--- /dev/null
+From ed3770a9cd5764a575b83810ea679bbff2b03082 Mon Sep 17 00:00:00 2001
+From: Søren Holm <sgh@sgh.dk>
+Date: Mon, 17 Sep 2012 21:50:57 +0000
+Subject: asix: Support DLink DUB-E100 H/W Ver C1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Søren Holm <sgh@sgh.dk>
+
+commit ed3770a9cd5764a575b83810ea679bbff2b03082 upstream.
+
+Signed-off-by: Søren Holm <sgh@sgh.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/asix.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -1604,6 +1604,10 @@ static const struct usb_device_id produc
+ USB_DEVICE (0x2001, 0x3c05),
+ .driver_info = (unsigned long) &ax88772_info,
+ }, {
++ // DLink DUB-E100 H/W Ver C1
++ USB_DEVICE (0x2001, 0x1a02),
++ .driver_info = (unsigned long) &ax88772_info,
++}, {
+ // Linksys USB1000
+ USB_DEVICE (0x1737, 0x0039),
+ .driver_info = (unsigned long) &ax88178_info,
--- /dev/null
+From e21093ef6fb4cbecdf926102286dbe280ae965db Mon Sep 17 00:00:00 2001
+From: "Ira W. Snyder" <iws@ovro.caltech.edu>
+Date: Tue, 11 Sep 2012 15:58:15 -0700
+Subject: can: janz-ican3: fix support for older hardware revisions
+
+From: "Ira W. Snyder" <iws@ovro.caltech.edu>
+
+commit e21093ef6fb4cbecdf926102286dbe280ae965db upstream.
+
+The Revision 1.0 Janz CMOD-IO Carrier Board does not have support for
+the reset registers. To support older hardware, the code is changed to
+use the hardware reset register on the Janz VMOD-ICAN3 hardware itself.
+
+Signed-off-by: Ira W. Snyder <iws@ovro.caltech.edu>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/janz-ican3.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/can/janz-ican3.c
++++ b/drivers/net/can/janz-ican3.c
+@@ -1250,7 +1250,6 @@ static irqreturn_t ican3_irq(int irq, vo
+ */
+ static int ican3_reset_module(struct ican3_dev *mod)
+ {
+- u8 val = 1 << mod->num;
+ unsigned long start;
+ u8 runold, runnew;
+
+@@ -1264,8 +1263,7 @@ static int ican3_reset_module(struct ica
+ runold = ioread8(mod->dpm + TARGET_RUNNING);
+
+ /* reset the module */
+- iowrite8(val, &mod->ctrl->reset_assert);
+- iowrite8(val, &mod->ctrl->reset_deassert);
++ iowrite8(0x00, &mod->dpmctrl->hwreset);
+
+ /* wait until the module has finished resetting and is running */
+ start = jiffies;
--- /dev/null
+From ab04c8bd423edb03e2148350a091836c196107fc Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Wed, 19 Sep 2012 14:58:45 +0200
+Subject: can: ti_hecc: fix oops during rmmod
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit ab04c8bd423edb03e2148350a091836c196107fc upstream.
+
+This patch fixes an oops which occurs when unloading the driver, while the
+network interface is still up. The problem is that first the io mapping is
+teared own, then the CAN device is unregistered, resulting in accessing the
+hardware's iomem:
+
+[ 172.744232] Unable to handle kernel paging request at virtual address c88b0040
+[ 172.752441] pgd = c7be4000
+[ 172.755645] [c88b0040] *pgd=87821811, *pte=00000000, *ppte=00000000
+[ 172.762207] Internal error: Oops: 807 [#1] PREEMPT ARM
+[ 172.767517] Modules linked in: ti_hecc(-) can_dev
+[ 172.772430] CPU: 0 Not tainted (3.5.0alpha-00037-g3554cc0 #126)
+[ 172.778961] PC is at ti_hecc_close+0xb0/0x100 [ti_hecc]
+[ 172.784423] LR is at __dev_close_many+0x90/0xc0
+[ 172.789123] pc : [<bf00c768>] lr : [<c033be58>] psr: 60000013
+[ 172.789123] sp : c5c1de68 ip : 00040081 fp : 00000000
+[ 172.801025] r10: 00000001 r9 : c5c1c000 r8 : 00100100
+[ 172.806457] r7 : c5d0a48c r6 : c5d0a400 r5 : 00000000 r4 : c5d0a000
+[ 172.813232] r3 : c88b0000 r2 : 00000001 r1 : c5d0a000 r0 : c5d0a000
+[ 172.820037] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 172.827423] Control: 10c5387d Table: 87be4019 DAC: 00000015
+[ 172.833404] Process rmmod (pid: 600, stack limit = 0xc5c1c2f0)
+[ 172.839447] Stack: (0xc5c1de68 to 0xc5c1e000)
+[ 172.843994] de60: bf00c6b8 c5c1dec8 c5d0a000 c5d0a000 00200200 c033be58
+[ 172.852478] de80: c5c1de44 c5c1dec8 c5c1dec8 c033bf2c c5c1de90 c5c1de90 c5d0a084 c5c1de44
+[ 172.860992] dea0: c5c1dec8 c033c098 c061d3dc c5d0a000 00000000 c05edf28 c05edb34 c000d724
+[ 172.869476] dec0: 00000000 c033c2f8 c5d0a084 c5d0a084 00000000 c033c370 00000000 c5d0a000
+[ 172.877990] dee0: c05edb00 c033c3b8 c5d0a000 bf00d3ac c05edb00 bf00d7c8 bf00d7c8 c02842dc
+[ 172.886474] df00: c02842c8 c0282f90 c5c1c000 c05edb00 bf00d7c8 c0283668 bf00d7c8 00000000
+[ 172.894989] df20: c0611f98 befe2f80 c000d724 c0282d10 bf00d804 00000000 00000013 c0068a8c
+[ 172.903472] df40: c5c538e8 685f6974 00636365 c61571a8 c5cb9980 c61571a8 c6158a20 c00c9bc4
+[ 172.911987] df60: 00000000 00000000 c5cb9980 00000000 c5cb9980 00000000 c7823680 00000006
+[ 172.920471] df80: bf00d804 00000880 c5c1df8c 00000000 000d4267 befe2f80 00000001 b6d90068
+[ 172.928985] dfa0: 00000081 c000d5a0 befe2f80 00000001 befe2f80 00000880 b6d90008 00000008
+[ 172.937469] dfc0: befe2f80 00000001 b6d90068 00000081 00000001 00000000 befe2eac 00000000
+[ 172.945983] dfe0: 00000000 befe2b18 00023ba4 b6e6addc 60000010 befe2f80 a8e00190 86d2d344
+[ 172.954498] [<bf00c768>] (ti_hecc_close+0xb0/0x100 [ti_hecc]) from [<c033be58>] (__dev__registered_many+0xc0/0x2a0)
+[ 172.984161] [<c033c098>] (rollback_registered_many+0xc0/0x2a0) from [<c033c2f8>] (rollback_registered+0x20/0x30)
+[ 172.994750] [<c033c2f8>] (rollback_registered+0x20/0x30) from [<c033c370>] (unregister_netdevice_queue+0x68/0x98)
+[ 173.005401] [<c033c370>] (unregister_netdevice_queue+0x68/0x98) from [<c033c3b8>] (unregister_netdev+0x18/0x20)
+[ 173.015899] [<c033c3b8>] (unregister_netdev+0x18/0x20) from [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc])
+[ 173.026245] [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc]) from [<c02842dc>] (platform_drv_remove+0x14/0x18)
+[ 173.036712] [<c02842dc>] (platform_drv_remove+0x14/0x18) from [<c0282f90>] (__device_release_driver+0x7c/0xbc)
+
+Tested-by: Jan Luebbe <jlu@pengutronix.de>
+Cc: Anant Gole <anantgole@ti.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/ti_hecc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/ti_hecc.c
++++ b/drivers/net/can/ti_hecc.c
+@@ -984,12 +984,12 @@ static int __devexit ti_hecc_remove(stru
+ struct net_device *ndev = platform_get_drvdata(pdev);
+ struct ti_hecc_priv *priv = netdev_priv(ndev);
+
++ unregister_candev(ndev);
+ clk_disable(priv->clk);
+ clk_put(priv->clk);
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ iounmap(priv->base);
+ release_mem_region(res->start, resource_size(res));
+- unregister_candev(ndev);
+ free_candev(ndev);
+ platform_set_drvdata(pdev, NULL);
+
--- /dev/null
+From a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@do-not-panic.com>
+Date: Fri, 14 Sep 2012 15:36:57 -0700
+Subject: cfg80211: fix possible circular lock on reg_regdb_search()
+
+From: "Luis R. Rodriguez" <mcgrof@do-not-panic.com>
+
+commit a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 upstream.
+
+When call_crda() is called we kick off a witch hunt search
+for the same regulatory domain on our internal regulatory
+database and that work gets kicked off on a workqueue, this
+is done while the cfg80211_mutex is held. If that workqueue
+kicks off it will first lock reg_regdb_search_mutex and
+later cfg80211_mutex but to ensure two CPUs will not contend
+against cfg80211_mutex the right thing to do is to have the
+reg_regdb_search() wait until the cfg80211_mutex is let go.
+
+The lockdep report is pasted below.
+
+cfg80211: Calling CRDA to update world regulatory domain
+
+======================================================
+[ INFO: possible circular locking dependency detected ]
+3.3.8 #3 Tainted: G O
+-------------------------------------------------------
+kworker/0:1/235 is trying to acquire lock:
+ (cfg80211_mutex){+.+...}, at: [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
+
+but task is already holding lock:
+ (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (reg_regdb_search_mutex){+.+...}:
+ [<800a8384>] lock_acquire+0x60/0x88
+ [<802950a8>] mutex_lock_nested+0x54/0x31c
+ [<81645778>] is_world_regdom+0x9f8/0xc74 [cfg80211]
+
+-> #1 (reg_mutex#2){+.+...}:
+ [<800a8384>] lock_acquire+0x60/0x88
+ [<802950a8>] mutex_lock_nested+0x54/0x31c
+ [<8164539c>] is_world_regdom+0x61c/0xc74 [cfg80211]
+
+-> #0 (cfg80211_mutex){+.+...}:
+ [<800a77b8>] __lock_acquire+0x10d4/0x17bc
+ [<800a8384>] lock_acquire+0x60/0x88
+ [<802950a8>] mutex_lock_nested+0x54/0x31c
+ [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
+
+other info that might help us debug this:
+
+Chain exists of:
+ cfg80211_mutex --> reg_mutex#2 --> reg_regdb_search_mutex
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(reg_regdb_search_mutex);
+ lock(reg_mutex#2);
+ lock(reg_regdb_search_mutex);
+ lock(cfg80211_mutex);
+
+ *** DEADLOCK ***
+
+3 locks held by kworker/0:1/235:
+ #0: (events){.+.+..}, at: [<80089a00>] process_one_work+0x230/0x460
+ #1: (reg_regdb_work){+.+...}, at: [<80089a00>] process_one_work+0x230/0x460
+ #2: (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]
+
+stack backtrace:
+Call Trace:
+[<80290fd4>] dump_stack+0x8/0x34
+[<80291bc4>] print_circular_bug+0x2ac/0x2d8
+[<800a77b8>] __lock_acquire+0x10d4/0x17bc
+[<800a8384>] lock_acquire+0x60/0x88
+[<802950a8>] mutex_lock_nested+0x54/0x31c
+[<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
+
+Reported-by: Felix Fietkau <nbd@openwrt.org>
+Tested-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/reg.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -340,6 +340,9 @@ static void reg_regdb_search(struct work
+ struct reg_regdb_search_request *request;
+ const struct ieee80211_regdomain *curdom, *regdom;
+ int i, r;
++ bool set_reg = false;
++
++ mutex_lock(&cfg80211_mutex);
+
+ mutex_lock(®_regdb_search_mutex);
+ while (!list_empty(®_regdb_search_list)) {
+@@ -355,9 +358,7 @@ static void reg_regdb_search(struct work
+ r = reg_copy_regd(®dom, curdom);
+ if (r)
+ break;
+- mutex_lock(&cfg80211_mutex);
+- set_regdom(regdom);
+- mutex_unlock(&cfg80211_mutex);
++ set_reg = true;
+ break;
+ }
+ }
+@@ -365,6 +366,11 @@ static void reg_regdb_search(struct work
+ kfree(request);
+ }
+ mutex_unlock(®_regdb_search_mutex);
++
++ if (set_reg)
++ set_regdom(regdom);
++
++ mutex_unlock(&cfg80211_mutex);
+ }
+
+ static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
--- /dev/null
+From 61c6e7531d3b66b33187b8cdd700fd8ab93ffd62 Mon Sep 17 00:00:00 2001
+From: Sachin Kamat <sachin.kamat@linaro.org>
+Date: Mon, 17 Sep 2012 15:20:23 +0530
+Subject: DMA: PL330: Check the pointer returned by kzalloc
+
+From: Sachin Kamat <sachin.kamat@linaro.org>
+
+commit 61c6e7531d3b66b33187b8cdd700fd8ab93ffd62 upstream.
+
+kzalloc could return NULL. Hence add a check to avoid
+NULL pointer dereference.
+
+Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
+Acked-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/pl330.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2937,6 +2937,11 @@ pl330_probe(struct amba_device *adev, co
+ num_chan = max_t(int, pi->pcfg.num_peri, pi->pcfg.num_chan);
+
+ pdmac->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
++ if (!pdmac->peripherals) {
++ ret = -ENOMEM;
++ dev_err(&adev->dev, "unable to allocate pdmac->peripherals\n");
++ goto probe_err5;
++ }
+
+ for (i = 0; i < num_chan; i++) {
+ pch = &pdmac->peripherals[i];
--- /dev/null
+From 2e2c682becb20416c140aa0d6d3137b51a5c76da Mon Sep 17 00:00:00 2001
+From: Sachin Kamat <sachin.kamat@linaro.org>
+Date: Mon, 17 Sep 2012 15:20:22 +0530
+Subject: DMA: PL330: Fix potential NULL pointer dereference in
+ pl330_submit_req()
+
+From: Sachin Kamat <sachin.kamat@linaro.org>
+
+commit 2e2c682becb20416c140aa0d6d3137b51a5c76da upstream.
+
+'r->cfg' is being checked for NULL. However, it is dereferenced
+in the previous statements. Thus moving those statements within
+the check.
+
+Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
+Acked-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/pl330.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -1568,17 +1568,19 @@ static int pl330_submit_req(void *ch_id,
+ goto xfer_exit;
+ }
+
+- /* Prefer Secure Channel */
+- if (!_manager_ns(thrd))
+- r->cfg->nonsecure = 0;
+- else
+- r->cfg->nonsecure = 1;
+
+ /* Use last settings, if not provided */
+- if (r->cfg)
++ if (r->cfg) {
++ /* Prefer Secure Channel */
++ if (!_manager_ns(thrd))
++ r->cfg->nonsecure = 0;
++ else
++ r->cfg->nonsecure = 1;
++
+ ccr = _prepare_ccr(r->cfg);
+- else
++ } else {
+ ccr = readl(regs + CC(thrd->id));
++ }
+
+ /* If this req doesn't have valid xfer settings */
+ if (!_is_valid(ccr)) {
--- /dev/null
+From c456797681db814f4f5b36909e8e94047bf53d9c Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Tue, 11 Sep 2012 17:21:45 +0200
+Subject: dmaengine: at_hdmac: check that each sg data length is non-null
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit c456797681db814f4f5b36909e8e94047bf53d9c upstream.
+
+Avoid the construction of a malformed DMA request sent to
+the DMA controller.
+Log message is for debug only because this condition is unlikely to
+append and may only trigger at driver development time.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -691,6 +691,11 @@ atc_prep_slave_sg(struct dma_chan *chan,
+
+ mem = sg_dma_address(sg);
+ len = sg_dma_len(sg);
++ if (unlikely(!len)) {
++ dev_dbg(chan2dev(chan),
++ "prep_slave_sg: sg(%d) data length is zero\n", i);
++ goto err;
++ }
+ mem_width = 2;
+ if (unlikely(mem & 3 || len & 3))
+ mem_width = 0;
+@@ -726,6 +731,11 @@ atc_prep_slave_sg(struct dma_chan *chan,
+
+ mem = sg_dma_address(sg);
+ len = sg_dma_len(sg);
++ if (unlikely(!len)) {
++ dev_dbg(chan2dev(chan),
++ "prep_slave_sg: sg(%d) data length is zero\n", i);
++ goto err;
++ }
+ mem_width = 2;
+ if (unlikely(mem & 3 || len & 3))
+ mem_width = 0;
+@@ -759,6 +769,7 @@ atc_prep_slave_sg(struct dma_chan *chan,
+
+ err_desc_get:
+ dev_err(chan2dev(chan), "not enough descriptors available\n");
++err:
+ atc_desc_put(atchan, first);
+ return NULL;
+ }
--- /dev/null
+From c618a9be0e8c0f36baee2560860a0118a428fb26 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Tue, 11 Sep 2012 17:21:44 +0200
+Subject: dmaengine: at_hdmac: fix comment in atc_prep_slave_sg()
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit c618a9be0e8c0f36baee2560860a0118a428fb26 upstream.
+
+s/dma_memcpy/slave_sg/ and it is sg length that we are
+talking about.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -664,7 +664,7 @@ atc_prep_slave_sg(struct dma_chan *chan,
+ flags);
+
+ if (unlikely(!atslave || !sg_len)) {
+- dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n");
++ dev_dbg(chan2dev(chan), "prep_slave_sg: sg length is zero!\n");
+ return NULL;
+ }
+
--- /dev/null
+From 3d037774b42ed677f699b1dce7d548d55f4e4c2b Mon Sep 17 00:00:00 2001
+From: Pavankumar Kondeti <pkondeti@codeaurora.org>
+Date: Fri, 7 Sep 2012 11:23:28 +0530
+Subject: EHCI: Update qTD next pointer in QH overlay region during unlink
+
+From: Pavankumar Kondeti <pkondeti@codeaurora.org>
+
+commit 3d037774b42ed677f699b1dce7d548d55f4e4c2b upstream.
+
+There is a possibility of QH overlay region having reference to a stale
+qTD pointer during unlink.
+
+Consider an endpoint having two pending qTD before unlink process begins.
+The endpoint's QH queue looks like this.
+
+qTD1 --> qTD2 --> Dummy
+
+To unlink qTD2, QH is removed from asynchronous list and Asynchronous
+Advance Doorbell is programmed. The qTD1's next qTD pointer is set to
+qTD2'2 next qTD pointer and qTD2 is retired upon controller's doorbell
+interrupt. If QH's current qTD pointer points to qTD1, transfer overlay
+region still have reference to qTD2. But qtD2 is just unlinked and freed.
+This may cause EHCI system error. Fix this by updating qTD next pointer
+in QH overlay region with the qTD next pointer of the current qTD.
+
+Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-q.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -128,9 +128,17 @@ qh_refresh (struct ehci_hcd *ehci, struc
+ else {
+ qtd = list_entry (qh->qtd_list.next,
+ struct ehci_qtd, qtd_list);
+- /* first qtd may already be partially processed */
+- if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current)
++ /*
++ * first qtd may already be partially processed.
++ * If we come here during unlink, the QH overlay region
++ * might have reference to the just unlinked qtd. The
++ * qtd is updated in qh_completions(). Update the QH
++ * overlay here.
++ */
++ if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
++ qh->hw->hw_qtd_next = qtd->hw_next;
+ qtd = NULL;
++ }
+ }
+
+ if (qtd)
--- /dev/null
+From a96874a2a92feaef607ddd3137277a788cb927a6 Mon Sep 17 00:00:00 2001
+From: Keng-Yu Lin <kengyu@canonical.com>
+Date: Fri, 10 Aug 2012 01:39:23 +0800
+Subject: Intel xhci: Only switch the switchable ports
+
+From: Keng-Yu Lin <kengyu@canonical.com>
+
+commit a96874a2a92feaef607ddd3137277a788cb927a6 upstream.
+
+With a previous patch to enable the EHCI/XHCI port switching, it switches
+all the available ports.
+
+The assumption is not correct because the BIOS may expect some ports
+not switchable by the OS.
+
+There are two more registers that contains the information of the switchable
+and non-switchable ports.
+
+This patch adds the checking code for the two register so that only the
+switchable ports are altered.
+
+This patch should be backported to kernels as old as 3.0, that contain
+commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support
+EHCI/xHCI port switching."
+
+Signed-off-by: Keng-Yu Lin <kengyu@canonical.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -75,7 +75,9 @@
+ #define NB_PIF0_PWRDOWN_1 0x01100013
+
+ #define USB_INTEL_XUSB2PR 0xD0
++#define USB_INTEL_USB2PRM 0xD4
+ #define USB_INTEL_USB3_PSSEN 0xD8
++#define USB_INTEL_USB3PRM 0xDC
+
+ static struct amd_chipset_info {
+ struct pci_dev *nb_dev;
+@@ -772,10 +774,18 @@ void usb_enable_xhci_ports(struct pci_de
+ return;
+ }
+
+- ports_available = 0xffffffff;
++ /* Read USB3PRM, the USB 3.0 Port Routing Mask Register
++ * Indicate the ports that can be changed from OS.
++ */
++ pci_read_config_dword(xhci_pdev, USB_INTEL_USB3PRM,
++ &ports_available);
++
++ dev_dbg(&xhci_pdev->dev, "Configurable ports to enable SuperSpeed: 0x%x\n",
++ ports_available);
++
+ /* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
+- * Register, to turn on SuperSpeed terminations for all
+- * available ports.
++ * Register, to turn on SuperSpeed terminations for the
++ * switchable ports.
+ */
+ pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
+ cpu_to_le32(ports_available));
+@@ -785,7 +795,16 @@ void usb_enable_xhci_ports(struct pci_de
+ dev_dbg(&xhci_pdev->dev, "USB 3.0 ports that are now enabled "
+ "under xHCI: 0x%x\n", ports_available);
+
+- ports_available = 0xffffffff;
++ /* Read XUSB2PRM, xHCI USB 2.0 Port Routing Mask Register
++ * Indicate the USB 2.0 ports to be controlled by the xHCI host.
++ */
++
++ pci_read_config_dword(xhci_pdev, USB_INTEL_USB2PRM,
++ &ports_available);
++
++ dev_dbg(&xhci_pdev->dev, "Configurable USB 2.0 ports to hand over to xCHI: 0x%x\n",
++ ports_available);
++
+ /* Write XUSB2PR, the xHC USB 2.0 Port Routing Register, to
+ * switch the USB 2.0 power and data lines over to the xHCI
+ * host.
--- /dev/null
+From 872ece86ea5c367aa92f44689c2d01a1c767aeb3 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Tue, 4 Sep 2012 11:05:07 -0400
+Subject: NFS: Fix a problem with the legacy binary mount code
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 872ece86ea5c367aa92f44689c2d01a1c767aeb3 upstream.
+
+Apparently, am-utils is still using the legacy binary mountdata interface,
+and is having trouble parsing /proc/mounts due to the 'port=' field being
+incorrectly set.
+
+The following patch should fix up the regression.
+
+Reported-by: Marius Tolzmann <tolzmann@molgen.mpg.de>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1886,6 +1886,7 @@ static int nfs_validate_mount_data(void
+
+ memcpy(sap, &data->addr, sizeof(data->addr));
+ args->nfs_server.addrlen = sizeof(data->addr);
++ args->nfs_server.port = ntohs(data->addr.sin_port);
+ if (!nfs_verify_server_address(sap))
+ goto out_no_address;
+
+@@ -2598,6 +2599,7 @@ static int nfs4_validate_mount_data(void
+ return -EFAULT;
+ if (!nfs_verify_server_address(sap))
+ goto out_no_address;
++ args->nfs_server.port = ntohs(((struct sockaddr_in *)sap)->sin_port);
+
+ if (data->auth_flavourlen) {
+ if (data->auth_flavourlen > 1)
--- /dev/null
+From c3f52af3e03013db5237e339c817beaae5ec9e3a Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Mon, 3 Sep 2012 14:56:02 -0400
+Subject: NFS: Fix the initialisation of the readdir 'cookieverf' array
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit c3f52af3e03013db5237e339c817beaae5ec9e3a upstream.
+
+When the NFS_COOKIEVERF helper macro was converted into a static
+inline function in commit 99fadcd764 (nfs: convert NFS_*(inode)
+helpers to static inline), we broke the initialisation of the
+readdir cookies, since that depended on doing a memset with an
+argument of 'sizeof(NFS_COOKIEVERF(inode))' which therefore
+changed from sizeof(be32 cookieverf[2]) to sizeof(be32 *).
+
+At this point, NFS_COOKIEVERF seems to be more of an obfuscation
+than a helper, so the best thing would be to just get rid of it.
+
+Also see: https://bugzilla.kernel.org/show_bug.cgi?id=46881
+
+Reported-by: Andi Kleen <andi@firstfloor.org>
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/inode.c | 2 +-
+ fs/nfs/nfs3proc.c | 2 +-
+ fs/nfs/nfs4proc.c | 4 ++--
+ include/linux/nfs_fs.h | 5 -----
+ 4 files changed, 4 insertions(+), 9 deletions(-)
+
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -152,7 +152,7 @@ static void nfs_zap_caches_locked(struct
+ nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
+ nfsi->attrtimeo_timestamp = jiffies;
+
+- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
++ memset(NFS_I(inode)->cookieverf, 0, sizeof(NFS_I(inode)->cookieverf));
+ if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
+ nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
+ else
+--- a/fs/nfs/nfs3proc.c
++++ b/fs/nfs/nfs3proc.c
+@@ -644,7 +644,7 @@ nfs3_proc_readdir(struct dentry *dentry,
+ u64 cookie, struct page **pages, unsigned int count, int plus)
+ {
+ struct inode *dir = dentry->d_inode;
+- __be32 *verf = NFS_COOKIEVERF(dir);
++ __be32 *verf = NFS_I(dir)->cookieverf;
+ struct nfs3_readdirargs arg = {
+ .fh = NFS_FH(dir),
+ .cookie = cookie,
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3150,11 +3150,11 @@ static int _nfs4_proc_readdir(struct den
+ dentry->d_parent->d_name.name,
+ dentry->d_name.name,
+ (unsigned long long)cookie);
+- nfs4_setup_readdir(cookie, NFS_COOKIEVERF(dir), dentry, &args);
++ nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
+ res.pgbase = args.pgbase;
+ status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
+ if (status >= 0) {
+- memcpy(NFS_COOKIEVERF(dir), res.verifier.data, NFS4_VERIFIER_SIZE);
++ memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
+ status += args.pgbase;
+ }
+
+--- a/include/linux/nfs_fs.h
++++ b/include/linux/nfs_fs.h
+@@ -264,11 +264,6 @@ static inline const struct nfs_rpc_ops *
+ return NFS_SERVER(inode)->nfs_client->rpc_ops;
+ }
+
+-static inline __be32 *NFS_COOKIEVERF(const struct inode *inode)
+-{
+- return NFS_I(inode)->cookieverf;
+-}
+-
+ static inline unsigned NFS_MINATTRTIMEO(const struct inode *inode)
+ {
+ struct nfs_server *nfss = NFS_SERVER(inode);
--- /dev/null
+From 01913b49cf1dc6409a07dd2a4cc6af2e77f3c410 Mon Sep 17 00:00:00 2001
+From: Weston Andros Adamson <dros@netapp.com>
+Date: Thu, 6 Sep 2012 15:54:27 -0400
+Subject: NFS: return error from decode_getfh in decode open
+
+From: Weston Andros Adamson <dros@netapp.com>
+
+commit 01913b49cf1dc6409a07dd2a4cc6af2e77f3c410 upstream.
+
+If decode_getfh failed, nfs4_xdr_dec_open would return 0 since the last
+decode_* call must have succeeded.
+
+Signed-off-by: Weston Andros Adamson <dros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4xdr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -6081,7 +6081,8 @@ static int nfs4_xdr_dec_open(struct rpc_
+ status = decode_open(xdr, res);
+ if (status)
+ goto out;
+- if (decode_getfh(xdr, &res->fh) != 0)
++ status = decode_getfh(xdr, &res->fh);
++ if (status)
+ goto out;
+ if (decode_getfattr(xdr, res->f_attr, res->server) != 0)
+ goto out;
--- /dev/null
+From efd5d6b03bd9c9e0df646c56fb5f4f3e25e5c1ac Mon Sep 17 00:00:00 2001
+From: Sergei Poselenov <sposelenov@emcraft.com>
+Date: Sun, 2 Sep 2012 13:14:32 +0400
+Subject: rt2800usb: Added rx packet length validity check
+
+From: Sergei Poselenov <sposelenov@emcraft.com>
+
+commit efd5d6b03bd9c9e0df646c56fb5f4f3e25e5c1ac upstream.
+
+On our system (ARM Cortex-M3 SOC running linux-2.6.33)
+frequent crashes were observed in the rt2800usb module
+because of the invalid length of the received packet (3392,
+46920...). This patch adds the sanity check on the packet
+legth. Also, changed WARNING to ERROR in rt2x00lib_rxdone()
+so that the bad packet condition would be noticed.
+
+The fix was tested on the latest compat-wireless-3.5.1-1-snpc.
+
+Signed-off-by: Sergei Poselenov <sposelenov@emcraft.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2800usb.c | 10 +++++++++-
+ drivers/net/wireless/rt2x00/rt2x00dev.c | 2 +-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -667,8 +667,16 @@ static void rt2800usb_fill_rxdone(struct
+ skb_pull(entry->skb, RXINFO_DESC_SIZE);
+
+ /*
+- * FIXME: we need to check for rx_pkt_len validity
++ * Check for rx_pkt_len validity. Return if invalid, leaving
++ * rxdesc->size zeroed out by the upper level.
+ */
++ if (unlikely(rx_pkt_len == 0 ||
++ rx_pkt_len > entry->queue->data_size)) {
++ ERROR(entry->queue->rt2x00dev,
++ "Bad frame size %d, forcing to 0\n", rx_pkt_len);
++ return;
++ }
++
+ rxd = (__le32 *)(entry->skb->data + rx_pkt_len);
+
+ /*
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -628,7 +628,7 @@ void rt2x00lib_rxdone(struct queue_entry
+ */
+ if (unlikely(rxdesc.size == 0 ||
+ rxdesc.size > entry->queue->data_size)) {
+- WARNING(rt2x00dev, "Wrong frame size %d max %d.\n",
++ ERROR(rt2x00dev, "Wrong frame size %d max %d.\n",
+ rxdesc.size, entry->queue->data_size);
+ dev_kfree_skb(entry->skb);
+ goto renew_skb;
--- /dev/null
+From a396e10019eaf3809b0219c966865aaafec12630 Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Fri, 31 Aug 2012 19:22:11 +0200
+Subject: rt2x00: Fix rfkill polling prior to interface start.
+
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+
+commit a396e10019eaf3809b0219c966865aaafec12630 upstream.
+
+We need to program the rfkill switch GPIO pin direction to input at
+device initialization time, not only when the interface is brought up.
+Doing this only when the interface is brought up could lead to rfkill
+detecting the switch is turned on erroneously and inability to create
+the interface and bringing it up.
+
+Reported-and-tested-by: Andreas Messer <andi@bastelmap.de>
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo Van Doorn <ivdoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2400pci.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt2400pci.h | 1 +
+ drivers/net/wireless/rt2x00/rt2500pci.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt2500usb.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt2500usb.h | 1 +
+ drivers/net/wireless/rt2x00/rt2800pci.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt2800usb.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt61pci.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt61pci.h | 1 +
+ drivers/net/wireless/rt2x00/rt73usb.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt73usb.h | 3 +++
+ 11 files changed, 69 insertions(+)
+
+--- a/drivers/net/wireless/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/rt2x00/rt2400pci.c
+@@ -1611,6 +1611,7 @@ static int rt2400pci_probe_hw_mode(struc
+ static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -1624,6 +1625,14 @@ static int rt2400pci_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00pci_register_read(rt2x00dev, GPIOCSR, ®);
++ rt2x00_set_field32(®, GPIOCSR_BIT8, 1);
++ rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2400pci_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt2400pci.h
++++ b/drivers/net/wireless/rt2x00/rt2400pci.h
+@@ -670,6 +670,7 @@
+ #define GPIOCSR_BIT5 FIELD32(0x00000020)
+ #define GPIOCSR_BIT6 FIELD32(0x00000040)
+ #define GPIOCSR_BIT7 FIELD32(0x00000080)
++#define GPIOCSR_BIT8 FIELD32(0x00000100)
+
+ /*
+ * BBPPCSR: BBP Pin control register.
+--- a/drivers/net/wireless/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/rt2x00/rt2500pci.c
+@@ -1929,6 +1929,7 @@ static int rt2500pci_probe_hw_mode(struc
+ static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -1942,6 +1943,14 @@ static int rt2500pci_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00pci_register_read(rt2x00dev, GPIOCSR, ®);
++ rt2x00_set_field32(®, GPIOCSR_DIR0, 1);
++ rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2500pci_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/rt2x00/rt2500usb.c
+@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(struc
+ static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u16 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2500usb_register_read(rt2x00dev, MAC_CSR19, ®);
++ rt2x00_set_field16(®, MAC_CSR19_BIT8, 0);
++ rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2500usb_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt2500usb.h
++++ b/drivers/net/wireless/rt2x00/rt2500usb.h
+@@ -197,6 +197,7 @@
+ #define MAC_CSR19_BIT5 FIELD16(0x0020)
+ #define MAC_CSR19_BIT6 FIELD16(0x0040)
+ #define MAC_CSR19_BIT7 FIELD16(0x0080)
++#define MAC_CSR19_BIT8 FIELD16(0x0100)
+
+ /*
+ * MAC_CSR20: LED control register.
+--- a/drivers/net/wireless/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/rt2x00/rt2800pci.c
+@@ -973,6 +973,7 @@ static int rt2800pci_validate_eeprom(str
+ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -986,6 +987,14 @@ static int rt2800pci_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, ®);
++ rt2x00_set_field32(®, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
++ rt2x00pci_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2800_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -736,6 +736,7 @@ static int rt2800usb_validate_eeprom(str
+ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -749,6 +750,14 @@ static int rt2800usb_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, ®);
++ rt2x00_set_field32(®, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
++ rt2x00usb_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2800_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/rt2x00/rt61pci.c
+@@ -2832,6 +2832,7 @@ static int rt61pci_probe_hw_mode(struct
+ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Disable power saving.
+@@ -2850,6 +2851,14 @@ static int rt61pci_probe_hw(struct rt2x0
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00pci_register_read(rt2x00dev, MAC_CSR13, ®);
++ rt2x00_set_field32(®, MAC_CSR13_BIT13, 1);
++ rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt61pci_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt61pci.h
++++ b/drivers/net/wireless/rt2x00/rt61pci.h
+@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry {
+ #define MAC_CSR13_BIT10 FIELD32(0x00000400)
+ #define MAC_CSR13_BIT11 FIELD32(0x00000800)
+ #define MAC_CSR13_BIT12 FIELD32(0x00001000)
++#define MAC_CSR13_BIT13 FIELD32(0x00002000)
+
+ /*
+ * MAC_CSR14: LED control register.
+--- a/drivers/net/wireless/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/rt2x00/rt73usb.c
+@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(struct
+ static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x0
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00usb_register_read(rt2x00dev, MAC_CSR13, ®);
++ rt2x00_set_field32(®, MAC_CSR13_BIT15, 0);
++ rt2x00usb_register_write(rt2x00dev, MAC_CSR13, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt73usb_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt73usb.h
++++ b/drivers/net/wireless/rt2x00/rt73usb.h
+@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry {
+ #define MAC_CSR13_BIT10 FIELD32(0x00000400)
+ #define MAC_CSR13_BIT11 FIELD32(0x00000800)
+ #define MAC_CSR13_BIT12 FIELD32(0x00001000)
++#define MAC_CSR13_BIT13 FIELD32(0x00002000)
++#define MAC_CSR13_BIT14 FIELD32(0x00004000)
++#define MAC_CSR13_BIT15 FIELD32(0x00008000)
+
+ /*
+ * MAC_CSR14: LED control register.
--- /dev/null
+From 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Fri, 31 Aug 2012 19:22:10 +0200
+Subject: rt2x00: Fix word size of rt2500usb MAC_CSR19 register.
+
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+
+commit 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 upstream.
+
+The register is 16 bits wide, not 32.
+
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo Van Doorn <ivdoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2500usb.c | 2 +-
+ drivers/net/wireless/rt2x00/rt2500usb.h | 16 ++++++++--------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/rt2x00/rt2500usb.c
+@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(struct
+ u16 reg;
+
+ rt2500usb_register_read(rt2x00dev, MAC_CSR19, ®);
+- return rt2x00_get_field32(reg, MAC_CSR19_BIT7);
++ return rt2x00_get_field16(reg, MAC_CSR19_BIT7);
+ }
+
+ #ifdef CONFIG_RT2X00_LIB_LEDS
+--- a/drivers/net/wireless/rt2x00/rt2500usb.h
++++ b/drivers/net/wireless/rt2x00/rt2500usb.h
+@@ -189,14 +189,14 @@
+ * MAC_CSR19: GPIO control register.
+ */
+ #define MAC_CSR19 0x0426
+-#define MAC_CSR19_BIT0 FIELD32(0x0001)
+-#define MAC_CSR19_BIT1 FIELD32(0x0002)
+-#define MAC_CSR19_BIT2 FIELD32(0x0004)
+-#define MAC_CSR19_BIT3 FIELD32(0x0008)
+-#define MAC_CSR19_BIT4 FIELD32(0x0010)
+-#define MAC_CSR19_BIT5 FIELD32(0x0020)
+-#define MAC_CSR19_BIT6 FIELD32(0x0040)
+-#define MAC_CSR19_BIT7 FIELD32(0x0080)
++#define MAC_CSR19_BIT0 FIELD16(0x0001)
++#define MAC_CSR19_BIT1 FIELD16(0x0002)
++#define MAC_CSR19_BIT2 FIELD16(0x0004)
++#define MAC_CSR19_BIT3 FIELD16(0x0008)
++#define MAC_CSR19_BIT4 FIELD16(0x0010)
++#define MAC_CSR19_BIT5 FIELD16(0x0020)
++#define MAC_CSR19_BIT6 FIELD16(0x0040)
++#define MAC_CSR19_BIT7 FIELD16(0x0080)
+
+ /*
+ * MAC_CSR20: LED control register.
--- /dev/null
+From 177ef8360fabdc49ff08d2598c06e7f7a36b53e3 Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Fri, 31 Aug 2012 19:22:09 +0200
+Subject: rt2x00: Identify ASUS USB-N53 device.
+
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+
+commit 177ef8360fabdc49ff08d2598c06e7f7a36b53e3 upstream.
+
+This is an RT3572 based device.
+
+Signed-off-by: Maximilian Engelhardt <maxi@daemonizer.de>
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo Van Doorn <ivdoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2800usb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -1157,6 +1157,8 @@ static struct usb_device_id rt2800usb_de
+ { USB_DEVICE(0x1690, 0x0744) },
+ { USB_DEVICE(0x1690, 0x0761) },
+ { USB_DEVICE(0x1690, 0x0764) },
++ /* ASUS */
++ { USB_DEVICE(0x0b05, 0x179d) },
+ /* Cisco */
+ { USB_DEVICE(0x167b, 0x4001) },
+ /* EnGenius */
+@@ -1222,7 +1224,6 @@ static struct usb_device_id rt2800usb_de
+ { USB_DEVICE(0x0b05, 0x1760) },
+ { USB_DEVICE(0x0b05, 0x1761) },
+ { USB_DEVICE(0x0b05, 0x1790) },
+- { USB_DEVICE(0x0b05, 0x179d) },
+ /* AzureWave */
+ { USB_DEVICE(0x13d3, 0x3262) },
+ { USB_DEVICE(0x13d3, 0x3284) },
input-i8042-disable-mux-on-toshiba-c850d.patch
mips-mm-add-compound-tail-page-_mapcount-when-mapped.patch
rtlwifi-rtl8192ce-log-message-that-b_cut-device-may-not-work.patch
+asix-support-dlink-dub-e100-h-w-ver-c1.patch
+can-ti_hecc-fix-oops-during-rmmod.patch
+can-janz-ican3-fix-support-for-older-hardware-revisions.patch
+cfg80211-fix-possible-circular-lock-on-reg_regdb_search.patch
+dma-pl330-fix-potential-null-pointer-dereference-in.patch
+dma-pl330-check-the-pointer-returned-by-kzalloc.patch
+dmaengine-at_hdmac-fix-comment-in-atc_prep_slave_sg.patch
+dmaengine-at_hdmac-check-that-each-sg-data-length-is-non-null.patch
+rt2x00-identify-asus-usb-n53-device.patch
+rt2x00-fix-word-size-of-rt2500usb-mac_csr19-register.patch
+rt2x00-fix-rfkill-polling-prior-to-interface-start.patch
+nfs-fix-the-initialisation-of-the-readdir-cookieverf-array.patch
+nfs-fix-a-problem-with-the-legacy-binary-mount-code.patch
+nfs-return-error-from-decode_getfh-in-decode-open.patch
+ehci-update-qtd-next-pointer-in-qh-overlay-region-during-unlink.patch
+usb-ftdi_sio-pid-for-nzr-sem-16-usb.patch
+usb-ftdi_sio-do-not-claim-cdc-acm-function.patch
+usb-ftdi-sio-add-support-for-more-physik-instrumente-devices.patch
+usb-dwc3-ep0-correct-cache-sync-issue-in-case-of-ep0_bounced.patch
+usb-cdc-wdm-fix-wdm_find_device-return-value.patch
+usb-ohci-at91-fix-pio-handling-in-relation-with-number-of-ports.patch
+usb-add-device-quirk-for-joss-optical-touchboard.patch
+rt2800usb-added-rx-packet-length-validity-check.patch
+usb-host-xhci-fix-compliance-mode-on-sn65lvpe502cp-hardware.patch
+intel-xhci-only-switch-the-switchable-ports.patch
+usb-host-xhci-plat-use-ioremap_nocache.patch
+xhci-fix-a-logical-vs-bitwise-and-bug.patch
+xhci-make-handover-code-more-robust.patch
+xhci-recognize-usb-3.0-devices-as-superspeed-at-powerup.patch
+usb-host-xhci-fix-compilation-error-for-non-pci-based-stacks.patch
--- /dev/null
+From 92fc7a8b0f20bdb243c706daf42658e8e0cd2ef0 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 4 Sep 2012 10:41:02 -0400
+Subject: USB: add device quirk for Joss Optical touchboard
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 92fc7a8b0f20bdb243c706daf42658e8e0cd2ef0 upstream.
+
+This patch (as1604) adds a CONFIG_INTF_STRINGS quirk for the Joss
+infrared touchboard device. The device doesn't like to be asked for
+its interface strings.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: adam ? <adam3337@wp.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -96,6 +96,10 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x04b4, 0x0526), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ /* Microchip Joss Optical infrared touchboard device */
++ { USB_DEVICE(0x04d8, 0x000c), .driver_info =
++ USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ /* Samsung Android phone modem - ID conflict with SPH-I500 */
+ { USB_DEVICE(0x04e8, 0x6601), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
--- /dev/null
+From 6a44886899ef8cc396e230e492e6a56a883889f3 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Mon, 10 Sep 2012 22:17:34 +0200
+Subject: USB: cdc-wdm: fix wdm_find_device* return value
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit 6a44886899ef8cc396e230e492e6a56a883889f3 upstream.
+
+A logic error made the wdm_find_device* functions
+return a bogus pointer into static data instead of
+the intended NULL no matching device was found.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-wdm.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -134,12 +134,14 @@ static struct usb_driver wdm_driver;
+ /* return intfdata if we own the interface, else look up intf in the list */
+ static struct wdm_device *wdm_find_device(struct usb_interface *intf)
+ {
+- struct wdm_device *desc = NULL;
++ struct wdm_device *desc;
+
+ spin_lock(&wdm_device_list_lock);
+ list_for_each_entry(desc, &wdm_device_list, device_list)
+ if (desc->intf == intf)
+- break;
++ goto found;
++ desc = NULL;
++found:
+ spin_unlock(&wdm_device_list_lock);
+
+ return desc;
+@@ -147,12 +149,14 @@ static struct wdm_device *wdm_find_devic
+
+ static struct wdm_device *wdm_find_device_by_minor(int minor)
+ {
+- struct wdm_device *desc = NULL;
++ struct wdm_device *desc;
+
+ spin_lock(&wdm_device_list_lock);
+ list_for_each_entry(desc, &wdm_device_list, device_list)
+ if (desc->intf->minor == minor)
+- break;
++ goto found;
++ desc = NULL;
++found:
+ spin_unlock(&wdm_device_list_lock);
+
+ return desc;
--- /dev/null
+From 0416e494ce7dc84e2719bc9fb7daecb330476074 Mon Sep 17 00:00:00 2001
+From: Pratyush Anand <pratyush.anand@st.com>
+Date: Fri, 10 Aug 2012 13:42:16 +0530
+Subject: usb: dwc3: ep0: correct cache sync issue in case of ep0_bounced
+
+From: Pratyush Anand <pratyush.anand@st.com>
+
+commit 0416e494ce7dc84e2719bc9fb7daecb330476074 upstream.
+
+In case of ep0 out, if length is not aligned to maxpacket size then we use
+dwc->ep_bounce_addr for dma transfer and not request->dma. Since, we have
+alreday done memcpy from dwc->ep0_bounce to request->buf, so we do not need to
+issue cache sync function. In fact, cache sync function will bring wrong data
+in request->buf from request->dma in this scenario.
+
+So, cache sync function must not be executed in case of ep0 bounced.
+
+Signed-off-by: Pratyush Anand <pratyush.anand@st.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/ep0.c | 1 -
+ drivers/usb/dwc3/gadget.c | 7 +++++--
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -569,7 +569,6 @@ static void dwc3_ep0_complete_data(struc
+ transferred = min_t(u32, ur->length,
+ transfer_size - length);
+ memcpy(ur->buf, dwc->ep0_bounce, transferred);
+- dwc->ep0_bounced = false;
+ } else {
+ transferred = ur->length - length;
+ }
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -238,8 +238,11 @@ void dwc3_gadget_giveback(struct dwc3_ep
+ if (req->request.status == -EINPROGRESS)
+ req->request.status = status;
+
+- usb_gadget_unmap_request(&dwc->gadget, &req->request,
+- req->direction);
++ if (dwc->ep0_bounced && dep->number == 0)
++ dwc->ep0_bounced = false;
++ else
++ usb_gadget_unmap_request(&dwc->gadget, &req->request,
++ req->direction);
+
+ dev_dbg(dwc->dev, "request %p from %s completed %d/%d ===> %d\n",
+ req, dep->name, req->request.actual,
--- /dev/null
+From dafc4f7be1a556ca3868d343c00127728b397068 Mon Sep 17 00:00:00 2001
+From: Éric Piel <piel@delmic.com>
+Date: Tue, 4 Sep 2012 17:25:06 +0200
+Subject: USB: ftdi-sio: add support for more Physik Instrumente devices
+
+From: Éric Piel <piel@delmic.com>
+
+commit dafc4f7be1a556ca3868d343c00127728b397068 upstream.
+
+Commit b69cc672052540 added support for the E-861. After acquiring a C-867, I
+realised that every Physik Instrumente's device has a different PID. They are
+listed in the Windows device driver's .inf file. So here are all PIDs for the
+current (and probably future) USB devices from Physik Instrumente.
+
+Compiled, but only actually tested on the E-861 and C-867.
+
+Signed-off-by: Éric Piel <piel@delmic.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++++
+ drivers/usb/serial/ftdi_sio_ids.h | 21 ++++++++++++++++++++-
+ 2 files changed, 37 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -813,7 +813,24 @@ static struct usb_device_id id_table_com
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
+ { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
++ { USB_DEVICE(FTDI_VID, PI_C865_PID) },
++ { USB_DEVICE(FTDI_VID, PI_C857_PID) },
++ { USB_DEVICE(PI_VID, PI_C866_PID) },
++ { USB_DEVICE(PI_VID, PI_C663_PID) },
++ { USB_DEVICE(PI_VID, PI_C725_PID) },
++ { USB_DEVICE(PI_VID, PI_E517_PID) },
++ { USB_DEVICE(PI_VID, PI_C863_PID) },
+ { USB_DEVICE(PI_VID, PI_E861_PID) },
++ { USB_DEVICE(PI_VID, PI_C867_PID) },
++ { USB_DEVICE(PI_VID, PI_E609_PID) },
++ { USB_DEVICE(PI_VID, PI_E709_PID) },
++ { USB_DEVICE(PI_VID, PI_100F_PID) },
++ { USB_DEVICE(PI_VID, PI_1011_PID) },
++ { USB_DEVICE(PI_VID, PI_1012_PID) },
++ { USB_DEVICE(PI_VID, PI_1013_PID) },
++ { USB_DEVICE(PI_VID, PI_1014_PID) },
++ { USB_DEVICE(PI_VID, PI_1015_PID) },
++ { USB_DEVICE(PI_VID, PI_1016_PID) },
+ { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
+ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -797,8 +797,27 @@
+ * Physik Instrumente
+ * http://www.physikinstrumente.com/en/products/
+ */
++/* These two devices use the VID of FTDI */
++#define PI_C865_PID 0xe0a0 /* PI C-865 Piezomotor Controller */
++#define PI_C857_PID 0xe0a1 /* PI Encoder Trigger Box */
++
+ #define PI_VID 0x1a72 /* Vendor ID */
+-#define PI_E861_PID 0x1008 /* E-861 piezo controller USB connection */
++#define PI_C866_PID 0x1000 /* PI C-866 Piezomotor Controller */
++#define PI_C663_PID 0x1001 /* PI C-663 Mercury-Step */
++#define PI_C725_PID 0x1002 /* PI C-725 Piezomotor Controller */
++#define PI_E517_PID 0x1005 /* PI E-517 Digital Piezo Controller Operation Module */
++#define PI_C863_PID 0x1007 /* PI C-863 */
++#define PI_E861_PID 0x1008 /* PI E-861 Piezomotor Controller */
++#define PI_C867_PID 0x1009 /* PI C-867 Piezomotor Controller */
++#define PI_E609_PID 0x100D /* PI E-609 Digital Piezo Controller */
++#define PI_E709_PID 0x100E /* PI E-709 Digital Piezo Controller */
++#define PI_100F_PID 0x100F /* PI Digital Piezo Controller */
++#define PI_1011_PID 0x1011 /* PI Digital Piezo Controller */
++#define PI_1012_PID 0x1012 /* PI Motion Controller */
++#define PI_1013_PID 0x1013 /* PI Motion Controller */
++#define PI_1014_PID 0x1014 /* PI Device */
++#define PI_1015_PID 0x1015 /* PI Device */
++#define PI_1016_PID 0x1016 /* PI Digital Servo Module */
+
+ /*
+ * Kondo Kagaku Co.Ltd.
--- /dev/null
+From f08dea734844aa42ec57c229b0b73b3d7d21f810 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Mon, 10 Sep 2012 12:01:05 +0200
+Subject: USB: ftdi_sio: do not claim CDC ACM function
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit f08dea734844aa42ec57c229b0b73b3d7d21f810 upstream.
+
+The Microchip vid:pid 04d8:000a is used for their CDC ACM
+demo firmware application. This is a device with a single
+function conforming to the CDC ACM specification and with
+the intention of demonstrating CDC ACM class firmware and
+driver interaction. The demo is used on a number of
+development boards, and may also be used unmodified by
+vendors using Microchip hardware.
+
+Some vendors have re-used this vid:pid for other types of
+firmware, emulating FTDI chips. Attempting to continue to
+support such devices without breaking class based
+applications that by matching on interface
+class/subclass/proto being ff/ff/00. I have no information
+about the actual device or interface descriptors, but this
+will at least make the proper CDC ACM devices work again.
+Anyone having details of the offending device's descriptors
+should update this entry with the details.
+
+Reported-by: Florian Wöhrl <fw@woehrl.biz>
+Reported-by: Xiaofan Chen <xiaofanc@gmail.com>
+Cc: Alan Cox <alan@linux.intel.com>
+Cc: Bruno Thomsen <bruno.thomsen@gmail.com>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 4 +++-
+ drivers/usb/serial/ftdi_sio_ids.h | 5 ++++-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -805,7 +805,9 @@ static struct usb_device_id id_table_com
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+- { USB_DEVICE(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID) },
++ { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
++ USB_CLASS_VENDOR_SPEC,
++ USB_SUBCLASS_VENDOR_SPEC, 0x00) },
+ { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+ { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -542,7 +542,10 @@
+ /*
+ * Microchip Technology, Inc.
+ *
+- * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are also used by:
++ * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
++ * used by single function CDC ACM class based firmware demo
++ * applications. The VID/PID has also been used in firmware
++ * emulating FTDI serial chips by:
+ * Hornby Elite - Digital Command Control Console
+ * http://www.hornby.com/hornby-dcc/controllers/
+ */
--- /dev/null
+From 26a538b9ea2a3ee10dafc0068f0560dfd7b7ba37 Mon Sep 17 00:00:00 2001
+From: Horst Schirmeier <horst@schirmeier.com>
+Date: Fri, 31 Aug 2012 00:00:28 +0200
+Subject: USB: ftdi_sio: PID for NZR SEM 16+ USB
+
+From: Horst Schirmeier <horst@schirmeier.com>
+
+commit 26a538b9ea2a3ee10dafc0068f0560dfd7b7ba37 upstream.
+
+This adds the USB PID for the NZR SEM 16+ USB energy monitor device
+<http://www.nzr.de>. It works perfectly with the GPL software on
+<http://schou.dk/linux/sparometer/>.
+
+Signed-off-by: Horst Schirmeier <horst@schirmeier.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -704,6 +704,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_NZR_SEM_USB_PID) },
+ { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
+ { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
+ { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -75,6 +75,9 @@
+ #define FTDI_OPENDCC_GATEWAY_PID 0xBFDB
+ #define FTDI_OPENDCC_GBM_PID 0xBFDC
+
++/* NZR SEM 16+ USB (http://www.nzr.de) */
++#define FTDI_NZR_SEM_USB_PID 0xC1E0 /* NZR SEM-LOG16+ */
++
+ /*
+ * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
+ */
--- /dev/null
+From 296365781903226a3fb8758901eaeec09d2798e4 Mon Sep 17 00:00:00 2001
+From: Moiz Sonasath <m-sonasath@ti.com>
+Date: Wed, 5 Sep 2012 08:34:26 +0300
+Subject: usb: host: xhci: fix compilation error for non-PCI based stacks
+
+From: Moiz Sonasath <m-sonasath@ti.com>
+
+commit 296365781903226a3fb8758901eaeec09d2798e4 upstream.
+
+For non PCI-based stacks, this function call
+usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
+made from xhci_shutdown is not applicable.
+
+Ideally, we wouldn't have any PCI-specific code on
+a generic driver such as the xHCI stack, but it looks
+like we should just stub usb_disable_xhci_ports() out
+for non-PCI devices.
+
+[ balbi@ti.com: slight improvement to commit log ]
+
+This patch should be backported to kernels as old as 3.0, since the
+commit it fixes (e95829f474f0db3a4d940cae1423783edd966027 "xhci: Switch
+PPT ports to EHCI on shutdown.") was marked for stable.
+
+Signed-off-by: Moiz Sonasath<m-sonasath@ti.com>
+Signed-off-by: Ruchika Kharwar <ruchika@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/pci-quirks.h
++++ b/drivers/usb/host/pci-quirks.h
+@@ -15,6 +15,7 @@ void usb_disable_xhci_ports(struct pci_d
+ static inline void usb_amd_quirk_pll_disable(void) {}
+ static inline void usb_amd_quirk_pll_enable(void) {}
+ static inline void usb_amd_dev_put(void) {}
++static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
+ #endif /* CONFIG_PCI */
+
+ #endif /* __LINUX_USB_PCI_QUIRKS_H */
--- /dev/null
+From 71c731a296f1b08a3724bd1b514b64f1bda87a23 Mon Sep 17 00:00:00 2001
+From: "Alexis R. Cortes" <alexis.cortes@ti.com>
+Date: Fri, 3 Aug 2012 14:00:27 -0500
+Subject: usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP Hardware
+
+From: "Alexis R. Cortes" <alexis.cortes@ti.com>
+
+commit 71c731a296f1b08a3724bd1b514b64f1bda87a23 upstream.
+
+This patch is intended to work around a known issue on the
+SN65LVPE502CP USB3.0 re-driver that can delay the negotiation
+between a device and the host past the usual handshake timeout.
+
+If that happens on the first insertion, the host controller
+port will enter in Compliance Mode and NO port status event will
+be generated (as per xHCI Spec) making impossible to detect this
+event by software. The port will remain in compliance mode until
+a warm reset is applied to it.
+
+As a result of this, the port will seem "dead" to the user and no
+device connections or disconnections will be detected.
+
+For solving this, the patch creates a timer which polls every 2
+seconds the link state of each host controller's port (this
+by reading the PORTSC register) and recovers the port by issuing a
+Warm reset every time Compliance mode is detected.
+
+If a xHC USB3.0 port has previously entered to U0, the compliance
+mode issue will NOT occur only until system resumes from
+sleep/hibernate, therefore, the compliance mode timer is stopped
+when all xHC USB 3.0 ports have entered U0. The timer is initialized
+again after each system resume.
+
+Since the issue is being caused by a piece of hardware, the timer
+will be enabled ONLY on those systems that have the SN65LVPE502CP
+installed (this patch uses DMI strings for detecting those systems)
+therefore making this patch to act as a quirk (XHCI_COMP_MODE_QUIRK
+has been added to the xhci stack).
+
+This patch applies for these systems:
+Vendor: Hewlett-Packard. System Models: Z420, Z620 and Z820.
+
+This patch should be backported to kernels as old as 3.2, as that was
+the first kernel to support warm reset. The kernels will need to
+contain both commit 10d674a82e553cb8a1f41027bb3c3e309b3f6804 "USB: When
+hot reset for USB3 fails, try warm reset" and commit
+8bea2bd37df08aaa599aa361a9f8b836ba98e554 "usb: Add support for root hub
+port status CAS". The first patch add warm reset support, and the
+second patch modifies the USB core to issue a warm reset when the port
+is in compliance mode.
+
+Signed-off-by: Alexis R. Cortes <alexis.cortes@ti.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 42 +++++++++++++++
+ drivers/usb/host/xhci.c | 121 ++++++++++++++++++++++++++++++++++++++++++++
+ drivers/usb/host/xhci.h | 6 ++
+ 3 files changed, 169 insertions(+)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -493,11 +493,48 @@ static void xhci_hub_report_link_state(u
+ * when this bit is set.
+ */
+ pls |= USB_PORT_STAT_CONNECTION;
++ } else {
++ /*
++ * If CAS bit isn't set but the Port is already at
++ * Compliance Mode, fake a connection so the USB core
++ * notices the Compliance state and resets the port.
++ * This resolves an issue generated by the SN65LVPE502CP
++ * in which sometimes the port enters compliance mode
++ * caused by a delay on the host-device negotiation.
++ */
++ if (pls == USB_SS_PORT_LS_COMP_MOD)
++ pls |= USB_PORT_STAT_CONNECTION;
+ }
++
+ /* update status field */
+ *status |= pls;
+ }
+
++/*
++ * Function for Compliance Mode Quirk.
++ *
++ * This Function verifies if all xhc USB3 ports have entered U0, if so,
++ * the compliance mode timer is deleted. A port won't enter
++ * compliance mode if it has previously entered U0.
++ */
++void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
++{
++ u32 all_ports_seen_u0 = ((1 << xhci->num_usb3_ports)-1);
++ bool port_in_u0 = ((status & PORT_PLS_MASK) == XDEV_U0);
++
++ if (!(xhci->quirks & XHCI_COMP_MODE_QUIRK))
++ return;
++
++ if ((xhci->port_status_u0 != all_ports_seen_u0) && port_in_u0) {
++ xhci->port_status_u0 |= 1 << wIndex;
++ if (xhci->port_status_u0 == all_ports_seen_u0) {
++ del_timer_sync(&xhci->comp_mode_recovery_timer);
++ xhci_dbg(xhci, "All USB3 ports have entered U0 already!\n");
++ xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted.\n");
++ }
++ }
++}
++
+ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ u16 wIndex, char *buf, u16 wLength)
+ {
+@@ -644,6 +681,11 @@ int xhci_hub_control(struct usb_hcd *hcd
+ /* Update Port Link State for super speed ports*/
+ if (hcd->speed == HCD_USB3) {
+ xhci_hub_report_link_state(&status, temp);
++ /*
++ * Verify if all USB3 Ports Have entered U0 already.
++ * Delete Compliance Mode Timer if so.
++ */
++ xhci_del_comp_mod_timer(xhci, temp, wIndex);
+ }
+ if (bus_state->port_c_suspend & (1 << wIndex))
+ status |= 1 << USB_PORT_FEAT_C_SUSPEND;
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -26,6 +26,7 @@
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+ #include <linux/slab.h>
++#include <linux/dmi.h>
+
+ #include "xhci.h"
+
+@@ -398,6 +399,95 @@ static void xhci_msix_sync_irqs(struct x
+
+ #endif
+
++static void compliance_mode_recovery(unsigned long arg)
++{
++ struct xhci_hcd *xhci;
++ struct usb_hcd *hcd;
++ u32 temp;
++ int i;
++
++ xhci = (struct xhci_hcd *)arg;
++
++ for (i = 0; i < xhci->num_usb3_ports; i++) {
++ temp = xhci_readl(xhci, xhci->usb3_ports[i]);
++ if ((temp & PORT_PLS_MASK) == USB_SS_PORT_LS_COMP_MOD) {
++ /*
++ * Compliance Mode Detected. Letting USB Core
++ * handle the Warm Reset
++ */
++ xhci_dbg(xhci, "Compliance Mode Detected->Port %d!\n",
++ i + 1);
++ xhci_dbg(xhci, "Attempting Recovery routine!\n");
++ hcd = xhci->shared_hcd;
++
++ if (hcd->state == HC_STATE_SUSPENDED)
++ usb_hcd_resume_root_hub(hcd);
++
++ usb_hcd_poll_rh_status(hcd);
++ }
++ }
++
++ if (xhci->port_status_u0 != ((1 << xhci->num_usb3_ports)-1))
++ mod_timer(&xhci->comp_mode_recovery_timer,
++ jiffies + msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
++}
++
++/*
++ * Quirk to work around issue generated by the SN65LVPE502CP USB3.0 re-driver
++ * that causes ports behind that hardware to enter compliance mode sometimes.
++ * The quirk creates a timer that polls every 2 seconds the link state of
++ * each host controller's port and recovers it by issuing a Warm reset
++ * if Compliance mode is detected, otherwise the port will become "dead" (no
++ * device connections or disconnections will be detected anymore). Becasue no
++ * status event is generated when entering compliance mode (per xhci spec),
++ * this quirk is needed on systems that have the failing hardware installed.
++ */
++static void compliance_mode_recovery_timer_init(struct xhci_hcd *xhci)
++{
++ xhci->port_status_u0 = 0;
++ init_timer(&xhci->comp_mode_recovery_timer);
++
++ xhci->comp_mode_recovery_timer.data = (unsigned long) xhci;
++ xhci->comp_mode_recovery_timer.function = compliance_mode_recovery;
++ xhci->comp_mode_recovery_timer.expires = jiffies +
++ msecs_to_jiffies(COMP_MODE_RCVRY_MSECS);
++
++ set_timer_slack(&xhci->comp_mode_recovery_timer,
++ msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
++ add_timer(&xhci->comp_mode_recovery_timer);
++ xhci_dbg(xhci, "Compliance Mode Recovery Timer Initialized.\n");
++}
++
++/*
++ * This function identifies the systems that have installed the SN65LVPE502CP
++ * USB3.0 re-driver and that need the Compliance Mode Quirk.
++ * Systems:
++ * Vendor: Hewlett-Packard -> System Models: Z420, Z620 and Z820
++ */
++static bool compliance_mode_recovery_timer_quirk_check(void)
++{
++ const char *dmi_product_name, *dmi_sys_vendor;
++
++ dmi_product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
++ dmi_sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
++
++ if (!(strstr(dmi_sys_vendor, "Hewlett-Packard")))
++ return false;
++
++ if (strstr(dmi_product_name, "Z420") ||
++ strstr(dmi_product_name, "Z620") ||
++ strstr(dmi_product_name, "Z820"))
++ return true;
++
++ return false;
++}
++
++static int xhci_all_ports_seen_u0(struct xhci_hcd *xhci)
++{
++ return (xhci->port_status_u0 == ((1 << xhci->num_usb3_ports)-1));
++}
++
++
+ /*
+ * Initialize memory for HCD and xHC (one-time init).
+ *
+@@ -421,6 +511,12 @@ int xhci_init(struct usb_hcd *hcd)
+ retval = xhci_mem_init(xhci, GFP_KERNEL);
+ xhci_dbg(xhci, "Finished xhci_init\n");
+
++ /* Initializing Compliance Mode Recovery Data If Needed */
++ if (compliance_mode_recovery_timer_quirk_check()) {
++ xhci->quirks |= XHCI_COMP_MODE_QUIRK;
++ compliance_mode_recovery_timer_init(xhci);
++ }
++
+ return retval;
+ }
+
+@@ -629,6 +725,11 @@ void xhci_stop(struct usb_hcd *hcd)
+ del_timer_sync(&xhci->event_ring_timer);
+ #endif
+
++ /* Deleting Compliance Mode Recovery Timer */
++ if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
++ (!(xhci_all_ports_seen_u0(xhci))))
++ del_timer_sync(&xhci->comp_mode_recovery_timer);
++
+ if (xhci->quirks & XHCI_AMD_PLL_FIX)
+ usb_amd_dev_put();
+
+@@ -806,6 +907,16 @@ int xhci_suspend(struct xhci_hcd *xhci)
+ }
+ spin_unlock_irq(&xhci->lock);
+
++ /*
++ * Deleting Compliance Mode Recovery Timer because the xHCI Host
++ * is about to be suspended.
++ */
++ if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
++ (!(xhci_all_ports_seen_u0(xhci)))) {
++ del_timer_sync(&xhci->comp_mode_recovery_timer);
++ xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted!\n");
++ }
++
+ /* step 5: remove core well power */
+ /* synchronize irq when using MSI-X */
+ xhci_msix_sync_irqs(xhci);
+@@ -938,6 +1049,16 @@ int xhci_resume(struct xhci_hcd *xhci, b
+ usb_hcd_resume_root_hub(hcd);
+ usb_hcd_resume_root_hub(xhci->shared_hcd);
+ }
++
++ /*
++ * If system is subject to the Quirk, Compliance Mode Timer needs to
++ * be re-initialized Always after a system resume. Ports are subject
++ * to suffer the Compliance Mode issue again. It doesn't matter if
++ * ports have entered previously to U0 before system's suspension.
++ */
++ if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
++ compliance_mode_recovery_timer_init(xhci);
++
+ return retval;
+ }
+ #endif /* CONFIG_PM */
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1487,6 +1487,7 @@ struct xhci_hcd {
+ #define XHCI_AMD_0x96_HOST (1 << 9)
+ #define XHCI_TRUST_TX_LENGTH (1 << 10)
+ #define XHCI_SPURIOUS_REBOOT (1 << 13)
++#define XHCI_COMP_MODE_QUIRK (1 << 14)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
+@@ -1503,6 +1504,11 @@ struct xhci_hcd {
+ unsigned sw_lpm_support:1;
+ /* support xHCI 1.0 spec USB2 hardware LPM */
+ unsigned hw_lpm_support:1;
++ /* Compliance Mode Recovery Data */
++ struct timer_list comp_mode_recovery_timer;
++ u32 port_status_u0;
++/* Compliance Mode Timer Triggered every 2 seconds */
++#define COMP_MODE_RCVRY_MSECS 2000
+ };
+
+ /* convert between an HCD pointer and the corresponding EHCI_HCD */
--- /dev/null
+From 319acdfc064169023cd9ada5085b434fbcdacec2 Mon Sep 17 00:00:00 2001
+From: Ruchika Kharwar <ruchika@ti.com>
+Date: Fri, 10 Aug 2012 09:58:30 +0300
+Subject: usb: host: xhci-plat: use ioremap_nocache
+
+From: Ruchika Kharwar <ruchika@ti.com>
+
+commit 319acdfc064169023cd9ada5085b434fbcdacec2 upstream.
+
+Use the ioremap_nocache variant of the ioremap API in
+order to make sure our memory will be marked uncachable.
+
+This patch should be backported to kernels as old as 3.4, that contain
+the commit 3429e91a661e1f383aecc86c6bbcf65afb15c892 "usb: host: xhci:
+add platform driver support".
+
+Signed-off-by: Ruchika Kharwar <ruchika@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-plat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -118,7 +118,7 @@ static int xhci_plat_probe(struct platfo
+ goto put_hcd;
+ }
+
+- hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
++ hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
+ if (!hcd->regs) {
+ dev_dbg(&pdev->dev, "error mapping memory\n");
+ ret = -EFAULT;
--- /dev/null
+From 6fffb77c8393151b0cf8cef1b9c2ba90587dd2e8 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Wed, 29 Aug 2012 11:49:18 +0200
+Subject: USB: ohci-at91: fix PIO handling in relation with number of ports
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit 6fffb77c8393151b0cf8cef1b9c2ba90587dd2e8 upstream.
+
+If the number of ports present on the SoC/board is not the maximum
+and that the platform data is not filled with all data, there is
+an easy way to mess the PIO setup for this interface.
+This quick fix addresses mis-configuration in USB host platform data
+that is common in at91 boards since commit 0ee6d1e (USB: ohci-at91:
+change maximum number of ports) that did not modified the associatd
+board files.
+
+Reported-by: Klaus Falkner <klaus.falkner@solectrix.de>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ohci-at91.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -569,6 +569,16 @@ static int __devinit ohci_hcd_at91_drv_p
+
+ if (pdata) {
+ at91_for_each_port(i) {
++ /*
++ * do not configure PIO if not in relation with
++ * real USB port on board
++ */
++ if (i >= pdata->ports) {
++ pdata->vbus_pin[i] = -EINVAL;
++ pdata->overcurrent_pin[i] = -EINVAL;
++ break;
++ }
++
+ if (!gpio_is_valid(pdata->vbus_pin[i]))
+ continue;
+ gpio = pdata->vbus_pin[i];
--- /dev/null
+From 052c7f9ffb0e95843e75448d02664459253f9ff8 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 13 Aug 2012 19:57:03 +0300
+Subject: xhci: Fix a logical vs bitwise AND bug
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 052c7f9ffb0e95843e75448d02664459253f9ff8 upstream.
+
+The intent was to test whether the flag was set.
+
+This patch should be backported to stable kernels as old as 3.0, since
+it fixes a bug in commit e95829f474f0db3a4d940cae1423783edd966027 "xhci:
+Switch PPT ports to EHCI on shutdown.", which was marked for stable.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -760,7 +760,7 @@ void xhci_shutdown(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+
+- if (xhci->quirks && XHCI_SPURIOUS_REBOOT)
++ if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
+ usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
+
+ spin_lock_irq(&xhci->lock);
--- /dev/null
+From e955a1cd086de4d165ae0f4c7be7289d84b63bdc Mon Sep 17 00:00:00 2001
+From: Matthew Garrett <mjg@redhat.com>
+Date: Tue, 14 Aug 2012 16:44:49 -0400
+Subject: xhci: Make handover code more robust
+
+From: Matthew Garrett <mjg@redhat.com>
+
+commit e955a1cd086de4d165ae0f4c7be7289d84b63bdc upstream.
+
+My test platform (Intel DX79SI) boots reliably under BIOS, but frequently
+crashes when booting via UEFI. I finally tracked this down to the xhci
+handoff code. It seems that reads from the device occasionally just return
+0xff, resulting in xhci_find_next_cap_offset generating a value that's
+larger than the resource region. We then oops when attempting to read the
+value. Sanity checking that value lets us avoid the crash.
+
+I've no idea what's causing the underlying problem, and xhci still doesn't
+actually *work* even with this, but the machine at least boots which will
+probably make further debugging easier.
+
+This should be backported to kernels as old as 2.6.31, that contain the
+commit 66d4eadd8d067269ea8fead1a50fe87c2979a80d "USB: xhci: BIOS handoff
+and HW initialization."
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -841,12 +841,12 @@ static void __devinit quirk_usb_handoff_
+ void __iomem *op_reg_base;
+ u32 val;
+ int timeout;
++ int len = pci_resource_len(pdev, 0);
+
+ if (!mmio_resource_enabled(pdev, 0))
+ return;
+
+- base = ioremap_nocache(pci_resource_start(pdev, 0),
+- pci_resource_len(pdev, 0));
++ base = ioremap_nocache(pci_resource_start(pdev, 0), len);
+ if (base == NULL)
+ return;
+
+@@ -856,9 +856,17 @@ static void __devinit quirk_usb_handoff_
+ */
+ ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
+ do {
++ if ((ext_cap_offset + sizeof(val)) > len) {
++ /* We're reading garbage from the controller */
++ dev_warn(&pdev->dev,
++ "xHCI controller failing to respond");
++ return;
++ }
++
+ if (!ext_cap_offset)
+ /* We've reached the end of the extended capabilities */
+ goto hc_init;
++
+ val = readl(base + ext_cap_offset);
+ if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
+ break;
--- /dev/null
+From 29d214576f936db627ff62afb9ef438eea18bcd2 Mon Sep 17 00:00:00 2001
+From: Manoj Iyer <manoj.iyer@canonical.com>
+Date: Wed, 22 Aug 2012 11:53:18 -0500
+Subject: xhci: Recognize USB 3.0 devices as superspeed at powerup
+
+From: Manoj Iyer <manoj.iyer@canonical.com>
+
+commit 29d214576f936db627ff62afb9ef438eea18bcd2 upstream.
+
+On Intel Panther Point chipset USB 3.0 devices show up as
+high-speed devices on powerup, but after an s3 cycle they are
+correctly recognized as SuperSpeed. At powerup switch the port
+to xHCI so that USB 3.0 devices are correctly recognized.
+
+BugLink: http://bugs.launchpad.net/bugs/1000424
+
+This patch should be backported to kernels as old as 3.0, that contain
+commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support
+EHCI/xHCI port switching."
+
+Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -897,9 +897,10 @@ static void __devinit quirk_usb_handoff_
+ /* Disable any BIOS SMIs and clear all SMI events*/
+ writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
+
++hc_init:
+ if (usb_is_intel_switchable_xhci(pdev))
+ usb_enable_xhci_ports(pdev);
+-hc_init:
++
+ op_reg_base = base + XHCI_HC_LENGTH(readl(base));
+
+ /* Wait for the host controller to be ready before writing any
projects / thirdparty / kernel / stable-queue.git / commitdiff
