--- /dev/null
+From c419fcfd071cf34ba00f9f65282583772d2655e7 Mon Sep 17 00:00:00 2001
+From: Maciej Sosnowski <maciej.sosnowski@intel.com>
+Date: Wed, 23 May 2012 17:27:07 +0200
+Subject: dca: check against empty dca_domains list before unregister provider
+
+From: Maciej Sosnowski <maciej.sosnowski@intel.com>
+
+commit c419fcfd071cf34ba00f9f65282583772d2655e7 upstream.
+
+When providers get blocked unregister_dca_providers() is called ending up
+with dca_providers and dca_domain lists emptied. Dca should be prevented from
+trying to unregister any provider if dca_domain list is found empty.
+
+Reported-by: Jiang Liu <jiang.liu@huawei.com>
+Tested-by: Gaohuai Han <hangaohuai@huawei.com>
+Signed-off-by: Maciej Sosnowski <maciej.sosnowski@intel.com>
+Signed-off-by: Dan Williams <djbw@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dca/dca-core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/dca/dca-core.c
++++ b/drivers/dca/dca-core.c
+@@ -420,6 +420,11 @@ void unregister_dca_provider(struct dca_
+
+ raw_spin_lock_irqsave(&dca_lock, flags);
+
++ if (list_empty(&dca_domains)) {
++ raw_spin_unlock_irqrestore(&dca_lock, flags);
++ return;
++ }
++
+ list_del(&dca->node);
+
+ pci_rc = dca_pci_rc_from_dev(dev);
--- /dev/null
+From 7c1119bdd650fa58dad8157bc75c5fcf6ed97843 Mon Sep 17 00:00:00 2001
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Wed, 28 Nov 2012 06:49:47 +0000
+Subject: dma: sh: Don't use ENODEV for failing slave lookup
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit 7c1119bdd650fa58dad8157bc75c5fcf6ed97843 upstream.
+
+If dmaengine driver's .device_alloc_chan_resources() method returns -ENODEV,
+dma_request_channel() will decide, that the driver has been removed and will
+remove the device from its list. To prevent this use ENXIO if a slave lookup
+fails.
+
+Reported-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/sh/shdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/sh/shdma.c
++++ b/drivers/dma/sh/shdma.c
+@@ -326,7 +326,7 @@ static int sh_dmae_set_slave(struct shdm
+ shdma_chan);
+ const struct sh_dmae_slave_config *cfg = dmae_find_slave(sh_chan, slave_id);
+ if (!cfg)
+- return -ENODEV;
++ return -ENXIO;
+
+ if (!try)
+ sh_chan->config = cfg;
--- /dev/null
+From c7886b18273b07042e25e8d3ba5c983837b84123 Mon Sep 17 00:00:00 2001
+From: Magnus Damm <damm@opensource.se>
+Date: Wed, 13 Feb 2013 00:56:13 +0900
+Subject: gpio: em: Use irq_domain_add_simple() to fix runtime error
+
+From: Magnus Damm <damm@opensource.se>
+
+commit c7886b18273b07042e25e8d3ba5c983837b84123 upstream.
+
+Adjust the gpio-em.c driver to reconsider the pdata->irq_base
+variable. Non-DT board code like for instance board-kzm9d.c
+needs to operate of a static IRQ range for platform devices.
+
+So this patch is updating the code to make use of the function
+irq_domain_add_simple() instead of irq_domain_add_linear().
+
+Fixes a EMEV2 / KZM9D runtime error caused by the following commit:
+7385500 gpio/em: convert to linear IRQ domain
+
+Signed-off-by: Magnus Damm <damm@opensource.se>
+Tested-by: Simon Horman <horms+renesas@verge.net.au>
+Reported-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-em.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-em.c
++++ b/drivers/gpio/gpio-em.c
+@@ -299,8 +299,9 @@ static int em_gio_probe(struct platform_
+ irq_chip->irq_set_type = em_gio_irq_set_type;
+ irq_chip->flags = IRQCHIP_SKIP_SET_WAKE;
+
+- p->irq_domain = irq_domain_add_linear(pdev->dev.of_node,
++ p->irq_domain = irq_domain_add_simple(pdev->dev.of_node,
+ pdata->number_of_pins,
++ pdata->irq_base,
+ &em_gio_irq_domain_ops, p);
+ if (!p->irq_domain) {
+ ret = -ENXIO;
--- /dev/null
+From 5f3d4d5fb050c029fc41273c1a181b9a3d8dfc6a Mon Sep 17 00:00:00 2001
+From: Li Wei <lw@cn.fujitsu.com>
+Date: Thu, 21 Feb 2013 00:09:54 +0000
+Subject: ipv4: fix a bug in ping_err().
+
+
+From: Li Wei <lw@cn.fujitsu.com>
+
+[ Upstream commit b531ed61a2a2a77eeb2f7c88b49aa5ec7d9880d8 ]
+
+We should get 'type' and 'code' from the outer ICMP header.
+
+Signed-off-by: Li Wei <lw@cn.fujitsu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ping.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -322,8 +322,8 @@ void ping_err(struct sk_buff *skb, u32 i
+ struct iphdr *iph = (struct iphdr *)skb->data;
+ struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2));
+ struct inet_sock *inet_sock;
+- int type = icmph->type;
+- int code = icmph->code;
++ int type = icmp_hdr(skb)->type;
++ int code = icmp_hdr(skb)->code;
+ struct net *net = dev_net(skb->dev);
+ struct sock *sk;
+ int harderr;
--- /dev/null
+From 7f1b6cb60443762018a68781bab6d7599e94bed7 Mon Sep 17 00:00:00 2001
+From: Li Wei <lw@cn.fujitsu.com>
+Date: Thu, 21 Feb 2013 22:18:44 +0000
+Subject: ipv4: fix error handling in icmp_protocol.
+
+
+From: Li Wei <lw@cn.fujitsu.com>
+
+[ Upstream commit 5b0520425e5ea81ba95ec486dd6bbb59a09fff0e ]
+
+Now we handle icmp errors in each transport protocol's err_handler,
+for icmp protocols, that is ping_err. Since this handler only care
+of those icmp errors triggered by echo request, errors triggered
+by echo reply(which sent by kernel) are sliently ignored.
+
+So wrap ping_err() with icmp_err() to deal with those icmp errors.
+
+Signed-off-by: Li Wei <lw@cn.fujitsu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/icmp.h | 1 +
+ net/ipv4/af_inet.c | 2 +-
+ net/ipv4/icmp.c | 23 +++++++++++++++++++++++
+ 3 files changed, 25 insertions(+), 1 deletion(-)
+
+--- a/include/net/icmp.h
++++ b/include/net/icmp.h
+@@ -41,6 +41,7 @@ struct net;
+
+ extern void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info);
+ extern int icmp_rcv(struct sk_buff *skb);
++extern void icmp_err(struct sk_buff *, u32 info);
+ extern int icmp_init(void);
+ extern void icmp_out_count(struct net *net, unsigned char type);
+
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1595,7 +1595,7 @@ static const struct net_offload udp_offl
+
+ static const struct net_protocol icmp_protocol = {
+ .handler = icmp_rcv,
+- .err_handler = ping_err,
++ .err_handler = icmp_err,
+ .no_policy = 1,
+ .netns_ok = 1,
+ };
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -934,6 +934,29 @@ error:
+ goto drop;
+ }
+
++void icmp_err(struct sk_buff *skb, u32 info)
++{
++ struct iphdr *iph = (struct iphdr *)skb->data;
++ struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2));
++ int type = icmp_hdr(skb)->type;
++ int code = icmp_hdr(skb)->code;
++ struct net *net = dev_net(skb->dev);
++
++ /*
++ * Use ping_err to handle all icmp errors except those
++ * triggered by ICMP_ECHOREPLY which sent from kernel.
++ */
++ if (icmph->type != ICMP_ECHOREPLY) {
++ ping_err(skb, info);
++ return;
++ }
++
++ if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
++ ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ICMP, 0);
++ else if (type == ICMP_REDIRECT)
++ ipv4_redirect(skb, net, 0, 0, IPPROTO_ICMP, 0);
++}
++
+ /*
+ * This table is the definition of how we handle ICMP.
+ */
--- /dev/null
+From d4b29b02bf506ee6ae2041b9297b34e1cd8fa2f9 Mon Sep 17 00:00:00 2001
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> <yoshfuji@linux-ipv6.org>
+Date: Wed, 20 Feb 2013 00:29:08 +0000
+Subject: ipv6: fix race condition regarding dst->expires and dst->from.
+
+
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+
+[ Upstream commit ecd9883724b78cc72ed92c98bcb1a46c764fff21 ]
+
+Eric Dumazet wrote:
+| Some strange crashes happen in rt6_check_expired(), with access
+| to random addresses.
+|
+| At first glance, it looks like the RTF_EXPIRES and
+| stuff added in commit 1716a96101c49186b
+| (ipv6: fix problem with expired dst cache)
+| are racy : same dst could be manipulated at the same time
+| on different cpus.
+|
+| At some point, our stack believes rt->dst.from contains a dst pointer,
+| while its really a jiffie value (as rt->dst.expires shares the same area
+| of memory)
+|
+| rt6_update_expires() should be fixed, or am I missing something ?
+|
+| CC Neil because of https://bugzilla.redhat.com/show_bug.cgi?id=892060
+
+Because we do not have any locks for dst_entry, we cannot change
+essential structure in the entry; e.g., we cannot change reference
+to other entity.
+
+To fix this issue, split 'from' and 'expires' field in dst_entry
+out of union. Once it is 'from' is assigned in the constructor,
+keep the reference until the very last stage of the life time of
+the object.
+
+Of course, it is unsafe to change 'from', so make rt6_set_from simple
+just for fresh entries.
+
+Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
+Reported-by: Neil Horman <nhorman@tuxdriver.com>
+CC: Gao Feng <gaofeng@cn.fujitsu.com>
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Steinar H. Gunderson <sesse@google.com>
+Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/dst.h | 8 ++------
+ include/net/ip6_fib.h | 37 +++++++++++--------------------------
+ net/core/dst.c | 1 +
+ net/ipv6/route.c | 8 +++-----
+ 4 files changed, 17 insertions(+), 37 deletions(-)
+
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -36,13 +36,9 @@ struct dst_entry {
+ struct net_device *dev;
+ struct dst_ops *ops;
+ unsigned long _metrics;
+- union {
+- unsigned long expires;
+- /* point to where the dst_entry copied from */
+- struct dst_entry *from;
+- };
++ unsigned long expires;
+ struct dst_entry *path;
+- void *__pad0;
++ struct dst_entry *from;
+ #ifdef CONFIG_XFRM
+ struct xfrm_state *xfrm;
+ #else
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -166,50 +166,35 @@ static inline struct inet6_dev *ip6_dst_
+
+ static inline void rt6_clean_expires(struct rt6_info *rt)
+ {
+- if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from)
+- dst_release(rt->dst.from);
+-
+ rt->rt6i_flags &= ~RTF_EXPIRES;
+- rt->dst.from = NULL;
+ }
+
+ static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
+ {
+- if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from)
+- dst_release(rt->dst.from);
+-
+- rt->rt6i_flags |= RTF_EXPIRES;
+ rt->dst.expires = expires;
++ rt->rt6i_flags |= RTF_EXPIRES;
+ }
+
+-static inline void rt6_update_expires(struct rt6_info *rt, int timeout)
++static inline void rt6_update_expires(struct rt6_info *rt0, int timeout)
+ {
+- if (!(rt->rt6i_flags & RTF_EXPIRES)) {
+- if (rt->dst.from)
+- dst_release(rt->dst.from);
+- /* dst_set_expires relies on expires == 0
+- * if it has not been set previously.
+- */
+- rt->dst.expires = 0;
+- }
++ struct rt6_info *rt;
+
+- dst_set_expires(&rt->dst, timeout);
+- rt->rt6i_flags |= RTF_EXPIRES;
++ for (rt = rt0; rt && !(rt->rt6i_flags & RTF_EXPIRES);
++ rt = (struct rt6_info *)rt->dst.from);
++ if (rt && rt != rt0)
++ rt0->dst.expires = rt->dst.expires;
++
++ dst_set_expires(&rt0->dst, timeout);
++ rt0->rt6i_flags |= RTF_EXPIRES;
+ }
+
+ static inline void rt6_set_from(struct rt6_info *rt, struct rt6_info *from)
+ {
+ struct dst_entry *new = (struct dst_entry *) from;
+
+- if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from) {
+- if (new == rt->dst.from)
+- return;
+- dst_release(rt->dst.from);
+- }
+-
+ rt->rt6i_flags &= ~RTF_EXPIRES;
+- rt->dst.from = new;
+ dst_hold(new);
++ rt->dst.from = new;
+ }
+
+ static inline void ip6_rt_put(struct rt6_info *rt)
+--- a/net/core/dst.c
++++ b/net/core/dst.c
+@@ -179,6 +179,7 @@ void *dst_alloc(struct dst_ops *ops, str
+ dst_init_metrics(dst, dst_default_metrics, true);
+ dst->expires = 0UL;
+ dst->path = dst;
++ dst->from = NULL;
+ #ifdef CONFIG_XFRM
+ dst->xfrm = NULL;
+ #endif
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -300,6 +300,7 @@ static void ip6_dst_destroy(struct dst_e
+ {
+ struct rt6_info *rt = (struct rt6_info *)dst;
+ struct inet6_dev *idev = rt->rt6i_idev;
++ struct dst_entry *from = dst->from;
+
+ if (rt->n)
+ neigh_release(rt->n);
+@@ -312,8 +313,8 @@ static void ip6_dst_destroy(struct dst_e
+ in6_dev_put(idev);
+ }
+
+- if (!(rt->rt6i_flags & RTF_EXPIRES) && dst->from)
+- dst_release(dst->from);
++ dst->from = NULL;
++ dst_release(from);
+
+ if (rt6_has_peer(rt)) {
+ struct inet_peer *peer = rt6_peer_ptr(rt);
+@@ -1054,7 +1055,6 @@ struct dst_entry *ip6_blackhole_route(st
+
+ rt->rt6i_gateway = ort->rt6i_gateway;
+ rt->rt6i_flags = ort->rt6i_flags;
+- rt6_clean_expires(rt);
+ rt->rt6i_metric = 0;
+
+ memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
+@@ -1859,8 +1859,6 @@ static struct rt6_info *ip6_rt_copy(stru
+ if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
+ (RTF_DEFAULT | RTF_ADDRCONF))
+ rt6_set_from(rt, ort);
+- else
+- rt6_clean_expires(rt);
+ rt->rt6i_metric = 0;
+
+ #ifdef CONFIG_IPV6_SUBTREES
--- /dev/null
+From b2dc9692e8f6b75e1a30a061bd7583bea7862395 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 21 Feb 2013 12:18:52 +0000
+Subject: ipv6: use a stronger hash for tcp
+
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 08dcdbf6a7b9d14c2302c5bd0c5390ddf122f664 ]
+
+It looks like its possible to open thousands of TCP IPv6
+sessions on a server, all landing in a single slot of TCP hash
+table. Incoming packets have to lookup sockets in a very
+long list.
+
+We should hash all bits from foreign IPv6 addresses, using
+a salt and hash mix, not a simple XOR.
+
+inet6_ehashfn() can also separately use the ports, instead
+of xoring them.
+
+Reported-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/inet6_hashtables.h | 8 ++++----
+ include/net/inet_sock.h | 1 +
+ include/net/ipv6.h | 12 ++++++++++++
+ net/ipv4/af_inet.c | 9 +++++++--
+ 4 files changed, 24 insertions(+), 6 deletions(-)
+
+--- a/include/net/inet6_hashtables.h
++++ b/include/net/inet6_hashtables.h
+@@ -28,16 +28,16 @@
+
+ struct inet_hashinfo;
+
+-/* I have no idea if this is a good hash for v6 or not. -DaveM */
+ static inline unsigned int inet6_ehashfn(struct net *net,
+ const struct in6_addr *laddr, const u16 lport,
+ const struct in6_addr *faddr, const __be16 fport)
+ {
+- u32 ports = (lport ^ (__force u16)fport);
++ u32 ports = (((u32)lport) << 16) | (__force u32)fport;
+
+ return jhash_3words((__force u32)laddr->s6_addr32[3],
+- (__force u32)faddr->s6_addr32[3],
+- ports, inet_ehash_secret + net_hash_mix(net));
++ ipv6_addr_jhash(faddr),
++ ports,
++ inet_ehash_secret + net_hash_mix(net));
+ }
+
+ static inline int inet6_sk_ehashfn(const struct sock *sk)
+--- a/include/net/inet_sock.h
++++ b/include/net/inet_sock.h
+@@ -203,6 +203,7 @@ static inline void inet_sk_copy_descenda
+ extern int inet_sk_rebuild_header(struct sock *sk);
+
+ extern u32 inet_ehash_secret;
++extern u32 ipv6_hash_secret;
+ extern void build_ehash_secret(void);
+
+ static inline unsigned int inet_ehashfn(struct net *net,
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -15,6 +15,7 @@
+
+ #include <linux/ipv6.h>
+ #include <linux/hardirq.h>
++#include <linux/jhash.h>
+ #include <net/if_inet6.h>
+ #include <net/ndisc.h>
+ #include <net/flow.h>
+@@ -473,6 +474,17 @@ static inline u32 ipv6_addr_hash(const s
+ #endif
+ }
+
++/* more secured version of ipv6_addr_hash() */
++static inline u32 ipv6_addr_jhash(const struct in6_addr *a)
++{
++ u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1];
++
++ return jhash_3words(v,
++ (__force u32)a->s6_addr32[2],
++ (__force u32)a->s6_addr32[3],
++ ipv6_hash_secret);
++}
++
+ static inline bool ipv6_addr_loopback(const struct in6_addr *a)
+ {
+ return (a->s6_addr32[0] | a->s6_addr32[1] |
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -248,8 +248,12 @@ EXPORT_SYMBOL(inet_listen);
+ u32 inet_ehash_secret __read_mostly;
+ EXPORT_SYMBOL(inet_ehash_secret);
+
++u32 ipv6_hash_secret __read_mostly;
++EXPORT_SYMBOL(ipv6_hash_secret);
++
+ /*
+- * inet_ehash_secret must be set exactly once
++ * inet_ehash_secret must be set exactly once, and to a non nul value
++ * ipv6_hash_secret must be set exactly once.
+ */
+ void build_ehash_secret(void)
+ {
+@@ -259,7 +263,8 @@ void build_ehash_secret(void)
+ get_random_bytes(&rnd, sizeof(rnd));
+ } while (rnd == 0);
+
+- cmpxchg(&inet_ehash_secret, 0, rnd);
++ if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0)
++ get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret));
+ }
+ EXPORT_SYMBOL(build_ehash_secret);
+
--- /dev/null
+From johannes@sipsolutions.net Tue Feb 26 15:00:24 2013
+From: Johannes Berg <johannes@sipsolutions.net>
+Date: Tue, 26 Feb 2013 22:37:57 +0100
+Subject: mac80211: always unblock CSA queue stop when disconnecting
+To: gregkh@linuxfoundation.org
+Cc: stable@vger.kernel.org, jan.brummer@tabos.org, Johannes Berg <johannes.berg@intel.com>
+Message-ID: <1361914677-19032-1-git-send-email-johannes@sipsolutions.net>
+
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+Commit 5b36ebd8249f403c7edf7cf68d68e9a0d0f55243 upstream.
+
+In some cases when disconnecting after (or during?) CSA
+the queues might not recover, and then the only way to
+recover is reloading the module.
+
+Fix this by always unblocking the queue CSA reason when
+
+disconnecting.
+
+Reported-by: Jan-Michael Brummer <jan.brummer@tabos.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/mlme.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1812,6 +1812,8 @@ static void __ieee80211_disconnect(struc
+ WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+ transmit_frame, frame_buf);
+ ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
++ ieee80211_wake_queues_by_reason(&sdata->local->hw,
++ IEEE80211_QUEUE_STOP_REASON_CSA);
+ mutex_unlock(&ifmgd->mtx);
+
+ /*
+@@ -1856,8 +1858,6 @@ static void ieee80211_csa_connection_dro
+ container_of(work, struct ieee80211_sub_if_data,
+ u.mgd.csa_connection_drop_work);
+
+- ieee80211_wake_queues_by_reason(&sdata->local->hw,
+- IEEE80211_QUEUE_STOP_REASON_CSA);
+ __ieee80211_disconnect(sdata, true);
+ }
+
--- /dev/null
+From 6bbae7e2f6bb5d68f6440e58bb3e3fe541c7099f Mon Sep 17 00:00:00 2001
+From: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+Date: Fri, 22 Feb 2013 19:14:52 +0000
+Subject: mlx4_en: fix allocation of CPU affinity reverse-map
+
+
+From: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+
+[ Upstream commit 3770699675dd1b8fc1e86ff369eb3cce44e10082 ]
+
+The mlx4_en driver allocates the number of objects for the CPU affinity
+reverse-map based on the number of rx rings of the device. However,
+mlx4_assign_eq() calls irq_cpu_rmap_add() as many times as IRQ's are
+assigned to EQ's, which can be as large as mlx4_dev->caps.comp_pool. If
+caps.comp_pool is larger than rx_ring_num we will eventually hit the
+BUG_ON() in cpu_rmap_add().
+
+Fix this problem by allocating space for the maximum number of CPU
+affinity reverse-map objects we might want to add.
+
+Signed-off-by: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+Acked-by: Amir Vadai <amirv@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1434,7 +1434,7 @@ int mlx4_en_alloc_resources(struct mlx4_
+ }
+
+ #ifdef CONFIG_RFS_ACCEL
+- priv->dev->rx_cpu_rmap = alloc_irq_cpu_rmap(priv->rx_ring_num);
++ priv->dev->rx_cpu_rmap = alloc_irq_cpu_rmap(priv->mdev->dev->caps.comp_pool);
+ if (!priv->dev->rx_cpu_rmap)
+ goto err;
+
--- /dev/null
+From 1d750442e470efe1f245b2777c71e9072cff03c0 Mon Sep 17 00:00:00 2001
+From: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+Date: Fri, 22 Feb 2013 14:58:02 +0000
+Subject: mlx4_en: fix allocation of device tx_cq
+
+
+From: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+
+[ Upstream commit 427a96252d8eee7b9bbafce15bd37fa3387ede55 ]
+
+The memory to hold the network device tx_cq is not being allocated with
+the correct size in mlx4_en_init_netdev(). It should use MAX_TX_RINGS
+instead of MAX_RX_RINGS. This can cause problems if the number of tx
+rings being used is greater than MAX_RX_RINGS.
+
+Signed-off-by: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
+Acked-by: Amir Vadai <amirv@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1597,7 +1597,7 @@ int mlx4_en_init_netdev(struct mlx4_en_d
+ err = -ENOMEM;
+ goto out;
+ }
+- priv->tx_cq = kzalloc(sizeof(struct mlx4_en_cq) * MAX_RX_RINGS,
++ priv->tx_cq = kzalloc(sizeof(struct mlx4_en_cq) * MAX_TX_RINGS,
+ GFP_KERNEL);
+ if (!priv->tx_cq) {
+ err = -ENOMEM;
--- /dev/null
+From c4a3284a9f2e1e305cbdf7336a02d44f32372e0c Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Wed, 13 Feb 2013 12:09:52 +0000
+Subject: net: cdc_ncm: fix probing of devices with multiple control interface altsettings
+
+
+From: Bjørn Mork <bjorn@mork.no>
+
+[ Upstream commit f350ca03703133c94fe742f6fa6ff0fd8f5a9a09 ]
+
+commit bd329e1 ("net: cdc_ncm: do not bind to NCM compatible MBIM devices")
+added a test for a CDC MBIM altsetting, implementing the cdc_ncm part of
+MBIM backward compatibility support. This intentionally made the driver
+behave differently for CDC NCM devices with 2 alternate settings for the
+Communication interface, depending on whether or not CONFIG_USB_NET_CDC_MBIM
+was enabled. This is correct iff alternate setting #1 really *is* a MBIM
+setting. If not, then NCM probing will use a different altsetting than before,
+possibly causing probing failures depending on CONFIG_USB_NET_CDC_MBIM.
+
+Fix by setting the altsetting back to default after the test, restoring the
+previous behaviour for non MBIM devices.
+
+This bug causes probing of Huawei E3276 devices to fail when the MBIM driver
+is enabled, because these devices have a second alternate setting with no CDC
+functional descriptors.
+
+Cc: Greg Suarez <gsuarez@smithmicro.com>
+Cc: Alexey Orishko <alexey.orishko@stericsson.com>
+Reported-and-tested-by: Jonathan A. <yo.natan@hotmail.com>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/cdc_ncm.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -576,9 +576,14 @@ static int cdc_ncm_bind(struct usbnet *d
+ if ((intf->num_altsetting == 2) &&
+ !usb_set_interface(dev->udev,
+ intf->cur_altsetting->desc.bInterfaceNumber,
+- CDC_NCM_COMM_ALTSETTING_MBIM) &&
+- cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
+- return -ENODEV;
++ CDC_NCM_COMM_ALTSETTING_MBIM)) {
++ if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
++ return -ENODEV;
++ else
++ usb_set_interface(dev->udev,
++ intf->cur_altsetting->desc.bInterfaceNumber,
++ CDC_NCM_COMM_ALTSETTING_NCM);
++ }
+ #endif
+
+ /* NCM data altsetting is always 1 */
--- /dev/null
+From 231bd964f9d6e8c9854bb2e76bff09c83a85203e Mon Sep 17 00:00:00 2001
+From: Ying Xue <ying.xue@windriver.com>
+Date: Fri, 15 Feb 2013 22:28:25 +0000
+Subject: net: fix a compile error when SOCK_REFCNT_DEBUG is enabled
+
+
+From: Ying Xue <ying.xue@windriver.com>
+
+[ Upstream commit dec34fb0f5b7873de45132a84a3af29e61084a6b ]
+
+When SOCK_REFCNT_DEBUG is enabled, below build error is met:
+
+kernel/sysctl_binary.o: In function `sk_refcnt_debug_release':
+include/net/sock.h:1025: multiple definition of `sk_refcnt_debug_release'
+kernel/sysctl.o:include/net/sock.h:1025: first defined here
+kernel/audit.o: In function `sk_refcnt_debug_release':
+include/net/sock.h:1025: multiple definition of `sk_refcnt_debug_release'
+kernel/sysctl.o:include/net/sock.h:1025: first defined here
+make[1]: *** [kernel/built-in.o] Error 1
+make: *** [kernel] Error 2
+
+So we decide to make sk_refcnt_debug_release static to eliminate
+the error.
+
+Signed-off-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/sock.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1037,7 +1037,7 @@ static inline void sk_refcnt_debug_dec(s
+ sk->sk_prot->name, sk, atomic_read(&sk->sk_prot->socks));
+ }
+
+-inline void sk_refcnt_debug_release(const struct sock *sk)
++static inline void sk_refcnt_debug_release(const struct sock *sk)
+ {
+ if (atomic_read(&sk->sk_refcnt) != 1)
+ printk(KERN_DEBUG "Destruction of the %s socket %p delayed, refcnt=%d\n",
--- /dev/null
+From 4ead5e2075773c4d8b789044f55c0dd293448713 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 19 Feb 2013 10:42:03 -0800
+Subject: ppp: set qdisc_tx_busylock to avoid LOCKDEP splat
+
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 303c07db487be59ae9fda10600ea65ca11c21497 ]
+
+If a qdisc is installed on a ppp device, its possible to get
+a lockdep splat under stress, because nested dev_queue_xmit() can
+lock busylock a second time (on a different device, so its a false
+positive)
+
+Avoid this problem using a distinct lock_class_key for ppp
+devices.
+
+Reported-by: Yanko Kaneti <yaneti@declera.com>
+Tested-by: Yanko Kaneti <yaneti@declera.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ppp/ppp_generic.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -1058,7 +1058,15 @@ ppp_get_stats64(struct net_device *dev,
+ return stats64;
+ }
+
++static struct lock_class_key ppp_tx_busylock;
++static int ppp_dev_init(struct net_device *dev)
++{
++ dev->qdisc_tx_busylock = &ppp_tx_busylock;
++ return 0;
++}
++
+ static const struct net_device_ops ppp_netdev_ops = {
++ .ndo_init = ppp_dev_init,
+ .ndo_start_xmit = ppp_start_xmit,
+ .ndo_do_ioctl = ppp_net_ioctl,
+ .ndo_get_stats64 = ppp_get_stats64,
mmc-sdhci-esdhc-imx-fix-host-version-read.patch
mmc-core-expose-rpmb-partition-only-for-cmd23-capable-hosts.patch
hid-wiimote-fix-nunchuck-button-parser.patch
+net-cdc_ncm-fix-probing-of-devices-with-multiple-control-interface-altsettings.patch
+xen-netback-correctly-return-errors-from-netbk_count_requests.patch
+xen-netback-cancel-the-credit-timer-when-taking-the-vif-down.patch
+net-fix-a-compile-error-when-sock_refcnt_debug-is-enabled.patch
+xfrm-release-neighbor-upon-dst-destruction.patch
+ppp-set-qdisc_tx_busylock-to-avoid-lockdep-splat.patch
+ipv6-fix-race-condition-regarding-dst-expires-and-dst-from.patch
+ipv4-fix-a-bug-in-ping_err.patch
+ipv6-use-a-stronger-hash-for-tcp.patch
+ipv4-fix-error-handling-in-icmp_protocol.patch
+tcp-fix-syn-data-space-mis-accounting.patch
+mlx4_en-fix-allocation-of-device-tx_cq.patch
+mlx4_en-fix-allocation-of-cpu-affinity-reverse-map.patch
+sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch
+vlan-adjust-vlan_set_encap_proto-for-its-callers.patch
+mac80211-always-unblock-csa-queue-stop-when-disconnecting.patch
+usb-ehci-omap-don-t-free-gpios-that-we-didn-t-request.patch
+gpio-em-use-irq_domain_add_simple-to-fix-runtime-error.patch
+dma-sh-don-t-use-enodev-for-failing-slave-lookup.patch
+dca-check-against-empty-dca_domains-list-before-unregister-provider.patch
+usb-option-add-and-update-alcatel-modems.patch
+usb-option-add-yota-megafon-m100-1-4g-modem.patch
+usb-option-add-huawei-acm-devices-using-protocol-vendor.patch
+usb-ehci-omap-fix-autoloading-of-module.patch
+usb-storage-properly-handle-the-endian-issues-of-idproduct.patch
+usb-usb-storage-unusual_devs-update-for-super-top-sata-bridge.patch
+usb-musb-core-fix-failure-path.patch
+usb-musb-fix-dependency-on-transceiver-driver.patch
+usb-musb-ux500-use-clk_prepare_enable-and-clk_disable_unprepare.patch
--- /dev/null
+From 83245c8498fc24b28a76c3f0de8d80f7a8986d7e Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli@googlemail.com>
+Date: Sat, 23 Feb 2013 01:13:47 +0000
+Subject: sock_diag: Fix out-of-bounds access to sock_diag_handlers[]
+
+
+From: Mathias Krause <minipli@googlemail.com>
+
+[ Upstream commit 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0 ]
+
+Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
+with a family greater or equal then AF_MAX -- the array size of
+sock_diag_handlers[]. The current code does not test for this
+condition therefore is vulnerable to an out-of-bound access opening
+doors for a privilege escalation.
+
+Signed-off-by: Mathias Krause <minipli@googlemail.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/sock_diag.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -121,6 +121,9 @@ static int __sock_diag_rcv_msg(struct sk
+ if (nlmsg_len(nlh) < sizeof(*req))
+ return -EINVAL;
+
++ if (req->sdiag_family >= AF_MAX)
++ return -EINVAL;
++
+ hndl = sock_diag_lock_handler(req->sdiag_family);
+ if (hndl == NULL)
+ err = -ENOENT;
--- /dev/null
+From 9b521570f87082f7678e3f8c58e8ab13d3219eed Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Fri, 22 Feb 2013 08:59:06 +0000
+Subject: tcp: fix SYN-data space mis-accounting
+
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit 1b63edd6ecc55c3a61b40297b49e2323783bddfd ]
+
+In fast open the sender unncessarily reduces the space available
+for data in SYN by 12 bytes. This is because in the sender
+incorrectly reserves space for TS option twice in tcp_send_syn_data():
+tcp_mtu_to_mss() already accounts for TS option space. But it further
+reserves MAX_TCP_OPTION_SPACE when computing the payload space.
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_output.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1351,8 +1351,8 @@ int tcp_trim_head(struct sock *sk, struc
+ return 0;
+ }
+
+-/* Calculate MSS. Not accounting for SACKs here. */
+-int tcp_mtu_to_mss(struct sock *sk, int pmtu)
++/* Calculate MSS not accounting any TCP options. */
++static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu)
+ {
+ const struct tcp_sock *tp = tcp_sk(sk);
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+@@ -1381,13 +1381,17 @@ int tcp_mtu_to_mss(struct sock *sk, int
+ /* Then reserve room for full set of TCP options and 8 bytes of data */
+ if (mss_now < 48)
+ mss_now = 48;
+-
+- /* Now subtract TCP options size, not including SACKs */
+- mss_now -= tp->tcp_header_len - sizeof(struct tcphdr);
+-
+ return mss_now;
+ }
+
++/* Calculate MSS. Not accounting for SACKs here. */
++int tcp_mtu_to_mss(struct sock *sk, int pmtu)
++{
++ /* Subtract TCP options size, not including SACKs */
++ return __tcp_mtu_to_mss(sk, pmtu) -
++ (tcp_sk(sk)->tcp_header_len - sizeof(struct tcphdr));
++}
++
+ /* Inverse of above */
+ int tcp_mss_to_mtu(struct sock *sk, int mss)
+ {
+@@ -2930,7 +2934,7 @@ static int tcp_send_syn_data(struct sock
+ */
+ if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < tp->rx_opt.mss_clamp)
+ tp->rx_opt.mss_clamp = tp->rx_opt.user_mss;
+- space = tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
++ space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
+ MAX_TCP_OPTION_SPACE;
+
+ syn_data = skb_copy_expand(syn, skb_headroom(syn), space,
--- /dev/null
+From 428525f97153505e83983460a8d08a3210aa6b8a Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Thu, 14 Feb 2013 17:08:08 +0200
+Subject: USB: ehci-omap: Don't free gpios that we didn't request
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit 428525f97153505e83983460a8d08a3210aa6b8a upstream.
+
+This driver does not request any gpios so don't free them.
+Fixes L3 bus error on multiple modprobe/rmmod of ehci_hcd
+with ehci-omap in use.
+
+Without this patch, EHCI will break on repeated insmod/rmmod
+of ehci_hcd for all OMAP2+ platforms that use EHCI and
+set 'phy_reset = true' in usbhs_omap_board_data.
+i.e.
+
+board-3430sdp.c: .phy_reset = true,
+board-3630sdp.c: .phy_reset = true,
+board-am3517crane.c: .phy_reset = true,
+board-am3517evm.c: .phy_reset = true,
+board-cm-t3517.c: .phy_reset = true,
+board-cm-t35.c: .phy_reset = true,
+board-devkit8000.c: .phy_reset = true,
+board-igep0020.c: .phy_reset = true,
+board-igep0020.c: .phy_reset = true,
+board-omap3beagle.c: .phy_reset = true,
+board-omap3evm.c: .phy_reset = true,
+board-omap3pandora.c: .phy_reset = true,
+board-omap3stalker.c: .phy_reset = true,
+board-omap3touchbook.c: .phy_reset = true,
+board-omap4panda.c: .phy_reset = false,
+board-overo.c: .phy_reset = true,
+board-zoom.c: .phy_reset = true,
+
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Reviewed-by: Felipe Balbi <balbi@ti.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-omap.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -288,7 +288,6 @@ static int ehci_hcd_omap_remove(struct p
+ {
+ struct device *dev = &pdev->dev;
+ struct usb_hcd *hcd = dev_get_drvdata(dev);
+- struct ehci_hcd_omap_platform_data *pdata = dev->platform_data;
+
+ usb_remove_hcd(hcd);
+ disable_put_regulator(dev->platform_data);
+@@ -298,13 +297,6 @@ static int ehci_hcd_omap_remove(struct p
+ pm_runtime_put_sync(dev);
+ pm_runtime_disable(dev);
+
+- if (pdata->phy_reset) {
+- if (gpio_is_valid(pdata->reset_gpio_port[0]))
+- gpio_free(pdata->reset_gpio_port[0]);
+-
+- if (gpio_is_valid(pdata->reset_gpio_port[1]))
+- gpio_free(pdata->reset_gpio_port[1]);
+- }
+ return 0;
+ }
+
--- /dev/null
+From 04753523266629b1cd0518091da1658755787198 Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Thu, 14 Feb 2013 17:08:09 +0200
+Subject: USB: ehci-omap: Fix autoloading of module
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit 04753523266629b1cd0518091da1658755787198 upstream.
+
+The module alias should be "ehci-omap" and not
+"omap-ehci" to match the platform device name.
+The omap-ehci module should now autoload correctly.
+
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-omap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -364,7 +364,7 @@ static const struct hc_driver ehci_omap_
+ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+-MODULE_ALIAS("platform:omap-ehci");
++MODULE_ALIAS("platform:ehci-omap");
+ MODULE_AUTHOR("Texas Instruments, Inc.");
+ MODULE_AUTHOR("Felipe Balbi <felipe.balbi@nokia.com>");
+
--- /dev/null
+From 681d1e8761ca773967bce9bd1bb2896f07279551 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@canonical.com>
+Date: Fri, 4 Jan 2013 23:13:06 +0800
+Subject: usb: musb: core: fix failure path
+
+From: Ming Lei <ming.lei@canonical.com>
+
+commit 681d1e8761ca773967bce9bd1bb2896f07279551 upstream.
+
+In the fail1~fail5 failure path, pm_runtime_disable() should
+be called to avoid 'Unbalanced pm_runtime_enable' error in
+next probe() which may be triggered by defer probe or next
+'modprobe musb_hdrc'.
+
+Cc: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+Signed-off-by: Ming Lei <ming.lei@canonical.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1993,6 +1993,7 @@ fail2:
+ musb_platform_exit(musb);
+
+ fail1:
++ pm_runtime_disable(musb->controller);
+ dev_err(musb->controller,
+ "musb_init_controller failed with status %d\n", status);
+
--- /dev/null
+From 25736e0c8269e9613aa6036fbc591818daa30d14 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@canonical.com>
+Date: Fri, 4 Jan 2013 23:13:58 +0800
+Subject: usb: musb: fix dependency on transceiver driver
+
+From: Ming Lei <ming.lei@canonical.com>
+
+commit 25736e0c8269e9613aa6036fbc591818daa30d14 upstream.
+
+This patch let glue driver return -EPROBE_DEFER if the transceiver
+is not readly, so we can support defer probe on musb to fix the
+below error on 3.7-rc5 if transceiver drivers are built as module:
+
+[ 19.052490] unable to find transceiver of type USB2 PHY
+[ 19.072052] HS USB OTG: no transceiver configured
+[ 19.076995] musb-hdrc musb-hdrc.0.auto: musb_init_controller failed with status -19
+[ 19.089355] musb-hdrc: probe of musb-hdrc.0.auto rejects match -19
+[ 19.096771] driver: 'musb-omap2430': driver_bound: bound to device 'musb-omap2430'
+[ 19.105194] bus: 'platform': really_probe: bound device musb-omap2430 to driver musb-omap2430
+[ 19.174407] bus: 'platform': add driver twl4030_usb
+[ 19.179656] bus: 'platform': driver_probe_device: matched device twl4030_usb with driver twl4030_usb
+[ 19.202270] bus: 'platform': really_probe: probing driver twl4030_usb with device twl4030_usb
+[ 19.214172] twl4030_usb twl4030_usb: HW_CONDITIONS 0xc0/192; link 3
+[ 19.239624] musb-omap2430 musb-omap2430: musb core is not yet ready
+[ 19.246765] twl4030_usb twl4030_usb: Initialized TWL4030 USB module
+[ 19.254516] driver: 'twl4030_usb': driver_bound: bound to device 'twl4030_usb'
+[ 19.263580] bus: 'platform': really_probe: bound device twl4030_usb to driver twl4030_usb
+
+Cc: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+Signed-off-by: Ming Lei <ming.lei@canonical.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/am35x.c | 2 +-
+ drivers/usb/musb/blackfin.c | 2 +-
+ drivers/usb/musb/da8xx.c | 7 +++++--
+ drivers/usb/musb/davinci.c | 7 +++++--
+ drivers/usb/musb/musb_dsps.c | 2 +-
+ drivers/usb/musb/omap2430.c | 2 +-
+ drivers/usb/musb/tusb6010.c | 2 +-
+ drivers/usb/musb/ux500.c | 2 +-
+ 8 files changed, 16 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/musb/am35x.c
++++ b/drivers/usb/musb/am35x.c
+@@ -365,7 +365,7 @@ static int am35x_musb_init(struct musb *
+ usb_nop_xceiv_register();
+ musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2);
+ if (IS_ERR_OR_NULL(musb->xceiv))
+- return -ENODEV;
++ return -EPROBE_DEFER;
+
+ setup_timer(&otg_workaround, otg_timer, (unsigned long) musb);
+
+--- a/drivers/usb/musb/blackfin.c
++++ b/drivers/usb/musb/blackfin.c
+@@ -406,7 +406,7 @@ static int bfin_musb_init(struct musb *m
+ musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2);
+ if (IS_ERR_OR_NULL(musb->xceiv)) {
+ gpio_free(musb->config->gpio_vrsel);
+- return -ENODEV;
++ return -EPROBE_DEFER;
+ }
+
+ bfin_musb_reg_init(musb);
+--- a/drivers/usb/musb/da8xx.c
++++ b/drivers/usb/musb/da8xx.c
+@@ -410,6 +410,7 @@ static int da8xx_musb_init(struct musb *
+ {
+ void __iomem *reg_base = musb->ctrl_base;
+ u32 rev;
++ int ret = -ENODEV;
+
+ musb->mregs += DA8XX_MENTOR_CORE_OFFSET;
+
+@@ -420,8 +421,10 @@ static int da8xx_musb_init(struct musb *
+
+ usb_nop_xceiv_register();
+ musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2);
+- if (IS_ERR_OR_NULL(musb->xceiv))
++ if (IS_ERR_OR_NULL(musb->xceiv)) {
++ ret = -EPROBE_DEFER;
+ goto fail;
++ }
+
+ setup_timer(&otg_workaround, otg_timer, (unsigned long)musb);
+
+@@ -441,7 +444,7 @@ static int da8xx_musb_init(struct musb *
+ musb->isr = da8xx_musb_interrupt;
+ return 0;
+ fail:
+- return -ENODEV;
++ return ret;
+ }
+
+ static int da8xx_musb_exit(struct musb *musb)
+--- a/drivers/usb/musb/davinci.c
++++ b/drivers/usb/musb/davinci.c
+@@ -380,11 +380,14 @@ static int davinci_musb_init(struct musb
+ {
+ void __iomem *tibase = musb->ctrl_base;
+ u32 revision;
++ int ret = -ENODEV;
+
+ usb_nop_xceiv_register();
+ musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2);
+- if (IS_ERR_OR_NULL(musb->xceiv))
++ if (IS_ERR_OR_NULL(musb->xceiv)) {
++ ret = -EPROBE_DEFER;
+ goto unregister;
++ }
+
+ musb->mregs += DAVINCI_BASE_OFFSET;
+
+@@ -438,7 +441,7 @@ fail:
+ usb_put_phy(musb->xceiv);
+ unregister:
+ usb_nop_xceiv_unregister();
+- return -ENODEV;
++ return ret;
+ }
+
+ static int davinci_musb_exit(struct musb *musb)
+--- a/drivers/usb/musb/musb_dsps.c
++++ b/drivers/usb/musb/musb_dsps.c
+@@ -419,7 +419,7 @@ static int dsps_musb_init(struct musb *m
+ usb_nop_xceiv_register();
+ musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2);
+ if (IS_ERR_OR_NULL(musb->xceiv))
+- return -ENODEV;
++ return -EPROBE_DEFER;
+
+ /* Returns zero if e.g. not clocked */
+ rev = dsps_readl(reg_base, wrp->revision);
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -369,7 +369,7 @@ static int omap2430_musb_init(struct mus
+ musb->xceiv = devm_usb_get_phy(dev, USB_PHY_TYPE_USB2);
+ if (IS_ERR_OR_NULL(musb->xceiv)) {
+ pr_err("HS USB OTG: no transceiver configured\n");
+- return -ENODEV;
++ return -EPROBE_DEFER;
+ }
+
+ musb->isr = omap2430_musb_interrupt;
+--- a/drivers/usb/musb/tusb6010.c
++++ b/drivers/usb/musb/tusb6010.c
+@@ -1069,7 +1069,7 @@ static int tusb_musb_init(struct musb *m
+ usb_nop_xceiv_register();
+ musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2);
+ if (IS_ERR_OR_NULL(musb->xceiv))
+- return -ENODEV;
++ return -EPROBE_DEFER;
+
+ pdev = to_platform_device(musb->controller);
+
+--- a/drivers/usb/musb/ux500.c
++++ b/drivers/usb/musb/ux500.c
+@@ -61,7 +61,7 @@ static int ux500_musb_init(struct musb *
+ musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2);
+ if (IS_ERR_OR_NULL(musb->xceiv)) {
+ pr_err("HS USB OTG: no transceiver configured\n");
+- return -ENODEV;
++ return -EPROBE_DEFER;
+ }
+
+ musb->isr = ux500_musb_interrupt;
--- /dev/null
+From 99d17cfa3bbc6f4edb175f819af59c6b9e245e82 Mon Sep 17 00:00:00 2001
+From: Fabio Baltieri <fabio.baltieri@linaro.org>
+Date: Mon, 7 Jan 2013 17:47:41 +0100
+Subject: usb: musb: ux500: use clk_prepare_enable and clk_disable_unprepare
+
+From: Fabio Baltieri <fabio.baltieri@linaro.org>
+
+commit 99d17cfa3bbc6f4edb175f819af59c6b9e245e82 upstream.
+
+This patch converts the module to use clk_prepare_enable and
+clk_disable_unprepare variants as required by common clock framework.
+
+Without this the system crash during probe function.
+
+Signed-off-by: Fabio Baltieri <fabio.baltieri@linaro.org>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/ux500.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/musb/ux500.c
++++ b/drivers/usb/musb/ux500.c
+@@ -108,7 +108,7 @@ static int ux500_probe(struct platform_d
+ goto err3;
+ }
+
+- ret = clk_enable(clk);
++ ret = clk_prepare_enable(clk);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to enable clock\n");
+ goto err4;
+@@ -148,7 +148,7 @@ static int ux500_probe(struct platform_d
+ return 0;
+
+ err5:
+- clk_disable(clk);
++ clk_disable_unprepare(clk);
+
+ err4:
+ clk_put(clk);
+@@ -168,7 +168,7 @@ static int ux500_remove(struct platform_
+ struct ux500_glue *glue = platform_get_drvdata(pdev);
+
+ platform_device_unregister(glue->musb);
+- clk_disable(glue->clk);
++ clk_disable_unprepare(glue->clk);
+ clk_put(glue->clk);
+ kfree(glue);
+
+@@ -182,7 +182,7 @@ static int ux500_suspend(struct device *
+ struct musb *musb = glue_to_musb(glue);
+
+ usb_phy_set_suspend(musb->xceiv, 1);
+- clk_disable(glue->clk);
++ clk_disable_unprepare(glue->clk);
+
+ return 0;
+ }
+@@ -193,7 +193,7 @@ static int ux500_resume(struct device *d
+ struct musb *musb = glue_to_musb(glue);
+ int ret;
+
+- ret = clk_enable(glue->clk);
++ ret = clk_prepare_enable(glue->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clock\n");
+ return ret;
--- /dev/null
+From f8f0302bbcbd1b14655bef29f6996a2152be559d Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Wed, 23 Jan 2013 10:44:36 +0100
+Subject: USB: option: add and update Alcatel modems
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit f8f0302bbcbd1b14655bef29f6996a2152be559d upstream.
+
+Adding three currently unsupported modems based on information
+from .inf driver files:
+
+ Diag VID_1BBB&PID_0052&MI_00
+ AGPS VID_1BBB&PID_0052&MI_01
+ VOICE VID_1BBB&PID_0052&MI_02
+ AT VID_1BBB&PID_0052&MI_03
+ Modem VID_1BBB&PID_0052&MI_05
+ wwan VID_1BBB&PID_0052&MI_06
+
+ Diag VID_1BBB&PID_00B6&MI_00
+ AT VID_1BBB&PID_00B6&MI_01
+ Modem VID_1BBB&PID_00B6&MI_02
+ wwan VID_1BBB&PID_00B6&MI_03
+
+ Diag VID_1BBB&PID_00B7&MI_00
+ AGPS VID_1BBB&PID_00B7&MI_01
+ VOICE VID_1BBB&PID_00B7&MI_02
+ AT VID_1BBB&PID_00B7&MI_03
+ Modem VID_1BBB&PID_00B7&MI_04
+ wwan VID_1BBB&PID_00B7&MI_05
+
+Updating the blacklist info for the X060S_X200 and X220_X500D,
+reserving interfaces for a wwan driver, based on
+
+ wwan VID_1BBB&PID_0000&MI_04
+ wwan VID_1BBB&PID_0017&MI_06
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -479,6 +479,7 @@ static const struct option_blacklist_inf
+
+ static const struct option_blacklist_info alcatel_x200_blacklist = {
+ .sendsetup = BIT(0) | BIT(1),
++ .reserved = BIT(4),
+ };
+
+ static const struct option_blacklist_info zte_0037_blacklist = {
+@@ -1215,7 +1216,14 @@ static const struct usb_device_id option
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
+ },
+- { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D) },
++ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
++ { USB_DEVICE(ALCATEL_VENDOR_ID, 0x0052),
++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
++ { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b6),
++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++ { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b7),
++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
--- /dev/null
+From 1f3f687722fd9b29a0c2a85b4844e3b2a3585c63 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Wed, 13 Feb 2013 23:41:34 +0100
+Subject: USB: option: add Huawei "ACM" devices using protocol = vendor
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit 1f3f687722fd9b29a0c2a85b4844e3b2a3585c63 upstream.
+
+The USB device descriptor of one identity presented by a few
+Huawei morphing devices have serial functions with class codes
+02/02/ff, indicating CDC ACM with a vendor specific protocol. This
+combination is often used for MSFT RNDIS functions, and the CDC
+ACM class driver will therefore ignore such functions.
+
+The CDC ACM class driver cannot support functions with only 2
+endpoints. The underlying serial functions of these modems are
+also believed to be the same as for alternate device identities
+already supported by the option driver. Letting the same driver
+handle these functions independently of the current identity
+ensures consistent handling and user experience.
+
+There is no need to blacklist these devices in the rndis_host
+driver. Huawei serial functions will either have only 2 endpoints
+or a CDC ACM functional descriptor with bmCapabilities != 0, making
+them correctly ignored as "non RNDIS" by that driver.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -578,8 +578,12 @@ static const struct usb_device_id option
+ { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLE) },
+ { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c05, USB_CLASS_COMM, 0x02, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff),
--- /dev/null
+From cd565279e51bedee1b2988e84f9b3bef485adeb6 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Tue, 12 Feb 2013 13:42:24 +0100
+Subject: USB: option: add Yota / Megafon M100-1 4g modem
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit cd565279e51bedee1b2988e84f9b3bef485adeb6 upstream.
+
+Interface layout:
+
+ 00 CD-ROM
+ 01 debug COM port
+ 02 AP control port
+ 03 modem
+ 04 usb-ethernet
+
+Bus=01 Lev=02 Prnt=02 Port=01 Cnt=02 Dev#= 4 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=0408 ProdID=ea42 Rev= 0.00
+S: Manufacturer=Qualcomm, Incorporated
+S: Product=Qualcomm CDMA Technologies MSM
+S: SerialNumber=353568051xxxxxx
+C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -576,6 +576,8 @@ static const struct usb_device_id option
+ { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLX) },
+ { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GKE) },
+ { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLE) },
++ { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff),
--- /dev/null
+From cd060956c5e97931c3909e4a808508469c0bb9f6 Mon Sep 17 00:00:00 2001
+From: fangxiaozhi <huananhu@huawei.com>
+Date: Thu, 7 Feb 2013 15:32:07 +0800
+Subject: USB: storage: properly handle the endian issues of idProduct
+
+From: fangxiaozhi <huananhu@huawei.com>
+
+commit cd060956c5e97931c3909e4a808508469c0bb9f6 upstream.
+
+1. The idProduct is little endian, so make sure its value to be
+compatible with the current CPU. Make no break on big endian processors.
+
+Signed-off-by: fangxiaozhi <huananhu@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/initializers.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/storage/initializers.c
++++ b/drivers/usb/storage/initializers.c
+@@ -147,7 +147,7 @@ static int usb_stor_huawei_dongles_pid(s
+ int idProduct;
+
+ idesc = &us->pusb_intf->cur_altsetting->desc;
+- idProduct = us->pusb_dev->descriptor.idProduct;
++ idProduct = le16_to_cpu(us->pusb_dev->descriptor.idProduct);
+ /* The first port is CDROM,
+ * means the dongle in the single port mode,
+ * and a switch command is required to be sent. */
+@@ -169,7 +169,7 @@ int usb_stor_huawei_init(struct us_data
+ int result = 0;
+
+ if (usb_stor_huawei_dongles_pid(us)) {
+- if (us->pusb_dev->descriptor.idProduct >= 0x1446)
++ if (le16_to_cpu(us->pusb_dev->descriptor.idProduct) >= 0x1446)
+ result = usb_stor_huawei_scsi_init(us);
+ else
+ result = usb_stor_huawei_feature_init(us);
--- /dev/null
+From 18e03310b5caa6d11c1a8c61b982c37047693fba Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@redhat.com>
+Date: Thu, 14 Feb 2013 09:39:09 -0500
+Subject: USB: usb-storage: unusual_devs update for Super TOP SATA bridge
+
+From: Josh Boyer <jwboyer@redhat.com>
+
+commit 18e03310b5caa6d11c1a8c61b982c37047693fba upstream.
+
+The current entry in unusual_cypress.h for the Super TOP SATA bridge devices
+seems to be causing corruption on newer revisions of this device. This has
+been reported in Arch Linux and Fedora. The original patch was tested on
+devices with bcdDevice of 1.60, whereas the newer devices report bcdDevice
+as 2.20. Limit the UNUSUAL_DEV entry to devices less than 2.20.
+
+This fixes https://bugzilla.redhat.com/show_bug.cgi?id=909591
+
+The Arch Forum post on this is here:
+ https://bbs.archlinux.org/viewtopic.php?id=152011
+
+Reported-by: Carsten S. <carsteniq@yahoo.com>
+Tested-by: Carsten S. <carsteniq@yahoo.com>
+Signed-off-by: Josh Boyer <jwboyer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_cypress.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/unusual_cypress.h
++++ b/drivers/usb/storage/unusual_cypress.h
+@@ -31,7 +31,7 @@ UNUSUAL_DEV( 0x04b4, 0x6831, 0x0000, 0x
+ "Cypress ISD-300LP",
+ USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+
+-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999,
++UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219,
+ "Super Top",
+ "USB 2.0 SATA BRIDGE",
+ USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
--- /dev/null
+From 8977948658ded97d65febe5e45aab15934cfbb59 Mon Sep 17 00:00:00 2001
+From: Cong Wang <amwang@redhat.com>
+Date: Thu, 21 Feb 2013 23:32:27 +0000
+Subject: vlan: adjust vlan_set_encap_proto() for its callers
+
+
+From: Cong Wang <amwang@redhat.com>
+
+[ Upstream commit da8c87241c26aac81a64c7e4d21d438a33018f4e ]
+
+There are two places to call vlan_set_encap_proto():
+vlan_untag() and __pop_vlan_tci().
+
+vlan_untag() assumes skb->data points after mac addr, otherwise
+the following code
+
+ vhdr = (struct vlan_hdr *) skb->data;
+ vlan_tci = ntohs(vhdr->h_vlan_TCI);
+ __vlan_hwaccel_put_tag(skb, vlan_tci);
+
+ skb_pull_rcsum(skb, VLAN_HLEN);
+
+won't be correct. But __pop_vlan_tci() assumes points _before_
+mac addr.
+
+In vlan_set_encap_proto(), it looks for some magic L2 value
+after mac addr:
+
+ rawp = skb->data;
+ if (*(unsigned short *) rawp == 0xFFFF)
+ ...
+
+Therefore __pop_vlan_tci() is obviously wrong.
+
+A quick fix is avoiding using skb->data in vlan_set_encap_proto(),
+use 'vhdr+1' is always correct in both cases.
+
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Jesse Gross <jesse@nicira.com>
+Signed-off-by: Cong Wang <amwang@redhat.com>
+Acked-by: Jesse Gross <jesse@nicira.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/if_vlan.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -331,7 +331,7 @@ static inline void vlan_set_encap_proto(
+ struct vlan_hdr *vhdr)
+ {
+ __be16 proto;
+- unsigned char *rawp;
++ unsigned short *rawp;
+
+ /*
+ * Was a VLAN packet, grab the encapsulated protocol, which the layer
+@@ -344,8 +344,8 @@ static inline void vlan_set_encap_proto(
+ return;
+ }
+
+- rawp = skb->data;
+- if (*(unsigned short *) rawp == 0xFFFF)
++ rawp = (unsigned short *)(vhdr + 1);
++ if (*rawp == 0xFFFF)
+ /*
+ * This is a magic hack to spot IPX packets. Older Novell
+ * breaks the protocol design and runs IPX over 802.3 without
--- /dev/null
+From 240b9d33e5573f31f2080e4537f2c0431139484a Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Thu, 14 Feb 2013 03:18:58 +0000
+Subject: xen-netback: cancel the credit timer when taking the vif down
+
+
+From: David Vrabel <david.vrabel@citrix.com>
+
+[ Upstream commit 3e55f8b306cf305832a4ac78aa82e1b40e818ece ]
+
+If the credit timer is left armed after calling
+xen_netbk_remove_xenvif(), then it may fire and attempt to schedule
+the vif which will then oops as vif->netbk == NULL.
+
+This may happen both in the fatal error path and during normal
+disconnection from the front end.
+
+The sequencing during shutdown is critical to ensure that: a)
+vif->netbk doesn't become unexpectedly NULL; and b) the net device/vif
+is not freed.
+
+1. Mark as unschedulable (netif_carrier_off()).
+2. Synchronously cancel the timer.
+3. Remove the vif from the schedule list.
+4. Remove it from it netback thread group.
+5. Wait for vif->refcnt to become 0.
+
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+Reported-by: Christopher S. Aker <caker@theshore.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netback/interface.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -132,6 +132,7 @@ static void xenvif_up(struct xenvif *vif
+ static void xenvif_down(struct xenvif *vif)
+ {
+ disable_irq(vif->irq);
++ del_timer_sync(&vif->credit_timeout);
+ xen_netbk_deschedule_xenvif(vif);
+ xen_netbk_remove_xenvif(vif);
+ }
+@@ -363,8 +364,6 @@ void xenvif_disconnect(struct xenvif *vi
+ atomic_dec(&vif->refcnt);
+ wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
+
+- del_timer_sync(&vif->credit_timeout);
+-
+ if (vif->irq)
+ unbind_from_irqhandler(vif->irq, vif);
+
--- /dev/null
+From 156d41484b7e4786e1f69a6c21b2be3437f52c3e Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Thu, 14 Feb 2013 03:18:57 +0000
+Subject: xen-netback: correctly return errors from netbk_count_requests()
+
+
+From: David Vrabel <david.vrabel@citrix.com>
+
+[ Upstream commit 35876b5ffc154c357476b2c3bdab10feaf4bd8f0 ]
+
+netbk_count_requests() could detect an error, call
+netbk_fatal_tx_error() but return 0. The vif may then be used
+afterwards (e.g., in a call to netbk_tx_error().
+
+Since netbk_fatal_tx_error() could set vif->refcnt to 1, the vif may
+be freed immediately after the call to netbk_fatal_tx_error() (e.g.,
+if the vif is also removed).
+
+Netback thread Xenwatch thread
+-------------------------------------------
+netbk_fatal_tx_err() netback_remove()
+ xenvif_disconnect()
+ ...
+ free_netdev()
+netbk_tx_err() Oops!
+
+Signed-off-by: Wei Liu <wei.liu2@citrix.com>
+Signed-off-by: Jan Beulich <JBeulich@suse.com>
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Reported-by: Christopher S. Aker <caker@theshore.net>
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netback/netback.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -911,13 +911,13 @@ static int netbk_count_requests(struct x
+ if (frags >= work_to_do) {
+ netdev_err(vif->dev, "Need more frags\n");
+ netbk_fatal_tx_err(vif);
+- return -frags;
++ return -ENODATA;
+ }
+
+ if (unlikely(frags >= MAX_SKB_FRAGS)) {
+ netdev_err(vif->dev, "Too many frags\n");
+ netbk_fatal_tx_err(vif);
+- return -frags;
++ return -E2BIG;
+ }
+
+ memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags),
+@@ -925,7 +925,7 @@ static int netbk_count_requests(struct x
+ if (txp->size > first->size) {
+ netdev_err(vif->dev, "Frag is bigger than frame.\n");
+ netbk_fatal_tx_err(vif);
+- return -frags;
++ return -EIO;
+ }
+
+ first->size -= txp->size;
+@@ -935,7 +935,7 @@ static int netbk_count_requests(struct x
+ netdev_err(vif->dev, "txp->offset: %x, size: %u\n",
+ txp->offset, txp->size);
+ netbk_fatal_tx_err(vif);
+- return -frags;
++ return -EINVAL;
+ }
+ } while ((txp++)->flags & XEN_NETTXF_more_data);
+ return frags;
--- /dev/null
+From b79c2530c1d19741a701259d417cae0fd1ed2cd9 Mon Sep 17 00:00:00 2001
+From: Romain KUNTZ <r.kuntz@ipflavors.com>
+Date: Mon, 18 Feb 2013 02:36:24 +0000
+Subject: xfrm: release neighbor upon dst destruction
+
+
+From: Romain KUNTZ <r.kuntz@ipflavors.com>
+
+[ Upstream commit 18cf0d0784b4a634472ed24d0d7ca1c721d93e90 ]
+
+Neighbor is cloned in xfrm6_fill_dst but seems to never be released.
+Neighbor entry should be released when XFRM6 dst entry is destroyed
+in xfrm6_dst_destroy, otherwise references may be kept forever on
+the device pointed by the neighbor entry.
+
+I may not have understood all the subtleties of XFRM & dst so I would
+be happy to receive comments on this patch.
+
+Signed-off-by: Romain Kuntz <r.kuntz@ipflavors.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/xfrm6_policy.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv6/xfrm6_policy.c
++++ b/net/ipv6/xfrm6_policy.c
+@@ -236,6 +236,8 @@ static void xfrm6_dst_destroy(struct dst
+ {
+ struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+
++ if (likely(xdst->u.rt6.n))
++ neigh_release(xdst->u.rt6.n);
+ if (likely(xdst->u.rt6.rt6i_idev))
+ in6_dev_put(xdst->u.rt6.rt6i_idev);
+ dst_destroy_metrics_generic(dst);
projects / thirdparty / kernel / stable-queue.git / commitdiff
