--- /dev/null
+From 1588c51cf6d782e63a8719681d905ef0ac22ee62 Mon Sep 17 00:00:00 2001
+From: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
+Date: Thu, 9 Jan 2014 16:01:54 +0100
+Subject: ARM: at91: smc: bug fix in sam9_smc_cs_read()
+
+From: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
+
+commit 1588c51cf6d782e63a8719681d905ef0ac22ee62 upstream.
+
+There was a copy/paste error when reading the nwe_pulse value.
+
+Signed-off-by: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
+Acked-by: Boris BREZILLON <b.brezillon@overkiz.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Kevin Hilman <khilman@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-at91/sam9_smc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-at91/sam9_smc.c
++++ b/arch/arm/mach-at91/sam9_smc.c
+@@ -101,7 +101,7 @@ static void sam9_smc_cs_read(void __iome
+ /* Pulse register */
+ val = __raw_readl(base + AT91_SMC_PULSE);
+
+- config->nwe_setup = val & AT91_SMC_NWEPULSE;
++ config->nwe_pulse = val & AT91_SMC_NWEPULSE;
+ config->ncs_write_pulse = (val & AT91_SMC_NCS_WRPULSE) >> 8;
+ config->nrd_pulse = (val & AT91_SMC_NRDPULSE) >> 16;
+ config->ncs_read_pulse = (val & AT91_SMC_NCS_RDPULSE) >> 24;
--- /dev/null
+From 09164043f63c947a49797750a09ca1cd7c31108e Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 12 Jan 2014 15:11:37 -0600
+Subject: b43: Fix lockdep splat
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 09164043f63c947a49797750a09ca1cd7c31108e upstream.
+
+In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported
+when b43 is used with hostapd, and rfkill is used to kill the radio output.
+
+The lockdep splat (in part) is as follows:
+
+======================================================
+[ INFO: possible circular locking dependency detected ]
+3.12.0 #1 Not tainted
+-------------------------------------------------------
+rfkill/10040 is trying to acquire lock:
+ (rtnl_mutex){+.+.+.}, at: [<ffffffff8146f282>] rtnl_lock+0x12/0x20
+
+but task is already holding lock:
+ (rfkill_global_mutex){+.+.+.}, at: [<ffffffffa04832ca>] rfkill_fop_write+0x6a/0x170 [rfkill]
+
+--snip--
+
+Chain exists of:
+ rtnl_mutex --> misc_mtx --> rfkill_global_mutex
+
+The fix is to move the initialization of the hardware random number generator
+outside the code range covered by the rtnl_mutex.
+
+Reported-by: yury <urykhy@gmail.com>
+Tested-by: yury <urykhy@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/main.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -2422,6 +2422,7 @@ error:
+
+ static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
+ static void b43_one_core_detach(struct b43_bus_dev *dev);
++static int b43_rng_init(struct b43_wl *wl);
+
+ static void b43_request_firmware(struct work_struct *work)
+ {
+@@ -2473,6 +2474,10 @@ start_ieee80211:
+ goto err_one_core_detach;
+ wl->hw_registred = true;
+ b43_leds_register(wl->current_dev);
++
++ /* Register HW RNG driver */
++ b43_rng_init(wl);
++
+ goto out;
+
+ err_one_core_detach:
+@@ -4634,9 +4639,6 @@ static void b43_wireless_core_exit(struc
+ if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
+ return;
+
+- /* Unregister HW RNG driver */
+- b43_rng_exit(dev->wl);
+-
+ b43_set_status(dev, B43_STAT_UNINIT);
+
+ /* Stop the microcode PSM. */
+@@ -4779,9 +4781,6 @@ static int b43_wireless_core_init(struct
+
+ b43_set_status(dev, B43_STAT_INITIALIZED);
+
+- /* Register HW RNG driver */
+- b43_rng_init(dev->wl);
+-
+ out:
+ return err;
+
+@@ -5442,6 +5441,9 @@ static void b43_bcma_remove(struct bcma_
+
+ b43_one_core_detach(wldev->dev);
+
++ /* Unregister HW RNG driver */
++ b43_rng_exit(wl);
++
+ b43_leds_unregister(wl);
+
+ ieee80211_free_hw(wl->hw);
+@@ -5519,6 +5521,9 @@ static void b43_ssb_remove(struct ssb_de
+
+ b43_one_core_detach(dev);
+
++ /* Unregister HW RNG driver */
++ b43_rng_exit(wl);
++
+ if (list_empty(&wl->devlist)) {
+ b43_leds_unregister(wl);
+ /* Last core on the chip unregistered.
--- /dev/null
+From 64e5acb09ca6b50c97299cff9ef51299470b29f2 Mon Sep 17 00:00:00 2001
+From: ZHAO Gang <gamerh2o@gmail.com>
+Date: Sat, 18 Jan 2014 00:17:38 +0800
+Subject: b43: fix the wrong assignment of status.freq in b43_rx()
+
+From: ZHAO Gang <gamerh2o@gmail.com>
+
+commit 64e5acb09ca6b50c97299cff9ef51299470b29f2 upstream.
+
+Use the right function to update frequency value.
+
+If rx skb is probe response or beacon, the wrong frequency value can
+cause problem that bss info can't be updated when it should be.
+
+Fixes: 8318d78a44d4 ("cfg80211 API for channels/bitrates, mac80211 and driver conversion")
+Signed-off-by: ZHAO Gang <gamerh2o@gmail.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/xmit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/b43/xmit.c
++++ b/drivers/net/wireless/b43/xmit.c
+@@ -821,10 +821,10 @@ void b43_rx(struct b43_wldev *dev, struc
+ * channel number in b43. */
+ if (chanstat & B43_RX_CHAN_5GHZ) {
+ status.band = IEEE80211_BAND_5GHZ;
+- status.freq = b43_freq_to_channel_5ghz(chanid);
++ status.freq = b43_channel_to_freq_5ghz(chanid);
+ } else {
+ status.band = IEEE80211_BAND_2GHZ;
+- status.freq = b43_freq_to_channel_2ghz(chanid);
++ status.freq = b43_channel_to_freq_2ghz(chanid);
+ }
+ break;
+ default:
--- /dev/null
+From 0673effd41dba323d6a280ef37b5ef29f3f5a653 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 12 Jan 2014 15:11:38 -0600
+Subject: b43: Fix unload oops if firmware is not available
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 0673effd41dba323d6a280ef37b5ef29f3f5a653 upstream.
+
+The asyncronous firmware load uses a completion struct to hold firmware
+processing until the user-space routines are up and running. There is.
+however, a problem in that the waiter is nevered canceled during teardown.
+As a result, unloading the driver when firmware is not available causes an oops.
+
+To be able to access the completion structure at teardown, it had to be moved
+into the b43_wldev structure.
+
+This patch also fixes a typo in a comment.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/b43.h | 4 ++--
+ drivers/net/wireless/b43/main.c | 10 +++++-----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/b43/b43.h
++++ b/drivers/net/wireless/b43/b43.h
+@@ -731,8 +731,6 @@ enum b43_firmware_file_type {
+ struct b43_request_fw_context {
+ /* The device we are requesting the fw for. */
+ struct b43_wldev *dev;
+- /* a completion event structure needed if this call is asynchronous */
+- struct completion fw_load_complete;
+ /* a pointer to the firmware object */
+ const struct firmware *blob;
+ /* The type of firmware to request. */
+@@ -809,6 +807,8 @@ enum {
+ struct b43_wldev {
+ struct b43_bus_dev *dev;
+ struct b43_wl *wl;
++ /* a completion event structure needed if this call is asynchronous */
++ struct completion fw_load_complete;
+
+ /* The device initialization status.
+ * Use b43_status() to query. */
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -2068,6 +2068,7 @@ void b43_do_release_fw(struct b43_firmwa
+
+ static void b43_release_firmware(struct b43_wldev *dev)
+ {
++ complete(&dev->fw_load_complete);
+ b43_do_release_fw(&dev->fw.ucode);
+ b43_do_release_fw(&dev->fw.pcm);
+ b43_do_release_fw(&dev->fw.initvals);
+@@ -2093,7 +2094,7 @@ static void b43_fw_cb(const struct firmw
+ struct b43_request_fw_context *ctx = context;
+
+ ctx->blob = firmware;
+- complete(&ctx->fw_load_complete);
++ complete(&ctx->dev->fw_load_complete);
+ }
+
+ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+@@ -2140,7 +2141,7 @@ int b43_do_request_fw(struct b43_request
+ }
+ if (async) {
+ /* do this part asynchronously */
+- init_completion(&ctx->fw_load_complete);
++ init_completion(&ctx->dev->fw_load_complete);
+ err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
+ ctx->dev->dev->dev, GFP_KERNEL,
+ ctx, b43_fw_cb);
+@@ -2148,12 +2149,11 @@ int b43_do_request_fw(struct b43_request
+ pr_err("Unable to load firmware\n");
+ return err;
+ }
+- /* stall here until fw ready */
+- wait_for_completion(&ctx->fw_load_complete);
++ wait_for_completion(&ctx->dev->fw_load_complete);
+ if (ctx->blob)
+ goto fw_ready;
+ /* On some ARM systems, the async request will fail, but the next sync
+- * request works. For this reason, we dall through here
++ * request works. For this reason, we fall through here
+ */
+ }
+ err = request_firmware(&ctx->blob, ctx->fwname,
--- /dev/null
+From 452028665312672c6ba9e16a19248ee00ead9400 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 12 Jan 2014 15:11:39 -0600
+Subject: b43legacy: Fix unload oops if firmware is not available
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 452028665312672c6ba9e16a19248ee00ead9400 upstream.
+
+The asyncronous firmware load uses a completion struct to hold firmware
+processing until the user-space routines are up and running. There is.
+however, a problem in that the waiter is nevered canceled during teardown.
+As a result, unloading the driver when firmware is not available causes an oops.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43legacy/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/b43legacy/main.c
++++ b/drivers/net/wireless/b43legacy/main.c
+@@ -3919,6 +3919,7 @@ static void b43legacy_remove(struct ssb_
+ * as the ieee80211 unreg will destroy the workqueue. */
+ cancel_work_sync(&wldev->restart_work);
+ cancel_work_sync(&wl->firmware_load);
++ complete(&wldev->fw_load_complete);
+
+ B43legacy_WARN_ON(!wl);
+ if (!wldev->fw.ucode)
--- /dev/null
+From d303b1b5fbb688282bbf72a534b9dfed7af9fe4f Mon Sep 17 00:00:00 2001
+From: Phil Pokorny <ppokorny@penguincomputing.com>
+Date: Tue, 14 Jan 2014 10:46:46 -0800
+Subject: hwmon: (k10temp) Add support for Kaveri CPUs
+
+From: Phil Pokorny <ppokorny@penguincomputing.com>
+
+commit d303b1b5fbb688282bbf72a534b9dfed7af9fe4f upstream.
+
+Add new PCI ID to support new model "Kaveri" family.
+
+Signed-off-by: Philip Pokorny <ppokorny@penguincomputing.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/k10temp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -211,6 +211,7 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_i
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ {}
+ };
--- /dev/null
+From 91b0d1198417cf4fd9a7bd4138b6909f0b359099 Mon Sep 17 00:00:00 2001
+From: Eliad Peller <eliadx.peller@intel.com>
+Date: Sun, 5 Jan 2014 12:41:12 +0200
+Subject: iwlwifi: mvm: fix missing cleanup in .start() error path
+
+From: Eliad Peller <eliadx.peller@intel.com>
+
+commit 91b0d1198417cf4fd9a7bd4138b6909f0b359099 upstream.
+
+Cleanup of iwl_mvm_leds was missing in case of error,
+resulting in the following warning:
+
+WARNING: at lib/kobject.c:196 kobject_add_internal+0x1f4/0x210()
+kobject_add_internal failed for phy0-led with -EEXIST, don't try to register things with the same name in the same directory.
+
+which prevents further reloads of the driver.
+
+Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/ops.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
+@@ -424,6 +424,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *
+
+ out_unregister:
+ ieee80211_unregister_hw(mvm->hw);
++ iwl_mvm_leds_exit(mvm);
+ out_free:
+ iwl_phy_db_free(mvm->phy_db);
+ kfree(mvm->scan_cmd);
--- /dev/null
+From 2d93aee152b1758a94a18fe15d72153ba73b5679 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 24 Dec 2013 14:15:41 +0200
+Subject: iwlwifi: pcie: enable oscillator for L1 exit
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 2d93aee152b1758a94a18fe15d72153ba73b5679 upstream.
+
+Enabling the oscillator consumes slightly more power (100uA)
+but allows to make sure that we exit from L1 on time.
+
+Not doing so might lead to a PCIe specification violation
+since we might wake up from L1 at the wrong time.
+This issue has been identified on 3160 and 7260 only.
+On older NICs L1 off is not enabled, on newer NICs (7265),
+the issue is fixed.
+
+When the bug occurs the user sees that the NIC has
+disappeared from the PCI bridge, any access to the device
+returns 0xff.
+
+This fixes:
+ https://bugzilla.kernel.org/show_bug.cgi?id=64541
+
+and has been extensively discussed here:
+ http://markmail.org/thread/mfmpzqt3r333n4bo
+
+Fixes: 99cd47142399 ("iwlwifi: add 7000 series device configuration")
+Reported-and-tested-by: wzyboy <wzyboy@wzyboy.org>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-prph.h | 4 ++++
+ drivers/net/wireless/iwlwifi/pcie/trans.c | 22 ++++++++++++++++++++++
+ 2 files changed, 26 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
+@@ -260,4 +260,8 @@ static inline unsigned int SCD_QUEUE_STA
+
+ /*********************** END TX SCHEDULER *************************************/
+
++/* Oscillator clock */
++#define OSC_CLK (0xa04068)
++#define OSC_CLK_FORCE_CONTROL (0x8)
++
+ #endif /* __iwl_prph_h__ */
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -206,6 +206,28 @@ static int iwl_pcie_apm_init(struct iwl_
+ goto out;
+ }
+
++ if (trans->cfg->host_interrupt_operation_mode) {
++ /*
++ * This is a bit of an abuse - This is needed for 7260 / 3160
++ * only check host_interrupt_operation_mode even if this is
++ * not related to host_interrupt_operation_mode.
++ *
++ * Enable the oscillator to count wake up time for L1 exit. This
++ * consumes slightly more power (100uA) - but allows to be sure
++ * that we wake up from L1 on time.
++ *
++ * This looks weird: read twice the same register, discard the
++ * value, set a bit, and yet again, read that same register
++ * just to discard the value. But that's the way the hardware
++ * seems to like it.
++ */
++ iwl_read_prph(trans, OSC_CLK);
++ iwl_read_prph(trans, OSC_CLK);
++ iwl_set_bits_prph(trans, OSC_CLK, OSC_CLK_FORCE_CONTROL);
++ iwl_read_prph(trans, OSC_CLK);
++ iwl_read_prph(trans, OSC_CLK);
++ }
++
+ /*
+ * Enable DMA clock and wait for it to stabilize.
+ *
--- /dev/null
+From 743db27c526e0f31cc507959d662e97e2048a86f Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Mon, 11 Nov 2013 13:56:47 +0100
+Subject: KVM: s390: fix diagnose code extraction
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 743db27c526e0f31cc507959d662e97e2048a86f upstream.
+
+The diagnose code to be used is the contents of the base register (if not
+zero), plus the displacement. The current code ignores the base register
+contents. So let's fix that...
+
+Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kvm/diag.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/kvm/diag.c
++++ b/arch/s390/kvm/diag.c
+@@ -130,7 +130,7 @@ static int __diag_virtio_hypercall(struc
+
+ int kvm_s390_handle_diag(struct kvm_vcpu *vcpu)
+ {
+- int code = (vcpu->arch.sie_block->ipb & 0xfff0000) >> 16;
++ int code = kvm_s390_get_base_disp_rs(vcpu) & 0xffff;
+
+ trace_kvm_s390_handle_diag(vcpu, code);
+ switch (code) {
--- /dev/null
+From 9ed96e87c5748de4c2807ef17e81287c7304186c Mon Sep 17 00:00:00 2001
+From: Marcelo Tosatti <mtosatti@redhat.com>
+Date: Mon, 6 Jan 2014 12:00:02 -0200
+Subject: KVM: x86: limit PIT timer frequency
+
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit 9ed96e87c5748de4c2807ef17e81287c7304186c upstream.
+
+Limit PIT timer frequency similarly to the limit applied by
+LAPIC timer.
+
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/i8254.c | 18 ++++++++++++++++++
+ arch/x86/kvm/lapic.c | 3 ---
+ arch/x86/kvm/x86.c | 3 +++
+ arch/x86/kvm/x86.h | 2 ++
+ 4 files changed, 23 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -37,6 +37,7 @@
+
+ #include "irq.h"
+ #include "i8254.h"
++#include "x86.h"
+
+ #ifndef CONFIG_X86_64
+ #define mod_64(x, y) ((x) - (y) * div64_u64(x, y))
+@@ -349,6 +350,23 @@ static void create_pit_timer(struct kvm
+ atomic_set(&ps->pending, 0);
+ ps->irq_ack = 1;
+
++ /*
++ * Do not allow the guest to program periodic timers with small
++ * interval, since the hrtimers are not throttled by the host
++ * scheduler.
++ */
++ if (ps->is_periodic) {
++ s64 min_period = min_timer_period_us * 1000LL;
++
++ if (ps->period < min_period) {
++ pr_info_ratelimited(
++ "kvm: requested %lld ns "
++ "i8254 timer period limited to %lld ns\n",
++ ps->period, min_period);
++ ps->period = min_period;
++ }
++ }
++
+ hrtimer_start(&ps->timer, ktime_add_ns(ktime_get(), interval),
+ HRTIMER_MODE_ABS);
+ }
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -71,9 +71,6 @@
+ #define VEC_POS(v) ((v) & (32 - 1))
+ #define REG_POS(v) (((v) >> 5) << 4)
+
+-static unsigned int min_timer_period_us = 500;
+-module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
+-
+ static inline void apic_set_reg(struct kvm_lapic *apic, int reg_off, u32 val)
+ {
+ *((u32 *) (apic->regs + reg_off)) = val;
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -94,6 +94,9 @@ EXPORT_SYMBOL_GPL(kvm_x86_ops);
+ static bool ignore_msrs = 0;
+ module_param(ignore_msrs, bool, S_IRUGO | S_IWUSR);
+
++unsigned int min_timer_period_us = 500;
++module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
++
+ bool kvm_has_tsc_control;
+ EXPORT_SYMBOL_GPL(kvm_has_tsc_control);
+ u32 kvm_max_guest_tsc_khz;
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -124,5 +124,7 @@ int kvm_write_guest_virt_system(struct x
+
+ extern u64 host_xcr0;
+
++extern unsigned int min_timer_period_us;
++
+ extern struct static_key kvm_no_apic_vcpu;
+ #endif
--- /dev/null
+From 9795229752c31da0c5f8a7dc4c827665327b52f9 Mon Sep 17 00:00:00 2001
+From: Amitkumar Karwar <akarwar@marvell.com>
+Date: Fri, 10 Jan 2014 14:30:41 -0800
+Subject: mwifiex: add missing endian conversion for fw_tsf
+
+From: Amitkumar Karwar <akarwar@marvell.com>
+
+commit 9795229752c31da0c5f8a7dc4c827665327b52f9 upstream.
+
+It is u64 data received from firmware. Little endian to cpu
+conversion is required here.
+
+Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/scan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/mwifiex/scan.c
++++ b/drivers/net/wireless/mwifiex/scan.c
+@@ -1622,7 +1622,7 @@ int mwifiex_ret_802_11_scan(struct mwifi
+ const u8 *ie_buf;
+ size_t ie_len;
+ u16 channel = 0;
+- u64 fw_tsf = 0;
++ __le64 fw_tsf = 0;
+ u16 beacon_size = 0;
+ u32 curr_bcn_bytes;
+ u32 freq;
+@@ -1749,7 +1749,7 @@ int mwifiex_ret_802_11_scan(struct mwifi
+ ie_buf, ie_len, rssi, GFP_KERNEL);
+ bss_priv = (struct mwifiex_bss_priv *)bss->priv;
+ bss_priv->band = band;
+- bss_priv->fw_tsf = fw_tsf;
++ bss_priv->fw_tsf = le64_to_cpu(fw_tsf);
+ if (priv->media_connected &&
+ !memcmp(bssid,
+ priv->curr_bss_params.bss_descriptor
--- /dev/null
+From 1e202242ee1432d68a8bea4919b2ae0ef19d9e06 Mon Sep 17 00:00:00 2001
+From: Bing Zhao <bzhao@marvell.com>
+Date: Tue, 14 Jan 2014 19:16:34 -0800
+Subject: mwifiex: fix wrong 11ac bits setting in fw_cap_info
+
+From: Bing Zhao <bzhao@marvell.com>
+
+commit 1e202242ee1432d68a8bea4919b2ae0ef19d9e06 upstream.
+
+bit 14 is actually reserved and bit 12 & 13 should be used for
+11ac capability in fw_cap_info.
+
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/fw.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/mwifiex/fw.h
++++ b/drivers/net/wireless/mwifiex/fw.h
+@@ -228,7 +228,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
+
+ /* HW_SPEC fw_cap_info */
+
+-#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14)))
++#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(12)|BIT(13)))
+
+ #define GET_VHTCAP_CHWDSET(vht_cap_info) ((vht_cap_info >> 2) & 0x3)
+ #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3)
--- /dev/null
+From d82403a9f407217b6aed5260aa92a120e8e98310 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:35 -0600
+Subject: rtlwifi: Add missing code to PWDB statics routine
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit d82403a9f407217b6aed5260aa92a120e8e98310 upstream.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/stats.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/stats.c
++++ b/drivers/net/wireless/rtlwifi/stats.c
+@@ -176,6 +176,7 @@ static void rtl_process_pwdb(struct ieee
+ struct rtl_sta_info *drv_priv = NULL;
+ struct ieee80211_sta *sta = NULL;
+ long undec_sm_pwdb;
++ long undec_sm_cck;
+
+ rcu_read_lock();
+ if (rtlpriv->mac80211.opmode != NL80211_IFTYPE_STATION)
+@@ -185,12 +186,16 @@ static void rtl_process_pwdb(struct ieee
+ if (sta) {
+ drv_priv = (struct rtl_sta_info *) sta->drv_priv;
+ undec_sm_pwdb = drv_priv->rssi_stat.undec_sm_pwdb;
++ undec_sm_cck = drv_priv->rssi_stat.undec_sm_cck;
+ } else {
+ undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb;
++ undec_sm_cck = rtlpriv->dm.undec_sm_cck;
+ }
+
+ if (undec_sm_pwdb < 0)
+ undec_sm_pwdb = pstatus->rx_pwdb_all;
++ if (undec_sm_cck < 0)
++ undec_sm_cck = pstatus->rx_pwdb_all;
+ if (pstatus->rx_pwdb_all > (u32) undec_sm_pwdb) {
+ undec_sm_pwdb = (((undec_sm_pwdb) *
+ (RX_SMOOTH_FACTOR - 1)) +
+@@ -200,6 +205,15 @@ static void rtl_process_pwdb(struct ieee
+ undec_sm_pwdb = (((undec_sm_pwdb) * (RX_SMOOTH_FACTOR - 1)) +
+ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
+ }
++ if (pstatus->rx_pwdb_all > (u32) undec_sm_cck) {
++ undec_sm_cck = (((undec_sm_pwdb) *
++ (RX_SMOOTH_FACTOR - 1)) +
++ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
++ undec_sm_cck = undec_sm_cck + 1;
++ } else {
++ undec_sm_pwdb = (((undec_sm_cck) * (RX_SMOOTH_FACTOR - 1)) +
++ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
++ }
+
+ if (sta) {
+ drv_priv->rssi_stat.undec_sm_pwdb = undec_sm_pwdb;
--- /dev/null
+From dc6405712268fe514d3dd89aa936c4397b0871b9 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:30 -0600
+Subject: rtlwifi: Increase the RX queue length for USB drivers
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit dc6405712268fe514d3dd89aa936c4397b0871b9 upstream.
+
+The current number of RX buffers queued is 32, which is too small under
+heavy load. That number is doubled.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -550,7 +550,7 @@ static void _rtl_rx_pre_process(struct i
+ }
+ }
+
+-#define __RX_SKB_MAX_QUEUED 32
++#define __RX_SKB_MAX_QUEUED 64
+
+ static void _rtl_rx_work(unsigned long param)
+ {
--- /dev/null
+From b9a758a8c905fc59e783ae91ad645452d877ea88 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:27 -0600
+Subject: rtlwifi: Redo register save locations
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit b9a758a8c905fc59e783ae91ad645452d877ea88 upstream.
+
+The initial USB driver did not use some register save locations in the
+private data storage. To save some memory, a union was used to overlay these
+variables with USB I/O components. In an update of the gain-control code,
+these register save locations are now needed for USB drivers.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/wifi.h | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -1035,6 +1035,7 @@ struct rtl_ht_agg {
+
+ struct rssi_sta {
+ long undec_sm_pwdb;
++ long undec_sm_cck;
+ };
+
+ struct rtl_tid_data {
+@@ -1325,8 +1326,10 @@ struct fast_ant_training {
+ struct rtl_dm {
+ /*PHY status for Dynamic Management */
+ long entry_min_undec_sm_pwdb;
++ long undec_sm_cck;
+ long undec_sm_pwdb; /*out dm */
+ long entry_max_undec_sm_pwdb;
++ s32 ofdm_pkt_cnt;
+ bool dm_initialgain_enable;
+ bool dynamic_txpower_enable;
+ bool current_turbo_edca;
+@@ -1341,6 +1344,7 @@ struct rtl_dm {
+ bool inform_fw_driverctrldm;
+ bool current_mrc_switch;
+ u8 txpowercount;
++ u8 powerindex_backup[6];
+
+ u8 thermalvalue_rxgain;
+ u8 thermalvalue_iqk;
+@@ -1352,7 +1356,9 @@ struct rtl_dm {
+ bool done_txpower;
+ u8 dynamic_txhighpower_lvl; /*Tx high power level */
+ u8 dm_flag; /*Indicate each dynamic mechanism's status. */
++ u8 dm_flag_tmp;
+ u8 dm_type;
++ u8 dm_rssi_sel;
+ u8 txpower_track_control;
+ bool interrupt_migration;
+ bool disable_tx_int;
+@@ -1951,6 +1957,7 @@ struct dig_t {
+ u8 pre_ccastate;
+ u8 cur_ccasate;
+ u8 large_fa_hit;
++ u8 dig_dynamic_min;
+ u8 forbidden_igi;
+ u8 dig_state;
+ u8 dig_highpwrstate;
+@@ -2031,22 +2038,15 @@ struct rtl_priv {
+ struct dig_t dm_digtable;
+ struct ps_t dm_pstable;
+
+- /* section shared by individual drivers */
+- union {
+- struct { /* data buffer pointer for USB reads */
+- __le32 *usb_data;
+- int usb_data_index;
+- bool initialized;
+- };
+- struct { /* section for 8723ae */
+- bool reg_init; /* true if regs saved */
+- u32 reg_874;
+- u32 reg_c70;
+- u32 reg_85c;
+- u32 reg_a74;
+- bool bt_operation_on;
+- };
+- };
++ u32 reg_874;
++ u32 reg_c70;
++ u32 reg_85c;
++ u32 reg_a74;
++ bool reg_init; /* true if regs saved */
++ bool bt_operation_on;
++ __le32 *usb_data;
++ int usb_data_index;
++ bool initialized;
+ bool enter_ps; /* true when entering PS */
+ u8 rate_mask[5];
+
--- /dev/null
+From f699273d6a624266ebc9198774f06ee64a3847a1 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 25 Nov 2013 10:45:28 -0600
+Subject: rtlwifi: rtl8188ee: Fix typo in code
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit f699273d6a624266ebc9198774f06ee64a3847a1 upstream.
+
+The static analyser "cppcheck" shows the following typo:
+drivers/net/wireless/rtlwifi/rtl8188ee/dm.c:1081]: (style) Same expression on both sides of '!='.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reported-by: David Binderman <dcb314@hotmail.com>
+Cc: David Binderman <dcb314@hotmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8188ee/dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+@@ -1078,7 +1078,7 @@ static void rtl88e_dm_txpower_tracking_c
+ rtldm->swing_flag_ofdm = true;
+ }
+
+- if (rtldm->swing_idx_cck != rtldm->swing_idx_cck) {
++ if (rtldm->swing_idx_cck_cur != rtldm->swing_idx_cck) {
+ rtldm->swing_idx_cck_cur = rtldm->swing_idx_cck;
+ rtldm->swing_flag_cck = true;
+ }
--- /dev/null
+From c908c74e005de780fddbe8cb6fcd44803f5d4b74 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:29 -0600
+Subject: rtlwifi: rtl8192c: Add new definitions in the dm_common header
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit c908c74e005de780fddbe8cb6fcd44803f5d4b74 upstream.
+
+Changes in the gain-control mechanism will require some changes in the header.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+@@ -91,6 +91,17 @@
+ #define TX_POWER_NEAR_FIELD_THRESH_LVL2 74
+ #define TX_POWER_NEAR_FIELD_THRESH_LVL1 67
+
++#define DYNAMIC_FUNC_DISABLE 0x0
++#define DYNAMIC_FUNC_DIG BIT(0)
++#define DYNAMIC_FUNC_HP BIT(1)
++#define DYNAMIC_FUNC_SS BIT(2) /*Tx Power Tracking*/
++#define DYNAMIC_FUNC_BT BIT(3)
++#define DYNAMIC_FUNC_ANT_DIV BIT(4)
++
++#define RSSI_CCK 0
++#define RSSI_OFDM 1
++#define RSSI_DEFAULT 2
++
+ struct swat_t {
+ u8 failure_cnt;
+ u8 try_flag;
+@@ -167,5 +178,8 @@ void rtl92c_phy_lc_calibrate(struct ieee
+ void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery);
+ void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw);
+ void rtl92c_dm_bt_coexist(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
+
+ #endif
--- /dev/null
+From 97204e93f01868eeba6ae5c4f3270f32905bb418 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:32 -0600
+Subject: rtlwifi: rtl8192c: Add routines to save/restore power index registers
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 97204e93f01868eeba6ae5c4f3270f32905bb418 upstream.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c | 36 ++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+@@ -158,6 +158,42 @@ static const u8 cckswing_table_ch14[CCK_
+ {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}
+ };
+
++static u32 power_index_reg[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
++
++void dm_restorepowerindex(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u8 index;
++
++ for (index = 0; index < 6; index++)
++ rtl_write_byte(rtlpriv, power_index_reg[index],
++ rtlpriv->dm.powerindex_backup[index]);
++}
++EXPORT_SYMBOL_GPL(dm_restorepowerindex);
++
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u8 index;
++
++ for (index = 0; index < 6; index++)
++ rtl_write_byte(rtlpriv, power_index_reg[index], value);
++}
++EXPORT_SYMBOL_GPL(dm_writepowerindex);
++
++void dm_savepowerindex(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u8 index;
++ u8 tmp;
++
++ for (index = 0; index < 6; index++) {
++ tmp = rtl_read_byte(rtlpriv, power_index_reg[index]);
++ rtlpriv->dm.powerindex_backup[index] = tmp;
++ }
++}
++EXPORT_SYMBOL_GPL(dm_savepowerindex);
++
+ static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
--- /dev/null
+From 8fd77aec1a9d6f4328fc0244f21932114e066df3 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:25 -0600
+Subject: rtlwifi: rtl8192c: Prevent reconnect attempts if not connected
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 8fd77aec1a9d6f4328fc0244f21932114e066df3 upstream.
+
+This driver has a watchdog timer that attempts to reconnect when beacon frames
+are not seen for 6 seconds. This patch disables that reconnect whenever the
+device has never been connected.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/base.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -1427,7 +1427,8 @@ void rtl_watchdog_wq_callback(void *data
+ /* if we can't recv beacon for 6s, we should
+ * reconnect this AP
+ */
+- if (rtlpriv->link_info.roam_times >= 3) {
++ if ((rtlpriv->link_info.roam_times >= 3) &&
++ !is_zero_ether_addr(rtlpriv->mac80211.bssid)) {
+ RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ "AP off, try to reconnect now\n");
+ rtlpriv->link_info.roam_times = 0;
--- /dev/null
+From f87f960b2fb802f26ee3b00c19320e57a9c583ff Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Thu, 9 Jan 2014 10:27:27 -0600
+Subject: rtlwifi: rtl8192cu: Add new device ID
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit f87f960b2fb802f26ee3b00c19320e57a9c583ff upstream.
+
+Reported-by: Jan Prinsloo <janroot@gmail.com>
+Tested-by: Jan Prinsloo <janroot@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -306,6 +306,7 @@ static struct usb_device_id rtl8192c_usb
+ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+ /* HP - Lite-On ,8188CUS Slim Combo */
--- /dev/null
+From 62009b7f12793c932aaba0df946b04cb4a77d022 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:26 -0600
+Subject: rtlwifi: rtl8192cu: Add new firmware
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 62009b7f12793c932aaba0df946b04cb4a77d022 upstream.
+
+Vendor driver rtl8188C_8192C_8192D_usb_linux_v3.4.2_3727.20120404 introduced
+new firmware for these chips. The code try for the new file, and fall back to
+the original firmware if the new file is not available.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/core.c | 10 ++++++++++
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 16 +++++++++++++---
+ drivers/net/wireless/rtlwifi/wifi.h | 1 +
+ 3 files changed, 24 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/core.c
++++ b/drivers/net/wireless/rtlwifi/core.c
+@@ -46,10 +46,20 @@ void rtl_fw_cb(const struct firmware *fi
+ "Firmware callback routine entered!\n");
+ complete(&rtlpriv->firmware_loading_complete);
+ if (!firmware) {
++ if (rtlpriv->cfg->alt_fw_name) {
++ err = request_firmware(&firmware,
++ rtlpriv->cfg->alt_fw_name,
++ rtlpriv->io.dev);
++ pr_info("Loading alternative firmware %s\n",
++ rtlpriv->cfg->alt_fw_name);
++ if (!err)
++ goto found_alt;
++ }
+ pr_err("Firmware %s not available\n", rtlpriv->cfg->fw_name);
+ rtlpriv->max_fw_size = 0;
+ return;
+ }
++found_alt:
+ if (firmware->size > rtlpriv->max_fw_size) {
+ RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ "Firmware is too big!\n");
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -49,6 +49,9 @@ MODULE_AUTHOR("Larry Finger <Larry.Finge
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek 8192C/8188C 802.11n USB wireless");
+ MODULE_FIRMWARE("rtlwifi/rtl8192cufw.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_A.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_B.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_TMSC.bin");
+
+ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
+ {
+@@ -68,14 +71,21 @@ static int rtl92cu_init_sw_vars(struct i
+ "Can't alloc buffer for fw\n");
+ return 1;
+ }
+-
++ if (IS_VENDOR_UMC_A_CUT(rtlpriv->rtlhal.version) &&
++ !IS_92C_SERIAL(rtlpriv->rtlhal.version)) {
++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_A.bin";
++ } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlpriv->rtlhal.version)) {
++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_B.bin";
++ } else {
++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_TMSC.bin";
++ }
++ /* provide name of alternative file */
++ rtlpriv->cfg->alt_fw_name = "rtlwifi/rtl8192cufw.bin";
+ pr_info("Loading firmware %s\n", rtlpriv->cfg->fw_name);
+ rtlpriv->max_fw_size = 0x4000;
+ err = request_firmware_nowait(THIS_MODULE, 1,
+ rtlpriv->cfg->fw_name, rtlpriv->io.dev,
+ GFP_KERNEL, hw, rtl_fw_cb);
+-
+-
+ return err;
+ }
+
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -1806,6 +1806,7 @@ struct rtl_hal_cfg {
+ bool write_readback;
+ char *name;
+ char *fw_name;
++ char *alt_fw_name;
+ struct rtl_hal_ops *ops;
+ struct rtl_mod_params *mod_params;
+ struct rtl_hal_usbint_cfg *usb_interface_cfg;
--- /dev/null
+From e9b0784bb9de3152e787ee779868c626b137fb3b Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:34 -0600
+Subject: rtlwifi: rtl8192cu: Fix some code in RF handling
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit e9b0784bb9de3152e787ee779868c626b137fb3b upstream.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/rf.c | 29 +++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower(
+ if (mac->act_scanning) {
+ tx_agc[RF90_PATH_A] = 0x3f3f3f3f;
+ tx_agc[RF90_PATH_B] = 0x3f3f3f3f;
+- if (turbo_scanoff) {
+- for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+- tx_agc[idx1] = ppowerlevel[idx1] |
+- (ppowerlevel[idx1] << 8) |
+- (ppowerlevel[idx1] << 16) |
+- (ppowerlevel[idx1] << 24);
+- if (rtlhal->interface == INTF_USB) {
+- if (tx_agc[idx1] > 0x20 &&
+- rtlefuse->external_pa)
+- tx_agc[idx1] = 0x20;
+- }
++ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
++ tx_agc[idx1] = ppowerlevel[idx1] |
++ (ppowerlevel[idx1] << 8) |
++ (ppowerlevel[idx1] << 16) |
++ (ppowerlevel[idx1] << 24);
++ if (rtlhal->interface == INTF_USB) {
++ if (tx_agc[idx1] > 0x20 &&
++ rtlefuse->external_pa)
++ tx_agc[idx1] = 0x20;
+ }
+ }
+ } else {
+@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(
+ TXHIGHPWRLEVEL_LEVEL2) {
+ tx_agc[RF90_PATH_A] = 0x00000000;
+ tx_agc[RF90_PATH_B] = 0x00000000;
+- } else{
++ } else {
+ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+ tx_agc[idx1] = ppowerlevel[idx1] |
+ (ppowerlevel[idx1] << 8) |
+@@ -373,7 +371,12 @@ static void _rtl92c_write_ofdm_power_reg
+ regoffset == RTXAGC_B_MCS07_MCS04)
+ regoffset = 0xc98;
+ for (i = 0; i < 3; i++) {
+- writeVal = (writeVal > 6) ? (writeVal - 6) : 0;
++ if (i != 2)
++ writeVal = (writeVal > 8) ?
++ (writeVal - 8) : 0;
++ else
++ writeVal = (writeVal > 6) ?
++ (writeVal - 6) : 0;
+ rtl_write_byte(rtlpriv, (u32)(regoffset + i),
+ (u8)writeVal);
+ }
--- /dev/null
+From 9806eacf5de27ab01d680c5d75c92a3a89734e4f Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:33 -0600
+Subject: rtlwifi: rtl8192cu: Update the power index registers
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 9806eacf5de27ab01d680c5d75c92a3a89734e4f upstream.
+
+This patch uses the newly introduced power index register routines.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/dm.c | 9 +++++++++
+ drivers/net/wireless/rtlwifi/rtl8192cu/dm.h | 3 +++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
+@@ -101,6 +101,15 @@ void rtl92cu_dm_dynamic_txpower(struct i
+ "PHY_SetTxPowerLevel8192S() Channel = %d\n",
+ rtlphy->current_channel);
+ rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel);
++ if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++ TXHIGHPWRLEVEL_NORMAL)
++ dm_restorepowerindex(hw);
++ else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++ TXHIGHPWRLEVEL_LEVEL1)
++ dm_writepowerindex(hw, 0x14);
++ else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++ TXHIGHPWRLEVEL_LEVEL2)
++ dm_writepowerindex(hw, 0x10);
+ }
+
+ rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl;
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
+@@ -30,3 +30,6 @@
+ #include "../rtl8192ce/dm.h"
+
+ void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
--- /dev/null
+From 619ce76f8bb850b57032501a39f26aa6c6731c70 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:28 -0600
+Subject: rtlwifi: Set the link state
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 619ce76f8bb850b57032501a39f26aa6c6731c70 upstream.
+
+The present code fails to set the linked state when an interface is
+added.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/core.c
++++ b/drivers/net/wireless/rtlwifi/core.c
+@@ -194,6 +194,7 @@ static int rtl_op_add_interface(struct i
+ rtlpriv->cfg->maps
+ [RTL_IBSS_INT_MASKS]);
+ }
++ mac->link_state = MAC80211_LINKED;
+ break;
+ case NL80211_IFTYPE_ADHOC:
+ RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
--- /dev/null
+From 65b9cc97c6852fae19dc5c7745e9abc8dd380aad Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:31 -0600
+Subject: rtlwifi: Update beacon statistics for USB driver
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 65b9cc97c6852fae19dc5c7745e9abc8dd380aad upstream.
+
+The USB drivers were not updating the beacon statistics, which led to
+false beacon loss indications.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -477,6 +477,8 @@ static void _rtl_usb_rx_process_agg(stru
+ if (unicast)
+ rtlpriv->link_info.num_rx_inperiod++;
+ }
++ /* static bcn for roaming */
++ rtl_beacon_statistic(hw, skb);
+ }
+ }
+
--- /dev/null
+From 4e078146dff728f4865270a47710d57797e81eb6 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Tue, 21 Jan 2014 17:31:10 +0100
+Subject: s390/uapi: fix struct statfs64 definition
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 4e078146dff728f4865270a47710d57797e81eb6 upstream.
+
+With b8668fd0a7e1b59f "s390/uapi: change struct statfs[64] member types
+to unsigned values" the size of a couple of struct statfs64 member got
+incorrectly changed from 64 to 32 bit for 32 bit builds.
+
+Fix this by changing the type of couple of struct statfs64 members from
+unsigned long to unsigned long long.
+The definition of struct compat_statfs64 was correct however.
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/include/uapi/asm/statfs.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/s390/include/uapi/asm/statfs.h
++++ b/arch/s390/include/uapi/asm/statfs.h
+@@ -35,11 +35,11 @@ struct statfs {
+ struct statfs64 {
+ unsigned int f_type;
+ unsigned int f_bsize;
+- unsigned long f_blocks;
+- unsigned long f_bfree;
+- unsigned long f_bavail;
+- unsigned long f_files;
+- unsigned long f_ffree;
++ unsigned long long f_blocks;
++ unsigned long long f_bfree;
++ unsigned long long f_bavail;
++ unsigned long long f_files;
++ unsigned long long f_ffree;
+ __kernel_fsid_t f_fsid;
+ unsigned int f_namelen;
+ unsigned int f_frsize;
--- /dev/null
+From 3685f19e07802ec4207b52465c408f185b66490e Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Tue, 7 Jan 2014 15:00:12 -0700
+Subject: serial: 8250: enable UART_BUG_NOMSR for Tegra
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit 3685f19e07802ec4207b52465c408f185b66490e upstream.
+
+Tegra chips have 4 or 5 identical UART modules embedded. UARTs C..E have
+their MODEM-control signals tied off to a static state. However UARTs A
+and B can optionally route those signals to/from package pins, depending
+on the exact pinmux configuration.
+
+When these signals are not routed to package pins, false interrupts may
+trigger either temporarily, or permanently, all while not showing up in
+the IIR; it will read as NO_INT. This will eventually lead to the UART
+IRQ being disabled due to unhandled interrupts. When this happens, the
+kernel may print e.g.:
+
+ irq 68: nobody cared (try booting with the "irqpoll" option)
+
+In order to prevent this, enable UART_BUG_NOMSR. This prevents
+UART_IER_MSI from being enabled, which prevents the false interrupts
+from triggering.
+
+In practice, this is not needed under any of the following conditions:
+
+* On Tegra chips after Tegra30, since the HW bug has apparently been
+ fixed.
+
+* On UARTs C..E since their MODEM control signals are tied to the correct
+ static state which doesn't trigger the issue.
+
+* On UARTs A..B if the MODEM control signals are routed out to package
+ pins, since they will then carry valid signals.
+
+However, we ignore these exceptions for now, since they are only relevant
+if a board actually hooks up more than a 4-wire UART, and no currently
+supported board does this. If we ever support a board that does, we can
+refine the algorithm that enables UART_BUG_NOMSR to take those exceptions
+into account, and/or read a flag from DT/... that indicates that the
+board has hooked up and pinmux'd more than a 4-wire UART.
+
+Reported-by: Olof Johansson <olof@lixom.net> # autotester
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -2670,6 +2670,10 @@ static void serial8250_config_port(struc
+ if (port->type == PORT_16550A && port->iotype == UPIO_AU)
+ up->bugs |= UART_BUG_NOMSR;
+
++ /* HW bugs may trigger IRQ while IIR == NO_INT */
++ if (port->type == PORT_TEGRA)
++ up->bugs |= UART_BUG_NOMSR;
++
+ if (port->type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ)
+ autoconfig_irq(up);
+
--- /dev/null
+From 9c5320f8d7d9a2cf623e65d50e1113f34d9b9eb1 Mon Sep 17 00:00:00 2001
+From: Jonathan Woithe <jwoithe@just42.net>
+Date: Mon, 9 Dec 2013 16:33:08 +1030
+Subject: serial: 8250: Fix initialisation of Quatech cards with the AMCC PCI chip
+
+From: Jonathan Woithe <jwoithe@just42.net>
+
+commit 9c5320f8d7d9a2cf623e65d50e1113f34d9b9eb1 upstream.
+
+Fix the initialisation of older Quatech serial cards which are fitted with
+the AMCC PCI Matchmaker interface chip.
+
+Signed-off-by: Jonathan Woithe (jwoithe@just42.net)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1260,10 +1260,10 @@ static int pci_quatech_init(struct pci_d
+ unsigned long base = pci_resource_start(dev, 0);
+ if (base) {
+ u32 tmp;
+- outl(inl(base + 0x38), base + 0x38);
++ outl(inl(base + 0x38) | 0x00002000, base + 0x38);
+ tmp = inl(base + 0x3c);
+ outl(tmp | 0x01000000, base + 0x3c);
+- outl(tmp, base + 0x3c);
++ outl(tmp &= ~0x01000000, base + 0x3c);
+ }
+ }
+ return 0;
--- /dev/null
+From 48c0247d7b7bf58abb85a39021099529df365c4d Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegorslists@googlemail.com>
+Date: Mon, 9 Dec 2013 12:11:15 +0100
+Subject: serial: add support for 200 v3 series Titan card
+
+From: Yegor Yefremov <yegorslists@googlemail.com>
+
+commit 48c0247d7b7bf58abb85a39021099529df365c4d upstream.
+
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1545,6 +1545,7 @@ pci_wch_ch353_setup(struct serial_privat
+ #define PCI_DEVICE_ID_TITAN_800E 0xA014
+ #define PCI_DEVICE_ID_TITAN_200EI 0xA016
+ #define PCI_DEVICE_ID_TITAN_200EISI 0xA017
++#define PCI_DEVICE_ID_TITAN_200V3 0xA306
+ #define PCI_DEVICE_ID_TITAN_400V3 0xA310
+ #define PCI_DEVICE_ID_TITAN_410V3 0xA312
+ #define PCI_DEVICE_ID_TITAN_800V3 0xA314
+@@ -4139,6 +4140,9 @@ static struct pci_device_id serial_pci_t
+ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_oxsemi_2_4000000 },
++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3,
++ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++ pbn_b0_bt_2_921600 },
+ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_b0_4_921600 },
e752x_edac-fix-pci_dev-usage-count.patch
e1000e-fix-compiler-warnings.patch
mm-mempolicy.c-fix-mempolicy-printing-in-numa_maps.patch
+x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch
+x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch
+x86-add-check-for-number-of-available-vectors-before-cpu-down.patch
+kvm-x86-limit-pit-timer-frequency.patch
+usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch
+usb-pl2303-fix-data-corruption-on-termios-updates.patch
+usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch
+usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch
+usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch
+usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch
+usb-nokia-502-is-an-unusual-device.patch
+usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch
+usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch
+usb-ehci-add-freescale-imx28-special-write-register-method.patch
+rtlwifi-rtl8192cu-add-new-device-id.patch
+rtlwifi-update-beacon-statistics-for-usb-driver.patch
+rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch
+rtlwifi-rtl8192cu-add-new-firmware.patch
+rtlwifi-redo-register-save-locations.patch
+rtlwifi-set-the-link-state.patch
+rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch
+rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch
+rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch
+rtlwifi-rtl8192cu-update-the-power-index-registers.patch
+rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch
+rtlwifi-add-missing-code-to-pwdb-statics-routine.patch
+rtlwifi-rtl8188ee-fix-typo-in-code.patch
+mwifiex-add-missing-endian-conversion-for-fw_tsf.patch
+mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch
+iwlwifi-pcie-enable-oscillator-for-l1-exit.patch
+iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch
+b43-fix-lockdep-splat.patch
+b43-fix-unload-oops-if-firmware-is-not-available.patch
+b43legacy-fix-unload-oops-if-firmware-is-not-available.patch
+b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch
+staging-r8712u-set-device-type-to-wlan.patch
+staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch
+staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch
+tty-serial-at91-handle-shutdown-more-safely.patch
+arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch
+hwmon-k10temp-add-support-for-kaveri-cpus.patch
+serial-add-support-for-200-v3-series-titan-card.patch
+serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch
+serial-8250-enable-uart_bug_nomsr-for-tegra.patch
+kvm-s390-fix-diagnose-code-extraction.patch
+s390-uapi-fix-struct-statfs64-definition.patch
--- /dev/null
+From 3a21f00a5002b14e4aab52aef59d33ed28468a13 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 24 Dec 2013 11:22:54 -0600
+Subject: staging: r8712u: Set device type to wlan
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 3a21f00a5002b14e4aab52aef59d33ed28468a13 upstream.
+
+The latest version of NetworkManager does not recognize the device as wireless
+without this change.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/usb_intf.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -358,6 +358,10 @@ static u8 key_2char2num(u8 hch, u8 lch)
+ return (hex_to_bin(hch) << 4) | hex_to_bin(lch);
+ }
+
++static const struct device_type wlan_type = {
++ .name = "wlan",
++};
++
+ /*
+ * drv_init() - a device potentially for us
+ *
+@@ -393,6 +397,7 @@ static int r871xu_drv_init(struct usb_in
+ padapter->pusb_intf = pusb_intf;
+ usb_set_intfdata(pusb_intf, pnetdev);
+ SET_NETDEV_DEV(pnetdev, &pusb_intf->dev);
++ pnetdev->dev.type = &wlan_type;
+ /* step 2. */
+ padapter->dvobj_init = &r8712_usb_dvobj_init;
+ padapter->dvobj_deinit = &r8712_usb_dvobj_deinit;
--- /dev/null
+From 8f248dae133668bfb8e9379b4b3f0571c858b24a Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 8 Dec 2013 09:11:30 +0000
+Subject: staging: vt6656: [BUG] BBvUpdatePreEDThreshold Always set sensitivity on bScanning
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 8f248dae133668bfb8e9379b4b3f0571c858b24a upstream.
+
+byBBPreEDIndex value is initially 0, this means that from
+cold BBvUpdatePreEDThreshold is never set.
+
+This means that sensitivity may be in an ambiguous state,
+failing to scan any wireless points or at least distant ones.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/baseband.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/staging/vt6656/baseband.c
++++ b/drivers/staging/vt6656/baseband.c
+@@ -1466,7 +1466,6 @@ void BBvUpdatePreEDThreshold(struct vnt_
+
+ if( bScanning )
+ { // need Max sensitivity //RSSI -69, -70,....
+- if(pDevice->byBBPreEDIndex == 0) break;
+ pDevice->byBBPreEDIndex = 0;
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE)
+@@ -1609,7 +1608,6 @@ void BBvUpdatePreEDThreshold(struct vnt_
+
+ if( bScanning )
+ { // need Max sensitivity //RSSI -69, -70, ...
+- if(pDevice->byBBPreEDIndex == 0) break;
+ pDevice->byBBPreEDIndex = 0;
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE)
+@@ -1761,7 +1759,6 @@ void BBvUpdatePreEDThreshold(struct vnt_
+ case RF_VT3342A0: //RobertYu:20060627, testing table
+ if( bScanning )
+ { // need Max sensitivity //RSSI -67, -68, ...
+- if(pDevice->byBBPreEDIndex == 0) break;
+ pDevice->byBBPreEDIndex = 0;
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE)
--- /dev/null
+From 9acec059c0cef0bf086c738f4c0b1f4447782a48 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Wed, 1 Jan 2014 19:19:28 +0000
+Subject: staging: vt6656: CARDqGetNextTBTT correct uLowNextTBTT
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 9acec059c0cef0bf086c738f4c0b1f4447782a48 upstream.
+
+value uLowNextTBTT yields wrong value.
+
+ULL is needed with qwTSF
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vt6656/card.c
++++ b/drivers/staging/vt6656/card.c
+@@ -761,7 +761,7 @@ u64 CARDqGetNextTBTT(u64 qwTSF, u16 wBea
+
+ uBeaconInterval = wBeaconInterval * 1024;
+ // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval
+- uLowNextTBTT = ((qwTSF & 0xffffffffU) >> 10) << 10;
++ uLowNextTBTT = ((qwTSF & 0xffffffffULL) >> 10) << 10;
+ uLowRemain = (uLowNextTBTT) % uBeaconInterval;
+ uHighRemain = ((0x80000000 % uBeaconInterval) * 2 * (u32)(qwTSF >> 32))
+ % uBeaconInterval;
--- /dev/null
+From 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 Mon Sep 17 00:00:00 2001
+From: Marek Roszko <mark.roszko@gmail.com>
+Date: Tue, 7 Jan 2014 11:45:06 +0100
+Subject: tty/serial: at91: Handle shutdown more safely
+
+From: Marek Roszko <mark.roszko@gmail.com>
+
+commit 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 upstream.
+
+Interrupts were being cleaned up late in the shutdown handler, it is possible
+that an interrupt can occur and schedule a tasklet that runs after the port is
+cleaned up. There is a null dereference due to this race condition with the
+following stacktrace:
+
+[<c02092b0>] (atmel_tasklet_func+0x514/0x814) from [<c001fd34>] (tasklet_action+0x70/0xa8)
+[<c001fd34>] (tasklet_action+0x70/0xa8) from [<c001f60c>] (__do_softirq+0x90/0x144)
+[<c001f60c>] (__do_softirq+0x90/0x144) from [<c001fa18>] (irq_exit+0x40/0x4c)
+[<c001fa18>] (irq_exit+0x40/0x4c) from [<c000e298>] (handle_IRQ+0x64/0x84)
+[<c000e298>] (handle_IRQ+0x64/0x84) from [<c000d6c0>] (__irq_svc+0x40/0x50)
+[<c000d6c0>] (__irq_svc+0x40/0x50) from [<c0208060>] (atmel_rx_dma_release+0x88/0xb8)
+[<c0208060>] (atmel_rx_dma_release+0x88/0xb8) from [<c0209740>] (atmel_shutdown+0x104/0x160)
+[<c0209740>] (atmel_shutdown+0x104/0x160) from [<c0205e8c>] (uart_port_shutdown+0x2c/0x38)
+
+Signed-off-by: Marek Roszko <mark.roszko@gmail.com>
+Acked-by: Leilei Zhao <leilei.zhao@atmel.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1022,12 +1022,24 @@ static int atmel_startup(struct uart_por
+ static void atmel_shutdown(struct uart_port *port)
+ {
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
++
++ /*
++ * Clear out any scheduled tasklets before
++ * we destroy the buffers
++ */
++ tasklet_kill(&atmel_port->tasklet);
++
+ /*
+- * Ensure everything is stopped.
++ * Ensure everything is stopped and
++ * disable all interrupts, port and break condition.
+ */
+ atmel_stop_rx(port);
+ atmel_stop_tx(port);
+
++ UART_PUT_CR(port, ATMEL_US_RSTSTA);
++ UART_PUT_IDR(port, -1);
++
++
+ /*
+ * Shut-down the DMA.
+ */
+@@ -1054,12 +1066,6 @@ static void atmel_shutdown(struct uart_p
+ }
+
+ /*
+- * Disable all interrupts, port and break condition.
+- */
+- UART_PUT_CR(port, ATMEL_US_RSTSTA);
+- UART_PUT_IDR(port, -1);
+-
+- /*
+ * Free the interrupt
+ */
+ free_irq(port->irq, port);
--- /dev/null
+From 440ebadeae9298d7de3d4d105342691841ec88d0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 2 Jan 2014 22:49:24 +0100
+Subject: USB: cypress_m8: fix ring-indicator detection and reporting
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 440ebadeae9298d7de3d4d105342691841ec88d0 upstream.
+
+Fix ring-indicator (RI) status-bit definition, which was defined as CTS,
+effectively preventing RI-changes from being detected while reporting
+false RI status.
+
+This bug predates git.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cypress_m8.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/cypress_m8.h
++++ b/drivers/usb/serial/cypress_m8.h
+@@ -63,7 +63,7 @@
+ #define UART_DSR 0x20 /* data set ready - flow control - device to host */
+ #define CONTROL_RTS 0x10 /* request to send - flow control - host to device */
+ #define UART_CTS 0x10 /* clear to send - flow control - device to host */
+-#define UART_RI 0x10 /* ring indicator - modem - device to host */
++#define UART_RI 0x80 /* ring indicator - modem - device to host */
+ #define UART_CD 0x40 /* carrier detect - modem - device to host */
+ #define CYP_ERROR 0x08 /* received from input report - device to host */
+ /* Note - the below has nothing to do with the "feature report" reset */
--- /dev/null
+From 13518673f1419f2667985a6fca4543e44143408b Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Wed, 18 Dec 2013 16:41:25 +0200
+Subject: usb: dwc3: fix the glue drivers using the nop phy
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 13518673f1419f2667985a6fca4543e44143408b upstream.
+
+The reset_gpio member of the usb_phy_gen_xceiv_platform_data
+structure needs the have negative value or phy-generic's
+probe will fail unless DT is used. 0 is a valid gpio number.
+
+This fixes an issue where phy-generic fails to probe with
+message: "usb_phy_gen_xceiv.0: Error requesting RESET GPIO 0".
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/dwc3-exynos.c | 1 +
+ drivers/usb/dwc3/dwc3-pci.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-exynos.c
++++ b/drivers/usb/dwc3/dwc3-exynos.c
+@@ -46,6 +46,7 @@ static int dwc3_exynos_register_phys(str
+
+ exynos->usb2_phy = pdev;
+ pdata.type = USB_PHY_TYPE_USB2;
++ pdata.gpio_reset = -1;
+
+ ret = platform_device_add_data(exynos->usb2_phy, &pdata, sizeof(pdata));
+ if (ret)
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -72,6 +72,7 @@ static int dwc3_pci_register_phys(struct
+
+ glue->usb2_phy = pdev;
+ pdata.type = USB_PHY_TYPE_USB2;
++ pdata.gpio_reset = -1;
+
+ ret = platform_device_add_data(glue->usb2_phy, &pdata, sizeof(pdata));
+ if (ret)
--- /dev/null
+From feffe09f510c475df082546815f9e4a573f6a233 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Fri, 10 Jan 2014 13:51:26 +0800
+Subject: usb: ehci: add freescale imx28 special write register method
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit feffe09f510c475df082546815f9e4a573f6a233 upstream.
+
+According to Freescale imx28 Errata, "ENGR119653 USB: ARM to USB
+register error issue", All USB register write operations must
+use the ARM SWP instruction. So, we implement a special ehci_write
+for imx28.
+
+Discussion for it at below:
+http://marc.info/?l=linux-usb&m=137996395529294&w=2
+
+Without this patcheset, imx28 works unstable at high AHB bus loading.
+If the bus loading is not high, the imx28 usb can work well at the most
+of time. There is a IC errata for this problem, usually, we consider
+IC errata is a problem not a new feature, and this workaround is needed
+for that, so we need to add them to stable tree 3.11+.
+
+Cc: robert.hodaszi@digi.com
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Tested-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci.h | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -200,6 +200,7 @@ struct ehci_hcd { /* one per controlle
+ unsigned has_synopsys_hc_bug:1; /* Synopsys HC */
+ unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */
+ unsigned need_oc_pp_cycle:1; /* MPC834X port power */
++ unsigned imx28_write_fix:1; /* For Freescale i.MX28 */
+
+ /* required for usb32 quirk */
+ #define OHCI_CTRL_HCFS (3 << 6)
+@@ -675,6 +676,18 @@ static inline unsigned int ehci_readl(co
+ #endif
+ }
+
++#ifdef CONFIG_SOC_IMX28
++static inline void imx28_ehci_writel(const unsigned int val,
++ volatile __u32 __iomem *addr)
++{
++ __asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr));
++}
++#else
++static inline void imx28_ehci_writel(const unsigned int val,
++ volatile __u32 __iomem *addr)
++{
++}
++#endif
+ static inline void ehci_writel(const struct ehci_hcd *ehci,
+ const unsigned int val, __u32 __iomem *regs)
+ {
+@@ -683,7 +696,10 @@ static inline void ehci_writel(const str
+ writel_be(val, regs) :
+ writel(val, regs);
+ #else
+- writel(val, regs);
++ if (ehci->imx28_write_fix)
++ imx28_ehci_writel(val, regs);
++ else
++ writel(val, regs);
+ #endif
+ }
+
--- /dev/null
+From 543d7784b07ffd16cc82a9cb4e1e0323fd0040f1 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 7 Jan 2014 10:43:02 -0500
+Subject: USB: fix race between hub_disconnect and recursively_mark_NOTATTACHED
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 543d7784b07ffd16cc82a9cb4e1e0323fd0040f1 upstream.
+
+There is a race in the hub driver between hub_disconnect() and
+recursively_mark_NOTATTACHED(). This race can be triggered if the
+driver is unbound from a device at the same time as the bus's root hub
+is removed. When the race occurs, it can cause an oops:
+
+BUG: unable to handle kernel NULL pointer dereference at 0000015c
+IP: [<c16d5fb0>] recursively_mark_NOTATTACHED+0x20/0x60
+Call Trace:
+ [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
+ [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
+ [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
+ [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
+ [<c16d6082>] usb_set_device_state+0x92/0x120
+ [<c16d862b>] usb_disconnect+0x2b/0x1a0
+ [<c16dd4c0>] usb_remove_hcd+0xb0/0x160
+ [<c19ca846>] ? _raw_spin_unlock_irqrestore+0x26/0x50
+ [<c1704efc>] ehci_mid_remove+0x1c/0x30
+ [<c1704f26>] ehci_mid_stop_host+0x16/0x30
+ [<c16f7698>] penwell_otg_work+0xd28/0x3520
+ [<c19c945b>] ? __schedule+0x39b/0x7f0
+ [<c19cdb9d>] ? sub_preempt_count+0x3d/0x50
+ [<c125e97d>] process_one_work+0x11d/0x3d0
+ [<c19c7f4d>] ? mutex_unlock+0xd/0x10
+ [<c125e0e5>] ? manage_workers.isra.24+0x1b5/0x270
+ [<c125f009>] worker_thread+0xf9/0x320
+ [<c19ca846>] ? _raw_spin_unlock_irqrestore+0x26/0x50
+ [<c125ef10>] ? rescuer_thread+0x2b0/0x2b0
+ [<c1264ac4>] kthread+0x94/0xa0
+ [<c19d0f77>] ret_from_kernel_thread+0x1b/0x28
+ [<c1264a30>] ? kthread_create_on_node+0xc0/0xc0
+
+One problem is that recursively_mark_NOTATTACHED() uses the intfdata
+value and hub->hdev->maxchild while hub_disconnect() is clearing them.
+Another problem is that it uses hub->ports[i] while the port device is
+being released.
+
+To fix this race, we need to hold the device_state_lock while
+hub_disconnect() changes the values. (Note that usb_disconnect()
+and hub_port_connect_change() already acquire this lock at similar
+critical times during a USB device's life cycle.) We also need to
+remove the port devices after maxchild has been set to 0, instead of
+before.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: "Du, Changbin" <changbinx.du@intel.com>
+Tested-by: "Du, Changbin" <changbinx.du@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1605,7 +1605,7 @@ static void hub_disconnect(struct usb_in
+ {
+ struct usb_hub *hub = usb_get_intfdata(intf);
+ struct usb_device *hdev = interface_to_usbdev(intf);
+- int i;
++ int port1;
+
+ /* Take the hub off the event list and don't let it be added again */
+ spin_lock_irq(&hub_event_lock);
+@@ -1620,11 +1620,15 @@ static void hub_disconnect(struct usb_in
+ hub->error = 0;
+ hub_quiesce(hub, HUB_DISCONNECT);
+
+- usb_set_intfdata (intf, NULL);
++ /* Avoid races with recursively_mark_NOTATTACHED() */
++ spin_lock_irq(&device_state_lock);
++ port1 = hdev->maxchild;
++ hdev->maxchild = 0;
++ usb_set_intfdata(intf, NULL);
++ spin_unlock_irq(&device_state_lock);
+
+- for (i = 0; i < hdev->maxchild; i++)
+- usb_hub_remove_port_device(hub, i + 1);
+- hub->hdev->maxchild = 0;
++ for (; port1 > 0; --port1)
++ usb_hub_remove_port_device(hub, port1);
+
+ if (hub->hdev->speed == USB_SPEED_HIGH)
+ highspeed_hubs--;
--- /dev/null
+From c1f15196ac3b541d084dc80a8fbd8a74c6a0bd44 Mon Sep 17 00:00:00 2001
+From: Colin Leitner <colin.leitner@googlemail.com>
+Date: Mon, 6 Jan 2014 21:33:54 +0100
+Subject: USB: ftdi_sio: added CS5 quirk for broken smartcard readers
+
+From: Colin Leitner <colin.leitner@googlemail.com>
+
+commit c1f15196ac3b541d084dc80a8fbd8a74c6a0bd44 upstream.
+
+Genuine FTDI chips support only CS7/8. A previous fix in commit
+8704211f65a2 ("USB: ftdi_sio: fixed handling of unsupported CSIZE
+setting") enforced this limitation and reported it back to userspace.
+
+However, certain types of smartcard readers depend on specific
+driver behaviour that requests 0 data bits (not 5) to change into a
+different operating mode if CS5 has been set.
+
+This patch reenables this behaviour for all FTDI devices.
+
+Tagged to be added to stable, because it affects a lot of users of
+embedded systems which rely on these readers to work properly.
+
+Reported-by: Heinrich Siebmanns <H.Siebmanns@t-online.de>
+Tested-by: Heinrich Siebmanns <H.Siebmanns@t-online.de>
+Signed-off-by: Colin Leitner <colin.leitner@gmail.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2132,10 +2132,20 @@ static void ftdi_set_termios(struct tty_
+ }
+
+ /*
+- * All FTDI UART chips are limited to CS7/8. We won't pretend to
++ * All FTDI UART chips are limited to CS7/8. We shouldn't pretend to
+ * support CS5/6 and revert the CSIZE setting instead.
++ *
++ * CS5 however is used to control some smartcard readers which abuse
++ * this limitation to switch modes. Original FTDI chips fall back to
++ * eight data bits.
++ *
++ * TODO: Implement a quirk to only allow this with mentioned
++ * readers. One I know of (Argolis Smartreader V1)
++ * returns "USB smartcard server" as iInterface string.
++ * The vendor didn't bother with a custom VID/PID of
++ * course.
+ */
+- if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) {
++ if (C_CSIZE(tty) == CS6) {
+ dev_warn(ddev, "requested CSIZE setting not supported\n");
+
+ termios->c_cflag &= ~CSIZE;
+@@ -2182,6 +2192,9 @@ no_skip:
+ urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE;
+ }
+ switch (cflag & CSIZE) {
++ case CS5:
++ dev_dbg(ddev, "Setting CS5 quirk\n");
++ break;
+ case CS7:
+ urb_value |= 7;
+ dev_dbg(ddev, "Setting CS7\n");
--- /dev/null
+From 0e16114f2db4838251fb64f3b550996ad3585890 Mon Sep 17 00:00:00 2001
+From: Mikhail Zolotaryov <lebon@lebon.org.ua>
+Date: Sat, 28 Dec 2013 01:56:35 +0200
+Subject: USB: Nokia 502 is an unusual device
+
+From: Mikhail Zolotaryov <lebon@lebon.org.ua>
+
+commit 0e16114f2db4838251fb64f3b550996ad3585890 upstream.
+
+The USB storage operation of Nokia Asha 502 Dual SIM smartphone running Asha
+Platform 1.1.1 is unreliable in respect of data consistency (i.e. transfered
+files are corrupted). A similar issue is described here:
+http://discussions.nokia.com/t5/Asha-and-other-Nokia-Series-30/Nokia-301-USB-transfers-and-corrupted-files/td-p/1974170
+
+The workaround is (MAX_SECTORS_64):
+ rmmod usb_storage && modprobe usb_storage quirks=0421:06aa:m
+
+The patch adds the tested device to the unusual list permanently.
+
+Signed-off-by: Mikhail Zolotaryov <lebon@lebon.org.ua>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -234,6 +234,13 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64 ),
+
++/* Patch submitted by Mikhail Zolotaryov <lebon@lebon.org.ua> */
++UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110,
++ "Nokia",
++ "502",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_MAX_SECTORS_64 ),
++
+ #ifdef NO_SDDR09
+ UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100,
+ "Microtech",
--- /dev/null
+From 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= <zjn77777@163.com>
+Date: Wed, 18 Dec 2013 15:37:17 +0800
+Subject: usb: option: add new zte 3g modem pids to option driver
+
+From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= <zjn77777@163.com>
+
+commit 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 upstream.
+
+Signed-off-by: Jun zhang <zhang.jun92@zte.com.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1447,6 +1447,17 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
+
+ /* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff),
--- /dev/null
+From 623c8263376c0b8a4b0c220232e7313d762cd0cc Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Sun, 29 Dec 2013 19:22:53 +0100
+Subject: USB: pl2303: fix data corruption on termios updates
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 623c8263376c0b8a4b0c220232e7313d762cd0cc upstream.
+
+Some PL2303 devices are known to lose bytes if you change serial
+settings even to the same values as before. Avoid this by comparing the
+encoded settings with the previsouly used ones before configuring the
+device.
+
+The common case was fixed by commit bf5e5834bffc6 ("pl2303: Fix mode
+switching regression"), but this problem was still possible to trigger,
+for instance, by using the TCSETS2-interface to repeatedly request
+115201 baud, which gets mapped to 115200 and thus always triggers a
+settings update.
+
+Cc: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/pl2303.c | 33 +++++++++++++++++++++++++--------
+ 1 file changed, 25 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -141,6 +141,8 @@ struct pl2303_private {
+ spinlock_t lock;
+ u8 line_control;
+ u8 line_status;
++
++ u8 line_settings[7];
+ };
+
+ static int pl2303_vendor_read(__u16 value, __u16 index,
+@@ -280,10 +282,6 @@ static void pl2303_set_termios(struct tt
+ int baud_floor, baud_ceil;
+ int k;
+
+- /* The PL2303 is reported to lose bytes if you change
+- serial settings even to the same values as before. Thus
+- we actually need to filter in this specific case */
+-
+ if (old_termios && !tty_termios_hw_change(&tty->termios, old_termios))
+ return;
+
+@@ -422,10 +420,29 @@ static void pl2303_set_termios(struct tt
+ dev_dbg(&port->dev, "parity = none\n");
+ }
+
+- i = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+- SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
+- 0, 0, buf, 7, 100);
+- dev_dbg(&port->dev, "0x21:0x20:0:0 %d\n", i);
++ /*
++ * Some PL2303 are known to lose bytes if you change serial settings
++ * even to the same values as before. Thus we actually need to filter
++ * in this specific case.
++ *
++ * Note that the tty_termios_hw_change check above is not sufficient
++ * as a previously requested baud rate may differ from the one
++ * actually used (and stored in old_termios).
++ *
++ * NOTE: No additional locking needed for line_settings as it is
++ * only used in set_termios, which is serialised against itself.
++ */
++ if (!old_termios || memcmp(buf, priv->line_settings, 7)) {
++ i = usb_control_msg(serial->dev,
++ usb_sndctrlpipe(serial->dev, 0),
++ SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
++ 0, 0, buf, 7, 100);
++
++ dev_dbg(&port->dev, "0x21:0x20:0:0 %d\n", i);
++
++ if (i == 7)
++ memcpy(priv->line_settings, buf, 7);
++ }
+
+ /* change control lines if we are switching to or from B0 */
+ spin_lock_irqsave(&priv->lock, flags);
--- /dev/null
+From 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 Mon Sep 17 00:00:00 2001
+From: Rahul Bedarkar <rahulbedarkar89@gmail.com>
+Date: Thu, 2 Jan 2014 20:57:56 +0530
+Subject: USB: serial: add support for iBall 3.5G connect usb modem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rahul Bedarkar <rahulbedarkar89@gmail.com>
+
+commit 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 upstream.
+
+Add support for iBall 3.5G connect usb modem.
+
+$lsusb
+Bus 002 Device 006: ID 1c9e:9605 OMEGA TECHNOLOGY
+
+$usb-devices
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1c9e ProdID=9605 Rev=00.00
+S: Manufacturer=USB Modem
+S: Product=USB Modem
+S: SerialNumber=1234567890ABCDEF
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+
+Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
+Suggested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -320,6 +320,9 @@ static void option_instat_callback(struc
+ * It seems to contain a Qualcomm QSC6240/6290 chipset */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603
+
++/* iBall 3.5G connect wireless modem */
++#define IBALL_3_5G_CONNECT 0x9605
++
+ /* Zoom */
+ #define ZOOM_PRODUCT_4597 0x9607
+
+@@ -1500,6 +1503,7 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+ },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
++ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+ /* Pirelli */
+ { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) },
--- /dev/null
+From 9005355af23856c55a5538c9024355785424821b Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Fri, 15 Nov 2013 14:53:14 -0800
+Subject: usb: xhci: Check for XHCI_PLAT in xhci_cleanup_msix()
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit 9005355af23856c55a5538c9024355785424821b upstream.
+
+If CONFIG_PCI is enabled, make sure xhci_cleanup_msix()
+doesn't try to free a bogus PCI IRQ or dereference an invalid
+pci_dev when the xHCI device is actually a platform_device.
+
+This patch should be backported to kernels as old as 3.9, that
+contain the commit 52fb61250a7a132b0cfb9f4a1060a1f3c49e5a25
+"xhci-plat: Don't enable legacy PCI interrupts."
+
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -315,6 +315,9 @@ static void xhci_cleanup_msix(struct xhc
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+
++ if (xhci->quirks & XHCI_PLAT)
++ return;
++
+ xhci_free_irq(xhci);
+
+ if (xhci->msix_entries) {
--- /dev/null
+From da6139e49c7cb0f4251265cb5243b8d220adb48d Mon Sep 17 00:00:00 2001
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Mon, 13 Jan 2014 06:51:01 -0500
+Subject: x86: Add check for number of available vectors before CPU down
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+commit da6139e49c7cb0f4251265cb5243b8d220adb48d upstream.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64791
+
+When a cpu is downed on a system, the irqs on the cpu are assigned to
+other cpus. It is possible, however, that when a cpu is downed there
+aren't enough free vectors on the remaining cpus to account for the
+vectors from the cpu that is being downed.
+
+This results in an interesting "overflow" condition where irqs are
+"assigned" to a CPU but are not handled.
+
+For example, when downing cpus on a 1-64 logical processor system:
+
+<snip>
+[ 232.021745] smpboot: CPU 61 is now offline
+[ 238.480275] smpboot: CPU 62 is now offline
+[ 245.991080] ------------[ cut here ]------------
+[ 245.996270] WARNING: CPU: 0 PID: 0 at net/sched/sch_generic.c:264 dev_watchdog+0x246/0x250()
+[ 246.005688] NETDEV WATCHDOG: p786p1 (ixgbe): transmit queue 0 timed out
+[ 246.013070] Modules linked in: lockd sunrpc iTCO_wdt iTCO_vendor_support sb_edac ixgbe microcode e1000e pcspkr joydev edac_core lpc_ich ioatdma ptp mdio mfd_core i2c_i801 dca pps_core i2c_core wmi acpi_cpufreq isci libsas scsi_transport_sas
+[ 246.037633] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.12.0+ #14
+[ 246.044451] Hardware name: Intel Corporation S4600LH ........../SVRBD-ROW_T, BIOS SE5C600.86B.01.08.0003.022620131521 02/26/2013
+[ 246.057371] 0000000000000009 ffff88081fa03d40 ffffffff8164fbf6 ffff88081fa0ee48
+[ 246.065728] ffff88081fa03d90 ffff88081fa03d80 ffffffff81054ecc ffff88081fa13040
+[ 246.074073] 0000000000000000 ffff88200cce0000 0000000000000040 0000000000000000
+[ 246.082430] Call Trace:
+[ 246.085174] <IRQ> [<ffffffff8164fbf6>] dump_stack+0x46/0x58
+[ 246.091633] [<ffffffff81054ecc>] warn_slowpath_common+0x8c/0xc0
+[ 246.098352] [<ffffffff81054fb6>] warn_slowpath_fmt+0x46/0x50
+[ 246.104786] [<ffffffff815710d6>] dev_watchdog+0x246/0x250
+[ 246.110923] [<ffffffff81570e90>] ? dev_deactivate_queue.constprop.31+0x80/0x80
+[ 246.119097] [<ffffffff8106092a>] call_timer_fn+0x3a/0x110
+[ 246.125224] [<ffffffff8106280f>] ? update_process_times+0x6f/0x80
+[ 246.132137] [<ffffffff81570e90>] ? dev_deactivate_queue.constprop.31+0x80/0x80
+[ 246.140308] [<ffffffff81061db0>] run_timer_softirq+0x1f0/0x2a0
+[ 246.146933] [<ffffffff81059a80>] __do_softirq+0xe0/0x220
+[ 246.152976] [<ffffffff8165fedc>] call_softirq+0x1c/0x30
+[ 246.158920] [<ffffffff810045f5>] do_softirq+0x55/0x90
+[ 246.164670] [<ffffffff81059d35>] irq_exit+0xa5/0xb0
+[ 246.170227] [<ffffffff8166062a>] smp_apic_timer_interrupt+0x4a/0x60
+[ 246.177324] [<ffffffff8165f40a>] apic_timer_interrupt+0x6a/0x70
+[ 246.184041] <EOI> [<ffffffff81505a1b>] ? cpuidle_enter_state+0x5b/0xe0
+[ 246.191559] [<ffffffff81505a17>] ? cpuidle_enter_state+0x57/0xe0
+[ 246.198374] [<ffffffff81505b5d>] cpuidle_idle_call+0xbd/0x200
+[ 246.204900] [<ffffffff8100b7ae>] arch_cpu_idle+0xe/0x30
+[ 246.210846] [<ffffffff810a47b0>] cpu_startup_entry+0xd0/0x250
+[ 246.217371] [<ffffffff81646b47>] rest_init+0x77/0x80
+[ 246.223028] [<ffffffff81d09e8e>] start_kernel+0x3ee/0x3fb
+[ 246.229165] [<ffffffff81d0989f>] ? repair_env_string+0x5e/0x5e
+[ 246.235787] [<ffffffff81d095a5>] x86_64_start_reservations+0x2a/0x2c
+[ 246.242990] [<ffffffff81d0969f>] x86_64_start_kernel+0xf8/0xfc
+[ 246.249610] ---[ end trace fb74fdef54d79039 ]---
+[ 246.254807] ixgbe 0000:c2:00.0 p786p1: initiating reset due to tx timeout
+[ 246.262489] ixgbe 0000:c2:00.0 p786p1: Reset adapter
+Last login: Mon Nov 11 08:35:14 from 10.18.17.119
+[root@(none) ~]# [ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5
+[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX
+[ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5
+[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX
+
+(last lines keep repeating. ixgbe driver is dead until module reload.)
+
+If the downed cpu has more vectors than are free on the remaining cpus on the
+system, it is possible that some vectors are "orphaned" even though they are
+assigned to a cpu. In this case, since the ixgbe driver had a watchdog, the
+watchdog fired and notified that something was wrong.
+
+This patch adds a function, check_vectors(), to compare the number of vectors
+on the CPU going down and compares it to the number of vectors available on
+the system. If there aren't enough vectors for the CPU to go down, an
+error is returned and propogated back to userspace.
+
+v2: Do not need to look at percpu irqs
+v3: Need to check affinity to prevent counting of MSIs in IOAPIC Lowest
+ Priority Mode
+v4: Additional changes suggested by Gong Chen.
+v5/v6/v7/v8: Updated comment text
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Link: http://lkml.kernel.org/r/1389613861-3853-1-git-send-email-prarit@redhat.com
+Reviewed-by: Gong Chen <gong.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Michel Lespinasse <walken@google.com>
+Cc: Seiji Aguchi <seiji.aguchi@hds.com>
+Cc: Yang Zhang <yang.z.zhang@Intel.com>
+Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
+Cc: Janet Morgan <janet.morgan@intel.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: Ruiv Wang <ruiv.wang@gmail.com>
+Cc: Gong Chen <gong.chen@linux.intel.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/irq.h | 1
+ arch/x86/kernel/irq.c | 70 +++++++++++++++++++++++++++++++++++++++++++++
+ arch/x86/kernel/smpboot.c | 6 +++
+ 3 files changed, 77 insertions(+)
+
+--- a/arch/x86/include/asm/irq.h
++++ b/arch/x86/include/asm/irq.h
+@@ -25,6 +25,7 @@ extern void irq_ctx_init(int cpu);
+
+ #ifdef CONFIG_HOTPLUG_CPU
+ #include <linux/cpumask.h>
++extern int check_irq_vectors_for_cpu_disable(void);
+ extern void fixup_irqs(void);
+ extern void irq_force_complete_move(int);
+ #endif
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -249,6 +249,76 @@ void smp_kvm_posted_intr_ipi(struct pt_r
+ EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq);
+
+ #ifdef CONFIG_HOTPLUG_CPU
++/*
++ * This cpu is going to be removed and its vectors migrated to the remaining
++ * online cpus. Check to see if there are enough vectors in the remaining cpus.
++ * This function is protected by stop_machine().
++ */
++int check_irq_vectors_for_cpu_disable(void)
++{
++ int irq, cpu;
++ unsigned int this_cpu, vector, this_count, count;
++ struct irq_desc *desc;
++ struct irq_data *data;
++ struct cpumask affinity_new, online_new;
++
++ this_cpu = smp_processor_id();
++ cpumask_copy(&online_new, cpu_online_mask);
++ cpu_clear(this_cpu, online_new);
++
++ this_count = 0;
++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
++ irq = __this_cpu_read(vector_irq[vector]);
++ if (irq >= 0) {
++ desc = irq_to_desc(irq);
++ data = irq_desc_get_irq_data(desc);
++ cpumask_copy(&affinity_new, data->affinity);
++ cpu_clear(this_cpu, affinity_new);
++
++ /* Do not count inactive or per-cpu irqs. */
++ if (!irq_has_action(irq) || irqd_is_per_cpu(data))
++ continue;
++
++ /*
++ * A single irq may be mapped to multiple
++ * cpu's vector_irq[] (for example IOAPIC cluster
++ * mode). In this case we have two
++ * possibilities:
++ *
++ * 1) the resulting affinity mask is empty; that is
++ * this the down'd cpu is the last cpu in the irq's
++ * affinity mask, or
++ *
++ * 2) the resulting affinity mask is no longer
++ * a subset of the online cpus but the affinity
++ * mask is not zero; that is the down'd cpu is the
++ * last online cpu in a user set affinity mask.
++ */
++ if (cpumask_empty(&affinity_new) ||
++ !cpumask_subset(&affinity_new, &online_new))
++ this_count++;
++ }
++ }
++
++ count = 0;
++ for_each_online_cpu(cpu) {
++ if (cpu == this_cpu)
++ continue;
++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
++ vector++) {
++ if (per_cpu(vector_irq, cpu)[vector] < 0)
++ count++;
++ }
++ }
++
++ if (count < this_count) {
++ pr_warn("CPU %d disable failed: CPU has %u vectors assigned and there are only %u available.\n",
++ this_cpu, this_count, count);
++ return -ERANGE;
++ }
++ return 0;
++}
++
+ /* A cpu has been removed from cpu_online_mask. Reset irq affinities. */
+ void fixup_irqs(void)
+ {
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1309,6 +1309,12 @@ void cpu_disable_common(void)
+
+ int native_cpu_disable(void)
+ {
++ int ret;
++
++ ret = check_irq_vectors_for_cpu_disable();
++ if (ret)
++ return ret;
++
+ clear_local_APIC();
+
+ cpu_disable_common();
--- /dev/null
+From a7f84f03f660d93574ac88835d056c0d6468aebe Mon Sep 17 00:00:00 2001
+From: Dave Young <dyoung@redhat.com>
+Date: Fri, 20 Dec 2013 18:02:15 +0800
+Subject: x86/efi: Fix off-by-one bug in EFI Boot Services reservation
+
+From: Dave Young <dyoung@redhat.com>
+
+commit a7f84f03f660d93574ac88835d056c0d6468aebe upstream.
+
+Current code check boot service region with kernel text region by:
+start+size >= __pa_symbol(_text)
+The end of the above region should be start + size - 1 instead.
+
+I see this problem in ovmf + Fedora 19 grub boot:
+text start: 1000000 md start: 800000 md size: 800000
+
+Signed-off-by: Dave Young <dyoung@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+Acked-by: Toshi Kani <toshi.kani@hp.com>
+Tested-by: Toshi Kani <toshi.kani@hp.com>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/platform/efi/efi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -438,7 +438,7 @@ void __init efi_reserve_boot_services(vo
+ * - Not within any part of the kernel
+ * - Not the bios reserved area
+ */
+- if ((start+size >= __pa_symbol(_text)
++ if ((start + size > __pa_symbol(_text)
+ && start <= __pa_symbol(_end)) ||
+ !e820_all_mapped(start, start+size, E820_RAM) ||
+ memblock_is_region_reserved(start, size)) {
--- /dev/null
+From 2def2ef2ae5f3990aabdbe8a755911902707d268 Mon Sep 17 00:00:00 2001
+From: PaX Team <pageexec@freemail.hu>
+Date: Thu, 30 Jan 2014 16:59:25 -0800
+Subject: x86, x32: Correct invalid use of user timespec in the kernel
+
+From: PaX Team <pageexec@freemail.hu>
+
+commit 2def2ef2ae5f3990aabdbe8a755911902707d268 upstream.
+
+The x32 case for the recvmsg() timout handling is broken:
+
+ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
+ unsigned int vlen, unsigned int flags,
+ struct compat_timespec __user *timeout)
+ {
+ int datagrams;
+ struct timespec ktspec;
+
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+
+ if (COMPAT_USE_64BIT_TIME)
+ return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT,
+ (struct timespec *) timeout);
+ ...
+
+The timeout pointer parameter is provided by userland (hence the __user
+annotation) but for x32 syscalls it's simply cast to a kernel pointer
+and is passed to __sys_recvmmsg which will eventually directly
+dereference it for both reading and writing. Other callers to
+__sys_recvmmsg properly copy from userland to the kernel first.
+
+The bug was introduced by commit ee4fa23c4bfc ("compat: Use
+COMPAT_USE_64BIT_TIME in net/compat.c") and should affect all kernels
+since 3.4 (and perhaps vendor kernels if they backported x32 support
+along with this code).
+
+Note that CONFIG_X86_X32_ABI gets enabled at build time and only if
+CONFIG_X86_X32 is enabled and ld can build x32 executables.
+
+Other uses of COMPAT_USE_64BIT_TIME seem fine.
+
+This addresses CVE-2014-0038.
+
+Signed-off-by: PaX Team <pageexec@freemail.hu>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/compat.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -780,21 +780,16 @@ asmlinkage long compat_sys_recvmmsg(int
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+
+- if (COMPAT_USE_64BIT_TIME)
+- return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+- flags | MSG_CMSG_COMPAT,
+- (struct timespec *) timeout);
+-
+ if (timeout == NULL)
+ return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT, NULL);
+
+- if (get_compat_timespec(&ktspec, timeout))
++ if (compat_get_timespec(&ktspec, timeout))
+ return -EFAULT;
+
+ datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT, &ktspec);
+- if (datagrams > 0 && put_compat_timespec(&ktspec, timeout))
++ if (datagrams > 0 && compat_put_timespec(&ktspec, timeout))
+ datagrams = -EFAULT;
+
+ return datagrams;
projects / thirdparty / kernel / stable-queue.git / commitdiff
