect)
+ __field(bool, magic_pkt)
+ __field(bool, gtk_rekey_failure)
+@@ -2394,20 +2395,22 @@ TRACE_EVENT(cfg80211_report_wowlan_wakeu
+ __field(bool, rfkill_release)
+ __field(s32, pattern_idx)
+ __field(u32, packet_len)
+- __dynamic_array(u8, packet, wakeup->packet_present_len)
++ __dynamic_array(u8, packet,
++ wakeup ? wakeup->packet_present_len : 0)
+ ),
+ TP_fast_assign(
+ WIPHY_ASSIGN;
+ WDEV_ASSIGN;
+- __entry->disconnect = wakeup->disconnect;
+- __entry->magic_pkt = wakeup->magic_pkt;
+- __entry->gtk_rekey_failure = wakeup->gtk_rekey_failure;
+- __entry->eap_identity_req = wakeup->eap_identity_req;
+- __entry->four_way_handshake = wakeup->four_way_handshake;
+- __entry->rfkill_release = wakeup->rfkill_release;
+- __entry->pattern_idx = wakeup->pattern_idx;
+- __entry->packet_len = wakeup->packet_len;
+- if (wakeup->packet && wakeup->packet_present_len)
++ __entry->non_wireless = !wakeup;
++ __entry->disconnect = wakeup ? wakeup->disconnect : false;
++ __entry->magic_pkt = wakeup ? wakeup->magic_pkt : false;
++ __entry->gtk_rekey_failure = wakeup ? wakeup->gtk_rekey_failure : false;
++ __entry->eap_identity_req = wakeup ? wakeup->eap_identity_req : false;
++ __entry->four_way_handshake = wakeup ? wakeup->four_way_handshake : false;
++ __entry->rfkill_release = wakeup ? wakeup->rfkill_release : false;
++ __entry->pattern_idx = wakeup ? wakeup->pattern_idx : false;
++ __entry->packet_len = wakeup ? wakeup->packet_len : false;
++ if (wakeup && wakeup->packet && wakeup->packet_present_len)
+ memcpy(__get_dynamic_array(packet), wakeup->packet,
+ wakeup->packet_present_len);
+ ),
--- /dev/null
+From c2b93e0699723700f886ce17bb65ffd771195a6d Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 7 May 2013 11:28:31 -0400
+Subject: cifs: only set ops for inodes in I_NEW state
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit c2b93e0699723700f886ce17bb65ffd771195a6d upstream.
+
+It's generally not safe to reset the inode ops once they've been set. In
+the case where the inode was originally thought to be a directory and
+then later found to be a DFS referral, this can lead to an oops when we
+try to trigger an inode op on it after changing the ops to the blank
+referral operations.
+
+Reported-and-Tested-by: Sachin Prabhu <sprabhu@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/inode.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -169,7 +169,8 @@ cifs_fattr_to_inode(struct inode *inode,
+
+ if (fattr->cf_flags & CIFS_FATTR_DFS_REFERRAL)
+ inode->i_flags |= S_AUTOMOUNT;
+- cifs_set_ops(inode);
++ if (inode->i_state & I_NEW)
++ cifs_set_ops(inode);
+ }
+
+ void
--- /dev/null
+From 1e7e2e05c179a68aaf8830fe91547a87f4589e53 Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Fri, 24 May 2013 15:55:31 -0700
+Subject: drivers/char/random.c: fix priming of last_data
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit 1e7e2e05c179a68aaf8830fe91547a87f4589e53 upstream.
+
+Commit ec8f02da9ea5 ("random: prime last_data value per fips
+requirements") added priming of last_data per fips requirements.
+
+Unfortuantely, it did so in a way that can lead to multiple threads all
+incrementing nbytes, but only one actually doing anything with the extra
+data, which leads to some fun random corruption and panics.
+
+The fix is to simply do everything needed to prime last_data in a single
+shot, so there's no window for multiple cpus to increment nbytes -- in
+fact, we won't even increment or decrement nbytes anymore, we'll just
+extract the needed EXTRACT_SIZE one time per pool and then carry on with
+the normal routine.
+
+All these changes have been tested across multiple hosts and
+architectures where panics were previously encoutered. The code changes
+are are strictly limited to areas only touched when when booted in fips
+mode.
+
+This change should also go into 3.8-stable, to make the myriads of fips
+users on 3.8.x happy.
+
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Tested-by: Jan Stancek <jstancek@redhat.com>
+Tested-by: Jan Stodola <jstodola@redhat.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Matt Mackall <mpm@selenic.com>
+Cc: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/random.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -957,10 +957,23 @@ static ssize_t extract_entropy(struct en
+ {
+ ssize_t ret = 0, i;
+ __u8 tmp[EXTRACT_SIZE];
++ unsigned long flags;
+
+ /* if last_data isn't primed, we need EXTRACT_SIZE extra bytes */
+- if (fips_enabled && !r->last_data_init)
+- nbytes += EXTRACT_SIZE;
++ if (fips_enabled) {
++ spin_lock_irqsave(&r->lock, flags);
++ if (!r->last_data_init) {
++ r->last_data_init = true;
++ spin_unlock_irqrestore(&r->lock, flags);
++ trace_extract_entropy(r->name, EXTRACT_SIZE,
++ r->entropy_count, _RET_IP_);
++ xfer_secondary_pool(r, EXTRACT_SIZE);
++ extract_buf(r, tmp);
++ spin_lock_irqsave(&r->lock, flags);
++ memcpy(r->last_data, tmp, EXTRACT_SIZE);
++ }
++ spin_unlock_irqrestore(&r->lock, flags);
++ }
+
+ trace_extract_entropy(r->name, nbytes, r->entropy_count, _RET_IP_);
+ xfer_secondary_pool(r, nbytes);
+@@ -970,19 +983,6 @@ static ssize_t extract_entropy(struct en
+ extract_buf(r, tmp);
+
+ if (fips_enabled) {
+- unsigned long flags;
+-
+-
+- /* prime last_data value if need be, per fips 140-2 */
+- if (!r->last_data_init) {
+- spin_lock_irqsave(&r->lock, flags);
+- memcpy(r->last_data, tmp, EXTRACT_SIZE);
+- r->last_data_init = true;
+- nbytes -= EXTRACT_SIZE;
+- spin_unlock_irqrestore(&r->lock, flags);
+- extract_buf(r, tmp);
+- }
+-
+ spin_lock_irqsave(&r->lock, flags);
+ if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
+ panic("Hardware RNG duplicated output!\n");
--- /dev/null
+From d2242a384355773c711a936522bcfae0f35f8c2a Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Fri, 17 May 2013 09:30:35 -0700
+Subject: Drivers: hv: Fix a bug in get_vp_index()
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit d2242a384355773c711a936522bcfae0f35f8c2a upstream.
+
+Linux' notion of cpuid is different from the Host's notion of CPUID. In the
+call to bind the channel interrupts, we should use the host's notion of
+CPU Ids. Fix this bug.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/channel_mgmt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -318,7 +318,7 @@ static u32 get_vp_index(uuid_le *type_gu
+ return 0;
+ }
+ cur_cpu = (++next_vp % max_cpus);
+- return cur_cpu;
++ return hv_context.vp_index[cur_cpu];
+ }
+
+ /*
--- /dev/null
+From 7b92d03c3239f43e5b86c9cc9630f026d36ee995 Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Fri, 24 May 2013 15:55:08 -0700
+Subject: fat: fix possible overflow for fat_clusters
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit 7b92d03c3239f43e5b86c9cc9630f026d36ee995 upstream.
+
+Intermediate value of fat_clusters can be overflowed on 32bits arch.
+
+Reported-by: Krzysztof Strasburger <strasbur@chkw386.ch.pwr.wroc.pl>
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fat/inode.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/fs/fat/inode.c
++++ b/fs/fat/inode.c
+@@ -1223,6 +1223,19 @@ static int fat_read_root(struct inode *i
+ return 0;
+ }
+
++static unsigned long calc_fat_clusters(struct super_block *sb)
++{
++ struct msdos_sb_info *sbi = MSDOS_SB(sb);
++
++ /* Divide first to avoid overflow */
++ if (sbi->fat_bits != 12) {
++ unsigned long ent_per_sec = sb->s_blocksize * 8 / sbi->fat_bits;
++ return ent_per_sec * sbi->fat_length;
++ }
++
++ return sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
++}
++
+ /*
+ * Read the super block of an MS-DOS FS.
+ */
+@@ -1427,7 +1440,7 @@ int fat_fill_super(struct super_block *s
+ sbi->dirty = b->fat16.state & FAT_STATE_DIRTY;
+
+ /* check that FAT table does not overflow */
+- fat_clusters = sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
++ fat_clusters = calc_fat_clusters(sb);
+ total_clusters = min(total_clusters, fat_clusters - FAT_START_ENT);
+ if (total_clusters > MAX_FAT(sb)) {
+ if (!silent)
--- /dev/null
+From 3c9cfa782e075cc2348b949ba139911aac02c7cb Mon Sep 17 00:00:00 2001
+From: Heiko Abraham <abrahamh@web.de>
+Date: Sun, 5 May 2013 19:49:49 -0700
+Subject: Input: egalax_ts - ABS_MT_POSITION_Y not reported well
+
+From: Heiko Abraham <abrahamh@web.de>
+
+commit 3c9cfa782e075cc2348b949ba139911aac02c7cb upstream.
+
+The egalax_ts touchscreen modul not report ABS_MT_POSITION_Y proper.
+As result it may be, that upper software levels only receive x coordinates well.
+
+Signed-off-by: Heiko Abraham <abrahamh@web.de>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/touchscreen/egalax_ts.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/egalax_ts.c
++++ b/drivers/input/touchscreen/egalax_ts.c
+@@ -216,7 +216,7 @@ static int egalax_ts_probe(struct i2c_cl
+ input_set_abs_params(input_dev,
+ ABS_MT_POSITION_X, 0, EGALAX_MAX_X, 0, 0);
+ input_set_abs_params(input_dev,
+- ABS_MT_POSITION_X, 0, EGALAX_MAX_Y, 0, 0);
++ ABS_MT_POSITION_Y, 0, EGALAX_MAX_Y, 0, 0);
+ input_mt_init_slots(input_dev, MAX_SUPPORT_POINTS, 0);
+
+ input_set_drvdata(input_dev, ts);
--- /dev/null
+From f70ed7b330ce769828d402f920fb13da6c13ea63 Mon Sep 17 00:00:00 2001
+From: Ilan Peer <ilan.peer@intel.com>
+Date: Sun, 28 Apr 2013 08:18:28 +0300
+Subject: iwlwifi: mvm: Always use SCAN_TYPE_FORCED
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+commit f70ed7b330ce769828d402f920fb13da6c13ea63 upstream.
+
+The FW AUX framework does not handle well cases where time events
+fail to be scheduled (and as a result issues assert 0x3330). Until
+a proper fix is in place, WA this by always setting the scan type to
+SCAN_TYPE_FORCED.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/scan.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
+@@ -298,6 +298,12 @@ int iwl_mvm_scan_request(struct iwl_mvm
+ else
+ cmd->type = cpu_to_le32(SCAN_TYPE_FORCED);
+
++ /*
++ * TODO: This is a WA due to a bug in the FW AUX framework that does not
++ * properly handle time events that fail to be scheduled
++ */
++ cmd->type = cpu_to_le32(SCAN_TYPE_FORCED);
++
+ cmd->repeats = cpu_to_le32(1);
+
+ /*
--- /dev/null
+From ba283927268d45184c17c37ff78d427e59026229 Mon Sep 17 00:00:00 2001
+From: Alexander Bondar <alexander.bondar@intel.com>
+Date: Thu, 2 May 2013 16:34:48 +0300
+Subject: iwlwifi: mvm: Prevent setting assoc flag in MAC_CONTEXT_CMD
+
+From: Alexander Bondar <alexander.bondar@intel.com>
+
+commit ba283927268d45184c17c37ff78d427e59026229 upstream.
+
+In the normal flow first MAC_CONTEXT_CMD for particular interface is
+never sent while associated. The exception is fw restart flow when
+resuming from suspend when WoWLAN is enabled. In this case successive
+"add" and "modify" MAC_CONTEXT_CMD commands may be sent with assoc flag
+set what cause FW mal functioning. To prevent this never set assoc flag
+in MAC_CONTEXT_CMD with action "add".
+
+Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+@@ -586,10 +586,12 @@ static int iwl_mvm_mac_ctxt_send_cmd(str
+ */
+ static void iwl_mvm_mac_ctxt_cmd_fill_sta(struct iwl_mvm *mvm,
+ struct ieee80211_vif *vif,
+- struct iwl_mac_data_sta *ctxt_sta)
++ struct iwl_mac_data_sta *ctxt_sta,
++ bool force_assoc_off)
+ {
+ /* We need the dtim_period to set the MAC as associated */
+- if (vif->bss_conf.assoc && vif->bss_conf.dtim_period) {
++ if (vif->bss_conf.assoc && vif->bss_conf.dtim_period &&
++ !force_assoc_off) {
+ u32 dtim_offs;
+
+ /*
+@@ -652,7 +654,8 @@ static int iwl_mvm_mac_ctxt_cmd_station(
+ iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
+
+ /* Fill the data specific for station mode */
+- iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.sta);
++ iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.sta,
++ action == FW_CTXT_ACTION_ADD);
+
+ return iwl_mvm_mac_ctxt_send_cmd(mvm, &cmd);
+ }
+@@ -669,7 +672,8 @@ static int iwl_mvm_mac_ctxt_cmd_p2p_clie
+ iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
+
+ /* Fill the data specific for station mode */
+- iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.p2p_sta.sta);
++ iwl_mvm_mac_ctxt_cmd_fill_sta(mvm, vif, &cmd.p2p_sta.sta,
++ action == FW_CTXT_ACTION_ADD);
+
+ cmd.p2p_sta.ctwin = cpu_to_le32(vif->bss_conf.p2p_ctwindow);
+
--- /dev/null
+From 2b9ccd4e4308272e5aec614b77c5385e7ec2ec90 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 13 May 2013 16:42:40 +0200
+Subject: mac80211: fix AP-mode frame matching
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 2b9ccd4e4308272e5aec614b77c5385e7ec2ec90 upstream.
+
+In AP mode, ignore frames with mis-matched BSSID that aren't
+multicast or sent to the correct destination. This fixes
+reporting public action frames to userspace multiple times
+on multiple virtual AP interfaces.
+
+Reported-by: Jouni Malinen <j@w1.fi>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3032,6 +3032,9 @@ static int prepare_for_handlers(struct i
+ * and location updates. Note that mac80211
+ * itself never looks at these frames.
+ */
++ if (!multicast &&
++ !ether_addr_equal(sdata->vif.addr, hdr->addr1))
++ return 0;
+ if (ieee80211_is_public_action(hdr, skb->len))
+ return 1;
+ if (!ieee80211_is_beacon(hdr->frame_control))
--- /dev/null
+From 655914ab863bcc06c84270e4159fd59002d6b529 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 6 May 2013 15:54:58 +0200
+Subject: mac80211: use just spin_lock() in ieee80211_get_tkip_p2k()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 655914ab863bcc06c84270e4159fd59002d6b529 upstream.
+
+ieee80211_get_tkip_p2k() may be called with interrupts
+disabled, so spin_unlock_bh() isn't safe and leads to
+warnings. Since it's always called with BHs disabled
+already, just use spin_lock().
+
+Reported-by: Milan Kocian <milon@wq.cz>
+Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/tkip.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/tkip.c
++++ b/net/mac80211/tkip.c
+@@ -208,10 +208,10 @@ void ieee80211_get_tkip_p2k(struct ieee8
+ u32 iv32 = get_unaligned_le32(&data[4]);
+ u16 iv16 = data[2] | (data[0] << 8);
+
+- spin_lock_bh(&key->u.tkip.txlock);
++ spin_lock(&key->u.tkip.txlock);
+ ieee80211_compute_tkip_p1k(key, iv32);
+ tkip_mixing_phase2(tk, ctx, iv16, p2k);
+- spin_unlock_bh(&key->u.tkip.txlock);
++ spin_unlock(&key->u.tkip.txlock);
+ }
+ EXPORT_SYMBOL(ieee80211_get_tkip_p2k);
+
--- /dev/null
+From 10b3a32d292c21ea5b3ad5ca5975e88bb20b8d68 Mon Sep 17 00:00:00 2001
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Fri, 24 May 2013 15:55:33 -0700
+Subject: random: fix accounting race condition with lockless irq entropy_count update
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+commit 10b3a32d292c21ea5b3ad5ca5975e88bb20b8d68 upstream.
+
+Commit 902c098a3663 ("random: use lockless techniques in the interrupt
+path") turned IRQ path from being spinlock protected into lockless
+cmpxchg-retry update.
+
+That commit removed r->lock serialization between crediting entropy bits
+from IRQ context and accounting when extracting entropy on userspace
+read path, but didn't turn the r->entropy_count reads/updates in
+account() to use cmpxchg as well.
+
+It has been observed, that under certain circumstances this leads to
+read() on /dev/urandom to return 0 (EOF), as r->entropy_count gets
+corrupted and becomes negative, which in turn results in propagating 0
+all the way from account() to the actual read() call.
+
+Convert the accounting code to be the proper lockless counterpart of
+what has been partially done by 902c098a3663.
+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Cc: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/random.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -865,16 +865,24 @@ static size_t account(struct entropy_sto
+ if (r->entropy_count / 8 < min + reserved) {
+ nbytes = 0;
+ } else {
++ int entropy_count, orig;
++retry:
++ entropy_count = orig = ACCESS_ONCE(r->entropy_count);
+ /* If limited, never pull more than available */
+- if (r->limit && nbytes + reserved >= r->entropy_count / 8)
+- nbytes = r->entropy_count/8 - reserved;
++ if (r->limit && nbytes + reserved >= entropy_count / 8)
++ nbytes = entropy_count/8 - reserved;
+
+- if (r->entropy_count / 8 >= nbytes + reserved)
+- r->entropy_count -= nbytes*8;
+- else
+- r->entropy_count = reserved;
++ if (entropy_count / 8 >= nbytes + reserved) {
++ entropy_count -= nbytes*8;
++ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
++ goto retry;
++ } else {
++ entropy_count = reserved;
++ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
++ goto retry;
++ }
+
+- if (r->entropy_count < random_write_wakeup_thresh)
++ if (entropy_count < random_write_wakeup_thresh)
+ wakeup_write = 1;
+ }
+
avr32-fix-relocation-check-for-signed-18-bit-offset.patch
usb-ohci-fix-logic-for-scheduling-isochronous-urbs.patch
usb-fix-latency-in-uhci-hcd-and-ohci-hcd.patch
+arm-plat-orion-fix-num_resources-and-id-for-ge10-and-ge11.patch
+arm-omap-fix-__init-section-mismatch-for-_enable_preprogram.patch
+arm-am33xx-add-missing-.clkdm_name-to-clkdiv32k_ick-clock.patch
+arm-7723-1-crypto-sha1-armv4-large.s-fix-sp-handling.patch
+arm-at91-trivial-fix-model-name-for-sam9x25-ek.patch
+arm-at91-rm9200-fix-time-support.patch
+arm-at91-dt-fix-macb-pinctrl_macb_rmii_mii_alt-definition.patch
+cfg80211-fix-wowlan-wakeup-tracing.patch
+cfg80211-fix-wiphy_register-error-path.patch
+cfg80211-fix-sending-wowlan-tcp-wakeup-settings.patch
+mac80211-use-just-spin_lock-in-ieee80211_get_tkip_p2k.patch
+mac80211-fix-ap-mode-frame-matching.patch
+iwlwifi-mvm-always-use-scan_type_forced.patch
+iwlwifi-mvm-prevent-setting-assoc-flag-in-mac_context_cmd.patch
+staging-vt6656-fix-missing-spin-lock-in-iwctl_siwpower.patch
+staging-vt6656-use-free_netdev-instead-of-kfree.patch
+usb-chipidea-fix-link-error-when-usb_ehci_hcd-is-a-module.patch
+usb-option-add-telewell-tw-lte-4g.patch
+usb-option-add-device-ids-for-dell-5804-novatel-e371-wwan-card.patch
+usb-ftdi_sio-add-support-for-newport-conex-motor-drivers.patch
+usb-cxacru-potential-underflow-in-cxacru_cm_get_array.patch
+tty-fix-tty-miss-restart-after-we-turn-off-flow-control.patch
+usb-blacklisted-cinterion-s-plxx-wwan-interface.patch
+usb-reset-resume-quirk-needed-by-a-hub.patch
+usb-xhci-override-bogus-bulk-wmaxpacketsize-values.patch
+usb-uhci-fix-for-suspend-of-virtual-hp-controller.patch
+input-egalax_ts-abs_mt_position_y-not-reported-well.patch
+drivers-hv-fix-a-bug-in-get_vp_index.patch
+cifs-only-set-ops-for-inodes-in-i_new-state.patch
+arc-copy_-to-from-_user-to-honor-usermode-access-permissions.patch
+drivers-char-random.c-fix-priming-of-last_data.patch
+random-fix-accounting-race-condition-with-lockless-irq-entropy_count-update.patch
+fat-fix-possible-overflow-for-fat_clusters.patch
--- /dev/null
+From 91ec61f8f01cf32868e2ed2fa96a299e77964055 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Wed, 15 May 2013 01:44:25 +0100
+Subject: staging: vt6656: [bug] Fix missing spin lock in iwctl_siwpower.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 91ec61f8f01cf32868e2ed2fa96a299e77964055 upstream.
+
+Fixes occasional dead lock on power up / down.
+
+spin_lock_irq is used because of unlocking with spin_unlock_irq
+elsewhere in the driver.
+
+Only relevant to kernels 3.8 and later when command was
+transferred to the iw_handler.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/iwctl.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/vt6656/iwctl.c
++++ b/drivers/staging/vt6656/iwctl.c
+@@ -1348,9 +1348,12 @@ int iwctl_siwpower(struct net_device *de
+ return rc;
+ }
+
++ spin_lock_irq(&pDevice->lock);
++
+ if (wrq->disabled) {
+ pDevice->ePSMode = WMAC_POWER_CAM;
+ PSvDisablePowerSaving(pDevice);
++ spin_unlock_irq(&pDevice->lock);
+ return rc;
+ }
+ if ((wrq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
+@@ -1361,6 +1364,9 @@ int iwctl_siwpower(struct net_device *de
+ pDevice->ePSMode = WMAC_POWER_FAST;
+ PSvEnablePowerSaving((void *)pDevice, pMgmt->wListenInterval);
+ }
++
++ spin_unlock_irq(&pDevice->lock);
++
+ switch (wrq->flags & IW_POWER_MODE) {
+ case IW_POWER_UNICAST_R:
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO " SIOCSIWPOWER: IW_POWER_UNICAST_R \n");
--- /dev/null
+From 0a438d5b381e2bdfd5e02d653bf46fcc878356e3 Mon Sep 17 00:00:00 2001
+From: Hema Prathaban <hemaklnce@gmail.com>
+Date: Sat, 11 May 2013 22:39:47 +0530
+Subject: staging: vt6656: use free_netdev instead of kfree
+
+From: Hema Prathaban <hemaklnce@gmail.com>
+
+commit 0a438d5b381e2bdfd5e02d653bf46fcc878356e3 upstream.
+
+use free_netdev() instead of kfree(pDevice->apdev)
+
+Signed-off-by: Hema Prathaban <hemaklnce@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/hostap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vt6656/hostap.c
++++ b/drivers/staging/vt6656/hostap.c
+@@ -133,7 +133,7 @@ static int hostap_disable_hostapd(struct
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n",
+ pDevice->dev->name, pDevice->apdev->name);
+ }
+- kfree(pDevice->apdev);
++ free_netdev(pDevice->apdev);
+ pDevice->apdev = NULL;
+ pDevice->bEnable8021x = false;
+ pDevice->bEnableHostWEP = false;
--- /dev/null
+From dab73b4eb9ef924a2b90dab84e539076d82b256f Mon Sep 17 00:00:00 2001
+From: Wang YanQing <udknight@gmail.com>
+Date: Thu, 9 May 2013 14:16:47 +0800
+Subject: TTY: Fix tty miss restart after we turn off flow-control
+
+From: Wang YanQing <udknight@gmail.com>
+
+commit dab73b4eb9ef924a2b90dab84e539076d82b256f upstream.
+
+I meet emacs hang in start if I do the operation below:
+ 1: echo 3 > /proc/sys/vm/drop_caches
+ 2: emacs BigFile
+ 3: Press CTRL-S follow 2 immediately
+
+Then emacs hang on, CTRL-Q can't resume, the terminal
+hang on, you can do nothing with this terminal except
+close it.
+
+The reason is before emacs takeover control the tty,
+we use CTRL-S to XOFF it. Then when emacs takeover the
+control, it may don't use the flow-control, so emacs hang.
+This patch fix it.
+
+This patch will fix a kind of strange tty relation hang problem,
+I believe I meet it with vim in ssh, and also see below bug report:
+http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=465823
+
+Signed-off-by: Wang YanQing <udknight@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/n_tty.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1588,6 +1588,14 @@ static void n_tty_set_termios(struct tty
+ ldata->real_raw = 0;
+ }
+ n_tty_set_room(tty);
++ /*
++ * Fix tty hang when I_IXON(tty) is cleared, but the tty
++ * been stopped by STOP_CHAR(tty) before it.
++ */
++ if (!I_IXON(tty) && old && (old->c_iflag & IXON) && !tty->flow_stopped) {
++ start_tty(tty);
++ }
++
+ /* The termios change make the tty ready for I/O */
+ wake_up_interruptible(&tty->write_wait);
+ wake_up_interruptible(&tty->read_wait);
--- /dev/null
+From 8ff10bdb14a52e3f25d4ce09e0582a8684c1a6db Mon Sep 17 00:00:00 2001
+From: Schemmel Hans-Christoph <Hans-Christoph.Schemmel@gemalto.com>
+Date: Mon, 6 May 2013 11:05:12 +0200
+Subject: USB: Blacklisted Cinterion's PLxx WWAN Interface
+
+From: Schemmel Hans-Christoph <Hans-Christoph.Schemmel@gemalto.com>
+
+commit 8ff10bdb14a52e3f25d4ce09e0582a8684c1a6db upstream.
+
+/drivers/usb/serial/option.c: Blacklisted Cinterion's PLxx WWAN
+Interface (USB Interface 4), because it will be handled by QMI WWAN
+driver. Product IDs renamed.
+
+Signed-off-by: Hans-Christoph Schemmel <hans-christoph.schemmel@gemalto.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -342,8 +342,8 @@ static void option_instat_callback(struc
+ #define CINTERION_PRODUCT_EU3_E 0x0051
+ #define CINTERION_PRODUCT_EU3_P 0x0052
+ #define CINTERION_PRODUCT_PH8 0x0053
+-#define CINTERION_PRODUCT_AH6 0x0055
+-#define CINTERION_PRODUCT_PLS8 0x0060
++#define CINTERION_PRODUCT_AHXX 0x0055
++#define CINTERION_PRODUCT_PLXX 0x0060
+
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID 0x0b3c
+@@ -1268,8 +1268,9 @@ static const struct usb_device_id option
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
+- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AH6) },
+- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLS8) },
++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
--- /dev/null
+From 7c8bfed7aaeba690de30835fe89882e1047a55fd Mon Sep 17 00:00:00 2001
+From: David Rientjes <rientjes@google.com>
+Date: Fri, 26 Apr 2013 13:25:01 -0700
+Subject: usb, chipidea: fix link error when USB_EHCI_HCD is a module
+
+From: David Rientjes <rientjes@google.com>
+
+commit 7c8bfed7aaeba690de30835fe89882e1047a55fd upstream.
+
+Fixes link error when USB_EHCI_HCD=m and USB_CHIPIDEA_HOST=y:
+
+ drivers/built-in.o: In function `ci_hdrc_host_init':
+ drivers/usb/chipidea/host.c:104: undefined reference to `ehci_init_driver'
+
+as a result of commit 09f6ffde2ece ("USB: EHCI: fix build error by making
+ChipIdea host a normal EHCI driver").
+
+Signed-off-by: David Rientjes <rientjes@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/chipidea/Kconfig
++++ b/drivers/usb/chipidea/Kconfig
+@@ -20,7 +20,7 @@ config USB_CHIPIDEA_UDC
+ config USB_CHIPIDEA_HOST
+ bool "ChipIdea host controller"
+ depends on USB=y || USB=USB_CHIPIDEA
+- depends on USB_EHCI_HCD
++ depends on USB_EHCI_HCD=y
+ select USB_EHCI_ROOT_HUB_TT
+ help
+ Say Y here to enable host controller functionality of the
--- /dev/null
+From 2a0ebf80aa95cc758d4725f74a7016e992606a39 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sun, 19 May 2013 21:52:20 +0300
+Subject: USB: cxacru: potential underflow in cxacru_cm_get_array()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 2a0ebf80aa95cc758d4725f74a7016e992606a39 upstream.
+
+The value of "offd" comes off the instance->rcv_buf[] and we used it as
+the offset into an array. The problem is that we check the upper bound
+but not for negative values.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/atm/cxacru.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/atm/cxacru.c
++++ b/drivers/usb/atm/cxacru.c
+@@ -686,7 +686,8 @@ static int cxacru_cm_get_array(struct cx
+ {
+ int ret, len;
+ __le32 *buf;
+- int offb, offd;
++ int offb;
++ unsigned int offd;
+ const int stride = CMD_PACKET_SIZE / (4 * 2) - 1;
+ int buflen = ((size - 1) / stride + 1 + size * 2) * 4;
+
--- /dev/null
+From 7138143972b7c293267c783fc99a194f0ceff7f2 Mon Sep 17 00:00:00 2001
+From: "Gomella, Andrew (NIH/NHLBI) [F]" <andrew.gomella@nih.gov>
+Date: Fri, 17 May 2013 17:39:46 +0000
+Subject: USB: ftdi_sio: Add support for Newport CONEX motor drivers
+
+From: "Gomella, Andrew (NIH/NHLBI) [F]" <andrew.gomella@nih.gov>
+
+commit 7138143972b7c293267c783fc99a194f0ceff7f2 upstream.
+
+Here are two more devices that use FTDI USB-to-serial chips with new product ID's.
+
+The devices are the Newport Conex-AGP and Conex-CC motor controllers.
+(http://www.newport.com/CONEX-AGP-Integrated-Piezo-Motor-Rotation-Stages-/987623/1033/info.aspx)
+(http://www.newport.com/CONEX-CC-DC-Servo-Controller-Actuators/934114/1033/info.aspx)
+
+usb-devices command yields:
+
+P: Vendor=104d ProdID=3002 Rev=06.00
+S: Manufacturer=Newport
+S: Product=CONEX-CC
+
+as well as
+
+P: Vendor=104d ProdID=3006 Rev=06.00
+S: Manufacturer=Newport
+S: Product=CONEX-AGP
+
+Signed-off-by: Andrew Gomella <andrew.gomella@nih.gov>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -191,6 +191,8 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_BOOST_PID) },
+ { USB_DEVICE(NEWPORT_VID, NEWPORT_AGILIS_PID) },
++ { USB_DEVICE(NEWPORT_VID, NEWPORT_CONEX_CC_PID) },
++ { USB_DEVICE(NEWPORT_VID, NEWPORT_CONEX_AGP_PID) },
+ { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
+ { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -772,6 +772,8 @@
+ */
+ #define NEWPORT_VID 0x104D
+ #define NEWPORT_AGILIS_PID 0x3000
++#define NEWPORT_CONEX_CC_PID 0x3002
++#define NEWPORT_CONEX_AGP_PID 0x3006
+
+ /* Interbiometrics USB I/O Board */
+ /* Developed for Interbiometrics by Rudolf Gugler */
--- /dev/null
+From 49c6e370dd6400b84897c4100095089b5c13a061 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Mon, 6 May 2013 16:16:44 -0500
+Subject: USB: option: add device IDs for Dell 5804 (Novatel E371) WWAN card
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit 49c6e370dd6400b84897c4100095089b5c13a061 upstream.
+
+A rebranded Novatel E371 for AT&T's LTE bands.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -196,6 +196,7 @@ static void option_instat_callback(struc
+
+ #define DELL_PRODUCT_5800_MINICARD_VZW 0x8195 /* Novatel E362 */
+ #define DELL_PRODUCT_5800_V2_MINICARD_VZW 0x8196 /* Novatel E362 */
++#define DELL_PRODUCT_5804_MINICARD_ATT 0x819b /* Novatel E371 */
+
+ #define KYOCERA_VENDOR_ID 0x0c88
+ #define KYOCERA_PRODUCT_KPC650 0x17da
+@@ -771,6 +772,7 @@ static const struct usb_device_id option
+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) }, /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_MINICARD_VZW, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_V2_MINICARD_VZW, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5804_MINICARD_ATT, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
--- /dev/null
+From 73c042df6e1bc50544842a04b777b36bbe3630e6 Mon Sep 17 00:00:00 2001
+From: Teppo Kotilainen <qubit303@gmail.com>
+Date: Fri, 3 May 2013 10:28:12 +0300
+Subject: usb: option: Add Telewell TW-LTE 4G
+
+From: Teppo Kotilainen <qubit303@gmail.com>
+
+commit 73c042df6e1bc50544842a04b777b36bbe3630e6 upstream.
+
+Information from driver description files:
+
+ diag: VID_19D2&PID_0412&MI_00
+ nmea: VID_19D2&PID_0412&MI_01
+ at: VID_19D2&PID_0412&MI_02
+ modem: VID_19D2&PID_0412&MI_03
+ net: VID_19D2&PID_0412&MI_04
+
+Signed-off-by: Teppo Kotilainen <qubit303@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -966,6 +966,8 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0330, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0395, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0412, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G */
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
--- /dev/null
+From bac6b03275184c912ad0818c9a0a736847804dca Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Tue, 30 Apr 2013 10:18:04 +0200
+Subject: USB: reset resume quirk needed by a hub
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit bac6b03275184c912ad0818c9a0a736847804dca upstream.
+
+Werner Fink has reported problems with this hub.
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -88,6 +88,9 @@ static const struct usb_device_id usb_qu
+ /* Edirol SD-20 */
+ { USB_DEVICE(0x0582, 0x0027), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Alcor Micro Corp. Hub */
++ { USB_DEVICE(0x058f, 0x9254), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* appletouch */
+ { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
+
--- /dev/null
+From 997ff893603c6455da4c5e26ba1d0f81adfecdfc Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 14 May 2013 13:55:29 -0400
+Subject: USB: UHCI: fix for suspend of virtual HP controller
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 997ff893603c6455da4c5e26ba1d0f81adfecdfc upstream.
+
+HP's virtual UHCI host controller takes a long time to suspend
+(several hundred microseconds), even when no devices are attached.
+This provokes a warning message from uhci-hcd in the auto-stop case.
+
+To prevent this from happening, this patch adds a test to avoid
+performing an auto-stop when the wait_for_hp quirk flag is set. The
+controller will still suspend through the normal runtime PM mechanism.
+And since that pathway includes a 1-ms delay, the slowness of the
+virtual hardware won't matter.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: ZhenHua <zhen-hual@hp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/uhci-hub.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/uhci-hub.c
++++ b/drivers/usb/host/uhci-hub.c
+@@ -225,7 +225,8 @@ static int uhci_hub_status_data(struct u
+ /* auto-stop if nothing connected for 1 second */
+ if (any_ports_active(uhci))
+ uhci->rh_state = UHCI_RH_RUNNING;
+- else if (time_after_eq(jiffies, uhci->auto_stop_time))
++ else if (time_after_eq(jiffies, uhci->auto_stop_time) &&
++ !uhci->wait_for_hp)
+ suspend_rh(uhci, UHCI_RH_AUTO_STOPPED);
+ break;
+
--- /dev/null
+From e4f47e3675e6f1f40906b785b934ce963e9f2eb3 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 8 May 2013 11:18:05 -0400
+Subject: USB: xHCI: override bogus bulk wMaxPacketSize values
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit e4f47e3675e6f1f40906b785b934ce963e9f2eb3 upstream.
+
+This patch shortens the logic in xhci_endpoint_init() by moving common
+calculations involving max_packet and max_burst outside the switch
+statement, rather than repeating the same code in multiple
+case-specific statements. It also replaces two usages of max_packet
+which were clearly intended to be max_burst all along.
+
+More importantly, it compensates for a common bug in high-speed bulk
+endpoint descriptors. In many devices there is a bulk endpoint having
+a wMaxPacketSize value smaller than 512, which is forbidden by the USB
+spec. Some xHCI controllers can't handle this and refuse to accept
+the endpoint. This patch changes the max_packet value to 512, which
+allows the controller to use the endpoint properly.
+
+In practice the bogus maxpacket size doesn't matter, because none of
+the transfers sent via these endpoints are longer than the maxpacket
+value anyway.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: "Aurélien Leblond" <blablack@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-mem.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1423,15 +1423,17 @@ int xhci_endpoint_init(struct xhci_hcd *
+ ep_ctx->ep_info2 |= cpu_to_le32(xhci_get_endpoint_type(udev, ep));
+
+ /* Set the max packet size and max burst */
++ max_packet = GET_MAX_PACKET(usb_endpoint_maxp(&ep->desc));
++ max_burst = 0;
+ switch (udev->speed) {
+ case USB_SPEED_SUPER:
+- max_packet = usb_endpoint_maxp(&ep->desc);
+- ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet));
+ /* dig out max burst from ep companion desc */
+- max_packet = ep->ss_ep_comp.bMaxBurst;
+- ep_ctx->ep_info2 |= cpu_to_le32(MAX_BURST(max_packet));
++ max_burst = ep->ss_ep_comp.bMaxBurst;
+ break;
+ case USB_SPEED_HIGH:
++ /* Some devices get this wrong */
++ if (usb_endpoint_xfer_bulk(&ep->desc))
++ max_packet = 512;
+ /* bits 11:12 specify the number of additional transaction
+ * opportunities per microframe (USB 2.0, section 9.6.6)
+ */
+@@ -1439,17 +1441,16 @@ int xhci_endpoint_init(struct xhci_hcd *
+ usb_endpoint_xfer_int(&ep->desc)) {
+ max_burst = (usb_endpoint_maxp(&ep->desc)
+ & 0x1800) >> 11;
+- ep_ctx->ep_info2 |= cpu_to_le32(MAX_BURST(max_burst));
+ }
+- /* Fall through */
++ break;
+ case USB_SPEED_FULL:
+ case USB_SPEED_LOW:
+- max_packet = GET_MAX_PACKET(usb_endpoint_maxp(&ep->desc));
+- ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet));
+ break;
+ default:
+ BUG();
+ }
++ ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet) |
++ MAX_BURST(max_burst));
+ max_esit_payload = xhci_get_max_esit_payload(xhci, udev, ep);
+ ep_ctx->tx_info = cpu_to_le32(MAX_ESIT_PAYLOAD_FOR_EP(max_esit_payload));
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
