--- /dev/null
+From 0645b93f6c223b594c0dca348e2ae0a23bccf6e3 Mon Sep 17 00:00:00 2001
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+Date: Fri, 22 Nov 2013 14:49:52 +0100
+Subject: ARM: at91: at91sam9g45: set default mmc pinctrl-names
+
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+
+commit 0645b93f6c223b594c0dca348e2ae0a23bccf6e3 upstream.
+
+pinctrl-names property was missing from mmc nodes.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91sam9g45.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -618,6 +618,7 @@
+ compatible = "atmel,hsmci";
+ reg = <0xfff80000 0x600>;
+ interrupts = <11 IRQ_TYPE_LEVEL_HIGH 0>;
++ pinctrl-names = "default";
+ dmas = <&dma 1 AT91_DMA_CFG_PER_ID(0)>;
+ dma-names = "rxtx";
+ #address-cells = <1>;
+@@ -629,6 +630,7 @@
+ compatible = "atmel,hsmci";
+ reg = <0xfffd0000 0x600>;
+ interrupts = <29 IRQ_TYPE_LEVEL_HIGH 0>;
++ pinctrl-names = "default";
+ dmas = <&dma 1 AT91_DMA_CFG_PER_ID(13)>;
+ dma-names = "rxtx";
+ #address-cells = <1>;
--- /dev/null
+From 1588c51cf6d782e63a8719681d905ef0ac22ee62 Mon Sep 17 00:00:00 2001
+From: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
+Date: Thu, 9 Jan 2014 16:01:54 +0100
+Subject: ARM: at91: smc: bug fix in sam9_smc_cs_read()
+
+From: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
+
+commit 1588c51cf6d782e63a8719681d905ef0ac22ee62 upstream.
+
+There was a copy/paste error when reading the nwe_pulse value.
+
+Signed-off-by: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
+Acked-by: Boris BREZILLON <b.brezillon@overkiz.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Kevin Hilman <khilman@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-at91/sam9_smc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-at91/sam9_smc.c
++++ b/arch/arm/mach-at91/sam9_smc.c
+@@ -101,7 +101,7 @@ static void sam9_smc_cs_read(void __iome
+ /* Pulse register */
+ val = __raw_readl(base + AT91_SMC_PULSE);
+
+- config->nwe_setup = val & AT91_SMC_NWEPULSE;
++ config->nwe_pulse = val & AT91_SMC_NWEPULSE;
+ config->ncs_write_pulse = (val & AT91_SMC_NCS_WRPULSE) >> 8;
+ config->nrd_pulse = (val & AT91_SMC_NRDPULSE) >> 16;
+ config->ncs_read_pulse = (val & AT91_SMC_NCS_RDPULSE) >> 24;
--- /dev/null
+From 1e2f9295f4c657500111514f92a3d3894d0e05b4 Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date: Thu, 9 Jan 2014 08:51:15 +0530
+Subject: ath9k: Disable cross-band FCC
+
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+
+commit 1e2f9295f4c657500111514f92a3d3894d0e05b4 upstream.
+
+Fast Channel Change across bands was enabled for
+AR9462 recently, but this is causing baseband issues.
+Disable it until this feature is tested well. Also,
+remove the feature bit for AR9565 since it is
+a single-band card and doesn't support this feature.
+
+Reported-by: Oleksij Rempel <linux@rempel-privat.de>
+Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -2608,13 +2608,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw
+ ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+ pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
+
+- /*
+- * Fast channel change across bands is available
+- * only for AR9462 and AR9565.
+- */
+- if (AR_SREV_9462(ah) || AR_SREV_9565(ah))
+- pCap->hw_caps |= ATH9K_HW_CAP_FCC_BAND_SWITCH;
+-
+ return 0;
+ }
+
--- /dev/null
+From ff9a93f2ebb88ac7aab9568de80b64b92078e96d Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date: Thu, 9 Jan 2014 08:51:14 +0530
+Subject: ath9k: Use correct channel for RX packets
+
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+
+commit ff9a93f2ebb88ac7aab9568de80b64b92078e96d upstream.
+
+Accessing the current channel definition in mac80211
+when processing RX packets is problematic because it
+could have been updated when a scan is issued. Since a
+channel change involves flushing the existing packets
+in the RX queue before a chip-reset is done, they would
+be processed using the wrong band/channel information.
+
+To avoid this, use the current channel information
+maintained in the driver.
+
+Reported-by: Oleksij Rempel <linux@rempel-privat.de>
+Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/recv.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -848,20 +848,15 @@ static int ath9k_process_rate(struct ath
+ enum ieee80211_band band;
+ unsigned int i = 0;
+ struct ath_softc __maybe_unused *sc = common->priv;
++ struct ath_hw *ah = sc->sc_ah;
+
+- band = hw->conf.chandef.chan->band;
++ band = ah->curchan->chan->band;
+ sband = hw->wiphy->bands[band];
+
+- switch (hw->conf.chandef.width) {
+- case NL80211_CHAN_WIDTH_5:
++ if (IS_CHAN_QUARTER_RATE(ah->curchan))
+ rxs->flag |= RX_FLAG_5MHZ;
+- break;
+- case NL80211_CHAN_WIDTH_10:
++ else if (IS_CHAN_HALF_RATE(ah->curchan))
+ rxs->flag |= RX_FLAG_10MHZ;
+- break;
+- default:
+- break;
+- }
+
+ if (rx_stats->rs_rate & 0x80) {
+ /* HT rate */
+@@ -1175,6 +1170,14 @@ static int ath9k_rx_skb_preprocess(struc
+ ath_start_rx_poll(sc, 3);
+ }
+
++ /*
++ * This shouldn't happen, but have a safety check anyway.
++ */
++ if (WARN_ON(!ah->curchan)) {
++ ret = -EINVAL;
++ goto exit;
++ }
++
+ if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
+ ret =-EINVAL;
+ goto exit;
+@@ -1182,8 +1185,8 @@ static int ath9k_rx_skb_preprocess(struc
+
+ ath9k_process_rssi(common, hw, rx_stats, rx_status);
+
+- rx_status->band = hw->conf.chandef.chan->band;
+- rx_status->freq = hw->conf.chandef.chan->center_freq;
++ rx_status->band = ah->curchan->chan->band;
++ rx_status->freq = ah->curchan->chan->center_freq;
+ rx_status->antenna = rx_stats->rs_antenna;
+ rx_status->flag |= RX_FLAG_MACTIME_END;
+
--- /dev/null
+From 09164043f63c947a49797750a09ca1cd7c31108e Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 12 Jan 2014 15:11:37 -0600
+Subject: b43: Fix lockdep splat
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 09164043f63c947a49797750a09ca1cd7c31108e upstream.
+
+In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported
+when b43 is used with hostapd, and rfkill is used to kill the radio output.
+
+The lockdep splat (in part) is as follows:
+
+======================================================
+[ INFO: possible circular locking dependency detected ]
+3.12.0 #1 Not tainted
+-------------------------------------------------------
+rfkill/10040 is trying to acquire lock:
+ (rtnl_mutex){+.+.+.}, at: [<ffffffff8146f282>] rtnl_lock+0x12/0x20
+
+but task is already holding lock:
+ (rfkill_global_mutex){+.+.+.}, at: [<ffffffffa04832ca>] rfkill_fop_write+0x6a/0x170 [rfkill]
+
+--snip--
+
+Chain exists of:
+ rtnl_mutex --> misc_mtx --> rfkill_global_mutex
+
+The fix is to move the initialization of the hardware random number generator
+outside the code range covered by the rtnl_mutex.
+
+Reported-by: yury <urykhy@gmail.com>
+Tested-by: yury <urykhy@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/main.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -2424,6 +2424,7 @@ error:
+
+ static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
+ static void b43_one_core_detach(struct b43_bus_dev *dev);
++static int b43_rng_init(struct b43_wl *wl);
+
+ static void b43_request_firmware(struct work_struct *work)
+ {
+@@ -2475,6 +2476,10 @@ start_ieee80211:
+ goto err_one_core_detach;
+ wl->hw_registred = true;
+ b43_leds_register(wl->current_dev);
++
++ /* Register HW RNG driver */
++ b43_rng_init(wl);
++
+ goto out;
+
+ err_one_core_detach:
+@@ -4636,9 +4641,6 @@ static void b43_wireless_core_exit(struc
+ if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
+ return;
+
+- /* Unregister HW RNG driver */
+- b43_rng_exit(dev->wl);
+-
+ b43_set_status(dev, B43_STAT_UNINIT);
+
+ /* Stop the microcode PSM. */
+@@ -4795,9 +4797,6 @@ static int b43_wireless_core_init(struct
+
+ b43_set_status(dev, B43_STAT_INITIALIZED);
+
+- /* Register HW RNG driver */
+- b43_rng_init(dev->wl);
+-
+ out:
+ return err;
+
+@@ -5464,6 +5463,9 @@ static void b43_bcma_remove(struct bcma_
+
+ b43_one_core_detach(wldev->dev);
+
++ /* Unregister HW RNG driver */
++ b43_rng_exit(wl);
++
+ b43_leds_unregister(wl);
+
+ ieee80211_free_hw(wl->hw);
+@@ -5541,6 +5543,9 @@ static void b43_ssb_remove(struct ssb_de
+
+ b43_one_core_detach(dev);
+
++ /* Unregister HW RNG driver */
++ b43_rng_exit(wl);
++
+ if (list_empty(&wl->devlist)) {
+ b43_leds_unregister(wl);
+ /* Last core on the chip unregistered.
--- /dev/null
+From 64e5acb09ca6b50c97299cff9ef51299470b29f2 Mon Sep 17 00:00:00 2001
+From: ZHAO Gang <gamerh2o@gmail.com>
+Date: Sat, 18 Jan 2014 00:17:38 +0800
+Subject: b43: fix the wrong assignment of status.freq in b43_rx()
+
+From: ZHAO Gang <gamerh2o@gmail.com>
+
+commit 64e5acb09ca6b50c97299cff9ef51299470b29f2 upstream.
+
+Use the right function to update frequency value.
+
+If rx skb is probe response or beacon, the wrong frequency value can
+cause problem that bss info can't be updated when it should be.
+
+Fixes: 8318d78a44d4 ("cfg80211 API for channels/bitrates, mac80211 and driver conversion")
+Signed-off-by: ZHAO Gang <gamerh2o@gmail.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/xmit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/b43/xmit.c
++++ b/drivers/net/wireless/b43/xmit.c
+@@ -821,10 +821,10 @@ void b43_rx(struct b43_wldev *dev, struc
+ * channel number in b43. */
+ if (chanstat & B43_RX_CHAN_5GHZ) {
+ status.band = IEEE80211_BAND_5GHZ;
+- status.freq = b43_freq_to_channel_5ghz(chanid);
++ status.freq = b43_channel_to_freq_5ghz(chanid);
+ } else {
+ status.band = IEEE80211_BAND_2GHZ;
+- status.freq = b43_freq_to_channel_2ghz(chanid);
++ status.freq = b43_channel_to_freq_2ghz(chanid);
+ }
+ break;
+ default:
--- /dev/null
+From 0673effd41dba323d6a280ef37b5ef29f3f5a653 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 12 Jan 2014 15:11:38 -0600
+Subject: b43: Fix unload oops if firmware is not available
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 0673effd41dba323d6a280ef37b5ef29f3f5a653 upstream.
+
+The asyncronous firmware load uses a completion struct to hold firmware
+processing until the user-space routines are up and running. There is.
+however, a problem in that the waiter is nevered canceled during teardown.
+As a result, unloading the driver when firmware is not available causes an oops.
+
+To be able to access the completion structure at teardown, it had to be moved
+into the b43_wldev structure.
+
+This patch also fixes a typo in a comment.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/b43.h | 4 ++--
+ drivers/net/wireless/b43/main.c | 10 +++++-----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/b43/b43.h
++++ b/drivers/net/wireless/b43/b43.h
+@@ -731,8 +731,6 @@ enum b43_firmware_file_type {
+ struct b43_request_fw_context {
+ /* The device we are requesting the fw for. */
+ struct b43_wldev *dev;
+- /* a completion event structure needed if this call is asynchronous */
+- struct completion fw_load_complete;
+ /* a pointer to the firmware object */
+ const struct firmware *blob;
+ /* The type of firmware to request. */
+@@ -809,6 +807,8 @@ enum {
+ struct b43_wldev {
+ struct b43_bus_dev *dev;
+ struct b43_wl *wl;
++ /* a completion event structure needed if this call is asynchronous */
++ struct completion fw_load_complete;
+
+ /* The device initialization status.
+ * Use b43_status() to query. */
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -2070,6 +2070,7 @@ void b43_do_release_fw(struct b43_firmwa
+
+ static void b43_release_firmware(struct b43_wldev *dev)
+ {
++ complete(&dev->fw_load_complete);
+ b43_do_release_fw(&dev->fw.ucode);
+ b43_do_release_fw(&dev->fw.pcm);
+ b43_do_release_fw(&dev->fw.initvals);
+@@ -2095,7 +2096,7 @@ static void b43_fw_cb(const struct firmw
+ struct b43_request_fw_context *ctx = context;
+
+ ctx->blob = firmware;
+- complete(&ctx->fw_load_complete);
++ complete(&ctx->dev->fw_load_complete);
+ }
+
+ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+@@ -2142,7 +2143,7 @@ int b43_do_request_fw(struct b43_request
+ }
+ if (async) {
+ /* do this part asynchronously */
+- init_completion(&ctx->fw_load_complete);
++ init_completion(&ctx->dev->fw_load_complete);
+ err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
+ ctx->dev->dev->dev, GFP_KERNEL,
+ ctx, b43_fw_cb);
+@@ -2150,12 +2151,11 @@ int b43_do_request_fw(struct b43_request
+ pr_err("Unable to load firmware\n");
+ return err;
+ }
+- /* stall here until fw ready */
+- wait_for_completion(&ctx->fw_load_complete);
++ wait_for_completion(&ctx->dev->fw_load_complete);
+ if (ctx->blob)
+ goto fw_ready;
+ /* On some ARM systems, the async request will fail, but the next sync
+- * request works. For this reason, we dall through here
++ * request works. For this reason, we fall through here
+ */
+ }
+ err = request_firmware(&ctx->blob, ctx->fwname,
--- /dev/null
+From 452028665312672c6ba9e16a19248ee00ead9400 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 12 Jan 2014 15:11:39 -0600
+Subject: b43legacy: Fix unload oops if firmware is not available
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 452028665312672c6ba9e16a19248ee00ead9400 upstream.
+
+The asyncronous firmware load uses a completion struct to hold firmware
+processing until the user-space routines are up and running. There is.
+however, a problem in that the waiter is nevered canceled during teardown.
+As a result, unloading the driver when firmware is not available causes an oops.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43legacy/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/b43legacy/main.c
++++ b/drivers/net/wireless/b43legacy/main.c
+@@ -3919,6 +3919,7 @@ static void b43legacy_remove(struct ssb_
+ * as the ieee80211 unreg will destroy the workqueue. */
+ cancel_work_sync(&wldev->restart_work);
+ cancel_work_sync(&wl->firmware_load);
++ complete(&wldev->fw_load_complete);
+
+ B43legacy_WARN_ON(!wl);
+ if (!wldev->fw.ucode)
--- /dev/null
+From d303b1b5fbb688282bbf72a534b9dfed7af9fe4f Mon Sep 17 00:00:00 2001
+From: Phil Pokorny <ppokorny@penguincomputing.com>
+Date: Tue, 14 Jan 2014 10:46:46 -0800
+Subject: hwmon: (k10temp) Add support for Kaveri CPUs
+
+From: Phil Pokorny <ppokorny@penguincomputing.com>
+
+commit d303b1b5fbb688282bbf72a534b9dfed7af9fe4f upstream.
+
+Add new PCI ID to support new model "Kaveri" family.
+
+Signed-off-by: Philip Pokorny <ppokorny@penguincomputing.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/k10temp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -210,6 +210,7 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_i
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ {}
+ };
--- /dev/null
+From 91b0d1198417cf4fd9a7bd4138b6909f0b359099 Mon Sep 17 00:00:00 2001
+From: Eliad Peller <eliadx.peller@intel.com>
+Date: Sun, 5 Jan 2014 12:41:12 +0200
+Subject: iwlwifi: mvm: fix missing cleanup in .start() error path
+
+From: Eliad Peller <eliadx.peller@intel.com>
+
+commit 91b0d1198417cf4fd9a7bd4138b6909f0b359099 upstream.
+
+Cleanup of iwl_mvm_leds was missing in case of error,
+resulting in the following warning:
+
+WARNING: at lib/kobject.c:196 kobject_add_internal+0x1f4/0x210()
+kobject_add_internal failed for phy0-led with -EEXIST, don't try to register things with the same name in the same directory.
+
+which prevents further reloads of the driver.
+
+Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/ops.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
+@@ -446,6 +446,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *
+
+ out_unregister:
+ ieee80211_unregister_hw(mvm->hw);
++ iwl_mvm_leds_exit(mvm);
+ out_free:
+ iwl_phy_db_free(mvm->phy_db);
+ kfree(mvm->scan_cmd);
--- /dev/null
+From 2d93aee152b1758a94a18fe15d72153ba73b5679 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 24 Dec 2013 14:15:41 +0200
+Subject: iwlwifi: pcie: enable oscillator for L1 exit
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 2d93aee152b1758a94a18fe15d72153ba73b5679 upstream.
+
+Enabling the oscillator consumes slightly more power (100uA)
+but allows to make sure that we exit from L1 on time.
+
+Not doing so might lead to a PCIe specification violation
+since we might wake up from L1 at the wrong time.
+This issue has been identified on 3160 and 7260 only.
+On older NICs L1 off is not enabled, on newer NICs (7265),
+the issue is fixed.
+
+When the bug occurs the user sees that the NIC has
+disappeared from the PCI bridge, any access to the device
+returns 0xff.
+
+This fixes:
+ https://bugzilla.kernel.org/show_bug.cgi?id=64541
+
+and has been extensively discussed here:
+ http://markmail.org/thread/mfmpzqt3r333n4bo
+
+Fixes: 99cd47142399 ("iwlwifi: add 7000 series device configuration")
+Reported-and-tested-by: wzyboy <wzyboy@wzyboy.org>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-prph.h | 4 ++++
+ drivers/net/wireless/iwlwifi/pcie/trans.c | 22 ++++++++++++++++++++++
+ 2 files changed, 26 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
+@@ -272,4 +272,8 @@ static inline unsigned int SCD_QUEUE_STA
+
+ /*********************** END TX SCHEDULER *************************************/
+
++/* Oscillator clock */
++#define OSC_CLK (0xa04068)
++#define OSC_CLK_FORCE_CONTROL (0x8)
++
+ #endif /* __iwl_prph_h__ */
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -206,6 +206,28 @@ static int iwl_pcie_apm_init(struct iwl_
+ goto out;
+ }
+
++ if (trans->cfg->host_interrupt_operation_mode) {
++ /*
++ * This is a bit of an abuse - This is needed for 7260 / 3160
++ * only check host_interrupt_operation_mode even if this is
++ * not related to host_interrupt_operation_mode.
++ *
++ * Enable the oscillator to count wake up time for L1 exit. This
++ * consumes slightly more power (100uA) - but allows to be sure
++ * that we wake up from L1 on time.
++ *
++ * This looks weird: read twice the same register, discard the
++ * value, set a bit, and yet again, read that same register
++ * just to discard the value. But that's the way the hardware
++ * seems to like it.
++ */
++ iwl_read_prph(trans, OSC_CLK);
++ iwl_read_prph(trans, OSC_CLK);
++ iwl_set_bits_prph(trans, OSC_CLK, OSC_CLK_FORCE_CONTROL);
++ iwl_read_prph(trans, OSC_CLK);
++ iwl_read_prph(trans, OSC_CLK);
++ }
++
+ /*
+ * Enable DMA clock and wait for it to stabilize.
+ *
--- /dev/null
+From 743db27c526e0f31cc507959d662e97e2048a86f Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Mon, 11 Nov 2013 13:56:47 +0100
+Subject: KVM: s390: fix diagnose code extraction
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 743db27c526e0f31cc507959d662e97e2048a86f upstream.
+
+The diagnose code to be used is the contents of the base register (if not
+zero), plus the displacement. The current code ignores the base register
+contents. So let's fix that...
+
+Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kvm/diag.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/kvm/diag.c
++++ b/arch/s390/kvm/diag.c
+@@ -139,7 +139,7 @@ static int __diag_virtio_hypercall(struc
+
+ int kvm_s390_handle_diag(struct kvm_vcpu *vcpu)
+ {
+- int code = (vcpu->arch.sie_block->ipb & 0xfff0000) >> 16;
++ int code = kvm_s390_get_base_disp_rs(vcpu) & 0xffff;
+
+ if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
+ return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
--- /dev/null
+From ff1f3cb4b3ac5d039f02679f34cb1498d110d241 Mon Sep 17 00:00:00 2001
+From: Dominik Dingel <dingel@linux.vnet.ibm.com>
+Date: Mon, 9 Dec 2013 18:30:01 +0100
+Subject: KVM: s390: ioeventfd: ignore leftmost bits
+
+From: Dominik Dingel <dingel@linux.vnet.ibm.com>
+
+commit ff1f3cb4b3ac5d039f02679f34cb1498d110d241 upstream.
+
+The diagnose 500 subcode 3 contains the 32 bit subchannel id in bits 32-63
+(counting from the left). As for other I/O instructions, bits 0-31 should be
+ignored and thus not be passed to kvm_io_bus_write_cookie().
+
+This fixes a bug where the guest passed non-zero bits 0-31 which the
+host tried to interpret, leading to ioeventfd notification failures.
+
+Signed-off-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
+Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kvm/diag.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/kvm/diag.c
++++ b/arch/s390/kvm/diag.c
+@@ -122,7 +122,7 @@ static int __diag_virtio_hypercall(struc
+ * - gpr 4 contains the index on the bus (optionally)
+ */
+ ret = kvm_io_bus_write_cookie(vcpu->kvm, KVM_VIRTIO_CCW_NOTIFY_BUS,
+- vcpu->run->s.regs.gprs[2],
++ vcpu->run->s.regs.gprs[2] & 0xffffffff,
+ 8, &vcpu->run->s.regs.gprs[3],
+ vcpu->run->s.regs.gprs[4]);
+ srcu_read_unlock(&vcpu->kvm->srcu, idx);
--- /dev/null
+From 9ed96e87c5748de4c2807ef17e81287c7304186c Mon Sep 17 00:00:00 2001
+From: Marcelo Tosatti <mtosatti@redhat.com>
+Date: Mon, 6 Jan 2014 12:00:02 -0200
+Subject: KVM: x86: limit PIT timer frequency
+
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit 9ed96e87c5748de4c2807ef17e81287c7304186c upstream.
+
+Limit PIT timer frequency similarly to the limit applied by
+LAPIC timer.
+
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/i8254.c | 18 ++++++++++++++++++
+ arch/x86/kvm/lapic.c | 3 ---
+ arch/x86/kvm/x86.c | 3 +++
+ arch/x86/kvm/x86.h | 2 ++
+ 4 files changed, 23 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -37,6 +37,7 @@
+
+ #include "irq.h"
+ #include "i8254.h"
++#include "x86.h"
+
+ #ifndef CONFIG_X86_64
+ #define mod_64(x, y) ((x) - (y) * div64_u64(x, y))
+@@ -349,6 +350,23 @@ static void create_pit_timer(struct kvm
+ atomic_set(&ps->pending, 0);
+ ps->irq_ack = 1;
+
++ /*
++ * Do not allow the guest to program periodic timers with small
++ * interval, since the hrtimers are not throttled by the host
++ * scheduler.
++ */
++ if (ps->is_periodic) {
++ s64 min_period = min_timer_period_us * 1000LL;
++
++ if (ps->period < min_period) {
++ pr_info_ratelimited(
++ "kvm: requested %lld ns "
++ "i8254 timer period limited to %lld ns\n",
++ ps->period, min_period);
++ ps->period = min_period;
++ }
++ }
++
+ hrtimer_start(&ps->timer, ktime_add_ns(ktime_get(), interval),
+ HRTIMER_MODE_ABS);
+ }
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -71,9 +71,6 @@
+ #define VEC_POS(v) ((v) & (32 - 1))
+ #define REG_POS(v) (((v) >> 5) << 4)
+
+-static unsigned int min_timer_period_us = 500;
+-module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
+-
+ static inline void apic_set_reg(struct kvm_lapic *apic, int reg_off, u32 val)
+ {
+ *((u32 *) (apic->regs + reg_off)) = val;
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -94,6 +94,9 @@ EXPORT_SYMBOL_GPL(kvm_x86_ops);
+ static bool ignore_msrs = 0;
+ module_param(ignore_msrs, bool, S_IRUGO | S_IWUSR);
+
++unsigned int min_timer_period_us = 500;
++module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
++
+ bool kvm_has_tsc_control;
+ EXPORT_SYMBOL_GPL(kvm_has_tsc_control);
+ u32 kvm_max_guest_tsc_khz;
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -124,5 +124,7 @@ int kvm_write_guest_virt_system(struct x
+
+ extern u64 host_xcr0;
+
++extern unsigned int min_timer_period_us;
++
+ extern struct static_key kvm_no_apic_vcpu;
+ #endif
--- /dev/null
+From 66ae460b13c31a176b41550259683c841a62af3e Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Wed, 8 Jan 2014 20:19:22 +0200
+Subject: mei: use hbm idle state to prevent spurious resets
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit 66ae460b13c31a176b41550259683c841a62af3e upstream.
+
+When reset is caused by hbm protocol mismatch or timeout
+we might end up in an endless reset loop and hbm protocol
+will never sync
+
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hbm.c | 19 +++++++++++++++++++
+ drivers/misc/mei/hbm.h | 1 +
+ drivers/misc/mei/init.c | 12 ++++++++----
+ drivers/misc/mei/interrupt.c | 25 +++++++++++++++----------
+ 4 files changed, 43 insertions(+), 14 deletions(-)
+
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -128,6 +128,17 @@ static bool is_treat_specially_client(st
+ return false;
+ }
+
++/**
++ * mei_hbm_idle - set hbm to idle state
++ *
++ * @dev: the device structure
++ */
++void mei_hbm_idle(struct mei_device *dev)
++{
++ dev->init_clients_timer = 0;
++ dev->hbm_state = MEI_HBM_IDLE;
++}
++
+ int mei_hbm_start_wait(struct mei_device *dev)
+ {
+ int ret;
+@@ -577,6 +588,14 @@ void mei_hbm_dispatch(struct mei_device
+ mei_read_slots(dev, dev->rd_msg_buf, hdr->length);
+ mei_msg = (struct mei_bus_message *)dev->rd_msg_buf;
+
++ /* ignore spurious message and prevent reset nesting
++ * hbm is put to idle during system reset
++ */
++ if (dev->hbm_state == MEI_HBM_IDLE) {
++ dev_dbg(&dev->pdev->dev, "hbm: state is idle ignore spurious messages\n");
++ return 0;
++ }
++
+ switch (mei_msg->hbm_cmd) {
+ case HOST_START_RES_CMD:
+ version_res = (struct hbm_host_version_response *)mei_msg;
+--- a/drivers/misc/mei/hbm.h
++++ b/drivers/misc/mei/hbm.h
+@@ -49,6 +49,7 @@ static inline void mei_hbm_hdr(struct me
+ hdr->reserved = 0;
+ }
+
++void mei_hbm_idle(struct mei_device *dev);
+ int mei_hbm_start_req(struct mei_device *dev);
+ int mei_hbm_start_wait(struct mei_device *dev);
+ int mei_hbm_cl_flow_control_req(struct mei_device *dev, struct mei_cl *cl);
+--- a/drivers/misc/mei/init.c
++++ b/drivers/misc/mei/init.c
+@@ -139,14 +139,19 @@ void mei_reset(struct mei_device *dev, i
+ dev->dev_state != MEI_DEV_POWER_DOWN &&
+ dev->dev_state != MEI_DEV_POWER_UP);
+
++ /* we're already in reset, cancel the init timer
++ * if the reset was called due the hbm protocol error
++ * we need to call it before hw start
++ * so the hbm watchdog won't kick in
++ */
++ mei_hbm_idle(dev);
++
+ ret = mei_hw_reset(dev, interrupts_enabled);
+ if (ret) {
+ dev_err(&dev->pdev->dev, "hw reset failed disabling the device\n");
+ interrupts_enabled = false;
+- dev->dev_state = MEI_DEV_DISABLED;
+ }
+
+- dev->hbm_state = MEI_HBM_IDLE;
+
+ if (dev->dev_state != MEI_DEV_INITIALIZING &&
+ dev->dev_state != MEI_DEV_POWER_UP) {
+@@ -175,8 +180,6 @@ void mei_reset(struct mei_device *dev, i
+ memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg));
+ }
+
+- /* we're already in reset, cancel the init timer */
+- dev->init_clients_timer = 0;
+
+ dev->me_clients_num = 0;
+ dev->rd_msg_hdr = 0;
+@@ -188,6 +191,7 @@ void mei_reset(struct mei_device *dev, i
+
+ if (!interrupts_enabled) {
+ dev_dbg(&dev->pdev->dev, "intr not enabled end of reset\n");
++ dev->dev_state = MEI_DEV_DISABLED;
+ return;
+ }
+
+--- a/drivers/misc/mei/interrupt.c
++++ b/drivers/misc/mei/interrupt.c
+@@ -536,7 +536,6 @@ EXPORT_SYMBOL_GPL(mei_irq_write_handler)
+ *
+ * @work: pointer to the work_struct structure
+ *
+- * NOTE: This function is called by timer interrupt work
+ */
+ void mei_timer(struct work_struct *work)
+ {
+@@ -551,18 +550,24 @@ void mei_timer(struct work_struct *work)
+
+
+ mutex_lock(&dev->device_lock);
+- if (dev->dev_state != MEI_DEV_ENABLED) {
+- if (dev->dev_state == MEI_DEV_INIT_CLIENTS) {
+- if (dev->init_clients_timer) {
+- if (--dev->init_clients_timer == 0) {
+- dev_err(&dev->pdev->dev, "reset: init clients timeout hbm_state = %d.\n",
+- dev->hbm_state);
+- mei_reset(dev, 1);
+- }
++
++ /* Catch interrupt stalls during HBM init handshake */
++ if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
++ dev->hbm_state != MEI_HBM_IDLE) {
++
++ if (dev->init_clients_timer) {
++ if (--dev->init_clients_timer == 0) {
++ dev_err(&dev->pdev->dev, "timer: init clients timeout hbm_state = %d.\n",
++ dev->hbm_state);
++ mei_reset(dev, 1);
++ goto out;
+ }
+ }
+- goto out;
+ }
++
++ if (dev->dev_state != MEI_DEV_ENABLED)
++ goto out;
++
+ /*** connect/disconnect timeouts ***/
+ list_for_each_entry_safe(cl_pos, cl_next, &dev->file_list, link) {
+ if (cl_pos->timer_count) {
--- /dev/null
+From 9795229752c31da0c5f8a7dc4c827665327b52f9 Mon Sep 17 00:00:00 2001
+From: Amitkumar Karwar <akarwar@marvell.com>
+Date: Fri, 10 Jan 2014 14:30:41 -0800
+Subject: mwifiex: add missing endian conversion for fw_tsf
+
+From: Amitkumar Karwar <akarwar@marvell.com>
+
+commit 9795229752c31da0c5f8a7dc4c827665327b52f9 upstream.
+
+It is u64 data received from firmware. Little endian to cpu
+conversion is required here.
+
+Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/scan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/mwifiex/scan.c
++++ b/drivers/net/wireless/mwifiex/scan.c
+@@ -1681,7 +1681,7 @@ int mwifiex_ret_802_11_scan(struct mwifi
+ const u8 *ie_buf;
+ size_t ie_len;
+ u16 channel = 0;
+- u64 fw_tsf = 0;
++ __le64 fw_tsf = 0;
+ u16 beacon_size = 0;
+ u32 curr_bcn_bytes;
+ u32 freq;
+@@ -1815,7 +1815,7 @@ int mwifiex_ret_802_11_scan(struct mwifi
+ ie_buf, ie_len, rssi, GFP_KERNEL);
+ bss_priv = (struct mwifiex_bss_priv *)bss->priv;
+ bss_priv->band = band;
+- bss_priv->fw_tsf = fw_tsf;
++ bss_priv->fw_tsf = le64_to_cpu(fw_tsf);
+ if (priv->media_connected &&
+ !memcmp(bssid,
+ priv->curr_bss_params.bss_descriptor
--- /dev/null
+From 1e202242ee1432d68a8bea4919b2ae0ef19d9e06 Mon Sep 17 00:00:00 2001
+From: Bing Zhao <bzhao@marvell.com>
+Date: Tue, 14 Jan 2014 19:16:34 -0800
+Subject: mwifiex: fix wrong 11ac bits setting in fw_cap_info
+
+From: Bing Zhao <bzhao@marvell.com>
+
+commit 1e202242ee1432d68a8bea4919b2ae0ef19d9e06 upstream.
+
+bit 14 is actually reserved and bit 12 & 13 should be used for
+11ac capability in fw_cap_info.
+
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/fw.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/mwifiex/fw.h
++++ b/drivers/net/wireless/mwifiex/fw.h
+@@ -226,7 +226,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
+
+ /* HW_SPEC fw_cap_info */
+
+-#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14)))
++#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(12)|BIT(13)))
+
+ #define GET_VHTCAP_CHWDSET(vht_cap_info) ((vht_cap_info >> 2) & 0x3)
+ #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3)
--- /dev/null
+From d82403a9f407217b6aed5260aa92a120e8e98310 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:35 -0600
+Subject: rtlwifi: Add missing code to PWDB statics routine
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit d82403a9f407217b6aed5260aa92a120e8e98310 upstream.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/stats.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/stats.c
++++ b/drivers/net/wireless/rtlwifi/stats.c
+@@ -176,6 +176,7 @@ static void rtl_process_pwdb(struct ieee
+ struct rtl_sta_info *drv_priv = NULL;
+ struct ieee80211_sta *sta = NULL;
+ long undec_sm_pwdb;
++ long undec_sm_cck;
+
+ rcu_read_lock();
+ if (rtlpriv->mac80211.opmode != NL80211_IFTYPE_STATION)
+@@ -185,12 +186,16 @@ static void rtl_process_pwdb(struct ieee
+ if (sta) {
+ drv_priv = (struct rtl_sta_info *) sta->drv_priv;
+ undec_sm_pwdb = drv_priv->rssi_stat.undec_sm_pwdb;
++ undec_sm_cck = drv_priv->rssi_stat.undec_sm_cck;
+ } else {
+ undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb;
++ undec_sm_cck = rtlpriv->dm.undec_sm_cck;
+ }
+
+ if (undec_sm_pwdb < 0)
+ undec_sm_pwdb = pstatus->rx_pwdb_all;
++ if (undec_sm_cck < 0)
++ undec_sm_cck = pstatus->rx_pwdb_all;
+ if (pstatus->rx_pwdb_all > (u32) undec_sm_pwdb) {
+ undec_sm_pwdb = (((undec_sm_pwdb) *
+ (RX_SMOOTH_FACTOR - 1)) +
+@@ -200,6 +205,15 @@ static void rtl_process_pwdb(struct ieee
+ undec_sm_pwdb = (((undec_sm_pwdb) * (RX_SMOOTH_FACTOR - 1)) +
+ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
+ }
++ if (pstatus->rx_pwdb_all > (u32) undec_sm_cck) {
++ undec_sm_cck = (((undec_sm_pwdb) *
++ (RX_SMOOTH_FACTOR - 1)) +
++ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
++ undec_sm_cck = undec_sm_cck + 1;
++ } else {
++ undec_sm_pwdb = (((undec_sm_cck) * (RX_SMOOTH_FACTOR - 1)) +
++ (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
++ }
+
+ if (sta) {
+ drv_priv->rssi_stat.undec_sm_pwdb = undec_sm_pwdb;
--- /dev/null
+From dc6405712268fe514d3dd89aa936c4397b0871b9 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:30 -0600
+Subject: rtlwifi: Increase the RX queue length for USB drivers
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit dc6405712268fe514d3dd89aa936c4397b0871b9 upstream.
+
+The current number of RX buffers queued is 32, which is too small under
+heavy load. That number is doubled.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -557,7 +557,7 @@ static void _rtl_rx_pre_process(struct i
+ }
+ }
+
+-#define __RX_SKB_MAX_QUEUED 32
++#define __RX_SKB_MAX_QUEUED 64
+
+ static void _rtl_rx_work(unsigned long param)
+ {
--- /dev/null
+From b9a758a8c905fc59e783ae91ad645452d877ea88 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:27 -0600
+Subject: rtlwifi: Redo register save locations
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit b9a758a8c905fc59e783ae91ad645452d877ea88 upstream.
+
+The initial USB driver did not use some register save locations in the
+private data storage. To save some memory, a union was used to overlay these
+variables with USB I/O components. In an update of the gain-control code,
+these register save locations are now needed for USB drivers.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/wifi.h | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -1035,6 +1035,7 @@ struct rtl_ht_agg {
+
+ struct rssi_sta {
+ long undec_sm_pwdb;
++ long undec_sm_cck;
+ };
+
+ struct rtl_tid_data {
+@@ -1325,8 +1326,10 @@ struct fast_ant_training {
+ struct rtl_dm {
+ /*PHY status for Dynamic Management */
+ long entry_min_undec_sm_pwdb;
++ long undec_sm_cck;
+ long undec_sm_pwdb; /*out dm */
+ long entry_max_undec_sm_pwdb;
++ s32 ofdm_pkt_cnt;
+ bool dm_initialgain_enable;
+ bool dynamic_txpower_enable;
+ bool current_turbo_edca;
+@@ -1341,6 +1344,7 @@ struct rtl_dm {
+ bool inform_fw_driverctrldm;
+ bool current_mrc_switch;
+ u8 txpowercount;
++ u8 powerindex_backup[6];
+
+ u8 thermalvalue_rxgain;
+ u8 thermalvalue_iqk;
+@@ -1352,7 +1356,9 @@ struct rtl_dm {
+ bool done_txpower;
+ u8 dynamic_txhighpower_lvl; /*Tx high power level */
+ u8 dm_flag; /*Indicate each dynamic mechanism's status. */
++ u8 dm_flag_tmp;
+ u8 dm_type;
++ u8 dm_rssi_sel;
+ u8 txpower_track_control;
+ bool interrupt_migration;
+ bool disable_tx_int;
+@@ -1951,6 +1957,7 @@ struct dig_t {
+ u8 pre_ccastate;
+ u8 cur_ccasate;
+ u8 large_fa_hit;
++ u8 dig_dynamic_min;
+ u8 forbidden_igi;
+ u8 dig_state;
+ u8 dig_highpwrstate;
+@@ -2031,22 +2038,15 @@ struct rtl_priv {
+ struct dig_t dm_digtable;
+ struct ps_t dm_pstable;
+
+- /* section shared by individual drivers */
+- union {
+- struct { /* data buffer pointer for USB reads */
+- __le32 *usb_data;
+- int usb_data_index;
+- bool initialized;
+- };
+- struct { /* section for 8723ae */
+- bool reg_init; /* true if regs saved */
+- u32 reg_874;
+- u32 reg_c70;
+- u32 reg_85c;
+- u32 reg_a74;
+- bool bt_operation_on;
+- };
+- };
++ u32 reg_874;
++ u32 reg_c70;
++ u32 reg_85c;
++ u32 reg_a74;
++ bool reg_init; /* true if regs saved */
++ bool bt_operation_on;
++ __le32 *usb_data;
++ int usb_data_index;
++ bool initialized;
+ bool enter_ps; /* true when entering PS */
+ u8 rate_mask[5];
+
--- /dev/null
+From f699273d6a624266ebc9198774f06ee64a3847a1 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 25 Nov 2013 10:45:28 -0600
+Subject: rtlwifi: rtl8188ee: Fix typo in code
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit f699273d6a624266ebc9198774f06ee64a3847a1 upstream.
+
+The static analyser "cppcheck" shows the following typo:
+drivers/net/wireless/rtlwifi/rtl8188ee/dm.c:1081]: (style) Same expression on both sides of '!='.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reported-by: David Binderman <dcb314@hotmail.com>
+Cc: David Binderman <dcb314@hotmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8188ee/dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+@@ -1078,7 +1078,7 @@ static void rtl88e_dm_txpower_tracking_c
+ rtldm->swing_flag_ofdm = true;
+ }
+
+- if (rtldm->swing_idx_cck != rtldm->swing_idx_cck) {
++ if (rtldm->swing_idx_cck_cur != rtldm->swing_idx_cck) {
+ rtldm->swing_idx_cck_cur = rtldm->swing_idx_cck;
+ rtldm->swing_flag_cck = true;
+ }
--- /dev/null
+From c908c74e005de780fddbe8cb6fcd44803f5d4b74 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:29 -0600
+Subject: rtlwifi: rtl8192c: Add new definitions in the dm_common header
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit c908c74e005de780fddbe8cb6fcd44803f5d4b74 upstream.
+
+Changes in the gain-control mechanism will require some changes in the header.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+@@ -91,6 +91,17 @@
+ #define TX_POWER_NEAR_FIELD_THRESH_LVL2 74
+ #define TX_POWER_NEAR_FIELD_THRESH_LVL1 67
+
++#define DYNAMIC_FUNC_DISABLE 0x0
++#define DYNAMIC_FUNC_DIG BIT(0)
++#define DYNAMIC_FUNC_HP BIT(1)
++#define DYNAMIC_FUNC_SS BIT(2) /*Tx Power Tracking*/
++#define DYNAMIC_FUNC_BT BIT(3)
++#define DYNAMIC_FUNC_ANT_DIV BIT(4)
++
++#define RSSI_CCK 0
++#define RSSI_OFDM 1
++#define RSSI_DEFAULT 2
++
+ struct swat_t {
+ u8 failure_cnt;
+ u8 try_flag;
+@@ -167,5 +178,8 @@ void rtl92c_phy_lc_calibrate(struct ieee
+ void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery);
+ void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw);
+ void rtl92c_dm_bt_coexist(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
+
+ #endif
--- /dev/null
+From 97204e93f01868eeba6ae5c4f3270f32905bb418 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:32 -0600
+Subject: rtlwifi: rtl8192c: Add routines to save/restore power index registers
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 97204e93f01868eeba6ae5c4f3270f32905bb418 upstream.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c | 36 ++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+@@ -158,6 +158,42 @@ static const u8 cckswing_table_ch14[CCK_
+ {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}
+ };
+
++static u32 power_index_reg[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
++
++void dm_restorepowerindex(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u8 index;
++
++ for (index = 0; index < 6; index++)
++ rtl_write_byte(rtlpriv, power_index_reg[index],
++ rtlpriv->dm.powerindex_backup[index]);
++}
++EXPORT_SYMBOL_GPL(dm_restorepowerindex);
++
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u8 index;
++
++ for (index = 0; index < 6; index++)
++ rtl_write_byte(rtlpriv, power_index_reg[index], value);
++}
++EXPORT_SYMBOL_GPL(dm_writepowerindex);
++
++void dm_savepowerindex(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u8 index;
++ u8 tmp;
++
++ for (index = 0; index < 6; index++) {
++ tmp = rtl_read_byte(rtlpriv, power_index_reg[index]);
++ rtlpriv->dm.powerindex_backup[index] = tmp;
++ }
++}
++EXPORT_SYMBOL_GPL(dm_savepowerindex);
++
+ static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
--- /dev/null
+From 8fd77aec1a9d6f4328fc0244f21932114e066df3 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:25 -0600
+Subject: rtlwifi: rtl8192c: Prevent reconnect attempts if not connected
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 8fd77aec1a9d6f4328fc0244f21932114e066df3 upstream.
+
+This driver has a watchdog timer that attempts to reconnect when beacon frames
+are not seen for 6 seconds. This patch disables that reconnect whenever the
+device has never been connected.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/base.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -1437,7 +1437,8 @@ void rtl_watchdog_wq_callback(void *data
+ /* if we can't recv beacon for 6s, we should
+ * reconnect this AP
+ */
+- if (rtlpriv->link_info.roam_times >= 3) {
++ if ((rtlpriv->link_info.roam_times >= 3) &&
++ !is_zero_ether_addr(rtlpriv->mac80211.bssid)) {
+ RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ "AP off, try to reconnect now\n");
+ rtlpriv->link_info.roam_times = 0;
--- /dev/null
+From f87f960b2fb802f26ee3b00c19320e57a9c583ff Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Thu, 9 Jan 2014 10:27:27 -0600
+Subject: rtlwifi: rtl8192cu: Add new device ID
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit f87f960b2fb802f26ee3b00c19320e57a9c583ff upstream.
+
+Reported-by: Jan Prinsloo <janroot@gmail.com>
+Tested-by: Jan Prinsloo <janroot@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -306,6 +306,7 @@ static struct usb_device_id rtl8192c_usb
+ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+ /* HP - Lite-On ,8188CUS Slim Combo */
--- /dev/null
+From 62009b7f12793c932aaba0df946b04cb4a77d022 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:26 -0600
+Subject: rtlwifi: rtl8192cu: Add new firmware
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 62009b7f12793c932aaba0df946b04cb4a77d022 upstream.
+
+Vendor driver rtl8188C_8192C_8192D_usb_linux_v3.4.2_3727.20120404 introduced
+new firmware for these chips. The code try for the new file, and fall back to
+the original firmware if the new file is not available.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/core.c | 10 ++++++++++
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 16 +++++++++++++---
+ drivers/net/wireless/rtlwifi/wifi.h | 1 +
+ 3 files changed, 24 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/core.c
++++ b/drivers/net/wireless/rtlwifi/core.c
+@@ -46,10 +46,20 @@ void rtl_fw_cb(const struct firmware *fi
+ "Firmware callback routine entered!\n");
+ complete(&rtlpriv->firmware_loading_complete);
+ if (!firmware) {
++ if (rtlpriv->cfg->alt_fw_name) {
++ err = request_firmware(&firmware,
++ rtlpriv->cfg->alt_fw_name,
++ rtlpriv->io.dev);
++ pr_info("Loading alternative firmware %s\n",
++ rtlpriv->cfg->alt_fw_name);
++ if (!err)
++ goto found_alt;
++ }
+ pr_err("Firmware %s not available\n", rtlpriv->cfg->fw_name);
+ rtlpriv->max_fw_size = 0;
+ return;
+ }
++found_alt:
+ if (firmware->size > rtlpriv->max_fw_size) {
+ RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ "Firmware is too big!\n");
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -49,6 +49,9 @@ MODULE_AUTHOR("Larry Finger <Larry.Finge
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek 8192C/8188C 802.11n USB wireless");
+ MODULE_FIRMWARE("rtlwifi/rtl8192cufw.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_A.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_B.bin");
++MODULE_FIRMWARE("rtlwifi/rtl8192cufw_TMSC.bin");
+
+ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
+ {
+@@ -68,14 +71,21 @@ static int rtl92cu_init_sw_vars(struct i
+ "Can't alloc buffer for fw\n");
+ return 1;
+ }
+-
++ if (IS_VENDOR_UMC_A_CUT(rtlpriv->rtlhal.version) &&
++ !IS_92C_SERIAL(rtlpriv->rtlhal.version)) {
++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_A.bin";
++ } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlpriv->rtlhal.version)) {
++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_B.bin";
++ } else {
++ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_TMSC.bin";
++ }
++ /* provide name of alternative file */
++ rtlpriv->cfg->alt_fw_name = "rtlwifi/rtl8192cufw.bin";
+ pr_info("Loading firmware %s\n", rtlpriv->cfg->fw_name);
+ rtlpriv->max_fw_size = 0x4000;
+ err = request_firmware_nowait(THIS_MODULE, 1,
+ rtlpriv->cfg->fw_name, rtlpriv->io.dev,
+ GFP_KERNEL, hw, rtl_fw_cb);
+-
+-
+ return err;
+ }
+
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -1806,6 +1806,7 @@ struct rtl_hal_cfg {
+ bool write_readback;
+ char *name;
+ char *fw_name;
++ char *alt_fw_name;
+ struct rtl_hal_ops *ops;
+ struct rtl_mod_params *mod_params;
+ struct rtl_hal_usbint_cfg *usb_interface_cfg;
--- /dev/null
+From e9b0784bb9de3152e787ee779868c626b137fb3b Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:34 -0600
+Subject: rtlwifi: rtl8192cu: Fix some code in RF handling
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit e9b0784bb9de3152e787ee779868c626b137fb3b upstream.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/rf.c | 29 +++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower(
+ if (mac->act_scanning) {
+ tx_agc[RF90_PATH_A] = 0x3f3f3f3f;
+ tx_agc[RF90_PATH_B] = 0x3f3f3f3f;
+- if (turbo_scanoff) {
+- for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+- tx_agc[idx1] = ppowerlevel[idx1] |
+- (ppowerlevel[idx1] << 8) |
+- (ppowerlevel[idx1] << 16) |
+- (ppowerlevel[idx1] << 24);
+- if (rtlhal->interface == INTF_USB) {
+- if (tx_agc[idx1] > 0x20 &&
+- rtlefuse->external_pa)
+- tx_agc[idx1] = 0x20;
+- }
++ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
++ tx_agc[idx1] = ppowerlevel[idx1] |
++ (ppowerlevel[idx1] << 8) |
++ (ppowerlevel[idx1] << 16) |
++ (ppowerlevel[idx1] << 24);
++ if (rtlhal->interface == INTF_USB) {
++ if (tx_agc[idx1] > 0x20 &&
++ rtlefuse->external_pa)
++ tx_agc[idx1] = 0x20;
+ }
+ }
+ } else {
+@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(
+ TXHIGHPWRLEVEL_LEVEL2) {
+ tx_agc[RF90_PATH_A] = 0x00000000;
+ tx_agc[RF90_PATH_B] = 0x00000000;
+- } else{
++ } else {
+ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+ tx_agc[idx1] = ppowerlevel[idx1] |
+ (ppowerlevel[idx1] << 8) |
+@@ -373,7 +371,12 @@ static void _rtl92c_write_ofdm_power_reg
+ regoffset == RTXAGC_B_MCS07_MCS04)
+ regoffset = 0xc98;
+ for (i = 0; i < 3; i++) {
+- writeVal = (writeVal > 6) ? (writeVal - 6) : 0;
++ if (i != 2)
++ writeVal = (writeVal > 8) ?
++ (writeVal - 8) : 0;
++ else
++ writeVal = (writeVal > 6) ?
++ (writeVal - 6) : 0;
+ rtl_write_byte(rtlpriv, (u32)(regoffset + i),
+ (u8)writeVal);
+ }
--- /dev/null
+From 9806eacf5de27ab01d680c5d75c92a3a89734e4f Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:33 -0600
+Subject: rtlwifi: rtl8192cu: Update the power index registers
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 9806eacf5de27ab01d680c5d75c92a3a89734e4f upstream.
+
+This patch uses the newly introduced power index register routines.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/dm.c | 9 +++++++++
+ drivers/net/wireless/rtlwifi/rtl8192cu/dm.h | 3 +++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
+@@ -101,6 +101,15 @@ void rtl92cu_dm_dynamic_txpower(struct i
+ "PHY_SetTxPowerLevel8192S() Channel = %d\n",
+ rtlphy->current_channel);
+ rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel);
++ if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++ TXHIGHPWRLEVEL_NORMAL)
++ dm_restorepowerindex(hw);
++ else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++ TXHIGHPWRLEVEL_LEVEL1)
++ dm_writepowerindex(hw, 0x14);
++ else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++ TXHIGHPWRLEVEL_LEVEL2)
++ dm_writepowerindex(hw, 0x10);
+ }
+
+ rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl;
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
+@@ -30,3 +30,6 @@
+ #include "../rtl8192ce/dm.h"
+
+ void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
--- /dev/null
+From 619ce76f8bb850b57032501a39f26aa6c6731c70 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:28 -0600
+Subject: rtlwifi: Set the link state
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 619ce76f8bb850b57032501a39f26aa6c6731c70 upstream.
+
+The present code fails to set the linked state when an interface is
+added.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/core.c
++++ b/drivers/net/wireless/rtlwifi/core.c
+@@ -194,6 +194,7 @@ static int rtl_op_add_interface(struct i
+ rtlpriv->cfg->maps
+ [RTL_IBSS_INT_MASKS]);
+ }
++ mac->link_state = MAC80211_LINKED;
+ break;
+ case NL80211_IFTYPE_ADHOC:
+ RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
--- /dev/null
+From 65b9cc97c6852fae19dc5c7745e9abc8dd380aad Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:31 -0600
+Subject: rtlwifi: Update beacon statistics for USB driver
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 65b9cc97c6852fae19dc5c7745e9abc8dd380aad upstream.
+
+The USB drivers were not updating the beacon statistics, which led to
+false beacon loss indications.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -484,6 +484,8 @@ static void _rtl_usb_rx_process_agg(stru
+ if (unicast)
+ rtlpriv->link_info.num_rx_inperiod++;
+ }
++ /* static bcn for roaming */
++ rtl_beacon_statistic(hw, skb);
+ }
+ }
+
--- /dev/null
+From 4e078146dff728f4865270a47710d57797e81eb6 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Tue, 21 Jan 2014 17:31:10 +0100
+Subject: s390/uapi: fix struct statfs64 definition
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 4e078146dff728f4865270a47710d57797e81eb6 upstream.
+
+With b8668fd0a7e1b59f "s390/uapi: change struct statfs[64] member types
+to unsigned values" the size of a couple of struct statfs64 member got
+incorrectly changed from 64 to 32 bit for 32 bit builds.
+
+Fix this by changing the type of couple of struct statfs64 members from
+unsigned long to unsigned long long.
+The definition of struct compat_statfs64 was correct however.
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/include/uapi/asm/statfs.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/s390/include/uapi/asm/statfs.h
++++ b/arch/s390/include/uapi/asm/statfs.h
+@@ -35,11 +35,11 @@ struct statfs {
+ struct statfs64 {
+ unsigned int f_type;
+ unsigned int f_bsize;
+- unsigned long f_blocks;
+- unsigned long f_bfree;
+- unsigned long f_bavail;
+- unsigned long f_files;
+- unsigned long f_ffree;
++ unsigned long long f_blocks;
++ unsigned long long f_bfree;
++ unsigned long long f_bavail;
++ unsigned long long f_files;
++ unsigned long long f_ffree;
+ __kernel_fsid_t f_fsid;
+ unsigned int f_namelen;
+ unsigned int f_frsize;
--- /dev/null
+From 3685f19e07802ec4207b52465c408f185b66490e Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Tue, 7 Jan 2014 15:00:12 -0700
+Subject: serial: 8250: enable UART_BUG_NOMSR for Tegra
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit 3685f19e07802ec4207b52465c408f185b66490e upstream.
+
+Tegra chips have 4 or 5 identical UART modules embedded. UARTs C..E have
+their MODEM-control signals tied off to a static state. However UARTs A
+and B can optionally route those signals to/from package pins, depending
+on the exact pinmux configuration.
+
+When these signals are not routed to package pins, false interrupts may
+trigger either temporarily, or permanently, all while not showing up in
+the IIR; it will read as NO_INT. This will eventually lead to the UART
+IRQ being disabled due to unhandled interrupts. When this happens, the
+kernel may print e.g.:
+
+ irq 68: nobody cared (try booting with the "irqpoll" option)
+
+In order to prevent this, enable UART_BUG_NOMSR. This prevents
+UART_IER_MSI from being enabled, which prevents the false interrupts
+from triggering.
+
+In practice, this is not needed under any of the following conditions:
+
+* On Tegra chips after Tegra30, since the HW bug has apparently been
+ fixed.
+
+* On UARTs C..E since their MODEM control signals are tied to the correct
+ static state which doesn't trigger the issue.
+
+* On UARTs A..B if the MODEM control signals are routed out to package
+ pins, since they will then carry valid signals.
+
+However, we ignore these exceptions for now, since they are only relevant
+if a board actually hooks up more than a 4-wire UART, and no currently
+supported board does this. If we ever support a board that does, we can
+refine the algorithm that enables UART_BUG_NOMSR to take those exceptions
+into account, and/or read a flag from DT/... that indicates that the
+board has hooked up and pinmux'd more than a 4-wire UART.
+
+Reported-by: Olof Johansson <olof@lixom.net> # autotester
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -2670,6 +2670,10 @@ static void serial8250_config_port(struc
+ if (port->type == PORT_16550A && port->iotype == UPIO_AU)
+ up->bugs |= UART_BUG_NOMSR;
+
++ /* HW bugs may trigger IRQ while IIR == NO_INT */
++ if (port->type == PORT_TEGRA)
++ up->bugs |= UART_BUG_NOMSR;
++
+ if (port->type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ)
+ autoconfig_irq(up);
+
--- /dev/null
+From 9c5320f8d7d9a2cf623e65d50e1113f34d9b9eb1 Mon Sep 17 00:00:00 2001
+From: Jonathan Woithe <jwoithe@just42.net>
+Date: Mon, 9 Dec 2013 16:33:08 +1030
+Subject: serial: 8250: Fix initialisation of Quatech cards with the AMCC PCI chip
+
+From: Jonathan Woithe <jwoithe@just42.net>
+
+commit 9c5320f8d7d9a2cf623e65d50e1113f34d9b9eb1 upstream.
+
+Fix the initialisation of older Quatech serial cards which are fitted with
+the AMCC PCI Matchmaker interface chip.
+
+Signed-off-by: Jonathan Woithe (jwoithe@just42.net)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1260,10 +1260,10 @@ static int pci_quatech_init(struct pci_d
+ unsigned long base = pci_resource_start(dev, 0);
+ if (base) {
+ u32 tmp;
+- outl(inl(base + 0x38), base + 0x38);
++ outl(inl(base + 0x38) | 0x00002000, base + 0x38);
+ tmp = inl(base + 0x3c);
+ outl(tmp | 0x01000000, base + 0x3c);
+- outl(tmp, base + 0x3c);
++ outl(tmp &= ~0x01000000, base + 0x3c);
+ }
+ }
+ return 0;
--- /dev/null
+From 48c0247d7b7bf58abb85a39021099529df365c4d Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegorslists@googlemail.com>
+Date: Mon, 9 Dec 2013 12:11:15 +0100
+Subject: serial: add support for 200 v3 series Titan card
+
+From: Yegor Yefremov <yegorslists@googlemail.com>
+
+commit 48c0247d7b7bf58abb85a39021099529df365c4d upstream.
+
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1545,6 +1545,7 @@ pci_wch_ch353_setup(struct serial_privat
+ #define PCI_DEVICE_ID_TITAN_800E 0xA014
+ #define PCI_DEVICE_ID_TITAN_200EI 0xA016
+ #define PCI_DEVICE_ID_TITAN_200EISI 0xA017
++#define PCI_DEVICE_ID_TITAN_200V3 0xA306
+ #define PCI_DEVICE_ID_TITAN_400V3 0xA310
+ #define PCI_DEVICE_ID_TITAN_410V3 0xA312
+ #define PCI_DEVICE_ID_TITAN_800V3 0xA314
+@@ -4140,6 +4141,9 @@ static struct pci_device_id serial_pci_t
+ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_oxsemi_2_4000000 },
++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3,
++ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++ pbn_b0_bt_2_921600 },
+ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_b0_4_921600 },
e752x_edac-fix-pci_dev-usage-count.patch
e1000e-fix-compiler-warnings.patch
mm-mempolicy.c-fix-mempolicy-printing-in-numa_maps.patch
+x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch
+x86-efi-fix-off-by-one-bug-in-efi-boot-services-reservation.patch
+x86-add-check-for-number-of-available-vectors-before-cpu-down.patch
+kvm-x86-limit-pit-timer-frequency.patch
+x86-kvm-cache-the-base-of-the-kvm-cpuid-leaves.patch
+x86-kvm-correctly-access-the-kvm_cpuid_features-leaf-at-0x40000101.patch
+usb-chipidea-add-freescale-imx28-special-write-register-method.patch
+usb-chipidea-imx-set-ci_hdrc_imx28_write_fix-for-imx28.patch
+usb-chipidea-need-to-mask-int_status-when-write-otgsc.patch
+usb-chipidea-udc-using-multo-at-td-as-real-mult-value-for-iso-tx.patch
+usb-dwc3-fix-the-glue-drivers-using-the-nop-phy.patch
+usb-pl2303-fix-data-corruption-on-termios-updates.patch
+usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch
+usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch
+usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch
+usb-ftdi_sio-added-cs5-quirk-for-broken-smartcard-readers.patch
+usb-nokia-502-is-an-unusual-device.patch
+usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch
+usb-fix-race-between-hub_disconnect-and-recursively_mark_notattached.patch
+usb-ehci-add-freescale-imx28-special-write-register-method.patch
+rtlwifi-rtl8192cu-add-new-device-id.patch
+rtlwifi-update-beacon-statistics-for-usb-driver.patch
+rtlwifi-rtl8192c-prevent-reconnect-attempts-if-not-connected.patch
+rtlwifi-rtl8192cu-add-new-firmware.patch
+rtlwifi-redo-register-save-locations.patch
+rtlwifi-set-the-link-state.patch
+rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch
+rtlwifi-increase-the-rx-queue-length-for-usb-drivers.patch
+rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch
+rtlwifi-rtl8192cu-update-the-power-index-registers.patch
+rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch
+rtlwifi-add-missing-code-to-pwdb-statics-routine.patch
+rtlwifi-rtl8188ee-fix-typo-in-code.patch
+mwifiex-add-missing-endian-conversion-for-fw_tsf.patch
+mwifiex-fix-wrong-11ac-bits-setting-in-fw_cap_info.patch
+iwlwifi-pcie-enable-oscillator-for-l1-exit.patch
+iwlwifi-mvm-fix-missing-cleanup-in-.start-error-path.patch
+b43-fix-lockdep-splat.patch
+b43-fix-unload-oops-if-firmware-is-not-available.patch
+b43legacy-fix-unload-oops-if-firmware-is-not-available.patch
+b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch
+ath9k-use-correct-channel-for-rx-packets.patch
+ath9k-disable-cross-band-fcc.patch
+staging-lustre-ptlrpc-fix-a-crash-when-dereferencing-null.patch
+staging-r8712u-set-device-type-to-wlan.patch
+staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch
+staging-vt6656-cardqgetnexttbtt-correct-ulownexttbtt.patch
+mei-use-hbm-idle-state-to-prevent-spurious-resets.patch
+tty-serial-at91-handle-shutdown-more-safely.patch
+tty-serial-at91-fix-race-condition-in-atmel_serial_remove.patch
+tty-serial-at91-reset-rx_ring-when-port-is-shutdown.patch
+tty-serial-at91-disable-uart-timer-at-start-of-shutdown.patch
+arm-at91-at91sam9g45-set-default-mmc-pinctrl-names.patch
+arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch
+hwmon-k10temp-add-support-for-kaveri-cpus.patch
+xhci-avoid-infinite-loop-when-sg-urb-requires-too-many-trbs.patch
+xhci-set-scatter-gather-limit-to-avoid-failed-block-writes.patch
+serial-add-support-for-200-v3-series-titan-card.patch
+serial-8250-fix-initialisation-of-quatech-cards-with-the-amcc-pci-chip.patch
+serial-8250-enable-uart_bug_nomsr-for-tegra.patch
+kvm-s390-fix-diagnose-code-extraction.patch
+kvm-s390-ioeventfd-ignore-leftmost-bits.patch
+s390-uapi-fix-struct-statfs64-definition.patch
--- /dev/null
+From 3c92a0bf4d72737035a16c4fe357ccd439c9b7d2 Mon Sep 17 00:00:00 2001
+From: Amir Shehata <amir.shehata@intel.com>
+Date: Tue, 3 Dec 2013 21:58:47 +0800
+Subject: staging/lustre/ptlrpc: Fix a crash when dereferencing NULL
+ pointer
+
+From: Amir Shehata <amir.shehata@intel.com>
+
+commit 3c92a0bf4d72737035a16c4fe357ccd439c9b7d2 upstream.
+
+When a system runs out of memory and the function
+ptlrpc_register_bulk() is called from ptl_send_rpc() the call to
+LNetMEAttach() fails due to failure to allocate memory. This forces
+the code into an error path, which most probably previously went
+untested. The error path:
+if (rc != 0) {
+ CERROR("%s: LNetMEAttach failed x"LPU64"/%d: rc = %dn",
+ desc->bd_export->exp_obd->obd_name, xid,
+ posted_md, rc);
+ break;
+}
+This print assumes that desc->bd_export is not NULL. However, it is.
+In fact it is expected to be NULL. desc->bd_import is the correct
+structure to access in this case.
+
+Lustre-change: http://review.whamcloud.com/7121
+Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3585
+Signed-off-by: Amir Shehata <amir.shehata@intel.com>
+Reviewed-by: Liang Zhen <liang.zhen@intel.com>
+Reviewed-by: Doug Oucharek <doug.s.oucharek@intel.com>
+Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
+Signed-off-by: Peng Tao <bergwolf@gmail.com>
+Signed-off-by: Andreas Dilger <andreas.dilger@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/lustre/lustre/ptlrpc/niobuf.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/lustre/lustre/ptlrpc/niobuf.c
++++ b/drivers/staging/lustre/lustre/ptlrpc/niobuf.c
+@@ -179,7 +179,7 @@ int ptlrpc_register_bulk(struct ptlrpc_r
+ LNET_UNLINK, LNET_INS_AFTER, &me_h);
+ if (rc != 0) {
+ CERROR("%s: LNetMEAttach failed x"LPU64"/%d: rc = %d\n",
+- desc->bd_export->exp_obd->obd_name, xid,
++ desc->bd_import->imp_obd->obd_name, xid,
+ posted_md, rc);
+ break;
+ }
+@@ -189,7 +189,7 @@ int ptlrpc_register_bulk(struct ptlrpc_r
+ &desc->bd_mds[posted_md]);
+ if (rc != 0) {
+ CERROR("%s: LNetMDAttach failed x"LPU64"/%d: rc = %d\n",
+- desc->bd_export->exp_obd->obd_name, xid,
++ desc->bd_import->imp_obd->obd_name, xid,
+ posted_md, rc);
+ rc2 = LNetMEUnlink(me_h);
+ LASSERT(rc2 == 0);
+@@ -219,7 +219,7 @@ int ptlrpc_register_bulk(struct ptlrpc_r
+ /* Holler if peer manages to touch buffers before he knows the xid */
+ if (desc->bd_md_count != total_md)
+ CWARN("%s: Peer %s touched %d buffers while I registered\n",
+- desc->bd_export->exp_obd->obd_name, libcfs_id2str(peer),
++ desc->bd_import->imp_obd->obd_name, libcfs_id2str(peer),
+ total_md - desc->bd_md_count);
+ spin_unlock(&desc->bd_lock);
+
--- /dev/null
+From 3a21f00a5002b14e4aab52aef59d33ed28468a13 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 24 Dec 2013 11:22:54 -0600
+Subject: staging: r8712u: Set device type to wlan
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 3a21f00a5002b14e4aab52aef59d33ed28468a13 upstream.
+
+The latest version of NetworkManager does not recognize the device as wireless
+without this change.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/usb_intf.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -358,6 +358,10 @@ static u8 key_2char2num(u8 hch, u8 lch)
+ return (hex_to_bin(hch) << 4) | hex_to_bin(lch);
+ }
+
++static const struct device_type wlan_type = {
++ .name = "wlan",
++};
++
+ /*
+ * drv_init() - a device potentially for us
+ *
+@@ -393,6 +397,7 @@ static int r871xu_drv_init(struct usb_in
+ padapter->pusb_intf = pusb_intf;
+ usb_set_intfdata(pusb_intf, pnetdev);
+ SET_NETDEV_DEV(pnetdev, &pusb_intf->dev);
++ pnetdev->dev.type = &wlan_type;
+ /* step 2. */
+ padapter->dvobj_init = &r8712_usb_dvobj_init;
+ padapter->dvobj_deinit = &r8712_usb_dvobj_deinit;
--- /dev/null
+From 8f248dae133668bfb8e9379b4b3f0571c858b24a Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 8 Dec 2013 09:11:30 +0000
+Subject: staging: vt6656: [BUG] BBvUpdatePreEDThreshold Always set sensitivity on bScanning
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 8f248dae133668bfb8e9379b4b3f0571c858b24a upstream.
+
+byBBPreEDIndex value is initially 0, this means that from
+cold BBvUpdatePreEDThreshold is never set.
+
+This means that sensitivity may be in an ambiguous state,
+failing to scan any wireless points or at least distant ones.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/baseband.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/staging/vt6656/baseband.c
++++ b/drivers/staging/vt6656/baseband.c
+@@ -1464,7 +1464,6 @@ void BBvUpdatePreEDThreshold(struct vnt_
+
+ if( bScanning )
+ { // need Max sensitivity //RSSI -69, -70,....
+- if(pDevice->byBBPreEDIndex == 0) break;
+ pDevice->byBBPreEDIndex = 0;
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE)
+@@ -1607,7 +1606,6 @@ void BBvUpdatePreEDThreshold(struct vnt_
+
+ if( bScanning )
+ { // need Max sensitivity //RSSI -69, -70, ...
+- if(pDevice->byBBPreEDIndex == 0) break;
+ pDevice->byBBPreEDIndex = 0;
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE)
+@@ -1759,7 +1757,6 @@ void BBvUpdatePreEDThreshold(struct vnt_
+ case RF_VT3342A0: //RobertYu:20060627, testing table
+ if( bScanning )
+ { // need Max sensitivity //RSSI -67, -68, ...
+- if(pDevice->byBBPreEDIndex == 0) break;
+ pDevice->byBBPreEDIndex = 0;
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE)
--- /dev/null
+From 9acec059c0cef0bf086c738f4c0b1f4447782a48 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Wed, 1 Jan 2014 19:19:28 +0000
+Subject: staging: vt6656: CARDqGetNextTBTT correct uLowNextTBTT
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 9acec059c0cef0bf086c738f4c0b1f4447782a48 upstream.
+
+value uLowNextTBTT yields wrong value.
+
+ULL is needed with qwTSF
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vt6656/card.c
++++ b/drivers/staging/vt6656/card.c
+@@ -731,7 +731,7 @@ u64 CARDqGetNextTBTT(u64 qwTSF, u16 wBea
+
+ uBeaconInterval = wBeaconInterval * 1024;
+ // Next TBTT = ((local_current_TSF / beacon_interval) + 1 ) * beacon_interval
+- uLowNextTBTT = ((qwTSF & 0xffffffffU) >> 10) << 10;
++ uLowNextTBTT = ((qwTSF & 0xffffffffULL) >> 10) << 10;
+ uLowRemain = (uLowNextTBTT) % uBeaconInterval;
+ uHighRemain = ((0x80000000 % uBeaconInterval) * 2 * (u32)(qwTSF >> 32))
+ % uBeaconInterval;
--- /dev/null
+From 8bc661bfc0c2d221e209f4205bdaaf574d50100c Mon Sep 17 00:00:00 2001
+From: Marek Roszko <mark.roszko@gmail.com>
+Date: Fri, 10 Jan 2014 10:33:11 +0100
+Subject: tty/serial: at91: disable uart timer at start of shutdown
+
+From: Marek Roszko <mark.roszko@gmail.com>
+
+commit 8bc661bfc0c2d221e209f4205bdaaf574d50100c upstream.
+
+The uart timer will schedule a tasklet when it fires. It is possible that it
+can fire inside _shutdown before it is killed in the dma and pdc cleanup
+routines. This causes a tasklet that exists after the port is shutdown, so when
+the kernel finally executes it, it panics as the tty port is NULL.
+
+This is a somewhat rare condition but its possible if a program keeps on
+opening/closing the port. It has been observed in particular with systemd
+boot messages that were causing a kernel panic because of this behavior.
+
+Moving the timer deletion to the beginning of the function stops a tasklet from
+being scheduled unexpectedly.
+
+Signed-off-by: Marek Roszko <mark.roszko@gmail.com>
+[nicolas.ferre@atmel.com: modify commit message, call setup_timer() in any case]
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -824,9 +824,6 @@ static void atmel_release_rx_dma(struct
+ atmel_port->desc_rx = NULL;
+ atmel_port->chan_rx = NULL;
+ atmel_port->cookie_rx = -EINVAL;
+-
+- if (!atmel_port->is_usart)
+- del_timer_sync(&atmel_port->uart_timer);
+ }
+
+ static void atmel_rx_from_dma(struct uart_port *port)
+@@ -1228,9 +1225,6 @@ static void atmel_release_rx_pdc(struct
+ DMA_FROM_DEVICE);
+ kfree(pdc->buf);
+ }
+-
+- if (!atmel_port->is_usart)
+- del_timer_sync(&atmel_port->uart_timer);
+ }
+
+ static void atmel_rx_from_pdc(struct uart_port *port)
+@@ -1587,12 +1581,13 @@ static int atmel_startup(struct uart_por
+ /* enable xmit & rcvr */
+ UART_PUT_CR(port, ATMEL_US_TXEN | ATMEL_US_RXEN);
+
++ setup_timer(&atmel_port->uart_timer,
++ atmel_uart_timer_callback,
++ (unsigned long)port);
++
+ if (atmel_use_pdc_rx(port)) {
+ /* set UART timeout */
+ if (!atmel_port->is_usart) {
+- setup_timer(&atmel_port->uart_timer,
+- atmel_uart_timer_callback,
+- (unsigned long)port);
+ mod_timer(&atmel_port->uart_timer,
+ jiffies + uart_poll_timeout(port));
+ /* set USART timeout */
+@@ -1607,9 +1602,6 @@ static int atmel_startup(struct uart_por
+ } else if (atmel_use_dma_rx(port)) {
+ /* set UART timeout */
+ if (!atmel_port->is_usart) {
+- setup_timer(&atmel_port->uart_timer,
+- atmel_uart_timer_callback,
+- (unsigned long)port);
+ mod_timer(&atmel_port->uart_timer,
+ jiffies + uart_poll_timeout(port));
+ /* set USART timeout */
+@@ -1635,6 +1627,12 @@ static void atmel_shutdown(struct uart_p
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+
+ /*
++ * Prevent any tasklets being scheduled during
++ * cleanup
++ */
++ del_timer_sync(&atmel_port->uart_timer);
++
++ /*
+ * Clear out any scheduled tasklets before
+ * we destroy the buffers
+ */
--- /dev/null
+From f50c995f9ebf064cea1368bf361c4e29679415b4 Mon Sep 17 00:00:00 2001
+From: Marek Roszko <mark.roszko@gmail.com>
+Date: Tue, 7 Jan 2014 11:45:07 +0100
+Subject: tty/serial: at91: fix race condition in atmel_serial_remove
+
+From: Marek Roszko <mark.roszko@gmail.com>
+
+commit f50c995f9ebf064cea1368bf361c4e29679415b4 upstream.
+
+The _remove callback could be called when a tasklet is scheduled. tasklet_kill
+was called inside the function in order to free up any scheduled tasklets.
+However it was called after uart_remove_one_port which destroys tty references
+needed in the port for atmel_tasklet_func.
+Simply putting the tasklet_kill at the start of the function will prevent this
+conflict.
+
+Signed-off-by: Marek Roszko <mark.roszko@gmail.com>
+Acked-by: Leilei Zhao <leilei.zhao@atmel.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -2430,11 +2430,12 @@ static int atmel_serial_remove(struct pl
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+ int ret = 0;
+
++ tasklet_kill(&atmel_port->tasklet);
++
+ device_init_wakeup(&pdev->dev, 0);
+
+ ret = uart_remove_one_port(&atmel_uart, port);
+
+- tasklet_kill(&atmel_port->tasklet);
+ kfree(atmel_port->rx_ring.buf);
+
+ /* "port" is allocated statically, so we shouldn't free it */
--- /dev/null
+From 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 Mon Sep 17 00:00:00 2001
+From: Marek Roszko <mark.roszko@gmail.com>
+Date: Tue, 7 Jan 2014 11:45:06 +0100
+Subject: tty/serial: at91: Handle shutdown more safely
+
+From: Marek Roszko <mark.roszko@gmail.com>
+
+commit 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 upstream.
+
+Interrupts were being cleaned up late in the shutdown handler, it is possible
+that an interrupt can occur and schedule a tasklet that runs after the port is
+cleaned up. There is a null dereference due to this race condition with the
+following stacktrace:
+
+[<c02092b0>] (atmel_tasklet_func+0x514/0x814) from [<c001fd34>] (tasklet_action+0x70/0xa8)
+[<c001fd34>] (tasklet_action+0x70/0xa8) from [<c001f60c>] (__do_softirq+0x90/0x144)
+[<c001f60c>] (__do_softirq+0x90/0x144) from [<c001fa18>] (irq_exit+0x40/0x4c)
+[<c001fa18>] (irq_exit+0x40/0x4c) from [<c000e298>] (handle_IRQ+0x64/0x84)
+[<c000e298>] (handle_IRQ+0x64/0x84) from [<c000d6c0>] (__irq_svc+0x40/0x50)
+[<c000d6c0>] (__irq_svc+0x40/0x50) from [<c0208060>] (atmel_rx_dma_release+0x88/0xb8)
+[<c0208060>] (atmel_rx_dma_release+0x88/0xb8) from [<c0209740>] (atmel_shutdown+0x104/0x160)
+[<c0209740>] (atmel_shutdown+0x104/0x160) from [<c0205e8c>] (uart_port_shutdown+0x2c/0x38)
+
+Signed-off-by: Marek Roszko <mark.roszko@gmail.com>
+Acked-by: Leilei Zhao <leilei.zhao@atmel.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1633,12 +1633,24 @@ static int atmel_startup(struct uart_por
+ static void atmel_shutdown(struct uart_port *port)
+ {
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
++
++ /*
++ * Clear out any scheduled tasklets before
++ * we destroy the buffers
++ */
++ tasklet_kill(&atmel_port->tasklet);
++
+ /*
+- * Ensure everything is stopped.
++ * Ensure everything is stopped and
++ * disable all interrupts, port and break condition.
+ */
+ atmel_stop_rx(port);
+ atmel_stop_tx(port);
+
++ UART_PUT_CR(port, ATMEL_US_RSTSTA);
++ UART_PUT_IDR(port, -1);
++
++
+ /*
+ * Shut-down the DMA.
+ */
+@@ -1648,12 +1660,6 @@ static void atmel_shutdown(struct uart_p
+ atmel_port->release_tx(port);
+
+ /*
+- * Disable all interrupts, port and break condition.
+- */
+- UART_PUT_CR(port, ATMEL_US_RSTSTA);
+- UART_PUT_IDR(port, -1);
+-
+- /*
+ * Free the interrupt
+ */
+ free_irq(port->irq, port);
--- /dev/null
+From bb7e73c598fb226c75f7625088a8f6a45a0fc892 Mon Sep 17 00:00:00 2001
+From: Mark Deneen <mdeneen@gmail.com>
+Date: Tue, 7 Jan 2014 11:45:09 +0100
+Subject: tty/serial: at91: reset rx_ring when port is shutdown
+
+From: Mark Deneen <mdeneen@gmail.com>
+
+commit bb7e73c598fb226c75f7625088a8f6a45a0fc892 upstream.
+
+When using RX DMA, the driver won't pass any data to the uart layer
+until the buffer is flipped. When the port is shutdown, the dma buffers
+are unmapped, but the head and tail of the ring buffer are not reseted.
+Since the serial console will keep the port open, this will only
+present itself when the uart is not shared.
+
+To reproduce the issue, with an unpatched driver, run a getty on /dev/ttyS0
+with no serial console and exit. Getty will exit, and when the new one returns
+you will be unable to log in. If you hold down a key long enough to fill the
+DMA buffer and flip it, you can then log in.
+
+Signed-off-by: Mark Deneen <mdeneen@gmail.com>
+Acked-by: Leilei Zhao <leilei.zhao@atmel.com>
+[nicolas.ferre@atmel.com: adapt to mainline kernel, handle !DMA case]
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1660,6 +1660,12 @@ static void atmel_shutdown(struct uart_p
+ atmel_port->release_tx(port);
+
+ /*
++ * Reset ring buffer pointers
++ */
++ atmel_port->rx_ring.head = 0;
++ atmel_port->rx_ring.tail = 0;
++
++ /*
+ * Free the interrupt
+ */
+ free_irq(port->irq, port);
--- /dev/null
+From ed8f8318d2ef3e5f9e4ddf79349508c116b68d7f Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Fri, 10 Jan 2014 13:51:27 +0800
+Subject: usb: chipidea: add freescale imx28 special write register method
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit ed8f8318d2ef3e5f9e4ddf79349508c116b68d7f upstream.
+
+According to Freescale imx28 Errata, "ENGR119653 USB: ARM to USB
+register error issue", All USB register write operations must
+use the ARM SWP instruction. So, we implement special hw_write
+and hw_test_and_clear for imx28.
+
+Discussion for it at below:
+http://marc.info/?l=linux-usb&m=137996395529294&w=2
+
+This patch is needed for stable tree 3.11+.
+
+Cc: robert.hodaszi@digi.com
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Tested-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/ci.h | 26 ++++++++++++++++++++++++--
+ drivers/usb/chipidea/core.c | 2 ++
+ drivers/usb/chipidea/host.c | 1 +
+ include/linux/usb/chipidea.h | 1 +
+ 4 files changed, 28 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/chipidea/ci.h
++++ b/drivers/usb/chipidea/ci.h
+@@ -135,6 +135,7 @@ struct hw_bank {
+ * @id_event: indicates there is an id event, and handled at ci_otg_work
+ * @b_sess_valid_event: indicates there is a vbus event, and handled
+ * at ci_otg_work
++ * @imx28_write_fix: Freescale imx28 needs swp instruction for writing
+ */
+ struct ci_hdrc {
+ struct device *dev;
+@@ -173,6 +174,7 @@ struct ci_hdrc {
+ struct dentry *debugfs;
+ bool id_event;
+ bool b_sess_valid_event;
++ bool imx28_write_fix;
+ };
+
+ static inline struct ci_role_driver *ci_role(struct ci_hdrc *ci)
+@@ -253,6 +255,26 @@ static inline u32 hw_read(struct ci_hdrc
+ return ioread32(ci->hw_bank.regmap[reg]) & mask;
+ }
+
++#ifdef CONFIG_SOC_IMX28
++static inline void imx28_ci_writel(u32 val, volatile void __iomem *addr)
++{
++ __asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr));
++}
++#else
++static inline void imx28_ci_writel(u32 val, volatile void __iomem *addr)
++{
++}
++#endif
++
++static inline void __hw_write(struct ci_hdrc *ci, u32 val,
++ void __iomem *addr)
++{
++ if (ci->imx28_write_fix)
++ imx28_ci_writel(val, addr);
++ else
++ iowrite32(val, addr);
++}
++
+ /**
+ * hw_write: writes to a hw register
+ * @reg: register index
+@@ -266,7 +288,7 @@ static inline void hw_write(struct ci_hd
+ data = (ioread32(ci->hw_bank.regmap[reg]) & ~mask)
+ | (data & mask);
+
+- iowrite32(data, ci->hw_bank.regmap[reg]);
++ __hw_write(ci, data, ci->hw_bank.regmap[reg]);
+ }
+
+ /**
+@@ -281,7 +303,7 @@ static inline u32 hw_test_and_clear(stru
+ {
+ u32 val = ioread32(ci->hw_bank.regmap[reg]) & mask;
+
+- iowrite32(val, ci->hw_bank.regmap[reg]);
++ __hw_write(ci, val, ci->hw_bank.regmap[reg]);
+ return val;
+ }
+
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -497,6 +497,8 @@ static int ci_hdrc_probe(struct platform
+ ci->transceiver = ci->platdata->phy;
+ else
+ ci->global_phy = true;
++ ci->imx28_write_fix = !!(ci->platdata->flags &
++ CI_HDRC_IMX28_WRITE_FIX);
+
+ ret = hw_device_init(ci, base);
+ if (ret < 0) {
+--- a/drivers/usb/chipidea/host.c
++++ b/drivers/usb/chipidea/host.c
+@@ -65,6 +65,7 @@ static int host_start(struct ci_hdrc *ci
+ ehci->caps = ci->hw_bank.cap;
+ ehci->has_hostpc = ci->hw_bank.lpm;
+ ehci->has_tdi_phy_lpm = ci->hw_bank.lpm;
++ ehci->imx28_write_fix = ci->imx28_write_fix;
+
+ if (ci->platdata->reg_vbus) {
+ ret = regulator_enable(ci->platdata->reg_vbus);
+--- a/include/linux/usb/chipidea.h
++++ b/include/linux/usb/chipidea.h
+@@ -24,6 +24,7 @@ struct ci_hdrc_platform_data {
+ * but otg is not supported (no register otgsc).
+ */
+ #define CI_HDRC_DUAL_ROLE_NOT_OTG BIT(4)
++#define CI_HDRC_IMX28_WRITE_FIX BIT(5)
+ enum usb_dr_mode dr_mode;
+ #define CI_HDRC_CONTROLLER_RESET_EVENT 0
+ #define CI_HDRC_CONTROLLER_STOPPED_EVENT 1
--- /dev/null
+From 1071055e2a118a81c0b300d7f4af7eba3f7a7c82 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Fri, 10 Jan 2014 13:51:28 +0800
+Subject: usb: chipidea: imx: set CI_HDRC_IMX28_WRITE_FIX for imx28
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 1071055e2a118a81c0b300d7f4af7eba3f7a7c82 upstream.
+
+Due to imx28 needs ARM swp instruction for writing, we set
+CI_HDRC_IMX28_WRITE_FIX for imx28.
+
+This patch is needed for stable tree 3.11+
+
+Cc: robert.hodaszi@digi.com
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Tested-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/ci_hdrc_imx.c | 32 ++++++++++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/chipidea/ci_hdrc_imx.c
++++ b/drivers/usb/chipidea/ci_hdrc_imx.c
+@@ -23,6 +23,26 @@
+ #include "ci.h"
+ #include "ci_hdrc_imx.h"
+
++#define CI_HDRC_IMX_IMX28_WRITE_FIX BIT(0)
++
++struct ci_hdrc_imx_platform_flag {
++ unsigned int flags;
++};
++
++static const struct ci_hdrc_imx_platform_flag imx27_usb_data = {
++};
++
++static const struct ci_hdrc_imx_platform_flag imx28_usb_data = {
++ .flags = CI_HDRC_IMX_IMX28_WRITE_FIX,
++};
++
++static const struct of_device_id ci_hdrc_imx_dt_ids[] = {
++ { .compatible = "fsl,imx28-usb", .data = &imx28_usb_data},
++ { .compatible = "fsl,imx27-usb", .data = &imx27_usb_data},
++ { /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids);
++
+ struct ci_hdrc_imx_data {
+ struct usb_phy *phy;
+ struct platform_device *ci_pdev;
+@@ -82,6 +102,9 @@ static int ci_hdrc_imx_probe(struct plat
+ CI_HDRC_DISABLE_STREAMING,
+ };
+ int ret;
++ const struct of_device_id *of_id =
++ of_match_device(ci_hdrc_imx_dt_ids, &pdev->dev);
++ const struct ci_hdrc_imx_platform_flag *imx_platform_flag = of_id->data;
+
+ data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+ if (!data) {
+@@ -121,6 +144,9 @@ static int ci_hdrc_imx_probe(struct plat
+
+ pdata.phy = data->phy;
+
++ if (imx_platform_flag->flags & CI_HDRC_IMX_IMX28_WRITE_FIX)
++ pdata.flags |= CI_HDRC_IMX28_WRITE_FIX;
++
+ if (!pdev->dev.dma_mask)
+ pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask;
+ if (!pdev->dev.coherent_dma_mask)
+@@ -187,12 +213,6 @@ static int ci_hdrc_imx_remove(struct pla
+ return 0;
+ }
+
+-static const struct of_device_id ci_hdrc_imx_dt_ids[] = {
+- { .compatible = "fsl,imx27-usb", },
+- { /* sentinel */ }
+-};
+-MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids);
+-
+ static struct platform_driver ci_hdrc_imx_driver = {
+ .probe = ci_hdrc_imx_probe,
+ .remove = ci_hdrc_imx_remove,
--- /dev/null
+From 5332ff1fb63c46588656e4208201bc131627c878 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Fri, 10 Jan 2014 13:51:31 +0800
+Subject: usb: chipidea: need to mask INT_STATUS when write otgsc
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 5332ff1fb63c46588656e4208201bc131627c878 upstream.
+
+For otgsc, both enable bits and status bits are in it. So we need
+to make sure the status bits are not be cleared when write enable
+bits. It can fix one bug that we plug in/out Micro AB cable fast,
+and sometimes, the IDIS will be cleared wrongly when handle last
+ID interrupt (ID 0->1), so the current interrupt will not occur.
+
+For stable tree: 3.12+
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/otg.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/chipidea/otg.h
++++ b/drivers/usb/chipidea/otg.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (C) 2013 Freescale Semiconductor, Inc.
++ * Copyright (C) 2013-2014 Freescale Semiconductor, Inc.
+ *
+ * Author: Peter Chen
+ *
+@@ -19,12 +19,12 @@ static inline void ci_clear_otg_interrup
+
+ static inline void ci_enable_otg_interrupt(struct ci_hdrc *ci, u32 bits)
+ {
+- hw_write(ci, OP_OTGSC, bits, bits);
++ hw_write(ci, OP_OTGSC, bits | OTGSC_INT_STATUS_BITS, bits);
+ }
+
+ static inline void ci_disable_otg_interrupt(struct ci_hdrc *ci, u32 bits)
+ {
+- hw_write(ci, OP_OTGSC, bits, 0);
++ hw_write(ci, OP_OTGSC, bits | OTGSC_INT_STATUS_BITS, 0);
+ }
+
+ int ci_hdrc_otg_init(struct ci_hdrc *ci);
--- /dev/null
+From 2fc5a7dace3c43e62402ab4e8800a8f1834ffe2a Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Fri, 10 Jan 2014 13:51:32 +0800
+Subject: usb: chipidea: udc: using MultO at TD as real mult value for ISO-TX
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 2fc5a7dace3c43e62402ab4e8800a8f1834ffe2a upstream.
+
+We have met a bug that the high bandwidth ISO-TX transfer has failed
+at the last packet if it is less than 1024, the TD status shows it
+is "Transaction Error".
+
+The root cause of this problem is: the mult value at qh is not correct
+for current TD's transfer length. We use TD list to queue un-transfer
+TDs, and change mult for new adding TDs. If new adding TDs transfer length
+less than 1024, but the queued un-transfer TDs transfer length is larger
+than 1024, the transfer error will occur, and vice versa.
+Usually, this problem occurs at the last packet, and the first packet for
+new frame.
+
+We fixed this problem by setting Mult at QH as the largest value (3), and
+set MultO (Multiplier Override) at TD according to every transfer length.
+It can cover both hardware version less than 2.3 (the real mult is MultO
+if it is not 0) and 2.3+ (the real mult is min(qh.mult, td.multo)).
+
+Since the MultO bits are only existed at TX TD, we keep the ISO-RX behavior
+unchanged.
+
+For stable tree: 3.11+.
+
+Cc: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Reported-by: Matthieu Vanin <b47495@freescale.com>
+Tested-by: Matthieu Vanin <b47495@freescale.com>
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/udc.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -394,6 +394,14 @@ static int add_td_to_list(struct ci_hw_e
+ node->ptr->token = cpu_to_le32(length << __ffs(TD_TOTAL_BYTES));
+ node->ptr->token &= cpu_to_le32(TD_TOTAL_BYTES);
+ node->ptr->token |= cpu_to_le32(TD_STATUS_ACTIVE);
++ if (hwep->type == USB_ENDPOINT_XFER_ISOC && hwep->dir == TX) {
++ u32 mul = hwreq->req.length / hwep->ep.maxpacket;
++
++ if (hwreq->req.length == 0
++ || hwreq->req.length % hwep->ep.maxpacket)
++ mul++;
++ node->ptr->token |= mul << __ffs(TD_MULTO);
++ }
+
+ temp = (u32) (hwreq->req.dma + hwreq->req.actual);
+ if (length) {
+@@ -516,10 +524,11 @@ static int _hardware_enqueue(struct ci_h
+ hwep->qh.ptr->td.token &=
+ cpu_to_le32(~(TD_STATUS_HALTED|TD_STATUS_ACTIVE));
+
+- if (hwep->type == USB_ENDPOINT_XFER_ISOC) {
++ if (hwep->type == USB_ENDPOINT_XFER_ISOC && hwep->dir == RX) {
+ u32 mul = hwreq->req.length / hwep->ep.maxpacket;
+
+- if (hwreq->req.length % hwep->ep.maxpacket)
++ if (hwreq->req.length == 0
++ || hwreq->req.length % hwep->ep.maxpacket)
+ mul++;
+ hwep->qh.ptr->cap |= mul << __ffs(QH_MULT);
+ }
+@@ -1172,6 +1181,12 @@ static int ep_enable(struct usb_ep *ep,
+ if (hwep->num)
+ cap |= QH_ZLT;
+ cap |= (hwep->ep.maxpacket << __ffs(QH_MAX_PKT)) & QH_MAX_PKT;
++ /*
++ * For ISO-TX, we set mult at QH as the largest value, and use
++ * MultO at TD as real mult value.
++ */
++ if (hwep->type == USB_ENDPOINT_XFER_ISOC && hwep->dir == TX)
++ cap |= 3 << __ffs(QH_MULT);
+
+ hwep->qh.ptr->cap = cpu_to_le32(cap);
+
--- /dev/null
+From 440ebadeae9298d7de3d4d105342691841ec88d0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 2 Jan 2014 22:49:24 +0100
+Subject: USB: cypress_m8: fix ring-indicator detection and reporting
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 440ebadeae9298d7de3d4d105342691841ec88d0 upstream.
+
+Fix ring-indicator (RI) status-bit definition, which was defined as CTS,
+effectively preventing RI-changes from being detected while reporting
+false RI status.
+
+This bug predates git.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cypress_m8.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/cypress_m8.h
++++ b/drivers/usb/serial/cypress_m8.h
+@@ -63,7 +63,7 @@
+ #define UART_DSR 0x20 /* data set ready - flow control - device to host */
+ #define CONTROL_RTS 0x10 /* request to send - flow control - host to device */
+ #define UART_CTS 0x10 /* clear to send - flow control - device to host */
+-#define UART_RI 0x10 /* ring indicator - modem - device to host */
++#define UART_RI 0x80 /* ring indicator - modem - device to host */
+ #define UART_CD 0x40 /* carrier detect - modem - device to host */
+ #define CYP_ERROR 0x08 /* received from input report - device to host */
+ /* Note - the below has nothing to do with the "feature report" reset */
--- /dev/null
+From 13518673f1419f2667985a6fca4543e44143408b Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Wed, 18 Dec 2013 16:41:25 +0200
+Subject: usb: dwc3: fix the glue drivers using the nop phy
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 13518673f1419f2667985a6fca4543e44143408b upstream.
+
+The reset_gpio member of the usb_phy_gen_xceiv_platform_data
+structure needs the have negative value or phy-generic's
+probe will fail unless DT is used. 0 is a valid gpio number.
+
+This fixes an issue where phy-generic fails to probe with
+message: "usb_phy_gen_xceiv.0: Error requesting RESET GPIO 0".
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/dwc3-exynos.c | 1 +
+ drivers/usb/dwc3/dwc3-pci.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-exynos.c
++++ b/drivers/usb/dwc3/dwc3-exynos.c
+@@ -50,6 +50,7 @@ static int dwc3_exynos_register_phys(str
+
+ exynos->usb2_phy = pdev;
+ pdata.type = USB_PHY_TYPE_USB2;
++ pdata.gpio_reset = -1;
+
+ ret = platform_device_add_data(exynos->usb2_phy, &pdata, sizeof(pdata));
+ if (ret)
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -52,6 +52,7 @@ static int dwc3_pci_register_phys(struct
+
+ glue->usb2_phy = pdev;
+ pdata.type = USB_PHY_TYPE_USB2;
++ pdata.gpio_reset = -1;
+
+ ret = platform_device_add_data(glue->usb2_phy, &pdata, sizeof(pdata));
+ if (ret)
--- /dev/null
+From feffe09f510c475df082546815f9e4a573f6a233 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Fri, 10 Jan 2014 13:51:26 +0800
+Subject: usb: ehci: add freescale imx28 special write register method
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit feffe09f510c475df082546815f9e4a573f6a233 upstream.
+
+According to Freescale imx28 Errata, "ENGR119653 USB: ARM to USB
+register error issue", All USB register write operations must
+use the ARM SWP instruction. So, we implement a special ehci_write
+for imx28.
+
+Discussion for it at below:
+http://marc.info/?l=linux-usb&m=137996395529294&w=2
+
+Without this patcheset, imx28 works unstable at high AHB bus loading.
+If the bus loading is not high, the imx28 usb can work well at the most
+of time. There is a IC errata for this problem, usually, we consider
+IC errata is a problem not a new feature, and this workaround is needed
+for that, so we need to add them to stable tree 3.11+.
+
+Cc: robert.hodaszi@digi.com
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Tested-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci.h | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -203,6 +203,7 @@ struct ehci_hcd { /* one per controlle
+ unsigned has_synopsys_hc_bug:1; /* Synopsys HC */
+ unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */
+ unsigned need_oc_pp_cycle:1; /* MPC834X port power */
++ unsigned imx28_write_fix:1; /* For Freescale i.MX28 */
+
+ /* required for usb32 quirk */
+ #define OHCI_CTRL_HCFS (3 << 6)
+@@ -679,6 +680,18 @@ static inline unsigned int ehci_readl(co
+ #endif
+ }
+
++#ifdef CONFIG_SOC_IMX28
++static inline void imx28_ehci_writel(const unsigned int val,
++ volatile __u32 __iomem *addr)
++{
++ __asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr));
++}
++#else
++static inline void imx28_ehci_writel(const unsigned int val,
++ volatile __u32 __iomem *addr)
++{
++}
++#endif
+ static inline void ehci_writel(const struct ehci_hcd *ehci,
+ const unsigned int val, __u32 __iomem *regs)
+ {
+@@ -687,7 +700,10 @@ static inline void ehci_writel(const str
+ writel_be(val, regs) :
+ writel(val, regs);
+ #else
+- writel(val, regs);
++ if (ehci->imx28_write_fix)
++ imx28_ehci_writel(val, regs);
++ else
++ writel(val, regs);
+ #endif
+ }
+
--- /dev/null
+From 543d7784b07ffd16cc82a9cb4e1e0323fd0040f1 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 7 Jan 2014 10:43:02 -0500
+Subject: USB: fix race between hub_disconnect and recursively_mark_NOTATTACHED
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 543d7784b07ffd16cc82a9cb4e1e0323fd0040f1 upstream.
+
+There is a race in the hub driver between hub_disconnect() and
+recursively_mark_NOTATTACHED(). This race can be triggered if the
+driver is unbound from a device at the same time as the bus's root hub
+is removed. When the race occurs, it can cause an oops:
+
+BUG: unable to handle kernel NULL pointer dereference at 0000015c
+IP: [<c16d5fb0>] recursively_mark_NOTATTACHED+0x20/0x60
+Call Trace:
+ [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
+ [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
+ [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
+ [<c16d5fc4>] recursively_mark_NOTATTACHED+0x34/0x60
+ [<c16d6082>] usb_set_device_state+0x92/0x120
+ [<c16d862b>] usb_disconnect+0x2b/0x1a0
+ [<c16dd4c0>] usb_remove_hcd+0xb0/0x160
+ [<c19ca846>] ? _raw_spin_unlock_irqrestore+0x26/0x50
+ [<c1704efc>] ehci_mid_remove+0x1c/0x30
+ [<c1704f26>] ehci_mid_stop_host+0x16/0x30
+ [<c16f7698>] penwell_otg_work+0xd28/0x3520
+ [<c19c945b>] ? __schedule+0x39b/0x7f0
+ [<c19cdb9d>] ? sub_preempt_count+0x3d/0x50
+ [<c125e97d>] process_one_work+0x11d/0x3d0
+ [<c19c7f4d>] ? mutex_unlock+0xd/0x10
+ [<c125e0e5>] ? manage_workers.isra.24+0x1b5/0x270
+ [<c125f009>] worker_thread+0xf9/0x320
+ [<c19ca846>] ? _raw_spin_unlock_irqrestore+0x26/0x50
+ [<c125ef10>] ? rescuer_thread+0x2b0/0x2b0
+ [<c1264ac4>] kthread+0x94/0xa0
+ [<c19d0f77>] ret_from_kernel_thread+0x1b/0x28
+ [<c1264a30>] ? kthread_create_on_node+0xc0/0xc0
+
+One problem is that recursively_mark_NOTATTACHED() uses the intfdata
+value and hub->hdev->maxchild while hub_disconnect() is clearing them.
+Another problem is that it uses hub->ports[i] while the port device is
+being released.
+
+To fix this race, we need to hold the device_state_lock while
+hub_disconnect() changes the values. (Note that usb_disconnect()
+and hub_port_connect_change() already acquire this lock at similar
+critical times during a USB device's life cycle.) We also need to
+remove the port devices after maxchild has been set to 0, instead of
+before.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: "Du, Changbin" <changbinx.du@intel.com>
+Tested-by: "Du, Changbin" <changbinx.du@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1610,7 +1610,7 @@ static void hub_disconnect(struct usb_in
+ {
+ struct usb_hub *hub = usb_get_intfdata(intf);
+ struct usb_device *hdev = interface_to_usbdev(intf);
+- int i;
++ int port1;
+
+ /* Take the hub off the event list and don't let it be added again */
+ spin_lock_irq(&hub_event_lock);
+@@ -1625,11 +1625,15 @@ static void hub_disconnect(struct usb_in
+ hub->error = 0;
+ hub_quiesce(hub, HUB_DISCONNECT);
+
+- usb_set_intfdata (intf, NULL);
++ /* Avoid races with recursively_mark_NOTATTACHED() */
++ spin_lock_irq(&device_state_lock);
++ port1 = hdev->maxchild;
++ hdev->maxchild = 0;
++ usb_set_intfdata(intf, NULL);
++ spin_unlock_irq(&device_state_lock);
+
+- for (i = 0; i < hdev->maxchild; i++)
+- usb_hub_remove_port_device(hub, i + 1);
+- hub->hdev->maxchild = 0;
++ for (; port1 > 0; --port1)
++ usb_hub_remove_port_device(hub, port1);
+
+ if (hub->hdev->speed == USB_SPEED_HIGH)
+ highspeed_hubs--;
--- /dev/null
+From c1f15196ac3b541d084dc80a8fbd8a74c6a0bd44 Mon Sep 17 00:00:00 2001
+From: Colin Leitner <colin.leitner@googlemail.com>
+Date: Mon, 6 Jan 2014 21:33:54 +0100
+Subject: USB: ftdi_sio: added CS5 quirk for broken smartcard readers
+
+From: Colin Leitner <colin.leitner@googlemail.com>
+
+commit c1f15196ac3b541d084dc80a8fbd8a74c6a0bd44 upstream.
+
+Genuine FTDI chips support only CS7/8. A previous fix in commit
+8704211f65a2 ("USB: ftdi_sio: fixed handling of unsupported CSIZE
+setting") enforced this limitation and reported it back to userspace.
+
+However, certain types of smartcard readers depend on specific
+driver behaviour that requests 0 data bits (not 5) to change into a
+different operating mode if CS5 has been set.
+
+This patch reenables this behaviour for all FTDI devices.
+
+Tagged to be added to stable, because it affects a lot of users of
+embedded systems which rely on these readers to work properly.
+
+Reported-by: Heinrich Siebmanns <H.Siebmanns@t-online.de>
+Tested-by: Heinrich Siebmanns <H.Siebmanns@t-online.de>
+Signed-off-by: Colin Leitner <colin.leitner@gmail.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2116,10 +2116,20 @@ static void ftdi_set_termios(struct tty_
+ }
+
+ /*
+- * All FTDI UART chips are limited to CS7/8. We won't pretend to
++ * All FTDI UART chips are limited to CS7/8. We shouldn't pretend to
+ * support CS5/6 and revert the CSIZE setting instead.
++ *
++ * CS5 however is used to control some smartcard readers which abuse
++ * this limitation to switch modes. Original FTDI chips fall back to
++ * eight data bits.
++ *
++ * TODO: Implement a quirk to only allow this with mentioned
++ * readers. One I know of (Argolis Smartreader V1)
++ * returns "USB smartcard server" as iInterface string.
++ * The vendor didn't bother with a custom VID/PID of
++ * course.
+ */
+- if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) {
++ if (C_CSIZE(tty) == CS6) {
+ dev_warn(ddev, "requested CSIZE setting not supported\n");
+
+ termios->c_cflag &= ~CSIZE;
+@@ -2166,6 +2176,9 @@ no_skip:
+ urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE;
+ }
+ switch (cflag & CSIZE) {
++ case CS5:
++ dev_dbg(ddev, "Setting CS5 quirk\n");
++ break;
+ case CS7:
+ urb_value |= 7;
+ dev_dbg(ddev, "Setting CS7\n");
--- /dev/null
+From 0e16114f2db4838251fb64f3b550996ad3585890 Mon Sep 17 00:00:00 2001
+From: Mikhail Zolotaryov <lebon@lebon.org.ua>
+Date: Sat, 28 Dec 2013 01:56:35 +0200
+Subject: USB: Nokia 502 is an unusual device
+
+From: Mikhail Zolotaryov <lebon@lebon.org.ua>
+
+commit 0e16114f2db4838251fb64f3b550996ad3585890 upstream.
+
+The USB storage operation of Nokia Asha 502 Dual SIM smartphone running Asha
+Platform 1.1.1 is unreliable in respect of data consistency (i.e. transfered
+files are corrupted). A similar issue is described here:
+http://discussions.nokia.com/t5/Asha-and-other-Nokia-Series-30/Nokia-301-USB-transfers-and-corrupted-files/td-p/1974170
+
+The workaround is (MAX_SECTORS_64):
+ rmmod usb_storage && modprobe usb_storage quirks=0421:06aa:m
+
+The patch adds the tested device to the unusual list permanently.
+
+Signed-off-by: Mikhail Zolotaryov <lebon@lebon.org.ua>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -234,6 +234,13 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64 ),
+
++/* Patch submitted by Mikhail Zolotaryov <lebon@lebon.org.ua> */
++UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110,
++ "Nokia",
++ "502",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_MAX_SECTORS_64 ),
++
+ #ifdef NO_SDDR09
+ UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100,
+ "Microtech",
--- /dev/null
+From 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= <zjn77777@163.com>
+Date: Wed, 18 Dec 2013 15:37:17 +0800
+Subject: usb: option: add new zte 3g modem pids to option driver
+
+From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= <zjn77777@163.com>
+
+commit 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 upstream.
+
+Signed-off-by: Jun zhang <zhang.jun92@zte.com.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1447,6 +1447,17 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
+
+ /* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff),
--- /dev/null
+From 623c8263376c0b8a4b0c220232e7313d762cd0cc Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Sun, 29 Dec 2013 19:22:53 +0100
+Subject: USB: pl2303: fix data corruption on termios updates
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 623c8263376c0b8a4b0c220232e7313d762cd0cc upstream.
+
+Some PL2303 devices are known to lose bytes if you change serial
+settings even to the same values as before. Avoid this by comparing the
+encoded settings with the previsouly used ones before configuring the
+device.
+
+The common case was fixed by commit bf5e5834bffc6 ("pl2303: Fix mode
+switching regression"), but this problem was still possible to trigger,
+for instance, by using the TCSETS2-interface to repeatedly request
+115201 baud, which gets mapped to 115200 and thus always triggers a
+settings update.
+
+Cc: Frank Schäfer <fschaefer.oss@googlemail.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/pl2303.c | 34 +++++++++++++++++++++++++---------
+ 1 file changed, 25 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -142,6 +142,8 @@ struct pl2303_private {
+ spinlock_t lock;
+ u8 line_control;
+ u8 line_status;
++
++ u8 line_settings[7];
+ };
+
+ static int pl2303_vendor_read(__u16 value, __u16 index,
+@@ -339,11 +341,6 @@ static void pl2303_set_termios(struct tt
+ int i;
+ u8 control;
+
+- /*
+- * The PL2303 is reported to lose bytes if you change serial settings
+- * even to the same values as before. Thus we actually need to filter
+- * in this specific case.
+- */
+ if (old_termios && !tty_termios_hw_change(&tty->termios, old_termios))
+ return;
+
+@@ -428,10 +425,29 @@ static void pl2303_set_termios(struct tt
+ dev_dbg(&port->dev, "parity = none\n");
+ }
+
+- i = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+- SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
+- 0, 0, buf, 7, 100);
+- dev_dbg(&port->dev, "0x21:0x20:0:0 %d\n", i);
++ /*
++ * Some PL2303 are known to lose bytes if you change serial settings
++ * even to the same values as before. Thus we actually need to filter
++ * in this specific case.
++ *
++ * Note that the tty_termios_hw_change check above is not sufficient
++ * as a previously requested baud rate may differ from the one
++ * actually used (and stored in old_termios).
++ *
++ * NOTE: No additional locking needed for line_settings as it is
++ * only used in set_termios, which is serialised against itself.
++ */
++ if (!old_termios || memcmp(buf, priv->line_settings, 7)) {
++ i = usb_control_msg(serial->dev,
++ usb_sndctrlpipe(serial->dev, 0),
++ SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
++ 0, 0, buf, 7, 100);
++
++ dev_dbg(&port->dev, "0x21:0x20:0:0 %d\n", i);
++
++ if (i == 7)
++ memcpy(priv->line_settings, buf, 7);
++ }
+
+ /* change control lines if we are switching to or from B0 */
+ spin_lock_irqsave(&priv->lock, flags);
--- /dev/null
+From 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 Mon Sep 17 00:00:00 2001
+From: Rahul Bedarkar <rahulbedarkar89@gmail.com>
+Date: Thu, 2 Jan 2014 20:57:56 +0530
+Subject: USB: serial: add support for iBall 3.5G connect usb modem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rahul Bedarkar <rahulbedarkar89@gmail.com>
+
+commit 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 upstream.
+
+Add support for iBall 3.5G connect usb modem.
+
+$lsusb
+Bus 002 Device 006: ID 1c9e:9605 OMEGA TECHNOLOGY
+
+$usb-devices
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1c9e ProdID=9605 Rev=00.00
+S: Manufacturer=USB Modem
+S: Product=USB Modem
+S: SerialNumber=1234567890ABCDEF
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+
+Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
+Suggested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -320,6 +320,9 @@ static void option_instat_callback(struc
+ * It seems to contain a Qualcomm QSC6240/6290 chipset */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603
+
++/* iBall 3.5G connect wireless modem */
++#define IBALL_3_5G_CONNECT 0x9605
++
+ /* Zoom */
+ #define ZOOM_PRODUCT_4597 0x9607
+
+@@ -1500,6 +1503,7 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+ },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
++ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+ /* Pirelli */
+ { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) },
--- /dev/null
+From 9005355af23856c55a5538c9024355785424821b Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Fri, 15 Nov 2013 14:53:14 -0800
+Subject: usb: xhci: Check for XHCI_PLAT in xhci_cleanup_msix()
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit 9005355af23856c55a5538c9024355785424821b upstream.
+
+If CONFIG_PCI is enabled, make sure xhci_cleanup_msix()
+doesn't try to free a bogus PCI IRQ or dereference an invalid
+pci_dev when the xHCI device is actually a platform_device.
+
+This patch should be backported to kernels as old as 3.9, that
+contain the commit 52fb61250a7a132b0cfb9f4a1060a1f3c49e5a25
+"xhci-plat: Don't enable legacy PCI interrupts."
+
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -321,6 +321,9 @@ static void xhci_cleanup_msix(struct xhc
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+
++ if (xhci->quirks & XHCI_PLAT)
++ return;
++
+ xhci_free_irq(xhci);
+
+ if (xhci->msix_entries) {
--- /dev/null
+From da6139e49c7cb0f4251265cb5243b8d220adb48d Mon Sep 17 00:00:00 2001
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Mon, 13 Jan 2014 06:51:01 -0500
+Subject: x86: Add check for number of available vectors before CPU down
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+commit da6139e49c7cb0f4251265cb5243b8d220adb48d upstream.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64791
+
+When a cpu is downed on a system, the irqs on the cpu are assigned to
+other cpus. It is possible, however, that when a cpu is downed there
+aren't enough free vectors on the remaining cpus to account for the
+vectors from the cpu that is being downed.
+
+This results in an interesting "overflow" condition where irqs are
+"assigned" to a CPU but are not handled.
+
+For example, when downing cpus on a 1-64 logical processor system:
+
+<snip>
+[ 232.021745] smpboot: CPU 61 is now offline
+[ 238.480275] smpboot: CPU 62 is now offline
+[ 245.991080] ------------[ cut here ]------------
+[ 245.996270] WARNING: CPU: 0 PID: 0 at net/sched/sch_generic.c:264 dev_watchdog+0x246/0x250()
+[ 246.005688] NETDEV WATCHDOG: p786p1 (ixgbe): transmit queue 0 timed out
+[ 246.013070] Modules linked in: lockd sunrpc iTCO_wdt iTCO_vendor_support sb_edac ixgbe microcode e1000e pcspkr joydev edac_core lpc_ich ioatdma ptp mdio mfd_core i2c_i801 dca pps_core i2c_core wmi acpi_cpufreq isci libsas scsi_transport_sas
+[ 246.037633] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.12.0+ #14
+[ 246.044451] Hardware name: Intel Corporation S4600LH ........../SVRBD-ROW_T, BIOS SE5C600.86B.01.08.0003.022620131521 02/26/2013
+[ 246.057371] 0000000000000009 ffff88081fa03d40 ffffffff8164fbf6 ffff88081fa0ee48
+[ 246.065728] ffff88081fa03d90 ffff88081fa03d80 ffffffff81054ecc ffff88081fa13040
+[ 246.074073] 0000000000000000 ffff88200cce0000 0000000000000040 0000000000000000
+[ 246.082430] Call Trace:
+[ 246.085174] <IRQ> [<ffffffff8164fbf6>] dump_stack+0x46/0x58
+[ 246.091633] [<ffffffff81054ecc>] warn_slowpath_common+0x8c/0xc0
+[ 246.098352] [<ffffffff81054fb6>] warn_slowpath_fmt+0x46/0x50
+[ 246.104786] [<ffffffff815710d6>] dev_watchdog+0x246/0x250
+[ 246.110923] [<ffffffff81570e90>] ? dev_deactivate_queue.constprop.31+0x80/0x80
+[ 246.119097] [<ffffffff8106092a>] call_timer_fn+0x3a/0x110
+[ 246.125224] [<ffffffff8106280f>] ? update_process_times+0x6f/0x80
+[ 246.132137] [<ffffffff81570e90>] ? dev_deactivate_queue.constprop.31+0x80/0x80
+[ 246.140308] [<ffffffff81061db0>] run_timer_softirq+0x1f0/0x2a0
+[ 246.146933] [<ffffffff81059a80>] __do_softirq+0xe0/0x220
+[ 246.152976] [<ffffffff8165fedc>] call_softirq+0x1c/0x30
+[ 246.158920] [<ffffffff810045f5>] do_softirq+0x55/0x90
+[ 246.164670] [<ffffffff81059d35>] irq_exit+0xa5/0xb0
+[ 246.170227] [<ffffffff8166062a>] smp_apic_timer_interrupt+0x4a/0x60
+[ 246.177324] [<ffffffff8165f40a>] apic_timer_interrupt+0x6a/0x70
+[ 246.184041] <EOI> [<ffffffff81505a1b>] ? cpuidle_enter_state+0x5b/0xe0
+[ 246.191559] [<ffffffff81505a17>] ? cpuidle_enter_state+0x57/0xe0
+[ 246.198374] [<ffffffff81505b5d>] cpuidle_idle_call+0xbd/0x200
+[ 246.204900] [<ffffffff8100b7ae>] arch_cpu_idle+0xe/0x30
+[ 246.210846] [<ffffffff810a47b0>] cpu_startup_entry+0xd0/0x250
+[ 246.217371] [<ffffffff81646b47>] rest_init+0x77/0x80
+[ 246.223028] [<ffffffff81d09e8e>] start_kernel+0x3ee/0x3fb
+[ 246.229165] [<ffffffff81d0989f>] ? repair_env_string+0x5e/0x5e
+[ 246.235787] [<ffffffff81d095a5>] x86_64_start_reservations+0x2a/0x2c
+[ 246.242990] [<ffffffff81d0969f>] x86_64_start_kernel+0xf8/0xfc
+[ 246.249610] ---[ end trace fb74fdef54d79039 ]---
+[ 246.254807] ixgbe 0000:c2:00.0 p786p1: initiating reset due to tx timeout
+[ 246.262489] ixgbe 0000:c2:00.0 p786p1: Reset adapter
+Last login: Mon Nov 11 08:35:14 from 10.18.17.119
+[root@(none) ~]# [ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5
+[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX
+[ 246.792676] ixgbe 0000:c2:00.0 p786p1: detected SFP+: 5
+[ 249.231598] ixgbe 0000:c2:00.0 p786p1: NIC Link is Up 10 Gbps, Flow Control: RX/TX
+
+(last lines keep repeating. ixgbe driver is dead until module reload.)
+
+If the downed cpu has more vectors than are free on the remaining cpus on the
+system, it is possible that some vectors are "orphaned" even though they are
+assigned to a cpu. In this case, since the ixgbe driver had a watchdog, the
+watchdog fired and notified that something was wrong.
+
+This patch adds a function, check_vectors(), to compare the number of vectors
+on the CPU going down and compares it to the number of vectors available on
+the system. If there aren't enough vectors for the CPU to go down, an
+error is returned and propogated back to userspace.
+
+v2: Do not need to look at percpu irqs
+v3: Need to check affinity to prevent counting of MSIs in IOAPIC Lowest
+ Priority Mode
+v4: Additional changes suggested by Gong Chen.
+v5/v6/v7/v8: Updated comment text
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Link: http://lkml.kernel.org/r/1389613861-3853-1-git-send-email-prarit@redhat.com
+Reviewed-by: Gong Chen <gong.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Michel Lespinasse <walken@google.com>
+Cc: Seiji Aguchi <seiji.aguchi@hds.com>
+Cc: Yang Zhang <yang.z.zhang@Intel.com>
+Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
+Cc: Janet Morgan <janet.morgan@intel.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: Ruiv Wang <ruiv.wang@gmail.com>
+Cc: Gong Chen <gong.chen@linux.intel.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/irq.h | 1
+ arch/x86/kernel/irq.c | 70 +++++++++++++++++++++++++++++++++++++++++++++
+ arch/x86/kernel/smpboot.c | 6 +++
+ 3 files changed, 77 insertions(+)
+
+--- a/arch/x86/include/asm/irq.h
++++ b/arch/x86/include/asm/irq.h
+@@ -25,6 +25,7 @@ extern void irq_ctx_init(int cpu);
+
+ #ifdef CONFIG_HOTPLUG_CPU
+ #include <linux/cpumask.h>
++extern int check_irq_vectors_for_cpu_disable(void);
+ extern void fixup_irqs(void);
+ extern void irq_force_complete_move(int);
+ #endif
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -262,6 +262,76 @@ __visible void smp_trace_x86_platform_ip
+ EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq);
+
+ #ifdef CONFIG_HOTPLUG_CPU
++/*
++ * This cpu is going to be removed and its vectors migrated to the remaining
++ * online cpus. Check to see if there are enough vectors in the remaining cpus.
++ * This function is protected by stop_machine().
++ */
++int check_irq_vectors_for_cpu_disable(void)
++{
++ int irq, cpu;
++ unsigned int this_cpu, vector, this_count, count;
++ struct irq_desc *desc;
++ struct irq_data *data;
++ struct cpumask affinity_new, online_new;
++
++ this_cpu = smp_processor_id();
++ cpumask_copy(&online_new, cpu_online_mask);
++ cpu_clear(this_cpu, online_new);
++
++ this_count = 0;
++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
++ irq = __this_cpu_read(vector_irq[vector]);
++ if (irq >= 0) {
++ desc = irq_to_desc(irq);
++ data = irq_desc_get_irq_data(desc);
++ cpumask_copy(&affinity_new, data->affinity);
++ cpu_clear(this_cpu, affinity_new);
++
++ /* Do not count inactive or per-cpu irqs. */
++ if (!irq_has_action(irq) || irqd_is_per_cpu(data))
++ continue;
++
++ /*
++ * A single irq may be mapped to multiple
++ * cpu's vector_irq[] (for example IOAPIC cluster
++ * mode). In this case we have two
++ * possibilities:
++ *
++ * 1) the resulting affinity mask is empty; that is
++ * this the down'd cpu is the last cpu in the irq's
++ * affinity mask, or
++ *
++ * 2) the resulting affinity mask is no longer
++ * a subset of the online cpus but the affinity
++ * mask is not zero; that is the down'd cpu is the
++ * last online cpu in a user set affinity mask.
++ */
++ if (cpumask_empty(&affinity_new) ||
++ !cpumask_subset(&affinity_new, &online_new))
++ this_count++;
++ }
++ }
++
++ count = 0;
++ for_each_online_cpu(cpu) {
++ if (cpu == this_cpu)
++ continue;
++ for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
++ vector++) {
++ if (per_cpu(vector_irq, cpu)[vector] < 0)
++ count++;
++ }
++ }
++
++ if (count < this_count) {
++ pr_warn("CPU %d disable failed: CPU has %u vectors assigned and there are only %u available.\n",
++ this_cpu, this_count, count);
++ return -ERANGE;
++ }
++ return 0;
++}
++
+ /* A cpu has been removed from cpu_online_mask. Reset irq affinities. */
+ void fixup_irqs(void)
+ {
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1310,6 +1310,12 @@ void cpu_disable_common(void)
+
+ int native_cpu_disable(void)
+ {
++ int ret;
++
++ ret = check_irq_vectors_for_cpu_disable();
++ if (ret)
++ return ret;
++
+ clear_local_APIC();
+
+ cpu_disable_common();
--- /dev/null
+From a7f84f03f660d93574ac88835d056c0d6468aebe Mon Sep 17 00:00:00 2001
+From: Dave Young <dyoung@redhat.com>
+Date: Fri, 20 Dec 2013 18:02:15 +0800
+Subject: x86/efi: Fix off-by-one bug in EFI Boot Services reservation
+
+From: Dave Young <dyoung@redhat.com>
+
+commit a7f84f03f660d93574ac88835d056c0d6468aebe upstream.
+
+Current code check boot service region with kernel text region by:
+start+size >= __pa_symbol(_text)
+The end of the above region should be start + size - 1 instead.
+
+I see this problem in ovmf + Fedora 19 grub boot:
+text start: 1000000 md start: 800000 md size: 800000
+
+Signed-off-by: Dave Young <dyoung@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+Acked-by: Toshi Kani <toshi.kani@hp.com>
+Tested-by: Toshi Kani <toshi.kani@hp.com>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/platform/efi/efi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -440,7 +440,7 @@ void __init efi_reserve_boot_services(vo
+ * - Not within any part of the kernel
+ * - Not the bios reserved area
+ */
+- if ((start+size >= __pa_symbol(_text)
++ if ((start + size > __pa_symbol(_text)
+ && start <= __pa_symbol(_end)) ||
+ !e820_all_mapped(start, start+size, E820_RAM) ||
+ memblock_is_region_reserved(start, size)) {
--- /dev/null
+From 1c300a40772dae829b91dad634999a6a522c0829 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 27 Jan 2014 14:49:40 +0100
+Subject: x86, kvm: cache the base of the KVM cpuid leaves
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 1c300a40772dae829b91dad634999a6a522c0829 upstream.
+
+It is unnecessary to go through hypervisor_cpuid_base every time
+a leaf is found (which will be every time a feature is requested
+after the next patch).
+
+Fixes: 1085ba7f552d84aa8ac0ae903fa8d0cc2ff9f79d
+Cc: mtosatti@redhat.com
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/kvm_para.h | 22 ++++++----------------
+ arch/x86/kernel/kvm.c | 27 +++++++++++++++++++++++++++
+ 2 files changed, 33 insertions(+), 16 deletions(-)
+
+--- a/arch/x86/include/asm/kvm_para.h
++++ b/arch/x86/include/asm/kvm_para.h
+@@ -85,28 +85,13 @@ static inline long kvm_hypercall4(unsign
+ return ret;
+ }
+
+-static inline uint32_t kvm_cpuid_base(void)
+-{
+- if (boot_cpu_data.cpuid_level < 0)
+- return 0; /* So we don't blow up on old processors */
+-
+- if (cpu_has_hypervisor)
+- return hypervisor_cpuid_base("KVMKVMKVM\0\0\0", 0);
+-
+- return 0;
+-}
+-
+-static inline bool kvm_para_available(void)
+-{
+- return kvm_cpuid_base() != 0;
+-}
+-
+ static inline unsigned int kvm_arch_para_features(void)
+ {
+ return cpuid_eax(KVM_CPUID_FEATURES);
+ }
+
+ #ifdef CONFIG_KVM_GUEST
++bool kvm_para_available(void);
+ void __init kvm_guest_init(void);
+ void kvm_async_pf_task_wait(u32 token);
+ void kvm_async_pf_task_wake(u32 token);
+@@ -126,6 +111,11 @@ static inline void kvm_spinlock_init(voi
+ #define kvm_async_pf_task_wait(T) do {} while(0)
+ #define kvm_async_pf_task_wake(T) do {} while(0)
+
++static inline bool kvm_para_available(void)
++{
++ return 0;
++}
++
+ static inline u32 kvm_read_and_reset_pf_reason(void)
+ {
+ return 0;
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -500,6 +500,33 @@ void __init kvm_guest_init(void)
+ #endif
+ }
+
++static noinline uint32_t __kvm_cpuid_base(void)
++{
++ if (boot_cpu_data.cpuid_level < 0)
++ return 0; /* So we don't blow up on old processors */
++
++ if (cpu_has_hypervisor)
++ return hypervisor_cpuid_base("KVMKVMKVM\0\0\0", 0);
++
++ return 0;
++}
++
++static inline uint32_t kvm_cpuid_base(void)
++{
++ static int kvm_cpuid_base = -1;
++
++ if (kvm_cpuid_base == -1)
++ kvm_cpuid_base = __kvm_cpuid_base();
++
++ return kvm_cpuid_base;
++}
++
++bool kvm_para_available(void)
++{
++ return kvm_cpuid_base() != 0;
++}
++EXPORT_SYMBOL_GPL(kvm_para_available);
++
+ static uint32_t __init kvm_detect(void)
+ {
+ return kvm_cpuid_base();
--- /dev/null
+From 77f01bdfa5e55dc19d3eb747181d2730a9bb3ca8 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 27 Jan 2014 14:51:44 +0100
+Subject: x86, kvm: correctly access the KVM_CPUID_FEATURES leaf at 0x40000101
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 77f01bdfa5e55dc19d3eb747181d2730a9bb3ca8 upstream.
+
+When Hyper-V hypervisor leaves are present, KVM must relocate
+its own leaves at 0x40000100, because Windows does not look for
+Hyper-V leaves at indices other than 0x40000000. In this case,
+the KVM features are at 0x40000101, but the old code would always
+look at 0x40000001.
+
+Fix by using kvm_cpuid_base(). This also requires making the
+function non-inline, since kvm_cpuid_base() is static.
+
+Fixes: 1085ba7f552d84aa8ac0ae903fa8d0cc2ff9f79d
+Cc: mtosatti@redhat.com
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/kvm_para.h | 11 ++++++-----
+ arch/x86/kernel/kvm.c | 5 +++++
+ 2 files changed, 11 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/include/asm/kvm_para.h
++++ b/arch/x86/include/asm/kvm_para.h
+@@ -85,13 +85,9 @@ static inline long kvm_hypercall4(unsign
+ return ret;
+ }
+
+-static inline unsigned int kvm_arch_para_features(void)
+-{
+- return cpuid_eax(KVM_CPUID_FEATURES);
+-}
+-
+ #ifdef CONFIG_KVM_GUEST
+ bool kvm_para_available(void);
++unsigned int kvm_arch_para_features(void);
+ void __init kvm_guest_init(void);
+ void kvm_async_pf_task_wait(u32 token);
+ void kvm_async_pf_task_wake(u32 token);
+@@ -115,6 +111,11 @@ static inline bool kvm_para_available(vo
+ {
+ return 0;
+ }
++
++static inline unsigned int kvm_arch_para_features(void)
++{
++ return 0;
++}
+
+ static inline u32 kvm_read_and_reset_pf_reason(void)
+ {
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -527,6 +527,11 @@ bool kvm_para_available(void)
+ }
+ EXPORT_SYMBOL_GPL(kvm_para_available);
+
++unsigned int kvm_arch_para_features(void)
++{
++ return cpuid_eax(kvm_cpuid_base() | KVM_CPUID_FEATURES);
++}
++
+ static uint32_t __init kvm_detect(void)
+ {
+ return kvm_cpuid_base();
--- /dev/null
+From 2def2ef2ae5f3990aabdbe8a755911902707d268 Mon Sep 17 00:00:00 2001
+From: PaX Team <pageexec@freemail.hu>
+Date: Thu, 30 Jan 2014 16:59:25 -0800
+Subject: x86, x32: Correct invalid use of user timespec in the kernel
+
+From: PaX Team <pageexec@freemail.hu>
+
+commit 2def2ef2ae5f3990aabdbe8a755911902707d268 upstream.
+
+The x32 case for the recvmsg() timout handling is broken:
+
+ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
+ unsigned int vlen, unsigned int flags,
+ struct compat_timespec __user *timeout)
+ {
+ int datagrams;
+ struct timespec ktspec;
+
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+
+ if (COMPAT_USE_64BIT_TIME)
+ return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT,
+ (struct timespec *) timeout);
+ ...
+
+The timeout pointer parameter is provided by userland (hence the __user
+annotation) but for x32 syscalls it's simply cast to a kernel pointer
+and is passed to __sys_recvmmsg which will eventually directly
+dereference it for both reading and writing. Other callers to
+__sys_recvmmsg properly copy from userland to the kernel first.
+
+The bug was introduced by commit ee4fa23c4bfc ("compat: Use
+COMPAT_USE_64BIT_TIME in net/compat.c") and should affect all kernels
+since 3.4 (and perhaps vendor kernels if they backported x32 support
+along with this code).
+
+Note that CONFIG_X86_X32_ABI gets enabled at build time and only if
+CONFIG_X86_X32 is enabled and ld can build x32 executables.
+
+Other uses of COMPAT_USE_64BIT_TIME seem fine.
+
+This addresses CVE-2014-0038.
+
+Signed-off-by: PaX Team <pageexec@freemail.hu>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/compat.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -780,21 +780,16 @@ asmlinkage long compat_sys_recvmmsg(int
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+
+- if (COMPAT_USE_64BIT_TIME)
+- return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+- flags | MSG_CMSG_COMPAT,
+- (struct timespec *) timeout);
+-
+ if (timeout == NULL)
+ return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT, NULL);
+
+- if (get_compat_timespec(&ktspec, timeout))
++ if (compat_get_timespec(&ktspec, timeout))
+ return -EFAULT;
+
+ datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT, &ktspec);
+- if (datagrams > 0 && put_compat_timespec(&ktspec, timeout))
++ if (datagrams > 0 && compat_put_timespec(&ktspec, timeout))
+ datagrams = -EFAULT;
+
+ return datagrams;
--- /dev/null
+From d6c9ea9069af684358efedcaf2f2f687f51c58ee Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 6 Jan 2014 03:16:32 +0000
+Subject: xhci: Avoid infinite loop when sg urb requires too many trbs
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit d6c9ea9069af684358efedcaf2f2f687f51c58ee upstream.
+
+Currently prepare_ring() returns -ENOMEM if the urb won't fit into a
+single ring segment. usb_sg_wait() treats this error as a temporary
+condition and will keep retrying until something else goes wrong.
+
+The number of retries should be limited in usb_sg_wait(), but also
+prepare_ring() should not return an error code that suggests it might
+be worth retrying. Change it to -EINVAL.
+
+Reported-by: jidanni@jidanni.org
+References: http://bugs.debian.org/733907
+Fixes: 35773dac5f86 ('usb: xhci: Link TRB must not occur within a USB payload burst')
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2964,7 +2964,7 @@ static int prepare_ring(struct xhci_hcd
+ if (num_trbs >= TRBS_PER_SEGMENT) {
+ xhci_err(xhci, "Too many fragments %d, max %d\n",
+ num_trbs, TRBS_PER_SEGMENT - 1);
+- return -ENOMEM;
++ return -EINVAL;
+ }
+
+ nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
--- /dev/null
+From f2d9b991c549f159dc9ae81f77d8206c790cbfee Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Mon, 6 Jan 2014 13:07:03 -0800
+Subject: xhci: Set scatter-gather limit to avoid failed block writes.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit f2d9b991c549f159dc9ae81f77d8206c790cbfee upstream.
+
+Commit 35773dac5f862cb1c82ea151eba3e2f6de51ec3e "usb: xhci: Link TRB
+must not occur within a USB payload burst" attempted to fix an issue
+found with USB ethernet adapters, and inadvertently broke USB storage
+devices. The patch attempts to ensure that transfers never span a
+segment, and rejects transfers that have more than 63 entries (or
+possibly less, if some entries cross 64KB boundaries).
+
+usb-storage limits the maximum transfer size to 120K, and we had assumed
+the block layer would pass a scatter-gather list of 4K entries,
+resulting in no more than 31 sglist entries:
+
+http://marc.info/?l=linux-usb&m=138498190419312&w=2
+
+That assumption was wrong, since we've seen the driver reject a write
+that was 218 sectors long (of probably 512 bytes each):
+
+Jan 1 07:04:49 jidanni5 kernel: [ 559.624704] xhci_hcd 0000:00:14.0: Too many fragments 79, max 63
+...
+Jan 1 07:04:58 jidanni5 kernel: [ 568.622583] Write(10): 2a 00 00 06 85 0e 00 00 da 00
+
+Limit the number of scatter-gather entries to half a ring segment. That
+should be margin enough in case some entries cross 64KB boundaries.
+Increase the number of TRBs per segment from 64 to 256, which should
+result in ring segments fitting on a 4K page.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: jidanni@jidanni.org
+References: http://bugs.debian.org/733907
+Fixes: 35773dac5f86 ('usb: xhci: Link TRB must not occur within a USB payload burst')
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 4 ++--
+ drivers/usb/host/xhci.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4727,8 +4727,8 @@ int xhci_gen_setup(struct usb_hcd *hcd,
+ struct device *dev = hcd->self.controller;
+ int retval;
+
+- /* Accept arbitrarily long scatter-gather lists */
+- hcd->self.sg_tablesize = ~0;
++ /* Limit the block layer scatter-gather lists to half a segment. */
++ hcd->self.sg_tablesize = TRBS_PER_SEGMENT / 2;
+
+ /* support to build packet from discontinuous buffers */
+ hcd->self.no_sg_constraint = 1;
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1262,7 +1262,7 @@ union xhci_trb {
+ * since the command ring is 64-byte aligned.
+ * It must also be greater than 16.
+ */
+-#define TRBS_PER_SEGMENT 64
++#define TRBS_PER_SEGMENT 256
+ /* Allow two commands + a link TRB, along with any reserved command TRBs */
+ #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3)
+ #define TRB_SEGMENT_SIZE (TRBS_PER_SEGMENT*16)
projects / thirdparty / kernel / stable-queue.git / commitdiff
