--- /dev/null
+From aaa10eb1d0034eccc096f583fe308f0921617598 Mon Sep 17 00:00:00 2001
+From: Arnaud Patard <apatard@hupstream.com>
+Date: Wed, 25 Apr 2012 12:17:24 +0200
+Subject: 8250_pci: fix pch uart matching
+
+From: Arnaud Patard <apatard@hupstream.com>
+
+commit aaa10eb1d0034eccc096f583fe308f0921617598 upstream.
+
+The rules used to make 8250_pci "ignore" the PCH uarts are lacking pci subids
+entries, preventing it to match and thus is breaking serial port support for
+theses systems.
+
+This has been tested on a nanoETXexpress-TT, which has a specifici uart clock.
+
+Tested-by: Erwan Velu <Erwan.Velu@zodiacaerospace.com>
+[stable@: please apply to 3.0-stable, 3.2-stable and 3.3-stable]
+Signed-off-by: Arnaud Patard <apatard@hupstream.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1609,54 +1609,72 @@ static struct pci_serial_quirk pci_seria
+ {
+ .vendor = PCI_VENDOR_ID_INTEL,
+ .device = 0x8811,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = PCI_VENDOR_ID_INTEL,
+ .device = 0x8812,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = PCI_VENDOR_ID_INTEL,
+ .device = 0x8813,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = PCI_VENDOR_ID_INTEL,
+ .device = 0x8814,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x8027,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x8028,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x8029,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x800C,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
+ {
+ .vendor = 0x10DB,
+ .device = 0x800D,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
--- /dev/null
+From 8b979f7c6bf13a57e7b6002f1175312a44773960 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Lothar=20Wa=C3=9Fmann?= <LW@KARO-electronics.de>
+Date: Thu, 3 May 2012 11:37:12 +0200
+Subject: Add missing call to uart_update_timeout()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lothar Waßmann <LW@KARO-electronics.de>
+
+commit 8b979f7c6bf13a57e7b6002f1175312a44773960 upstream.
+
+This patch fixes a problem reported here:
+http://article.gmane.org/gmane.linux.ports.arm.kernel/155242/match=auart
+
+Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/mxs-auart.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -369,6 +369,8 @@ static void mxs_auart_settermios(struct
+
+ writel(ctrl, u->membase + AUART_LINECTRL);
+ writel(ctrl2, u->membase + AUART_CTRL2);
++
++ uart_update_timeout(u, termios->c_cflag, baud);
+ }
+
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
--- /dev/null
+From c0a5f4a05af588a0f9951f8d24e2564b09501918 Mon Sep 17 00:00:00 2001
+From: Rajkumar Kasirajan <rajkumar.kasirajan@stericsson.com>
+Date: Thu, 17 May 2012 17:03:24 -0700
+Subject: drivers/rtc/rtc-pl031.c: configure correct wday for 2000-01-01
+
+From: Rajkumar Kasirajan <rajkumar.kasirajan@stericsson.com>
+
+commit c0a5f4a05af588a0f9951f8d24e2564b09501918 upstream.
+
+The reset date of the ST Micro version of PL031 is 2000-01-01. The
+correct weekday for 2000-01-01 is saturday, but pl031 is initialized to
+sunday. This may lead to alarm malfunction, so configure the correct
+wday if RTC_DR indicates reset.
+
+Signed-off-by: Rajkumar Kasirajan <rajkumar.kasirajan@stericsson.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: Mattias Wallin <mattias.wallin@stericsson.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-pl031.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/rtc/rtc-pl031.c
++++ b/drivers/rtc/rtc-pl031.c
+@@ -312,6 +312,7 @@ static int pl031_probe(struct amba_devic
+ int ret;
+ struct pl031_local *ldata;
+ struct rtc_class_ops *ops = id->data;
++ unsigned long time;
+
+ ret = amba_request_regions(adev, NULL);
+ if (ret)
+@@ -343,6 +344,23 @@ static int pl031_probe(struct amba_devic
+ writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
+ ldata->base + RTC_CR);
+
++ /*
++ * On ST PL031 variants, the RTC reset value does not provide correct
++ * weekday for 2000-01-01. Correct the erroneous sunday to saturday.
++ */
++ if (ldata->hw_designer == AMBA_VENDOR_ST) {
++ if (readl(ldata->base + RTC_YDR) == 0x2000) {
++ time = readl(ldata->base + RTC_DR);
++ if ((time &
++ (RTC_MON_MASK | RTC_MDAY_MASK | RTC_WDAY_MASK))
++ == 0x02120000) {
++ time = time | (0x7 << RTC_WDAY_SHIFT);
++ writel(0x2000, ldata->base + RTC_YLR);
++ writel(time, ldata->base + RTC_LR);
++ }
++ }
++ }
++
+ ldata->rtc = rtc_device_register("pl031", &adev->dev, ops,
+ THIS_MODULE);
+ if (IS_ERR(ldata->rtc)) {
--- /dev/null
+From b5e1b8cee7ad58a15d2fa79bcd7946acb592602d Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@kernel.org>
+Date: Mon, 21 May 2012 09:26:59 +1000
+Subject: md: using GFP_NOIO to allocate bio for flush request
+
+From: Shaohua Li <shli@kernel.org>
+
+commit b5e1b8cee7ad58a15d2fa79bcd7946acb592602d upstream.
+
+A flush request is usually issued in transaction commit code path, so
+using GFP_KERNEL to allocate memory for flush request bio falls into
+the classic deadlock issue.
+
+This is suitable for any -stable kernel to which it applies as it
+avoids a possible deadlock.
+
+Signed-off-by: Shaohua Li <shli@fusionio.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -452,7 +452,7 @@ static void submit_flushes(struct work_s
+ atomic_inc(&rdev->nr_pending);
+ atomic_inc(&rdev->nr_pending);
+ rcu_read_unlock();
+- bi = bio_alloc_mddev(GFP_KERNEL, 0, mddev);
++ bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+ bi->bi_end_io = md_end_flush;
+ bi->bi_private = rdev;
+ bi->bi_bdev = rdev->bdev;
--- /dev/null
+From 05f144a0d5c2207a0349348127f996e104ad7404 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Wed, 23 May 2012 12:48:13 +0100
+Subject: mm: mempolicy: Let vma_merge and vma_split handle
+ vma->vm_policy linkages
+
+From: Mel Gorman <mgorman@suse.de>
+
+commit 05f144a0d5c2207a0349348127f996e104ad7404 upstream.
+
+Dave Jones' system call fuzz testing tool "trinity" triggered the
+following bug error with slab debugging enabled
+
+ =============================================================================
+ BUG numa_policy (Not tainted): Poison overwritten
+ -----------------------------------------------------------------------------
+
+ INFO: 0xffff880146498250-0xffff880146498250. First byte 0x6a instead of 0x6b
+ INFO: Allocated in mpol_new+0xa3/0x140 age=46310 cpu=6 pid=32154
+ __slab_alloc+0x3d3/0x445
+ kmem_cache_alloc+0x29d/0x2b0
+ mpol_new+0xa3/0x140
+ sys_mbind+0x142/0x620
+ system_call_fastpath+0x16/0x1b
+ INFO: Freed in __mpol_put+0x27/0x30 age=46268 cpu=6 pid=32154
+ __slab_free+0x2e/0x1de
+ kmem_cache_free+0x25a/0x260
+ __mpol_put+0x27/0x30
+ remove_vma+0x68/0x90
+ exit_mmap+0x118/0x140
+ mmput+0x73/0x110
+ exit_mm+0x108/0x130
+ do_exit+0x162/0xb90
+ do_group_exit+0x4f/0xc0
+ sys_exit_group+0x17/0x20
+ system_call_fastpath+0x16/0x1b
+ INFO: Slab 0xffffea0005192600 objects=27 used=27 fp=0x (null) flags=0x20000000004080
+ INFO: Object 0xffff880146498250 @offset=592 fp=0xffff88014649b9d0
+
+This implied a reference counting bug and the problem happened during
+mbind().
+
+mbind() applies a new memory policy to a range and uses mbind_range() to
+merge existing VMAs or split them as necessary. In the event of splits,
+mpol_dup() will allocate a new struct mempolicy and maintain existing
+reference counts whose rules are documented in
+Documentation/vm/numa_memory_policy.txt .
+
+The problem occurs with shared memory policies. The vm_op->set_policy
+increments the reference count if necessary and split_vma() and
+vma_merge() have already handled the existing reference counts.
+However, policy_vma() screws it up by replacing an existing
+vma->vm_policy with one that potentially has the wrong reference count
+leading to a premature free. This patch removes the damage caused by
+policy_vma().
+
+With this patch applied Dave's trinity tool runs an mbind test for 5
+minutes without error. /proc/slabinfo reported that there are no
+numa_policy or shared_policy_node objects allocated after the test
+completed and the shared memory region was deleted.
+
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Cc: Dave Jones <davej@redhat.com>
+Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Stephen Wilson <wilsons@start.ca>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/mempolicy.c | 41 +++++++++++++++++------------------------
+ 1 file changed, 17 insertions(+), 24 deletions(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -607,27 +607,6 @@ check_range(struct mm_struct *mm, unsign
+ return first;
+ }
+
+-/* Apply policy to a single VMA */
+-static int policy_vma(struct vm_area_struct *vma, struct mempolicy *new)
+-{
+- int err = 0;
+- struct mempolicy *old = vma->vm_policy;
+-
+- pr_debug("vma %lx-%lx/%lx vm_ops %p vm_file %p set_policy %p\n",
+- vma->vm_start, vma->vm_end, vma->vm_pgoff,
+- vma->vm_ops, vma->vm_file,
+- vma->vm_ops ? vma->vm_ops->set_policy : NULL);
+-
+- if (vma->vm_ops && vma->vm_ops->set_policy)
+- err = vma->vm_ops->set_policy(vma, new);
+- if (!err) {
+- mpol_get(new);
+- vma->vm_policy = new;
+- mpol_put(old);
+- }
+- return err;
+-}
+-
+ /* Step 2: apply policy to a range and do splits. */
+ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ unsigned long end, struct mempolicy *new_pol)
+@@ -676,9 +655,23 @@ static int mbind_range(struct mm_struct
+ if (err)
+ goto out;
+ }
+- err = policy_vma(vma, new_pol);
+- if (err)
+- goto out;
++
++ /*
++ * Apply policy to a single VMA. The reference counting of
++ * policy for vma_policy linkages has already been handled by
++ * vma_merge and split_vma as necessary. If this is a shared
++ * policy then ->set_policy will increment the reference count
++ * for an sp node.
++ */
++ pr_debug("vma %lx-%lx/%lx vm_ops %p vm_file %p set_policy %p\n",
++ vma->vm_start, vma->vm_end, vma->vm_pgoff,
++ vma->vm_ops, vma->vm_file,
++ vma->vm_ops ? vma->vm_ops->set_policy : NULL);
++ if (vma->vm_ops && vma->vm_ops->set_policy) {
++ err = vma->vm_ops->set_policy(vma, new_pol);
++ if (err)
++ goto out;
++ }
+ }
+
+ out:
--- /dev/null
+From 9bc3711cbb67ac620bf09b4a147cbab45b2c36c0 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Thu, 19 Jan 2012 14:01:04 -0600
+Subject: SCSI: hpsa: Fix problem with MSA2xxx devices
+
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+
+commit 9bc3711cbb67ac620bf09b4a147cbab45b2c36c0 upstream.
+
+Upgraded firmware on Smart Array P7xx (and some others) made them show up as
+SCSI revision 5 devices and this caused the driver to fail to map MSA2xxx
+logical drives to the correct bus/target/lun. A symptom of this would be that
+the target ID of the logical drives as presented by the external storage array
+is ignored, and all such logical drives are assigned to target zero,
+differentiated only by LUN. Some multipath software reportedly does not deal
+well with this behavior, failing to recognize different paths to the same
+device as such.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: Scott Teel <scott.teel@hp.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Cc: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/hpsa.c | 34 +++++++++++++++-------------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -1676,30 +1676,26 @@ static void figure_bus_target_lun(struct
+
+ if (is_logical_dev_addr_mode(lunaddrbytes)) {
+ /* logical device */
+- if (unlikely(is_scsi_rev_5(h))) {
+- /* p1210m, logical drives lun assignments
+- * match SCSI REPORT LUNS data.
++ lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
++ if (is_msa2xxx(h, device)) {
++ /* msa2xxx way, put logicals on bus 1
++ * and match target/lun numbers box
++ * reports.
+ */
+- lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
+- *bus = 0;
+- *target = 0;
+- *lun = (lunid & 0x3fff) + 1;
++ *bus = 1;
++ *target = (lunid >> 16) & 0x3fff;
++ *lun = lunid & 0x00ff;
+ } else {
+- /* not p1210m... */
+- lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
+- if (is_msa2xxx(h, device)) {
+- /* msa2xxx way, put logicals on bus 1
+- * and match target/lun numbers box
+- * reports.
+- */
+- *bus = 1;
+- *target = (lunid >> 16) & 0x3fff;
+- *lun = lunid & 0x00ff;
++ if (likely(is_scsi_rev_5(h))) {
++ /* All current smart arrays (circa 2011) */
++ *bus = 0;
++ *target = 0;
++ *lun = (lunid & 0x3fff) + 1;
+ } else {
+- /* Traditional smart array way. */
++ /* Traditional old smart array way. */
+ *bus = 0;
+- *lun = 0;
+ *target = lunid & 0x3fff;
++ *lun = 0;
+ }
+ }
+ } else {
um-fix-__swp_type.patch
um-implement-a-custom-pte_same-function.patch
docs-update-howto-for-2.6.x-3.x-versioning.patch
+swap-don-t-do-discard-if-no-discard-option-added.patch
+usb-cdc-wdm-sanitize-error-returns.patch
+usb-cdc-wdm-poll-must-return-pollhup-if-device-is-gone.patch
+workqueue-skip-nr_running-sanity-check-in-worker_enter_idle-if-trustee-is-active.patch
+mm-mempolicy-let-vma_merge-and-vma_split-handle.patch
+md-using-gfp_noio-to-allocate-bio-for-flush-request.patch
+add-missing-call-to-uart_update_timeout.patch
+8250_pci-fix-pch-uart-matching.patch
+tty-allow-uart_register-unregister-register.patch
+usb-ftdi-sio-add-support-for-physik-instrumente-e-861.patch
+usb-storage-unusual_devs-entry-for-yarvik-pmp400-mp4-player.patch
+usb-ffs-test-fix-length-argument-of-out-function-call.patch
+drivers-rtc-rtc-pl031.c-configure-correct-wday-for-2000-01-01.patch
+scsi-hpsa-fix-problem-with-msa2xxx-devices.patch
+udlfb-fix-hcd_buffer_free-panic-on-unplug-replug.patch
+usb-usbtest-two-super-speed-fixes-for-usbtest.patch
--- /dev/null
+From 052b1987faca3606109d88d96bce124851f7c4c2 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@kernel.org>
+Date: Wed, 21 Mar 2012 16:34:17 -0700
+Subject: swap: don't do discard if no discard option added
+
+From: Shaohua Li <shli@kernel.org>
+
+commit 052b1987faca3606109d88d96bce124851f7c4c2 upstream.
+
+When swapon() was not passed the SWAP_FLAG_DISCARD option, sys_swapon()
+will still perform a discard operation. This can cause problems if
+discard is slow or buggy.
+
+Reverse the order of the check so that a discard operation is performed
+only if the sys_swapon() caller is attempting to enable discard.
+
+Signed-off-by: Shaohua Li <shli@fusionio.com>
+Reported-by: Holger Kiehl <Holger.Kiehl@dwd.de>
+Tested-by: Holger Kiehl <Holger.Kiehl@dwd.de>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: William Dauchy <wdauchy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/swapfile.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2103,7 +2103,7 @@ SYSCALL_DEFINE2(swapon, const char __use
+ p->flags |= SWP_SOLIDSTATE;
+ p->cluster_next = 1 + (random32() % p->highest_bit);
+ }
+- if (discard_swap(p) == 0 && (swap_flags & SWAP_FLAG_DISCARD))
++ if ((swap_flags & SWAP_FLAG_DISCARD) && discard_swap(p) == 0)
+ p->flags |= SWP_DISCARDABLE;
+ }
+
--- /dev/null
+From 1e66cded334e6cea596c72f6f650eec351b1e959 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Mon, 14 May 2012 14:51:22 +0100
+Subject: tty: Allow uart_register/unregister/register
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit 1e66cded334e6cea596c72f6f650eec351b1e959 upstream.
+
+This is legitimate but because we don't clear the drv->state pointer in the
+unregister code causes a bogus BUG().
+
+Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=42880
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/serial_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2283,6 +2283,7 @@ void uart_unregister_driver(struct uart_
+ tty_unregister_driver(p);
+ put_tty_driver(p);
+ kfree(drv->state);
++ drv->state = NULL;
+ drv->tty_driver = NULL;
+ }
+
--- /dev/null
+From 8d21547d3c9c3bc653261f26d554cfabc4a083de Mon Sep 17 00:00:00 2001
+From: Bernie Thompson <bernie@plugable.com>
+Date: Thu, 1 Mar 2012 17:35:48 -0800
+Subject: udlfb: fix hcd_buffer_free panic on unplug/replug
+
+From: Bernie Thompson <bernie@plugable.com>
+
+commit 8d21547d3c9c3bc653261f26d554cfabc4a083de upstream.
+
+Fix race conditions with unplug/replug behavior, in particular
+take care not to hold up USB probe/disconnect for long-running
+framebuffer operations and rely on usb to handle teardown.
+
+Fix for kernel panic reported with new F17 multiseat support.
+
+Reported-by: Kay Sievers <kay.sievers@vrfy.org>
+Signed-off-by: Bernie Thompson <bernie@plugable.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/udlfb.c | 146 +++++++++++++++++++++++++++-----------------------
+ include/video/udlfb.h | 1
+ 2 files changed, 81 insertions(+), 66 deletions(-)
+
+--- a/drivers/video/udlfb.c
++++ b/drivers/video/udlfb.c
+@@ -918,10 +918,6 @@ static void dlfb_free(struct kref *kref)
+ {
+ struct dlfb_data *dev = container_of(kref, struct dlfb_data, kref);
+
+- /* this function will wait for all in-flight urbs to complete */
+- if (dev->urbs.count > 0)
+- dlfb_free_urb_list(dev);
+-
+ if (dev->backing_buffer)
+ vfree(dev->backing_buffer);
+
+@@ -940,35 +936,42 @@ static void dlfb_release_urb_work(struct
+ up(&unode->dev->urbs.limit_sem);
+ }
+
+-static void dlfb_free_framebuffer_work(struct work_struct *work)
++static void dlfb_free_framebuffer(struct dlfb_data *dev)
+ {
+- struct dlfb_data *dev = container_of(work, struct dlfb_data,
+- free_framebuffer_work.work);
+ struct fb_info *info = dev->info;
+- int node = info->node;
+
+- unregister_framebuffer(info);
++ if (info) {
++ int node = info->node;
+
+- if (info->cmap.len != 0)
+- fb_dealloc_cmap(&info->cmap);
+- if (info->monspecs.modedb)
+- fb_destroy_modedb(info->monspecs.modedb);
+- if (info->screen_base)
+- vfree(info->screen_base);
++ unregister_framebuffer(info);
+
+- fb_destroy_modelist(&info->modelist);
++ if (info->cmap.len != 0)
++ fb_dealloc_cmap(&info->cmap);
++ if (info->monspecs.modedb)
++ fb_destroy_modedb(info->monspecs.modedb);
++ if (info->screen_base)
++ vfree(info->screen_base);
++
++ fb_destroy_modelist(&info->modelist);
+
+- dev->info = 0;
++ dev->info = NULL;
+
+- /* Assume info structure is freed after this point */
+- framebuffer_release(info);
++ /* Assume info structure is freed after this point */
++ framebuffer_release(info);
+
+- pr_warn("fb_info for /dev/fb%d has been freed\n", node);
++ pr_warn("fb_info for /dev/fb%d has been freed\n", node);
++ }
+
+ /* ref taken in probe() as part of registering framebfufer */
+ kref_put(&dev->kref, dlfb_free);
+ }
+
++static void dlfb_free_framebuffer_work(struct work_struct *work)
++{
++ struct dlfb_data *dev = container_of(work, struct dlfb_data,
++ free_framebuffer_work.work);
++ dlfb_free_framebuffer(dev);
++}
+ /*
+ * Assumes caller is holding info->lock mutex (for open and release at least)
+ */
+@@ -1570,14 +1573,15 @@ success:
+ kfree(buf);
+ return true;
+ }
++
++static void dlfb_init_framebuffer_work(struct work_struct *work);
++
+ static int dlfb_usb_probe(struct usb_interface *interface,
+ const struct usb_device_id *id)
+ {
+ struct usb_device *usbdev;
+ struct dlfb_data *dev = 0;
+- struct fb_info *info = 0;
+ int retval = -ENOMEM;
+- int i;
+
+ /* usb initialization */
+
+@@ -1589,9 +1593,7 @@ static int dlfb_usb_probe(struct usb_int
+ goto error;
+ }
+
+- /* we need to wait for both usb and fbdev to spin down on disconnect */
+ kref_init(&dev->kref); /* matching kref_put in usb .disconnect fn */
+- kref_get(&dev->kref); /* matching kref_put in free_framebuffer_work */
+
+ dev->udev = usbdev;
+ dev->gdev = &usbdev->dev; /* our generic struct device * */
+@@ -1619,10 +1621,39 @@ static int dlfb_usb_probe(struct usb_int
+ goto error;
+ }
+
++ kref_get(&dev->kref); /* matching kref_put in free_framebuffer_work */
++
+ /* We don't register a new USB class. Our client interface is fbdev */
+
++ /* Workitem keep things fast & simple during USB enumeration */
++ INIT_DELAYED_WORK(&dev->init_framebuffer_work,
++ dlfb_init_framebuffer_work);
++ schedule_delayed_work(&dev->init_framebuffer_work, 0);
++
++ return 0;
++
++error:
++ if (dev) {
++
++ kref_put(&dev->kref, dlfb_free); /* ref for framebuffer */
++ kref_put(&dev->kref, dlfb_free); /* last ref from kref_init */
++
++ /* dev has been deallocated. Do not dereference */
++ }
++
++ return retval;
++}
++
++static void dlfb_init_framebuffer_work(struct work_struct *work)
++{
++ struct dlfb_data *dev = container_of(work, struct dlfb_data,
++ init_framebuffer_work.work);
++ struct fb_info *info;
++ int retval;
++ int i;
++
+ /* allocates framebuffer driver structure, not framebuffer memory */
+- info = framebuffer_alloc(0, &interface->dev);
++ info = framebuffer_alloc(0, dev->gdev);
+ if (!info) {
+ retval = -ENOMEM;
+ pr_err("framebuffer_alloc failed\n");
+@@ -1668,15 +1699,13 @@ static int dlfb_usb_probe(struct usb_int
+ for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++) {
+ retval = device_create_file(info->dev, &fb_device_attrs[i]);
+ if (retval) {
+- pr_err("device_create_file failed %d\n", retval);
+- goto err_del_attrs;
++ pr_warn("device_create_file failed %d\n", retval);
+ }
+ }
+
+ retval = device_create_bin_file(info->dev, &edid_attr);
+ if (retval) {
+- pr_err("device_create_bin_file failed %d\n", retval);
+- goto err_del_attrs;
++ pr_warn("device_create_bin_file failed %d\n", retval);
+ }
+
+ pr_info("DisplayLink USB device /dev/fb%d attached. %dx%d resolution."
+@@ -1684,38 +1713,10 @@ static int dlfb_usb_probe(struct usb_int
+ info->var.xres, info->var.yres,
+ ((dev->backing_buffer) ?
+ info->fix.smem_len * 2 : info->fix.smem_len) >> 10);
+- return 0;
+-
+-err_del_attrs:
+- for (i -= 1; i >= 0; i--)
+- device_remove_file(info->dev, &fb_device_attrs[i]);
++ return;
+
+ error:
+- if (dev) {
+-
+- if (info) {
+- if (info->cmap.len != 0)
+- fb_dealloc_cmap(&info->cmap);
+- if (info->monspecs.modedb)
+- fb_destroy_modedb(info->monspecs.modedb);
+- if (info->screen_base)
+- vfree(info->screen_base);
+-
+- fb_destroy_modelist(&info->modelist);
+-
+- framebuffer_release(info);
+- }
+-
+- if (dev->backing_buffer)
+- vfree(dev->backing_buffer);
+-
+- kref_put(&dev->kref, dlfb_free); /* ref for framebuffer */
+- kref_put(&dev->kref, dlfb_free); /* last ref from kref_init */
+-
+- /* dev has been deallocated. Do not dereference */
+- }
+-
+- return retval;
++ dlfb_free_framebuffer(dev);
+ }
+
+ static void dlfb_usb_disconnect(struct usb_interface *interface)
+@@ -1735,12 +1736,24 @@ static void dlfb_usb_disconnect(struct u
+ /* When non-active we'll update virtual framebuffer, but no new urbs */
+ atomic_set(&dev->usb_active, 0);
+
+- /* remove udlfb's sysfs interfaces */
+- for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
+- device_remove_file(info->dev, &fb_device_attrs[i]);
+- device_remove_bin_file(info->dev, &edid_attr);
+- unlink_framebuffer(info);
++ /* this function will wait for all in-flight urbs to complete */
++ dlfb_free_urb_list(dev);
++
++ if (info) {
++
++ /* remove udlfb's sysfs interfaces */
++ for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
++ device_remove_file(info->dev, &fb_device_attrs[i]);
++ device_remove_bin_file(info->dev, &edid_attr);
++
++ /* it's safe to uncomment next line if your kernel
++ doesn't yet have this function exported */
++ unlink_framebuffer(info);
++ }
++
+ usb_set_intfdata(interface, NULL);
++ dev->udev = NULL;
++ dev->gdev = NULL;
+
+ /* if clients still have us open, will be freed on last close */
+ if (dev->fb_count == 0)
+@@ -1806,12 +1819,12 @@ static void dlfb_free_urb_list(struct dl
+ int ret;
+ unsigned long flags;
+
+- pr_notice("Waiting for completes and freeing all render urbs\n");
++ pr_notice("Freeing all render urbs\n");
+
+ /* keep waiting and freeing, until we've got 'em all */
+ while (count--) {
+
+- /* Getting interrupted means a leak, but ok at shutdown*/
++ /* Getting interrupted means a leak, but ok at disconnect */
+ ret = down_interruptible(&dev->urbs.limit_sem);
+ if (ret)
+ break;
+@@ -1833,6 +1846,7 @@ static void dlfb_free_urb_list(struct dl
+ kfree(node);
+ }
+
++ dev->urbs.count = 0;
+ }
+
+ static int dlfb_alloc_urb_list(struct dlfb_data *dev, int count, size_t size)
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -41,6 +41,7 @@ struct dlfb_data {
+ char *backing_buffer;
+ int fb_count;
+ bool virtualized; /* true when physical usb device not present */
++ struct delayed_work init_framebuffer_work;
+ struct delayed_work free_framebuffer_work;
+ atomic_t usb_active; /* 0 = update virtual buffer, but no usb traffic */
+ atomic_t lost_pixels; /* 1 = a render op failed. Need screen refresh */
--- /dev/null
+From 616b6937e348ef2b4c6ea5fef2cd3c441145efb0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 9 May 2012 13:53:21 +0200
+Subject: USB: cdc-wdm: poll must return POLLHUP if device is gone
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit 616b6937e348ef2b4c6ea5fef2cd3c441145efb0 upstream.
+
+Else the poll will be restarted indefinitely in a tight loop,
+preventing final device cleanup.
+
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -511,7 +511,7 @@ static unsigned int wdm_poll(struct file
+
+ spin_lock_irqsave(&desc->iuspin, flags);
+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+- mask = POLLERR;
++ mask = POLLHUP | POLLERR;
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+ goto desc_out;
+ }
--- /dev/null
+From 24a85bae5da2b43fed423859c09c5a81ab359473 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Fri, 27 Apr 2012 14:23:54 +0200
+Subject: USB: cdc-wdm: sanitize error returns
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit 24a85bae5da2b43fed423859c09c5a81ab359473 upstream.
+
+wdm_flush() returns unsanitized USB error codes.
+They must be cleaned up to before being anded to user space
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -500,7 +500,7 @@ static int wdm_flush(struct file *file,
+ dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+ desc->werr);
+
+- return desc->werr;
++ return usb_translate_errors(desc->werr);
+ }
+
+ static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
--- /dev/null
+From eb9c5836384cd2a276254df6254ed71117983626 Mon Sep 17 00:00:00 2001
+From: Matthias Fend <Matthias.Fend@wolfvision.net>
+Date: Mon, 7 May 2012 14:37:30 +0200
+Subject: USB: ffs-test: fix length argument of out function call
+
+From: Matthias Fend <Matthias.Fend@wolfvision.net>
+
+commit eb9c5836384cd2a276254df6254ed71117983626 upstream.
+
+The out functions should only handle actual available data instead of the complete buffer.
+Otherwise for example the ep0_consume function will report ghost events since it tries to decode
+the complete buffer - which may contain partly invalid data.
+
+Signed-off-by: Matthias Fend <matthias.fend@wolfvision.net>
+Acked-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/usb/ffs-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/usb/ffs-test.c
++++ b/tools/usb/ffs-test.c
+@@ -324,7 +324,7 @@ static void *start_thread_helper(void *a
+
+ ret = t->in(t, t->buf, t->buf_size);
+ if (ret > 0) {
+- ret = t->out(t, t->buf, t->buf_size);
++ ret = t->out(t, t->buf, ret);
+ name = out_name;
+ op = "write";
+ } else {
--- /dev/null
+From b69cc672052540e8efb1368420f10d7d4d8b8a3d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=89ric=20Piel?= <piel@delmic.com>
+Date: Mon, 7 May 2012 12:37:54 +0200
+Subject: USB: ftdi-sio: add support for Physik Instrumente E-861
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Éric Piel <piel@delmic.com>
+
+commit b69cc672052540e8efb1368420f10d7d4d8b8a3d upstream.
+
+This adds VID/PID for the PI E-861. Without it, I had to do:
+modprobe -q ftdi-sio product=0x1008 vendor=0x1a72
+
+http://www.physikinstrumente.com/en/products/prdetail.php?sortnr=900610
+
+Signed-off-by: Éric Piel <piel@delmic.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -809,6 +809,7 @@ static struct usb_device_id id_table_com
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
+ { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
++ { USB_DEVICE(PI_VID, PI_E861_PID) },
+ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -785,6 +785,14 @@
+ #define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */
+ #define RTSYSTEMS_CT29B_PID 0x9e54 /* CT29B Radio Cable */
+
++
++/*
++ * Physik Instrumente
++ * http://www.physikinstrumente.com/en/products/
++ */
++#define PI_VID 0x1a72 /* Vendor ID */
++#define PI_E861_PID 0x1008 /* E-861 piezo controller USB connection */
++
+ /*
+ * Bayer Ascensia Contour blood glucose meter USB-converter cable.
+ * http://winglucofacts.com/cables/
--- /dev/null
+From df767b71e5816692134d59c0c17e0f77cd73333d Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 8 May 2012 15:15:25 -0400
+Subject: usb-storage: unusual_devs entry for Yarvik PMP400 MP4 player
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit df767b71e5816692134d59c0c17e0f77cd73333d upstream.
+
+This patch (as1553) adds an unusual_dev entrie for the Yarvik PMP400
+MP4 music player.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Jesse Feddema <jdfeddema@gmail.com>
+Tested-by: Jesse Feddema <jdfeddema@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1885,6 +1885,13 @@ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE ),
+
++/* Reported by Jesse Feddema <jdfeddema@gmail.com> */
++UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x0000,
++ "Yarvik",
++ "PMP400",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
++
+ /* Reported by Hans de Goede <hdegoede@redhat.com>
+ * These Appotech controllers are found in Picture Frames, they provide a
+ * (buggy) emulation of a cdrom drive which contains the windows software
--- /dev/null
+From 6a23ccd216b6a8ba2c67a9f9d8969b4431ad2920 Mon Sep 17 00:00:00 2001
+From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
+Date: Mon, 16 Apr 2012 14:19:07 -0700
+Subject: usb: usbtest: two super speed fixes for usbtest
+
+From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
+
+commit 6a23ccd216b6a8ba2c67a9f9d8969b4431ad2920 upstream.
+
+bMaxPacketSize0 field for super speed is a power of 2, not a count.
+The size itself is always 512.
+
+Max packet size for a super speed bulk endpoint is 1024, so
+allocate the urb size in halt_simple() accordingly.
+
+Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
+Acked-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/usbtest.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -1025,7 +1025,10 @@ test_ctrl_queue(struct usbtest_dev *dev,
+ case 13: /* short read, resembling case 10 */
+ req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
+ /* last data packet "should" be DATA1, not DATA0 */
+- len = 1024 - udev->descriptor.bMaxPacketSize0;
++ if (udev->speed == USB_SPEED_SUPER)
++ len = 1024 - 512;
++ else
++ len = 1024 - udev->descriptor.bMaxPacketSize0;
+ expected = -EREMOTEIO;
+ break;
+ case 14: /* short read; try to fill the last packet */
+@@ -1384,11 +1387,15 @@ static int test_halt(struct usbtest_dev
+
+ static int halt_simple(struct usbtest_dev *dev)
+ {
+- int ep;
+- int retval = 0;
+- struct urb *urb;
++ int ep;
++ int retval = 0;
++ struct urb *urb;
++ struct usb_device *udev = testdev_to_usbdev(dev);
+
+- urb = simple_alloc_urb(testdev_to_usbdev(dev), 0, 512);
++ if (udev->speed == USB_SPEED_SUPER)
++ urb = simple_alloc_urb(udev, 0, 1024);
++ else
++ urb = simple_alloc_urb(udev, 0, 512);
+ if (urb == NULL)
+ return -ENOMEM;
+
--- /dev/null
+From 544ecf310f0e7f51fa057ac2a295fc1b3b35a9d3 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 14 May 2012 15:04:50 -0700
+Subject: workqueue: skip nr_running sanity check in worker_enter_idle() if trustee is active
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 544ecf310f0e7f51fa057ac2a295fc1b3b35a9d3 upstream.
+
+worker_enter_idle() has WARN_ON_ONCE() which triggers if nr_running
+isn't zero when every worker is idle. This can trigger spuriously
+while a cpu is going down due to the way trustee sets %WORKER_ROGUE
+and zaps nr_running.
+
+It first sets %WORKER_ROGUE on all workers without updating
+nr_running, releases gcwq->lock, schedules, regrabs gcwq->lock and
+then zaps nr_running. If the last running worker enters idle
+inbetween, it would see stale nr_running which hasn't been zapped yet
+and trigger the WARN_ON_ONCE().
+
+Fix it by performing the sanity check iff the trustee is idle.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/workqueue.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1215,8 +1215,13 @@ static void worker_enter_idle(struct wor
+ } else
+ wake_up_all(&gcwq->trustee_wait);
+
+- /* sanity check nr_running */
+- WARN_ON_ONCE(gcwq->nr_workers == gcwq->nr_idle &&
++ /*
++ * Sanity check nr_running. Because trustee releases gcwq->lock
++ * between setting %WORKER_ROGUE and zapping nr_running, the
++ * warning may trigger spuriously. Check iff trustee is idle.
++ */
++ WARN_ON_ONCE(gcwq->trustee_state == TRUSTEE_DONE &&
++ gcwq->nr_workers == gcwq->nr_idle &&
+ atomic_read(get_gcwq_nr_running(gcwq->cpu)));
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
