--- /dev/null
+From 3f1615340acea54e21f4b9d4d65921540dca84b2 Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontusf@broadcom.com>
+Date: Fri, 6 Mar 2015 16:18:41 +0100
+Subject: brcmfmac: Perform bound checking on vendor command buffer
+
+From: Pontus Fuchs <pontusf@broadcom.com>
+
+commit 3f1615340acea54e21f4b9d4d65921540dca84b2 upstream.
+
+A short or malformed vendor command buffer could cause reads outside
+the command buffer.
+
+Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
+[arend@broadcom.com: slightly modified debug trace output]
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd
+ void *dcmd_buf = NULL, *wr_pointer;
+ u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
+
+- brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
+- cmdhdr->len);
++ if (len < sizeof(*cmdhdr)) {
++ brcmf_err("vendor command too short: %d\n", len);
++ return -EINVAL;
++ }
+
+ vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
+ ifp = vif->ifp;
+
+- len -= sizeof(struct brcmf_vndr_dcmd_hdr);
++ brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
++
++ if (cmdhdr->offset > len) {
++ brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
++ return -EINVAL;
++ }
++
++ len -= cmdhdr->offset;
+ ret_len = cmdhdr->len;
+ if (ret_len > 0 || len > 0) {
+ if (len > BRCMF_DCMD_MAXLEN) {
--- /dev/null
+From 43b68879de27b1993518687fbc6013da80cdcbfe Mon Sep 17 00:00:00 2001
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Date: Thu, 26 Feb 2015 18:20:48 +0100
+Subject: cpuidle: mvebu: Fix the CPU PM notifier usage
+
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+
+commit 43b68879de27b1993518687fbc6013da80cdcbfe upstream.
+
+As stated in kernel/cpu_pm.c, "Platform is responsible for ensuring
+that cpu_pm_enter is not called twice on the same CPU before
+cpu_pm_exit is called.". In the current code in case of failure when
+calling mvebu_v7_cpu_suspend, the function cpu_pm_exit() is never
+called whereas cpu_pm_enter() was called just before.
+
+This patch moves the cpu_pm_exit() in order to balance the
+cpu_pm_enter() calls.
+
+Reported-by: Fulvio Benini <fbf@libero.it>
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpuidle/cpuidle-mvebu-v7.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/cpuidle/cpuidle-mvebu-v7.c
++++ b/drivers/cpuidle/cpuidle-mvebu-v7.c
+@@ -37,11 +37,11 @@ static int mvebu_v7_enter_idle(struct cp
+ deepidle = true;
+
+ ret = mvebu_v7_cpu_suspend(deepidle);
++ cpu_pm_exit();
++
+ if (ret)
+ return ret;
+
+- cpu_pm_exit();
+-
+ return index;
+ }
+
--- /dev/null
+From d7c146053dd195b90c79b9b8131431f44541d015 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Wed, 18 Mar 2015 00:21:32 +0200
+Subject: of/irq: Fix of_irq_parse_one() returned error codes
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+commit d7c146053dd195b90c79b9b8131431f44541d015 upstream.
+
+The error code paths that require cleanup use a goto to jump to the
+cleanup code and return an error code. However, the error code variable
+res, which is initialized to -EINVAL when declared, is then overwritten
+with the return value of of_parse_phandle_with_args(), and reused as the
+return code from of_irq_parse_one(). This leads to an undetermined error
+being returned instead of the expected -EINVAL value. Fix it.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/irq.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/of/irq.c
++++ b/drivers/of/irq.c
+@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node
+ struct device_node *p;
+ const __be32 *intspec, *tmp, *addr;
+ u32 intsize, intlen;
+- int i, res = -EINVAL;
++ int i, res;
+
+ pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
+
+@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node
+
+ /* Get size of interrupt specifier */
+ tmp = of_get_property(p, "#interrupt-cells", NULL);
+- if (tmp == NULL)
++ if (tmp == NULL) {
++ res = -EINVAL;
+ goto out;
++ }
+ intsize = be32_to_cpu(*tmp);
+
+ pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
+
+ /* Check index */
+- if ((index + 1) * intsize > intlen)
++ if ((index + 1) * intsize > intlen) {
++ res = -EINVAL;
+ goto out;
++ }
+
+ /* Copy intspec into irq structure */
+ intspec += index * intsize;
--- /dev/null
+From d525211f9d1be8b523ec7633f080f2116f5ea536 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 19 Feb 2015 18:03:11 +0100
+Subject: perf: Fix irq_work 'tail' recursion
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit d525211f9d1be8b523ec7633f080f2116f5ea536 upstream.
+
+Vince reported a watchdog lockup like:
+
+ [<ffffffff8115e114>] perf_tp_event+0xc4/0x210
+ [<ffffffff810b4f8a>] perf_trace_lock+0x12a/0x160
+ [<ffffffff810b7f10>] lock_release+0x130/0x260
+ [<ffffffff816c7474>] _raw_spin_unlock_irqrestore+0x24/0x40
+ [<ffffffff8107bb4d>] do_send_sig_info+0x5d/0x80
+ [<ffffffff811f69df>] send_sigio_to_task+0x12f/0x1a0
+ [<ffffffff811f71ce>] send_sigio+0xae/0x100
+ [<ffffffff811f72b7>] kill_fasync+0x97/0xf0
+ [<ffffffff8115d0b4>] perf_event_wakeup+0xd4/0xf0
+ [<ffffffff8115d103>] perf_pending_event+0x33/0x60
+ [<ffffffff8114e3fc>] irq_work_run_list+0x4c/0x80
+ [<ffffffff8114e448>] irq_work_run+0x18/0x40
+ [<ffffffff810196af>] smp_trace_irq_work_interrupt+0x3f/0xc0
+ [<ffffffff816c99bd>] trace_irq_work_interrupt+0x6d/0x80
+
+Which is caused by an irq_work generating new irq_work and therefore
+not allowing forward progress.
+
+This happens because processing the perf irq_work triggers another
+perf event (tracepoint stuff) which in turn generates an irq_work ad
+infinitum.
+
+Avoid this by raising the recursion counter in the irq_work -- which
+effectively disables all software events (including tracepoints) from
+actually triggering again.
+
+Reported-by: Vince Weaver <vincent.weaver@maine.edu>
+Tested-by: Vince Weaver <vincent.weaver@maine.edu>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Link: http://lkml.kernel.org/r/20150219170311.GH21418@twins.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4412,6 +4412,13 @@ static void perf_pending_event(struct ir
+ {
+ struct perf_event *event = container_of(entry,
+ struct perf_event, pending);
++ int rctx;
++
++ rctx = perf_swevent_get_recursion_context();
++ /*
++ * If we 'fail' here, that's OK, it means recursion is already disabled
++ * and we won't recurse 'further'.
++ */
+
+ if (event->pending_disable) {
+ event->pending_disable = 0;
+@@ -4422,6 +4429,9 @@ static void perf_pending_event(struct ir
+ event->pending_wakeup = 0;
+ perf_event_wakeup(event);
+ }
++
++ if (rctx >= 0)
++ perf_swevent_put_recursion_context(rctx);
+ }
+
+ /*
--- /dev/null
+From 2f1bce487cd0a02623cff3d877940f9a2026341c Mon Sep 17 00:00:00 2001
+From: Thierry Reding <treding@nvidia.com>
+Date: Wed, 25 Feb 2015 16:16:29 +0100
+Subject: phy: Find the right match in devm_phy_destroy()
+
+From: Thierry Reding <treding@nvidia.com>
+
+commit 2f1bce487cd0a02623cff3d877940f9a2026341c upstream.
+
+devm_phy_create() stores the pointer to the new PHY at the address
+returned by devres_alloc(). The res parameter passed to devm_phy_match()
+is therefore the location where the pointer to the PHY is stored, hence
+it needs to be dereferenced before comparing to the match data in order
+to find the correct match.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/phy-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -52,7 +52,9 @@ static void devm_phy_consume(struct devi
+
+ static int devm_phy_match(struct device *dev, void *res, void *match_data)
+ {
+- return res == match_data;
++ struct phy **phy = res;
++
++ return *phy == match_data;
+ }
+
+ /**
--- /dev/null
+From c8f0345586694a33f828bc6b177fb21eb1702325 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 24 Feb 2015 09:23:01 -0600
+Subject: rtlwifi: Improve handling of IPv6 packets
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit c8f0345586694a33f828bc6b177fb21eb1702325 upstream.
+
+Routine rtl_is_special_data() is supposed to identify packets that need to
+use a low bit rate so that the probability of successful transmission is
+high. The current version has a bug that causes all IPv6 packets to be
+labelled as special, with a corresponding low rate of transmission. A
+complete fix will be quite intrusive, but until that is available, all
+IPv6 packets are identified as regular.
+
+This patch also removes a magic number.
+
+Reported-and-tested-by: Alan Fisher <acf@unixcube.org>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Alan Fisher <acf@unixcube.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/base.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -1314,8 +1314,11 @@ u8 rtl_is_special_data(struct ieee80211_
+ }
+
+ return true;
+- } else if (0x86DD == ether_type) {
+- return true;
++ } else if (ETH_P_IPV6 == ether_type) {
++ /* TODO: Handle any IPv6 cases that need special handling.
++ * For now, always return false
++ */
++ goto end;
+ }
+
+ end:
iwlwifi-fix-max_ht_ampdu_exponent-for-older-devices.patch
iwlwifi-mvm-bt-coex-fix-a-null-pointer-exception.patch
iwlwifi-mvm-fix-roc-removal.patch
+uas-add-us_fl_no_ata_1x-for-initio-corporation-controllers-devices.patch
+usb-phy-am335x-control-check-return-value-of.patch
+usb-chipidea-otg-add-a_alt_hnp_support-response-for-b-device.patch
+usb-common-otg-fsm-only-signal-connect-after-switching-to-peripheral.patch
+phy-find-the-right-match-in-devm_phy_destroy.patch
+rtlwifi-improve-handling-of-ipv6-packets.patch
+cpuidle-mvebu-fix-the-cpu-pm-notifier-usage.patch
+brcmfmac-perform-bound-checking-on-vendor-command-buffer.patch
+of-irq-fix-of_irq_parse_one-returned-error-codes.patch
+perf-fix-irq_work-tail-recursion.patch
+staging-vt6656-vnt_rf_setpower-fix-missing-rate-rate_12m.patch
+vt6655-rfbsetpower-fix-missing-rate-rate_12m.patch
+vt6655-fix-late-setting-of-byrftype.patch
--- /dev/null
+From 163fe301b9f78b6de57d0014eafe504fd20c0cd4 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sat, 7 Mar 2015 16:36:37 +0000
+Subject: staging: vt6656: vnt_rf_setpower: fix missing rate RATE_12M
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 163fe301b9f78b6de57d0014eafe504fd20c0cd4 upstream.
+
+When the driver sets this rate a power of zero value is set causing
+data flow stoppage until another rate is tried.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/rf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/vt6656/rf.c
++++ b/drivers/staging/vt6656/rf.c
+@@ -640,6 +640,7 @@ int vnt_rf_setpower(struct vnt_private *
+ break;
+ case RATE_6M:
+ case RATE_9M:
++ case RATE_12M:
+ case RATE_18M:
+ case RATE_24M:
+ case RATE_36M:
--- /dev/null
+From bda13e35d584dabf52c9f77e0fe62683ac4d9f86 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 16 Mar 2015 15:18:13 +0100
+Subject: uas: Add US_FL_NO_ATA_1X for Initio Corporation controllers / devices
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit bda13e35d584dabf52c9f77e0fe62683ac4d9f86 upstream.
+
+A new uas compatible controller has shown up in some people's devices from
+the manufacturer Initio Corporation, this controller needs the US_FL_NO_ATA_1X
+quirk to work properly with uas, so add it to the uas quirks table.
+
+Reported-and-tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_uas.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++ "Initio Corporation",
++ "",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_ATA_1X),
++
+ /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
+ UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
+ "JMicron",
--- /dev/null
+From d20f7807996c69537e07443ef8dec4e01a28b099 Mon Sep 17 00:00:00 2001
+From: Li Jun <B47624@freescale.com>
+Date: Sun, 8 Mar 2015 16:05:01 +0800
+Subject: usb: chipidea: otg: add a_alt_hnp_support response for B device
+
+From: Li Jun <B47624@freescale.com>
+
+commit d20f7807996c69537e07443ef8dec4e01a28b099 upstream.
+
+This patch adds response to a_alt_hnp_support set feature request from legacy
+A device, that is, B-device can provide a message to the user indicating that
+the user needs to connect the B-device to an alternate port on the A-device.
+A device sets this feature indicates to the B-device that it is connected
+to an A-device port that is not capable of HNP, but that the A-device does have
+an alternate port that is capable of HNP.
+
+[Peter]
+Without this patch, the OTG B device can't be enumerated on
+non-HNP port at A device, see below log:
+[ 2.287464] usb 1-1: Dual-Role OTG device on non-HNP port
+[ 2.293105] usb 1-1: can't set HNP mode: -32
+[ 2.417422] usb 1-1: new high-speed USB device number 4 using ci_hdrc
+[ 2.460635] usb 1-1: Dual-Role OTG device on non-HNP port
+[ 2.466424] usb 1-1: can't set HNP mode: -32
+[ 2.587464] usb 1-1: new high-speed USB device number 5 using ci_hdrc
+[ 2.630649] usb 1-1: Dual-Role OTG device on non-HNP port
+[ 2.636436] usb 1-1: can't set HNP mode: -32
+[ 2.641003] usb usb1-port1: unable to enumerate USB device
+
+Acked-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Li Jun <b47624@freescale.com>
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/udc.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -929,6 +929,13 @@ __acquires(hwep->lock)
+ return retval;
+ }
+
++static int otg_a_alt_hnp_support(struct ci_hdrc *ci)
++{
++ dev_warn(&ci->gadget.dev,
++ "connect the device to an alternate port if you want HNP\n");
++ return isr_setup_status_phase(ci);
++}
++
+ /**
+ * isr_setup_packet_handler: setup packet handler
+ * @ci: UDC descriptor
+@@ -1061,6 +1068,10 @@ __acquires(ci->lock)
+ ci);
+ }
+ break;
++ case USB_DEVICE_A_ALT_HNP_SUPPORT:
++ if (ci_otg_is_fsm_mode(ci))
++ err = otg_a_alt_hnp_support(ci);
++ break;
+ default:
+ goto delegate;
+ }
--- /dev/null
+From a886bd92267c9e3d5c912860c6fb5a68479a7643 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Thu, 12 Mar 2015 09:47:53 +0800
+Subject: usb: common: otg-fsm: only signal connect after switching to peripheral
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit a886bd92267c9e3d5c912860c6fb5a68479a7643 upstream.
+
+We should signal connect (pull up dp) after we have already
+at peripheral mode, otherwise, the dp may be toggled due to
+we reset controller or do disconnect during the initialization
+for peripheral, then, the host may be confused during the
+enumeration, eg, it finds the reset can't succeed, but the
+device is still there, see below error message.
+
+hub 1-0:1.0: USB hub found
+hub 1-0:1.0: 1 port detected
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad?
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad?
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad?
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: cannot reset port 1 (err = -32)
+hub 1-0:1.0: Cannot enable port 1. Maybe the USB cable is bad?
+hub 1-0:1.0: unable to enumerate USB device on port 1
+
+Fixes: the issue existed when the otg fsm code was added.
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/common/usb-otg-fsm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/common/usb-otg-fsm.c
++++ b/drivers/usb/common/usb-otg-fsm.c
+@@ -150,9 +150,9 @@ static int otg_set_state(struct otg_fsm
+ break;
+ case OTG_STATE_B_PERIPHERAL:
+ otg_chrg_vbus(fsm, 0);
+- otg_loc_conn(fsm, 1);
+ otg_loc_sof(fsm, 0);
+ otg_set_protocol(fsm, PROTO_GADGET);
++ otg_loc_conn(fsm, 1);
+ break;
+ case OTG_STATE_B_WAIT_ACON:
+ otg_chrg_vbus(fsm, 0);
+@@ -213,10 +213,10 @@ static int otg_set_state(struct otg_fsm
+
+ break;
+ case OTG_STATE_A_PERIPHERAL:
+- otg_loc_conn(fsm, 1);
+ otg_loc_sof(fsm, 0);
+ otg_set_protocol(fsm, PROTO_GADGET);
+ otg_drv_vbus(fsm, 1);
++ otg_loc_conn(fsm, 1);
+ otg_add_timer(fsm, A_BIDL_ADIS);
+ break;
+ case OTG_STATE_A_WAIT_VFALL:
--- /dev/null
+From d0f347d62814ec0f599a05c61c5619d5e999e4ae Mon Sep 17 00:00:00 2001
+From: David Dueck <davidcdueck@googlemail.com>
+Date: Sun, 8 Feb 2015 16:29:30 +0100
+Subject: usb: phy: am335x-control: check return value of
+ bus_find_device
+
+From: David Dueck <davidcdueck@googlemail.com>
+
+commit d0f347d62814ec0f599a05c61c5619d5e999e4ae upstream.
+
+This fixes a potential null pointer dereference.
+
+Fixes: d4332013919a ("driver core: dev_get_drvdata: Don't check for NULL dev")
+Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: David Dueck <davidcdueck@googlemail.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/phy/phy-am335x-control.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/phy/phy-am335x-control.c
++++ b/drivers/usb/phy/phy-am335x-control.c
+@@ -126,6 +126,9 @@ struct phy_control *am335x_get_phy_contr
+ return NULL;
+
+ dev = bus_find_device(&platform_bus_type, NULL, node, match);
++ if (!dev)
++ return NULL;
++
+ ctrl_usb = dev_get_drvdata(dev);
+ if (!ctrl_usb)
+ return NULL;
--- /dev/null
+From 1f51d5801859e0b382dcc8f06875811d63ec8953 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sat, 7 Mar 2015 17:04:55 +0000
+Subject: vt6655: Fix late setting of byRFType.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 1f51d5801859e0b382dcc8f06875811d63ec8953 upstream.
+
+byRFType is not set prior to registration of mac80211 causing
+unpredictable operation after channel scans.
+
+With byRFType unset all channels are enabled this causes tx power
+to be set to values not present its eeprom.
+
+Move setting of this variable to vt6655_probe.
+
+byRFType must have a mask set. byRevId not used by driver and
+is removed.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6655/device_main.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -357,16 +357,6 @@ static void device_init_registers(struct
+ /* zonetype initial */
+ pDevice->byOriginalZonetype = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
+
+- /* Get RFType */
+- pDevice->byRFType = SROMbyReadEmbedded(pDevice->PortOffset, EEP_OFS_RFTYPE);
+-
+- /* force change RevID for VT3253 emu */
+- if ((pDevice->byRFType & RF_EMU) != 0)
+- pDevice->byRevId = 0x80;
+-
+- pDevice->byRFType &= RF_MASK;
+- pr_debug("pDevice->byRFType = %x\n", pDevice->byRFType);
+-
+ if (!pDevice->bZoneRegExist)
+ pDevice->byZoneType = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
+
+@@ -1806,6 +1796,12 @@ vt6655_probe(struct pci_dev *pcid, const
+ MACvInitialize(priv->PortOffset);
+ MACvReadEtherAddress(priv->PortOffset, priv->abyCurrentNetAddr);
+
++ /* Get RFType */
++ priv->byRFType = SROMbyReadEmbedded(priv->PortOffset, EEP_OFS_RFTYPE);
++ priv->byRFType &= RF_MASK;
++
++ dev_dbg(&pcid->dev, "RF Type = %x\n", priv->byRFType);
++
+ device_get_options(priv);
+ device_set_options(priv);
+ /* Mask out the options cannot be set to the chip */
--- /dev/null
+From 40c8790bcb7ac74f3038153cd09310e220c6a1df Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sat, 7 Mar 2015 17:04:54 +0000
+Subject: vt6655: RFbSetPower fix missing rate RATE_12M
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 40c8790bcb7ac74f3038153cd09310e220c6a1df upstream.
+
+When the driver sets this rate a power of zero value is set causing
+data flow stoppage until another rate is tried.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6655/rf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/vt6655/rf.c
++++ b/drivers/staging/vt6655/rf.c
+@@ -791,6 +791,7 @@ bool RFbSetPower(
+ break;
+ case RATE_6M:
+ case RATE_9M:
++ case RATE_12M:
+ case RATE_18M:
+ byPwr = priv->abyOFDMPwrTbl[uCH];
+ if (priv->byRFType == RF_UW2452)
projects / thirdparty / kernel / stable-queue.git / commitdiff
