--- /dev/null
+From 7282059489868e0ed1b0d79765730c6b233a8399 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Tue, 11 Feb 2014 12:42:37 +0200
+Subject: ACPI / hotplug / PCI: Relax the checking of _STA return values
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 7282059489868e0ed1b0d79765730c6b233a8399 upstream.
+
+The ACPI specification (ACPI 5.0A, Section 6.3.7) says:
+
+ _STA may return bit 0 clear (not present) with bit 3 set (device is
+ functional). This case is used to indicate a valid device for which
+ no device driver should be loaded (for example, a bridge device.)
+ Children of this device may be present and valid. OSPM should
+ continue enumeration below a device whose _STA returns this bit
+ combination.
+
+Evidently, some BIOSes follow that and return 0x0A from _STA, which
+causes problems to happen when they trigger bus check or device check
+notifications for those devices too. Namely, ACPIPHP thinks that they
+are gone and may drop them, for example, if such a notification is
+triggered during a resume from system suspend.
+
+To fix that, modify ACPICA to regard devies as present and
+functioning if _STA returns both the ACPI_STA_DEVICE_ENABLED
+and ACPI_STA_DEVICE_FUNCTIONING bits set for them.
+
+Reported-and-tested-by: Peter Wu <lekensteyn@gmail.com>
+[rjw: Subject and changelog, minor code modifications]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/hotplug/acpiphp_glue.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -706,6 +706,17 @@ static unsigned int get_slot_status(stru
+ return (unsigned int)sta;
+ }
+
++static inline bool device_status_valid(unsigned int sta)
++{
++ /*
++ * ACPI spec says that _STA may return bit 0 clear with bit 3 set
++ * if the device is valid but does not require a device driver to be
++ * loaded (Section 6.3.7 of ACPI 5.0A).
++ */
++ unsigned int mask = ACPI_STA_DEVICE_ENABLED | ACPI_STA_DEVICE_FUNCTIONING;
++ return (sta & mask) == mask;
++}
++
+ /**
+ * trim_stale_devices - remove PCI devices that are not responding.
+ * @dev: PCI device to start walking the hierarchy from.
+@@ -721,7 +732,7 @@ static void trim_stale_devices(struct pc
+ unsigned long long sta;
+
+ status = acpi_evaluate_integer(handle, "_STA", NULL, &sta);
+- alive = (ACPI_SUCCESS(status) && sta == ACPI_STA_ALL)
++ alive = (ACPI_SUCCESS(status) && device_status_valid(sta))
+ || acpiphp_no_hotplug(handle);
+ }
+ if (!alive) {
+@@ -764,7 +775,7 @@ static void acpiphp_check_bridge(struct
+ mutex_lock(&slot->crit_sect);
+ if (slot_no_hotplug(slot)) {
+ ; /* do nothing */
+- } else if (get_slot_status(slot) == ACPI_STA_ALL) {
++ } else if (device_status_valid(get_slot_status(slot))) {
+ /* remove stale devices if any */
+ list_for_each_entry_safe(dev, tmp, &bus->devices,
+ bus_list)
--- /dev/null
+From f88abaa0d0dc0d1f1a9ae21f8e822918e5aadfdf Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 7 Feb 2014 12:07:59 +0100
+Subject: ALSA: hda - Fix mic capture on Sony VAIO Pro 11
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f88abaa0d0dc0d1f1a9ae21f8e822918e5aadfdf upstream.
+
+The very same fixup is needed to make the mic on Sony VAIO Pro 11
+working as well as VAIO Pro 13 model.
+
+Reported-and-tested-by: Hendrik-Jan Heins <hjheins@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4057,6 +4057,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
++ SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
+ SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
--- /dev/null
+From 556ee818c06f37b2e583af0363e6b16d0e0270de Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 29 Jan 2014 14:56:16 -0700
+Subject: block: __elv_next_request() shouldn't call into the elevator if bypassing
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 556ee818c06f37b2e583af0363e6b16d0e0270de upstream.
+
+request_queue bypassing is used to suppress higher-level function of a
+request_queue so that they can be switched, reconfigured and shut
+down. A request_queue does the followings while bypassing.
+
+* bypasses elevator and io_cq association and queues requests directly
+ to the FIFO dispatch queue.
+
+* bypasses block cgroup request_list lookup and always uses the root
+ request_list.
+
+Once confirmed to be bypassing, specific elevator and block cgroup
+policy implementations can assume that nothing is in flight for them
+and perform various operations which would be dangerous otherwise.
+
+Such confirmation is acheived by short-circuiting all new requests
+directly to the dispatch queue and waiting for all the requests which
+were issued before to finish. Unfortunately, while the request
+allocating and draining sides were properly handled, we forgot to
+actually plug the request dispatch path. Even after bypassing mode is
+confirmed, if the attached driver tries to fetch a request and the
+dispatch queue is empty, __elv_next_request() would invoke the current
+elevator's elevator_dispatch_fn() callback. As all in-flight requests
+were drained, the elevator wouldn't contain any request but once
+bypass is confirmed we don't even know whether the elevator is even
+there. It might be in the process of being switched and half torn
+down.
+
+Frank Mayhar reports that this actually happened while switching
+elevators, leading to an oops.
+
+Let's fix it by making __elv_next_request() avoid invoking the
+elevator_dispatch_fn() callback if the queue is bypassing. It already
+avoids invoking the callback if the queue is dying. As a dying queue
+is guaranteed to be bypassing, we can simply replace blk_queue_dying()
+check with blk_queue_bypass().
+
+Reported-by: Frank Mayhar <fmayhar@google.com>
+References: http://lkml.kernel.org/g/1390319905.20232.38.camel@bobble.lax.corp.google.com
+Tested-by: Frank Mayhar <fmayhar@google.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -96,7 +96,7 @@ static inline struct request *__elv_next
+ q->flush_queue_delayed = 1;
+ return NULL;
+ }
+- if (unlikely(blk_queue_dying(q)) ||
++ if (unlikely(blk_queue_bypass(q)) ||
+ !q->elevator->type->ops.elevator_dispatch_fn(q, 0))
+ return NULL;
+ }
--- /dev/null
+From c8123f8c9cb517403b51aa41c3c46ff5e10b2c17 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@fb.com>
+Date: Wed, 12 Feb 2014 09:34:01 -0700
+Subject: block: add cond_resched() to potentially long running ioctl discard loop
+
+From: Jens Axboe <axboe@fb.com>
+
+commit c8123f8c9cb517403b51aa41c3c46ff5e10b2c17 upstream.
+
+When mkfs issues a full device discard and the device only
+supports discards of a smallish size, we can loop in
+blkdev_issue_discard() for a long time. If preempt isn't enabled,
+this can turn into a softlock situation and the kernel will
+start complaining.
+
+Add an explicit cond_resched() at the end of the loop to avoid
+that.
+
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-lib.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -121,6 +121,14 @@ int blkdev_issue_discard(struct block_de
+
+ atomic_inc(&bb.done);
+ submit_bio(type, bio);
++
++ /*
++ * We can loop for a long time in here, if someone does
++ * full device discards (like mkfs). Be nice and allow
++ * us to schedule out to avoid softlocking if preempt
++ * is disabled.
++ */
++ cond_resched();
+ }
+ blk_finish_plug(&plug);
+
--- /dev/null
+From 087787959ce851d7bbb19f10f6e9241b7f85a3ca Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Thu, 6 Feb 2014 15:14:13 -0500
+Subject: block: Fix nr_vecs for inline integrity vectors
+
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+
+commit 087787959ce851d7bbb19f10f6e9241b7f85a3ca upstream.
+
+Commit 9f060e2231ca changed the way we handle allocations for the
+integrity vectors. When the vectors are inline there is no associated
+slab and consequently bvec_nr_vecs() returns 0. Ensure that we check
+against BIP_INLINE_VECS in that case.
+
+Reported-by: David Milburn <dmilburn@redhat.com>
+Tested-by: David Milburn <dmilburn@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/bio-integrity.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/fs/bio-integrity.c
++++ b/fs/bio-integrity.c
+@@ -114,6 +114,14 @@ void bio_integrity_free(struct bio *bio)
+ }
+ EXPORT_SYMBOL(bio_integrity_free);
+
++static inline unsigned int bip_integrity_vecs(struct bio_integrity_payload *bip)
++{
++ if (bip->bip_slab == BIO_POOL_NONE)
++ return BIP_INLINE_VECS;
++
++ return bvec_nr_vecs(bip->bip_slab);
++}
++
+ /**
+ * bio_integrity_add_page - Attach integrity metadata
+ * @bio: bio to update
+@@ -129,7 +137,7 @@ int bio_integrity_add_page(struct bio *b
+ struct bio_integrity_payload *bip = bio->bi_integrity;
+ struct bio_vec *iv;
+
+- if (bip->bip_vcnt >= bvec_nr_vecs(bip->bip_slab)) {
++ if (bip->bip_vcnt >= bip_integrity_vecs(bip)) {
+ printk(KERN_ERR "%s: bip_vec full\n", __func__);
+ return 0;
+ }
--- /dev/null
+From a9f180345f5378ac87d80ed0bea55ba421d83859 Mon Sep 17 00:00:00 2001
+From: Steven Noonan <steven@uplinklabs.net>
+Date: Wed, 12 Feb 2014 23:01:07 -0800
+Subject: compiler/gcc4: Make quirk for asm_volatile_goto() unconditional
+
+From: Steven Noonan <steven@uplinklabs.net>
+
+commit a9f180345f5378ac87d80ed0bea55ba421d83859 upstream.
+
+I started noticing problems with KVM guest destruction on Linux
+3.12+, where guest memory wasn't being cleaned up. I bisected it
+down to the commit introducing the new 'asm goto'-based atomics,
+and found this quirk was later applied to those.
+
+Unfortunately, even with GCC 4.8.2 (which ostensibly fixed the
+known 'asm goto' bug) I am still getting some kind of
+miscompilation. If I enable the asm_volatile_goto quirk for my
+compiler, KVM guests are destroyed correctly and the memory is
+cleaned up.
+
+So make the quirk unconditional for now, until bug is found
+and fixed.
+
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Steven Noonan <steven@uplinklabs.net>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Jakub Jelinek <jakub@redhat.com>
+Cc: Richard Henderson <rth@twiddle.net>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Link: http://lkml.kernel.org/r/1392274867-15236-1-git-send-email-steven@uplinklabs.net
+Link: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/compiler-gcc4.h | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/include/linux/compiler-gcc4.h
++++ b/include/linux/compiler-gcc4.h
+@@ -75,11 +75,7 @@
+ *
+ * (asm goto is automatically volatile - the naming reflects this.)
+ */
+-#if GCC_VERSION <= 40801
+-# define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
+-#else
+-# define asm_volatile_goto(x...) do { asm goto(x); } while (0)
+-#endif
++#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
+
+ #ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
+ #if GCC_VERSION >= 40400
--- /dev/null
+From 269f979467cf49f2ea8132316c1f00f8c9678f7c Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Thu, 16 Jan 2014 11:59:58 -0800
+Subject: Drivers: hv: vmbus: Don't timeout during the initial connection with host
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit 269f979467cf49f2ea8132316c1f00f8c9678f7c upstream.
+
+When the guest attempts to connect with the host when there may already be a
+connection with the host (as would be the case during the kdump/kexec path),
+it is difficult to guarantee timely response from the host. Starting with
+WS2012 R2, the host supports this ability to re-connect with the host
+(explicitly to support kexec). Prior to responding to the guest, the host
+needs to ensure that device states based on the previous connection to
+the host have been properly torn down. This may introduce unbounded delays.
+To deal with this issue, don't do a timed wait during the initial connect
+with the host.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/connection.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/drivers/hv/connection.c
++++ b/drivers/hv/connection.c
+@@ -67,7 +67,6 @@ static int vmbus_negotiate_version(struc
+ int ret = 0;
+ struct vmbus_channel_initiate_contact *msg;
+ unsigned long flags;
+- int t;
+
+ init_completion(&msginfo->waitevent);
+
+@@ -102,15 +101,7 @@ static int vmbus_negotiate_version(struc
+ }
+
+ /* Wait for the connection response */
+- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+- if (t == 0) {
+- spin_lock_irqsave(&vmbus_connection.channelmsg_lock,
+- flags);
+- list_del(&msginfo->msglistentry);
+- spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock,
+- flags);
+- return -ETIMEDOUT;
+- }
++ wait_for_completion(&msginfo->waitevent);
+
+ spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
+ list_del(&msginfo->msglistentry);
--- /dev/null
+From 2c45aada341121438affc4cb8d5b4cfaa2813d3d Mon Sep 17 00:00:00 2001
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Mon, 10 Feb 2014 13:39:53 -0500
+Subject: genirq: Add missing irq_to_desc export for CONFIG_SPARSE_IRQ=n
+
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+
+commit 2c45aada341121438affc4cb8d5b4cfaa2813d3d upstream.
+
+In allmodconfig builds for sparc and any other arch which does
+not set CONFIG_SPARSE_IRQ, the following will be seen at modpost:
+
+ CC [M] lib/cpu-notifier-error-inject.o
+ CC [M] lib/pm-notifier-error-inject.o
+ERROR: "irq_to_desc" [drivers/gpio/gpio-mcp23s08.ko] undefined!
+make[2]: *** [__modpost] Error 1
+
+This happens because commit 3911ff30f5 ("genirq: export
+handle_edge_irq() and irq_to_desc()") added one export for it, but
+there were actually two instances of it, in an if/else clause for
+CONFIG_SPARSE_IRQ. Add the second one.
+
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Link: http://lkml.kernel.org/r/1392057610-11514-1-git-send-email-paul.gortmaker@windriver.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/irq/irqdesc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -274,6 +274,7 @@ struct irq_desc *irq_to_desc(unsigned in
+ {
+ return (irq < NR_IRQS) ? irq_desc + irq : NULL;
+ }
++EXPORT_SYMBOL(irq_to_desc);
+
+ static void free_desc(unsigned int irq)
+ {
--- /dev/null
+From 79970db213344b4a4034645db5ebfc31571f3fa3 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa@the-dreams.de>
+Date: Thu, 13 Feb 2014 21:36:29 +0100
+Subject: i2c: mv64xxx: refactor message start to ensure proper initialization
+
+From: Wolfram Sang <wsa@the-dreams.de>
+
+commit 79970db213344b4a4034645db5ebfc31571f3fa3 upstream.
+
+Because the offload mechanism can fall back to a standard transfer,
+having two seperate initialization states is unfortunate. Let's just
+have one state which does things consistently. This fixes a bug where
+some preparation was missing when the fallback happened. And it makes
+the code much easier to follow. To implement this, we put the check
+if offload is possible at the top of the offload setup function.
+
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Tested-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Fixes: 930ab3d403ae (i2c: mv64xxx: Add I2C Transaction Generator support)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-mv64xxx.c | 33 ++++++++++++++-------------------
+ 1 file changed, 14 insertions(+), 19 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mv64xxx.c
++++ b/drivers/i2c/busses/i2c-mv64xxx.c
+@@ -97,7 +97,6 @@ enum {
+ enum {
+ MV64XXX_I2C_ACTION_INVALID,
+ MV64XXX_I2C_ACTION_CONTINUE,
+- MV64XXX_I2C_ACTION_OFFLOAD_SEND_START,
+ MV64XXX_I2C_ACTION_SEND_START,
+ MV64XXX_I2C_ACTION_SEND_RESTART,
+ MV64XXX_I2C_ACTION_OFFLOAD_RESTART,
+@@ -204,6 +203,9 @@ static int mv64xxx_i2c_offload_msg(struc
+ unsigned long ctrl_reg;
+ struct i2c_msg *msg = drv_data->msgs;
+
++ if (!drv_data->offload_enabled)
++ return -EOPNOTSUPP;
++
+ drv_data->msg = msg;
+ drv_data->byte_posn = 0;
+ drv_data->bytes_left = msg->len;
+@@ -433,8 +435,7 @@ mv64xxx_i2c_do_action(struct mv64xxx_i2c
+
+ drv_data->msgs++;
+ drv_data->num_msgs--;
+- if (!(drv_data->offload_enabled &&
+- mv64xxx_i2c_offload_msg(drv_data))) {
++ if (mv64xxx_i2c_offload_msg(drv_data) < 0) {
+ drv_data->cntl_bits |= MV64XXX_I2C_REG_CONTROL_START;
+ writel(drv_data->cntl_bits,
+ drv_data->reg_base + drv_data->reg_offsets.control);
+@@ -458,15 +459,14 @@ mv64xxx_i2c_do_action(struct mv64xxx_i2c
+ drv_data->reg_base + drv_data->reg_offsets.control);
+ break;
+
+- case MV64XXX_I2C_ACTION_OFFLOAD_SEND_START:
+- if (!mv64xxx_i2c_offload_msg(drv_data))
+- break;
+- else
+- drv_data->action = MV64XXX_I2C_ACTION_SEND_START;
+- /* FALLTHRU */
+ case MV64XXX_I2C_ACTION_SEND_START:
+- writel(drv_data->cntl_bits | MV64XXX_I2C_REG_CONTROL_START,
+- drv_data->reg_base + drv_data->reg_offsets.control);
++ /* Can we offload this msg ? */
++ if (mv64xxx_i2c_offload_msg(drv_data) < 0) {
++ /* No, switch to standard path */
++ mv64xxx_i2c_prepare_for_io(drv_data, drv_data->msgs);
++ writel(drv_data->cntl_bits | MV64XXX_I2C_REG_CONTROL_START,
++ drv_data->reg_base + drv_data->reg_offsets.control);
++ }
+ break;
+
+ case MV64XXX_I2C_ACTION_SEND_ADDR_1:
+@@ -625,15 +625,10 @@ mv64xxx_i2c_execute_msg(struct mv64xxx_i
+ unsigned long flags;
+
+ spin_lock_irqsave(&drv_data->lock, flags);
+- if (drv_data->offload_enabled) {
+- drv_data->action = MV64XXX_I2C_ACTION_OFFLOAD_SEND_START;
+- drv_data->state = MV64XXX_I2C_STATE_WAITING_FOR_START_COND;
+- } else {
+- mv64xxx_i2c_prepare_for_io(drv_data, msg);
+
+- drv_data->action = MV64XXX_I2C_ACTION_SEND_START;
+- drv_data->state = MV64XXX_I2C_STATE_WAITING_FOR_START_COND;
+- }
++ drv_data->action = MV64XXX_I2C_ACTION_SEND_START;
++ drv_data->state = MV64XXX_I2C_STATE_WAITING_FOR_START_COND;
++
+ drv_data->send_stop = is_last;
+ drv_data->block = 1;
+ mv64xxx_i2c_do_action(drv_data);
--- /dev/null
+From 2f75e12c4457a9b3d042c0a0d748fa198dc2ffaf Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Wed, 12 Feb 2014 11:54:15 -0500
+Subject: IB/qib: Add missing serdes init sequence
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+commit 2f75e12c4457a9b3d042c0a0d748fa198dc2ffaf upstream.
+
+Research has shown that commit a77fcf895046 ("IB/qib: Use a single
+txselect module parameter for serdes tuning") missed a key serdes init
+sequence.
+
+This patch add that sequence.
+
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/qib/qib_iba7322.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -2395,6 +2395,11 @@ static int qib_7322_bringup_serdes(struc
+ qib_write_kreg_port(ppd, krp_ibcctrl_a, ppd->cpspec->ibcctrl_a);
+ qib_write_kreg(dd, kr_scratch, 0ULL);
+
++ /* ensure previous Tx parameters are not still forced */
++ qib_write_kreg_port(ppd, krp_tx_deemph_override,
++ SYM_MASK(IBSD_TX_DEEMPHASIS_OVERRIDE_0,
++ reset_tx_deemphasis_override));
++
+ if (qib_compat_ddr_negotiate) {
+ ppd->cpspec->ibdeltainprog = 1;
+ ppd->cpspec->ibsymsnap = read_7322_creg32_port(ppd,
--- /dev/null
+From aac5c4226e7136c331ed384c25d5560204da10a0 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 29 Jan 2014 16:16:39 +0300
+Subject: KVM: return an error code in kvm_vm_ioctl_register_coalesced_mmio()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit aac5c4226e7136c331ed384c25d5560204da10a0 upstream.
+
+If kvm_io_bus_register_dev() fails then it returns success but it should
+return an error code.
+
+I also did a little cleanup like removing an impossible NULL test.
+
+Fixes: 2b3c246a682c ('KVM: Make coalesced mmio use a device per zone')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ virt/kvm/coalesced_mmio.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/virt/kvm/coalesced_mmio.c
++++ b/virt/kvm/coalesced_mmio.c
+@@ -154,17 +154,13 @@ int kvm_vm_ioctl_register_coalesced_mmio
+ list_add_tail(&dev->list, &kvm->coalesced_zones);
+ mutex_unlock(&kvm->slots_lock);
+
+- return ret;
++ return 0;
+
+ out_free_dev:
+ mutex_unlock(&kvm->slots_lock);
+-
+ kfree(dev);
+
+- if (dev == NULL)
+- return -ENXIO;
+-
+- return 0;
++ return ret;
+ }
+
+ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,
--- /dev/null
+From 1877db75589a895bbdc4c4c3f23558e57b521141 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Wed, 5 Feb 2014 12:17:01 +1100
+Subject: md/raid1: restore ability for check and repair to fix read errors.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 1877db75589a895bbdc4c4c3f23558e57b521141 upstream.
+
+commit 30bc9b53878a9921b02e3b5bc4283ac1c6de102a
+ md/raid1: fix bio handling problems in process_checks()
+
+Move the bio_reset() to a point before where BIO_UPTODATE is checked,
+so that check now always report that the bio is uptodate, even if it is not.
+
+This causes process_check() to sometimes treat read-errors as
+successful matches so the good data isn't written out.
+
+This patch preserves the flag until it is needed.
+
+Bug was introduced in 3.11, but backported to 3.10-stable (as it fixed
+an even worse bug). So suitable for any -stable since 3.10.
+
+Reported-and-tested-by: Michael Tokarev <mjt@tls.msk.ru>
+Fixed: 30bc9b53878a9921b02e3b5bc4283ac1c6de102a
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid1.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1855,11 +1855,15 @@ static int process_checks(struct r1bio *
+ for (i = 0; i < conf->raid_disks * 2; i++) {
+ int j;
+ int size;
++ int uptodate;
+ struct bio *b = r1_bio->bios[i];
+ if (b->bi_end_io != end_sync_read)
+ continue;
+- /* fixup the bio for reuse */
++ /* fixup the bio for reuse, but preserve BIO_UPTODATE */
++ uptodate = test_bit(BIO_UPTODATE, &b->bi_flags);
+ bio_reset(b);
++ if (!uptodate)
++ clear_bit(BIO_UPTODATE, &b->bi_flags);
+ b->bi_vcnt = vcnt;
+ b->bi_size = r1_bio->sectors << 9;
+ b->bi_sector = r1_bio->sector +
+@@ -1892,11 +1896,14 @@ static int process_checks(struct r1bio *
+ int j;
+ struct bio *pbio = r1_bio->bios[primary];
+ struct bio *sbio = r1_bio->bios[i];
++ int uptodate = test_bit(BIO_UPTODATE, &sbio->bi_flags);
+
+ if (sbio->bi_end_io != end_sync_read)
+ continue;
++ /* Now we can 'fixup' the BIO_UPTODATE flag */
++ set_bit(BIO_UPTODATE, &sbio->bi_flags);
+
+- if (test_bit(BIO_UPTODATE, &sbio->bi_flags)) {
++ if (uptodate) {
+ for (j = vcnt; j-- ; ) {
+ struct page *p, *s;
+ p = pbio->bi_io_vec[j].bv_page;
+@@ -1911,7 +1918,7 @@ static int process_checks(struct r1bio *
+ if (j >= 0)
+ atomic64_add(r1_bio->sectors, &mddev->resync_mismatches);
+ if (j < 0 || (test_bit(MD_RECOVERY_CHECK, &mddev->recovery)
+- && test_bit(BIO_UPTODATE, &sbio->bi_flags))) {
++ && uptodate)) {
+ /* No need to write to this device. */
+ sbio->bi_end_io = NULL;
+ rdev_dec_pending(conf->mirrors[i].rdev, mddev);
--- /dev/null
+From 789b5e0315284463617e106baad360cb9e8db3ac Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 6 Feb 2014 03:42:45 +0530
+Subject: md/raid5: Fix CPU hotplug callback registration
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 789b5e0315284463617e106baad360cb9e8db3ac upstream.
+
+Subsystems that want to register CPU hotplug callbacks, as well as perform
+initialization for the CPUs that are already online, often do it as shown
+below:
+
+ get_online_cpus();
+
+ for_each_online_cpu(cpu)
+ init_cpu(cpu);
+
+ register_cpu_notifier(&foobar_cpu_notifier);
+
+ put_online_cpus();
+
+This is wrong, since it is prone to ABBA deadlocks involving the
+cpu_add_remove_lock and the cpu_hotplug.lock (when running concurrently
+with CPU hotplug operations).
+
+Interestingly, the raid5 code can actually prevent double initialization and
+hence can use the following simplified form of callback registration:
+
+ register_cpu_notifier(&foobar_cpu_notifier);
+
+ get_online_cpus();
+
+ for_each_online_cpu(cpu)
+ init_cpu(cpu);
+
+ put_online_cpus();
+
+A hotplug operation that occurs between registering the notifier and calling
+get_online_cpus(), won't disrupt anything, because the code takes care to
+perform the memory allocations only once.
+
+So reorganize the code in raid5 this way to fix the deadlock with callback
+registration.
+
+Cc: linux-raid@vger.kernel.org
+Fixes: 36d1c6476be51101778882897b315bd928c8c7b5
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+[Srivatsa: Fixed the unregister_cpu_notifier() deadlock, added the
+free_scratch_buffer() helper to condense code further and wrote the changelog.]
+Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid5.c | 90 +++++++++++++++++++++++++----------------------------
+ 1 file changed, 44 insertions(+), 46 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5351,23 +5351,43 @@ raid5_size(struct mddev *mddev, sector_t
+ return sectors * (raid_disks - conf->max_degraded);
+ }
+
++static void free_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu)
++{
++ safe_put_page(percpu->spare_page);
++ kfree(percpu->scribble);
++ percpu->spare_page = NULL;
++ percpu->scribble = NULL;
++}
++
++static int alloc_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu)
++{
++ if (conf->level == 6 && !percpu->spare_page)
++ percpu->spare_page = alloc_page(GFP_KERNEL);
++ if (!percpu->scribble)
++ percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
++
++ if (!percpu->scribble || (conf->level == 6 && !percpu->spare_page)) {
++ free_scratch_buffer(conf, percpu);
++ return -ENOMEM;
++ }
++
++ return 0;
++}
++
+ static void raid5_free_percpu(struct r5conf *conf)
+ {
+- struct raid5_percpu *percpu;
+ unsigned long cpu;
+
+ if (!conf->percpu)
+ return;
+
+- get_online_cpus();
+- for_each_possible_cpu(cpu) {
+- percpu = per_cpu_ptr(conf->percpu, cpu);
+- safe_put_page(percpu->spare_page);
+- kfree(percpu->scribble);
+- }
+ #ifdef CONFIG_HOTPLUG_CPU
+ unregister_cpu_notifier(&conf->cpu_notify);
+ #endif
++
++ get_online_cpus();
++ for_each_possible_cpu(cpu)
++ free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
+ put_online_cpus();
+
+ free_percpu(conf->percpu);
+@@ -5394,15 +5414,7 @@ static int raid456_cpu_notify(struct not
+ switch (action) {
+ case CPU_UP_PREPARE:
+ case CPU_UP_PREPARE_FROZEN:
+- if (conf->level == 6 && !percpu->spare_page)
+- percpu->spare_page = alloc_page(GFP_KERNEL);
+- if (!percpu->scribble)
+- percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
+-
+- if (!percpu->scribble ||
+- (conf->level == 6 && !percpu->spare_page)) {
+- safe_put_page(percpu->spare_page);
+- kfree(percpu->scribble);
++ if (alloc_scratch_buffer(conf, percpu)) {
+ pr_err("%s: failed memory allocation for cpu%ld\n",
+ __func__, cpu);
+ return notifier_from_errno(-ENOMEM);
+@@ -5410,10 +5422,7 @@ static int raid456_cpu_notify(struct not
+ break;
+ case CPU_DEAD:
+ case CPU_DEAD_FROZEN:
+- safe_put_page(percpu->spare_page);
+- kfree(percpu->scribble);
+- percpu->spare_page = NULL;
+- percpu->scribble = NULL;
++ free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
+ break;
+ default:
+ break;
+@@ -5425,40 +5434,29 @@ static int raid456_cpu_notify(struct not
+ static int raid5_alloc_percpu(struct r5conf *conf)
+ {
+ unsigned long cpu;
+- struct page *spare_page;
+- struct raid5_percpu __percpu *allcpus;
+- void *scribble;
+- int err;
++ int err = 0;
+
+- allcpus = alloc_percpu(struct raid5_percpu);
+- if (!allcpus)
++ conf->percpu = alloc_percpu(struct raid5_percpu);
++ if (!conf->percpu)
+ return -ENOMEM;
+- conf->percpu = allcpus;
++
++#ifdef CONFIG_HOTPLUG_CPU
++ conf->cpu_notify.notifier_call = raid456_cpu_notify;
++ conf->cpu_notify.priority = 0;
++ err = register_cpu_notifier(&conf->cpu_notify);
++ if (err)
++ return err;
++#endif
+
+ get_online_cpus();
+- err = 0;
+ for_each_present_cpu(cpu) {
+- if (conf->level == 6) {
+- spare_page = alloc_page(GFP_KERNEL);
+- if (!spare_page) {
+- err = -ENOMEM;
+- break;
+- }
+- per_cpu_ptr(conf->percpu, cpu)->spare_page = spare_page;
+- }
+- scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
+- if (!scribble) {
+- err = -ENOMEM;
++ err = alloc_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
++ if (err) {
++ pr_err("%s: failed memory allocation for cpu%ld\n",
++ __func__, cpu);
+ break;
+ }
+- per_cpu_ptr(conf->percpu, cpu)->scribble = scribble;
+ }
+-#ifdef CONFIG_HOTPLUG_CPU
+- conf->cpu_notify.notifier_call = raid456_cpu_notify;
+- conf->cpu_notify.priority = 0;
+- if (err == 0)
+- err = register_cpu_notifier(&conf->cpu_notify);
+-#endif
+ put_online_cpus();
+
+ return err;
--- /dev/null
+From 30c54df7cb9b15b222529a028390b9c9582dd65e Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Mon, 27 Jan 2014 22:27:23 +0200
+Subject: mei: clear write cb from waiting list on reset
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 30c54df7cb9b15b222529a028390b9c9582dd65e upstream.
+
+Clear write callbacks sitting in write_waiting list on reset.
+Otherwise these callbacks are left dangling and cause memory leak.
+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/client.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -916,8 +916,16 @@ void mei_cl_all_wakeup(struct mei_device
+ void mei_cl_all_write_clear(struct mei_device *dev)
+ {
+ struct mei_cl_cb *cb, *next;
++ struct list_head *list;
+
+- list_for_each_entry_safe(cb, next, &dev->write_list.list, list) {
++ list = &dev->write_list.list;
++ list_for_each_entry_safe(cb, next, list, list) {
++ list_del(&cb->list);
++ mei_io_cb_free(cb);
++ }
++
++ list = &dev->write_waiting_list.list;
++ list_for_each_entry_safe(cb, next, list, list) {
+ list_del(&cb->list);
+ mei_io_cb_free(cb);
+ }
--- /dev/null
+From 5cb906c7035f03a3a44fecece9d3ff8fcc75d6e0 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Mon, 27 Jan 2014 22:27:24 +0200
+Subject: mei: don't unset read cb ptr on reset
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 5cb906c7035f03a3a44fecece9d3ff8fcc75d6e0 upstream.
+
+Don't set read callback to NULL during reset as
+this leads to memory leak of both cb and its buffer.
+The memory is correctly freed during mei_release.
+
+The memory leak is detectable by kmemleak if
+application has open read call while system is going through
+suspend/resume.
+
+unreferenced object 0xecead780 (size 64):
+ comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
+ hex dump (first 32 bytes):
+ 00 01 10 00 00 02 20 00 00 bf 30 f1 00 00 00 00 ...... ...0.....
+ 00 00 00 00 00 00 00 00 36 01 00 00 00 70 da e2 ........6....p..
+ backtrace:
+ [<c1a60aec>] kmemleak_alloc+0x3c/0xa0
+ [<c131ed56>] kmem_cache_alloc_trace+0xc6/0x190
+ [<c16243c9>] mei_io_cb_init+0x29/0x50
+ [<c1625722>] mei_cl_read_start+0x102/0x360
+ [<c16268f3>] mei_read+0x103/0x4e0
+ [<c1324b09>] vfs_read+0x89/0x160
+ [<c1324d5f>] SyS_read+0x4f/0x80
+ [<c1a7b318>] syscall_call+0x7/0xb
+ [<ffffffff>] 0xffffffff
+unreferenced object 0xe2da7000 (size 512):
+ comm "AsyncTask #1", pid 1018, jiffies 4294949621 (age 152.440s)
+ hex dump (first 32 bytes):
+ 00 6c da e2 7c 00 00 00 00 00 00 00 c0 eb 0c 59 .l..|..........Y
+ 1b 00 00 00 01 00 00 00 02 10 00 00 01 00 00 00 ................
+ backtrace:
+ [<c1a60aec>] kmemleak_alloc+0x3c/0xa0
+ [<c131f127>] __kmalloc+0xe7/0x1d0
+ [<c162447e>] mei_io_cb_alloc_resp_buf+0x2e/0x60
+ [<c162574c>] mei_cl_read_start+0x12c/0x360
+ [<c16268f3>] mei_read+0x103/0x4e0
+ [<c1324b09>] vfs_read+0x89/0x160
+ [<c1324d5f>] SyS_read+0x4f/0x80
+ [<c1a7b318>] syscall_call+0x7/0xb
+ [<ffffffff>] 0xffffffff
+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/client.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -882,7 +882,6 @@ void mei_cl_all_disconnect(struct mei_de
+ list_for_each_entry_safe(cl, next, &dev->file_list, link) {
+ cl->state = MEI_FILE_DISCONNECTED;
+ cl->mei_flow_ctrl_creds = 0;
+- cl->read_cb = NULL;
+ cl->timer_count = 0;
+ }
+ }
--- /dev/null
+From 03b56329f9bb5a1cb73d7dc659d529a9a9bf3acc Mon Sep 17 00:00:00 2001
+From: Jan Moskyto Matejka <mq@suse.cz>
+Date: Fri, 7 Feb 2014 19:15:11 +0100
+Subject: Modpost: fixed USB alias generation for ranges including 0x9 and 0xA
+
+From: Jan Moskyto Matejka <mq@suse.cz>
+
+commit 03b56329f9bb5a1cb73d7dc659d529a9a9bf3acc upstream.
+
+Commit afe2dab4f6 ("USB: add hex/bcd detection to usb modalias generation")
+changed the routine that generates alias ranges. Before that change, only
+digits 0-9 were supported; the commit tried to fix the case when the range
+includes higher values than 0x9.
+
+Unfortunately, the commit didn't fix the case when the range includes both
+0x9 and 0xA, meaning that the final range must look like [x-9A-y] where
+x <= 0x9 and y >= 0xA -- instead the [x-9A-x] range was produced.
+
+Modprobe doesn't complain as it sees no difference between no-match and
+bad-pattern results of fnmatch().
+
+Fixing this simple bug to fix the aliases.
+Also changing the hardcoded beginning of the range to uppercase as all the
+other letters are also uppercase in the device version numbers.
+
+Fortunately, this affects only the dvb-usb-dib0700 module, AFAIK.
+
+Signed-off-by: Jan Moskyto Matejka <mq@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/mod/file2alias.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -210,8 +210,8 @@ static void do_usb_entry(void *symval,
+ range_lo < 0x9 ? "[%X-9" : "[%X",
+ range_lo);
+ sprintf(alias + strlen(alias),
+- range_hi > 0xA ? "a-%X]" : "%X]",
+- range_lo);
++ range_hi > 0xA ? "A-%X]" : "%X]",
++ range_hi);
+ }
+ }
+ if (bcdDevice_initial_digits < (sizeof(bcdDevice_lo) * 2 - 1))
--- /dev/null
+From ac323d8d807060f7c95a685a9fe861e7b6300993 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Thu, 30 Jan 2014 14:32:45 +0100
+Subject: power: max17040: Fix NULL pointer dereference when there is no platform_data
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit ac323d8d807060f7c95a685a9fe861e7b6300993 upstream.
+
+Fix NULL pointer dereference of "chip->pdata" if platform_data was not
+supplied to the driver.
+
+The driver during probe stored the pointer to the platform_data:
+ chip->pdata = client->dev.platform_data;
+Later it was dereferenced in max17040_get_online() and
+max17040_get_status().
+
+If platform_data was not supplied, the NULL pointer exception would
+happen:
+
+[ 6.626094] Unable to handle kernel of a at virtual address 00000000
+[ 6.628557] pgd = c0004000
+[ 6.632868] [00000000] *pgd=66262564
+[ 6.634636] Unable to handle kernel paging request at virtual address e6262000
+[ 6.642014] pgd = de468000
+[ 6.644700] [e6262000] *pgd=00000000
+[ 6.648265] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+[ 6.653552] Modules linked in:
+[ 6.656598] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 3.10.14-02717-gc58b4b4 #505
+[ 6.664334] Workqueue: events max17040_work
+[ 6.668488] task: dfa11b80 ti: df9f6000 task.ti: df9f6000
+[ 6.673873] PC is at show_pte+0x80/0xb8
+[ 6.677687] LR is at show_pte+0x3c/0xb8
+[ 6.681503] pc : [<c001b7b8>] lr : [<c001b774>] psr: 600f0113
+[ 6.681503] sp : df9f7d58 ip : 600f0113 fp : 00000009
+[ 6.692965] r10: 00000000 r9 : 00000000 r8 : dfa11b80
+[ 6.698171] r7 : df9f7ea0 r6 : e6262000 r5 : 00000000 r4 : 00000000
+[ 6.704680] r3 : 00000000 r2 : e6262000 r1 : 600f0193 r0 : c05b3750
+[ 6.711194] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
+[ 6.718485] Control: 10c53c7d Table: 5e46806a DAC: 00000015
+[ 6.724218] Process kworker/0:1 (pid: 31, stack limit = 0xdf9f6238)
+[ 6.730465] Stack: (0xdf9f7d58 to 0xdf9f8000)
+[ 6.914325] [<c001b7b8>] (show_pte+0x80/0xb8) from [<c047107c>] (__do_kernel_fault.part.9+0x44/0x74)
+[ 6.923425] [<c047107c>] (__do_kernel_fault.part.9+0x44/0x74) from [<c001bb7c>] (do_page_fault+0x2c4/0x360)
+[ 6.933144] [<c001bb7c>] (do_page_fault+0x2c4/0x360) from [<c0008400>] (do_DataAbort+0x34/0x9c)
+[ 6.941825] [<c0008400>] (do_DataAbort+0x34/0x9c) from [<c000e5d8>] (__dabt_svc+0x38/0x60)
+[ 6.950058] Exception stack(0xdf9f7ea0 to 0xdf9f7ee8)
+[ 6.955099] 7ea0: df0c1790 00000000 00000002 00000000 df0c1794 df0c1790 df0c1790 00000042
+[ 6.963271] 7ec0: df0c1794 00000001 00000000 00000009 00000000 df9f7ee8 c0306268 c0306270
+[ 6.971419] 7ee0: a00f0113 ffffffff
+[ 6.974902] [<c000e5d8>] (__dabt_svc+0x38/0x60) from [<c0306270>] (max17040_work+0x8c/0x144)
+[ 6.983317] [<c0306270>] (max17040_work+0x8c/0x144) from [<c003f364>] (process_one_work+0x138/0x440)
+[ 6.992429] [<c003f364>] (process_one_work+0x138/0x440) from [<c003fa64>] (worker_thread+0x134/0x3b8)
+[ 7.001628] [<c003fa64>] (worker_thread+0x134/0x3b8) from [<c00454bc>] (kthread+0xa4/0xb0)
+[ 7.009875] [<c00454bc>] (kthread+0xa4/0xb0) from [<c000eb28>] (ret_from_fork+0x14/0x2c)
+[ 7.017943] Code: e1a03005 e2422480 e0826104 e59f002c (e7922104)
+[ 7.024017] ---[ end trace 73bc7006b9cc5c79 ]---
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Fixes: c6f4a42de60b981dd210de01cd3e575835e3158e
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/max17040_battery.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/power/max17040_battery.c
++++ b/drivers/power/max17040_battery.c
+@@ -148,7 +148,7 @@ static void max17040_get_online(struct i
+ {
+ struct max17040_chip *chip = i2c_get_clientdata(client);
+
+- if (chip->pdata->battery_online)
++ if (chip->pdata && chip->pdata->battery_online)
+ chip->online = chip->pdata->battery_online();
+ else
+ chip->online = 1;
+@@ -158,7 +158,8 @@ static void max17040_get_status(struct i
+ {
+ struct max17040_chip *chip = i2c_get_clientdata(client);
+
+- if (!chip->pdata->charger_online || !chip->pdata->charger_enable) {
++ if (!chip->pdata || !chip->pdata->charger_online
++ || !chip->pdata->charger_enable) {
+ chip->status = POWER_SUPPLY_STATUS_UNKNOWN;
+ return;
+ }
--- /dev/null
+From 3d4b81eda2211f32886e2978daf6f39885042fc4 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Fri, 31 Jan 2014 11:52:57 -0800
+Subject: Revert "usb: xhci: Link TRB must not occur within a USB payload burst"
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 3d4b81eda2211f32886e2978daf6f39885042fc4 upstream.
+
+This reverts commit 35773dac5f862cb1c82ea151eba3e2f6de51ec3e. It's a
+hack that caused regressions in the usb-storage and userspace USB
+drivers that use usbfs and libusb. Commit 70cabb7d992f "xhci 1.0: Limit
+arbitrarily-aligned scatter gather." should fix the issues seen with the
+ax88179_178a driver on xHCI 1.0 hosts, without causing regressions.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 54 +------------------------------------------
+ include/linux/usb.h | 2 -
+ 2 files changed, 2 insertions(+), 54 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2929,58 +2929,8 @@ static int prepare_ring(struct xhci_hcd
+ }
+
+ while (1) {
+- if (room_on_ring(xhci, ep_ring, num_trbs)) {
+- union xhci_trb *trb = ep_ring->enqueue;
+- unsigned int usable = ep_ring->enq_seg->trbs +
+- TRBS_PER_SEGMENT - 1 - trb;
+- u32 nop_cmd;
+-
+- /*
+- * Section 4.11.7.1 TD Fragments states that a link
+- * TRB must only occur at the boundary between
+- * data bursts (eg 512 bytes for 480M).
+- * While it is possible to split a large fragment
+- * we don't know the size yet.
+- * Simplest solution is to fill the trb before the
+- * LINK with nop commands.
+- */
+- if (num_trbs == 1 || num_trbs <= usable || usable == 0)
+- break;
+-
+- if (ep_ring->type != TYPE_BULK)
+- /*
+- * While isoc transfers might have a buffer that
+- * crosses a 64k boundary it is unlikely.
+- * Since we can't add NOPs without generating
+- * gaps in the traffic just hope it never
+- * happens at the end of the ring.
+- * This could be fixed by writing a LINK TRB
+- * instead of the first NOP - however the
+- * TRB_TYPE_LINK_LE32() calls would all need
+- * changing to check the ring length.
+- */
+- break;
+-
+- if (num_trbs >= TRBS_PER_SEGMENT) {
+- xhci_err(xhci, "Too many fragments %d, max %d\n",
+- num_trbs, TRBS_PER_SEGMENT - 1);
+- return -ENOMEM;
+- }
+-
+- nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
+- ep_ring->cycle_state);
+- ep_ring->num_trbs_free -= usable;
+- do {
+- trb->generic.field[0] = 0;
+- trb->generic.field[1] = 0;
+- trb->generic.field[2] = 0;
+- trb->generic.field[3] = nop_cmd;
+- trb++;
+- } while (--usable);
+- ep_ring->enqueue = trb;
+- if (room_on_ring(xhci, ep_ring, num_trbs))
+- break;
+- }
++ if (room_on_ring(xhci, ep_ring, num_trbs))
++ break;
+
+ if (ep_ring == xhci->cmd_ring) {
+ xhci_err(xhci, "Do not support expand command ring\n");
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1262,8 +1262,6 @@ typedef void (*usb_complete_t)(struct ur
+ * @sg: scatter gather buffer list, the buffer size of each element in
+ * the list (except the last) must be divisible by the endpoint's
+ * max packet size if no_sg_constraint isn't set in 'struct usb_bus'
+- * (FIXME: scatter-gather under xHCI is broken for periodic transfers.
+- * Do not use urb->sg for interrupt endpoints for now, only bulk.)
+ * @num_mapped_sgs: (internal) number of mapped sg entries
+ * @num_sgs: number of entries in the sg list
+ * @transfer_buffer_length: How big is transfer_buffer. The transfer may
--- /dev/null
+From 140e3026a57ab7d830dab2f2c57796c222db0ea9 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Wed, 22 Jan 2014 13:35:02 -0800
+Subject: Revert "usbcore: set lpm_capable field for LPM capable root hubs"
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 140e3026a57ab7d830dab2f2c57796c222db0ea9 upstream.
+
+Commit 9df89d85b407690afa46ddfbccc80bec6869971d "usbcore: set
+lpm_capable field for LPM capable root hubs" was created under the
+assumption that all USB host controllers should have USB 3.0 Link PM
+enabled for all devices under the hosts.
+
+Unfortunately, that's not the case. The xHCI driver relies on knowledge
+of the host hardware scheduler to calculate the LPM U1/U2 timeout
+values, and it only sets lpm_capable to one for Intel host controllers
+(that have the XHCI_LPM_SUPPORT quirk set).
+
+When LPM is enabled for some Fresco Logic hosts, it causes failures with
+a AgeStar 3UBT USB 3.0 hard drive dock:
+
+Jan 11 13:59:03 sg-laptop kernel: usb 3-1: new SuperSpeed USB device number 2 using xhci_hcd
+Jan 11 13:59:03 sg-laptop kernel: usb 3-1: Set SEL for device-initiated U1 failed.
+Jan 11 13:59:08 sg-laptop kernel: usb 3-1: Set SEL for device-initiated U2 failed.
+Jan 11 13:59:08 sg-laptop kernel: usb-storage 3-1:1.0: USB Mass Storage device detected
+Jan 11 13:59:08 sg-laptop mtp-probe[613]: checking bus 3, device 2: "/sys/devices/pci0000:00/0000:00:1c.3/0000:04:00.0/usb3/3-1"
+Jan 11 13:59:08 sg-laptop mtp-probe[613]: bus: 3, device: 2 was not an MTP device
+Jan 11 13:59:08 sg-laptop kernel: scsi6 : usb-storage 3-1:1.0
+Jan 11 13:59:13 sg-laptop kernel: usb 3-1: Set SEL for device-initiated U1 failed.
+Jan 11 13:59:18 sg-laptop kernel: usb 3-1: Set SEL for device-initiated U2 failed.
+Jan 11 13:59:18 sg-laptop kernel: usbcore: registered new interface driver usb-storage
+Jan 11 13:59:40 sg-laptop kernel: usb 3-1: reset SuperSpeed USB device number 2 using xhci_hcd
+Jan 11 13:59:41 sg-laptop kernel: usb 3-1: device descriptor read/8, error -71
+Jan 11 13:59:41 sg-laptop kernel: usb 3-1: reset SuperSpeed USB device number 2 using xhci_hcd
+Jan 11 13:59:46 sg-laptop kernel: usb 3-1: device descriptor read/8, error -110
+Jan 11 13:59:46 sg-laptop kernel: scsi 6:0:0:0: Device offlined - not ready after error recovery
+Jan 11 13:59:46 sg-laptop kernel: usb 3-1: USB disconnect, device number 2
+
+lspci for the affected host:
+
+04:00.0 0c03: 1b73:1000 (rev 04) (prog-if 30 [XHCI])
+ Subsystem: 1043:1039
+ Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
+ Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
+ Latency: 0, Cache Line Size: 64 bytes
+ Interrupt: pin A routed to IRQ 19
+ Region 0: Memory at dd200000 (32-bit, non-prefetchable) [size=64K]
+ Capabilities: [50] Power Management version 3
+ Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold-)
+ Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
+ Capabilities: [68] MSI: Enable- Count=1/1 Maskable- 64bit+
+ Address: 0000000000000000 Data: 0000
+ Capabilities: [80] Express (v1) Endpoint, MSI 00
+ DevCap: MaxPayload 128 bytes, PhantFunc 0, Latency L0s <2us, L1 <32us
+ ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset-
+ DevCtl: Report errors: Correctable- Non-Fatal- Fatal- Unsupported-
+ RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+
+ MaxPayload 128 bytes, MaxReadReq 512 bytes
+ DevSta: CorrErr- UncorrErr- FatalErr- UnsuppReq- AuxPwr- TransPend-
+ LnkCap: Port #0, Speed 2.5GT/s, Width x1, ASPM L0s L1, Latency L0 unlimited, L1 unlimited
+ ClockPM- Surprise- LLActRep- BwNot-
+ LnkCtl: ASPM Disabled; RCB 64 bytes Disabled- Retrain- CommClk+
+ ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
+ LnkSta: Speed 2.5GT/s, Width x1, TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
+ Kernel driver in use: xhci_hcd
+ Kernel modules: xhci_hcd
+
+The commit was backported to stable kernels, and will need to be
+reverted there as well.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@intel.com>
+Reported-by: Sergey Galanov <sergey.e.galanov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd.c | 1 -
+ drivers/usb/core/hub.c | 7 +------
+ drivers/usb/core/usb.h | 1 -
+ 3 files changed, 1 insertion(+), 8 deletions(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1033,7 +1033,6 @@ static int register_root_hub(struct usb_
+ dev_name(&usb_dev->dev), retval);
+ return retval;
+ }
+- usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
+ }
+
+ retval = usb_new_device (usb_dev);
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -135,7 +135,7 @@ struct usb_hub *usb_hub_to_struct_hub(st
+ return usb_get_intfdata(hdev->actconfig->interface[0]);
+ }
+
+-int usb_device_supports_lpm(struct usb_device *udev)
++static int usb_device_supports_lpm(struct usb_device *udev)
+ {
+ /* USB 2.1 (and greater) devices indicate LPM support through
+ * their USB 2.0 Extended Capabilities BOS descriptor.
+@@ -156,11 +156,6 @@ int usb_device_supports_lpm(struct usb_d
+ "Power management will be impacted.\n");
+ return 0;
+ }
+-
+- /* udev is root hub */
+- if (!udev->parent)
+- return 1;
+-
+ if (udev->parent->lpm_capable)
+ return 1;
+
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -35,7 +35,6 @@ extern int usb_get_device_descriptor(str
+ unsigned int size);
+ extern int usb_get_bos_descriptor(struct usb_device *dev);
+ extern void usb_release_bos_descriptor(struct usb_device *dev);
+-extern int usb_device_supports_lpm(struct usb_device *udev);
+ extern char *usb_cache_string(struct usb_device *udev, int index);
+ extern int usb_set_configuration(struct usb_device *dev, int configuration);
+ extern int usb_choose_configuration(struct usb_device *udev);
--- /dev/null
+From 9cf00d91708221ff2d8a11143315f7ebab8d5da8 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Fri, 31 Jan 2014 11:51:59 -0800
+Subject: Revert "xhci: Avoid infinite loop when sg urb requires too many trbs"
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 9cf00d91708221ff2d8a11143315f7ebab8d5da8 upstream.
+
+This reverts commit d6c9ea9069af684358efedcaf2f2f687f51c58ee.
+
+We are ripping out commit 35773dac5f862cb1c82ea151eba3e2f6de51ec3e "usb:
+xhci: Link TRB must not occur within a USB payload burst" because it's a
+hack that caused regressions in the usb-storage and userspace USB
+drivers that use usbfs and libusb. This commit attempted to fix the
+issues with that patch.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2964,7 +2964,7 @@ static int prepare_ring(struct xhci_hcd
+ if (num_trbs >= TRBS_PER_SEGMENT) {
+ xhci_err(xhci, "Too many fragments %d, max %d\n",
+ num_trbs, TRBS_PER_SEGMENT - 1);
+- return -EINVAL;
++ return -ENOMEM;
+ }
+
+ nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |
--- /dev/null
+From 1386ff75797a187df324062fb4e929152392da88 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Fri, 31 Jan 2014 11:45:02 -0800
+Subject: Revert "xhci: Set scatter-gather limit to avoid failed block writes."
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 1386ff75797a187df324062fb4e929152392da88 upstream.
+
+This reverts commit f2d9b991c549f159dc9ae81f77d8206c790cbfee.
+
+We are ripping out commit 35773dac5f862cb1c82ea151eba3e2f6de51ec3e "usb:
+xhci: Link TRB must not occur within a USB payload burst" because it's a
+hack that caused regressions in the usb-storage and userspace USB
+drivers that use usbfs and libusb. This commit attempted to fix the
+issues with that patch.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 4 ++--
+ drivers/usb/host/xhci.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4727,8 +4727,8 @@ int xhci_gen_setup(struct usb_hcd *hcd,
+ struct device *dev = hcd->self.controller;
+ int retval;
+
+- /* Limit the block layer scatter-gather lists to half a segment. */
+- hcd->self.sg_tablesize = TRBS_PER_SEGMENT / 2;
++ /* Accept arbitrarily long scatter-gather lists */
++ hcd->self.sg_tablesize = ~0;
+
+ /* XHCI controllers don't stop the ep queue on short packets :| */
+ hcd->self.no_stop_on_short = 1;
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1262,7 +1262,7 @@ union xhci_trb {
+ * since the command ring is 64-byte aligned.
+ * It must also be greater than 16.
+ */
+-#define TRBS_PER_SEGMENT 256
++#define TRBS_PER_SEGMENT 64
+ /* Allow two commands + a link TRB, along with any reserved command TRBs */
+ #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3)
+ #define TRB_SEGMENT_SIZE (TRBS_PER_SEGMENT*16)
--- /dev/null
+From d651aa1d68a2f0a7ee65697b04c6a92f8c0a12f2 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Tue, 11 Feb 2014 13:38:54 -0500
+Subject: ring-buffer: Fix first commit on sub-buffer having non-zero delta
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit d651aa1d68a2f0a7ee65697b04c6a92f8c0a12f2 upstream.
+
+Each sub-buffer (buffer page) has a full 64 bit timestamp. The events on
+that page use a 27 bit delta against that timestamp in order to save on
+bits written to the ring buffer. If the time between events is larger than
+what the 27 bits can hold, a "time extend" event is added to hold the
+entire 64 bit timestamp again and the events after that hold a delta from
+that timestamp.
+
+As a "time extend" is always paired with an event, it is logical to just
+allocate the event with the time extend, to make things a bit more efficient.
+
+Unfortunately, when the pairing code was written, it removed the "delta = 0"
+from the first commit on a page, causing the events on the page to be
+slightly skewed.
+
+Fixes: 69d1b839f7ee "ring-buffer: Bind time extend and data events together"
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2397,6 +2397,13 @@ __rb_reserve_next(struct ring_buffer_per
+ write &= RB_WRITE_MASK;
+ tail = write - length;
+
++ /*
++ * If this is the first commit on the page, then it has the same
++ * timestamp as the page itself.
++ */
++ if (!tail)
++ delta = 0;
++
+ /* See if we shot pass the end of this buffer page */
+ if (unlikely(write > BUF_PAGE_SIZE))
+ return rb_move_tail(cpu_buffer, length, tail,
x86-smap-don-t-enable-smap-if-config_x86_smap-is-disabled.patch
x86-smap-smap_violation-is-bogus-if-config_x86_smap-is-off.patch
ftrace-x86-use-breakpoints-for-converting-function-graph-caller.patch
+alsa-hda-fix-mic-capture-on-sony-vaio-pro-11.patch
+mei-clear-write-cb-from-waiting-list-on-reset.patch
+mei-don-t-unset-read-cb-ptr-on-reset.patch
+vme-correct-read-write-alignment-algorithm.patch
+drivers-hv-vmbus-don-t-timeout-during-the-initial-connection-with-host.patch
+usb-ftdi_sio-add-mindstorms-ev3-console-adapter.patch
+usb-ftdi_sio-add-tagsys-rfid-reader-ids.patch
+usb-storage-add-unusual-devs-entry-for-blackberry-9000.patch
+usb-storage-restrict-bcddevice-range-for-super-top-in-cypress-atacb.patch
+usb-storage-enable-multi-lun-scanning-when-needed.patch
+usb-option-blacklist-zte-mf667-net-interface.patch
+usb-simple-add-dynastream-ant-usb-m-stick-device-support.patch
+xhci-1.0-limit-arbitrarily-aligned-scatter-gather.patch
+revert-xhci-set-scatter-gather-limit-to-avoid-failed-block-writes.patch
+revert-xhci-avoid-infinite-loop-when-sg-urb-requires-too-many-trbs.patch
+revert-usb-xhci-link-trb-must-not-occur-within-a-usb-payload-burst.patch
+revert-usbcore-set-lpm_capable-field-for-lpm-capable-root-hubs.patch
+modpost-fixed-usb-alias-generation-for-ranges-including-0x9-and-0xa.patch
+block-__elv_next_request-shouldn-t-call-into-the-elevator-if-bypassing.patch
+block-fix-nr_vecs-for-inline-integrity-vectors.patch
+block-add-cond_resched-to-potentially-long-running-ioctl-discard-loop.patch
+acpi-hotplug-pci-relax-the-checking-of-_sta-return-values.patch
+compiler-gcc4-make-quirk-for-asm_volatile_goto-unconditional.patch
+ib-qib-add-missing-serdes-init-sequence.patch
+kvm-return-an-error-code-in-kvm_vm_ioctl_register_coalesced_mmio.patch
+tick-clear-broadcast-pending-bit-when-switching-to-oneshot.patch
+md-raid1-restore-ability-for-check-and-repair-to-fix-read-errors.patch
+md-raid5-fix-cpu-hotplug-callback-registration.patch
+i2c-mv64xxx-refactor-message-start-to-ensure-proper-initialization.patch
+time-fix-overflow-when-hz-is-smaller-than-60.patch
+power-max17040-fix-null-pointer-dereference-when-there-is-no-platform_data.patch
+ring-buffer-fix-first-commit-on-sub-buffer-having-non-zero-delta.patch
+target-fix-free-after-use-regression-in-pr-unregister.patch
+genirq-add-missing-irq_to_desc-export-for-config_sparse_irq-n.patch
--- /dev/null
+From fc09149df6e20cfbb0bb86f10899607c321a31eb Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 30 Jan 2014 13:08:49 -0800
+Subject: target: Fix free-after-use regression in PR unregister
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit fc09149df6e20cfbb0bb86f10899607c321a31eb upstream.
+
+This patch addresses a >= v3.11 free-after-use regression
+in core_scsi3_emulate_pro_register() that was introduced
+in the following commit:
+
+commit bc118fe4c4a8cfa453491ba77c0a146a6d0e73e0
+Author: Andy Grover <agrover@redhat.com>
+Date: Thu May 16 10:41:04 2013 -0700
+
+ target: Further refactoring of core_scsi3_emulate_pro_register()
+
+To avoid the free-after-use, save an type value before hand, and
+only call core_scsi3_put_pr_reg() with a valid *pr_reg.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Andy Grover <agrover@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_pr.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -2009,7 +2009,7 @@ core_scsi3_emulate_pro_register(struct s
+ struct t10_reservation *pr_tmpl = &dev->t10_pr;
+ unsigned char isid_buf[PR_REG_ISID_LEN], *isid_ptr = NULL;
+ sense_reason_t ret = TCM_NO_SENSE;
+- int pr_holder = 0;
++ int pr_holder = 0, type;
+
+ if (!se_sess || !se_lun) {
+ pr_err("SPC-3 PR: se_sess || struct se_lun is NULL!\n");
+@@ -2131,6 +2131,7 @@ core_scsi3_emulate_pro_register(struct s
+ ret = TCM_RESERVATION_CONFLICT;
+ goto out;
+ }
++ type = pr_reg->pr_res_type;
+
+ spin_lock(&pr_tmpl->registration_lock);
+ /*
+@@ -2161,6 +2162,7 @@ core_scsi3_emulate_pro_register(struct s
+ * Release the calling I_T Nexus registration now..
+ */
+ __core_scsi3_free_registration(cmd->se_dev, pr_reg, NULL, 1);
++ pr_reg = NULL;
+
+ /*
+ * From spc4r17, section 5.7.11.3 Unregistering
+@@ -2174,8 +2176,8 @@ core_scsi3_emulate_pro_register(struct s
+ * RESERVATIONS RELEASED.
+ */
+ if (pr_holder &&
+- (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY ||
+- pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY)) {
++ (type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY ||
++ type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY)) {
+ list_for_each_entry(pr_reg_p,
+ &pr_tmpl->registration_list,
+ pr_reg_list) {
+@@ -2194,7 +2196,8 @@ core_scsi3_emulate_pro_register(struct s
+ ret = core_scsi3_update_and_write_aptpl(dev, aptpl);
+
+ out:
+- core_scsi3_put_pr_reg(pr_reg);
++ if (pr_reg)
++ core_scsi3_put_pr_reg(pr_reg);
+ return ret;
+ }
+
--- /dev/null
+From dd5fd9b91a77b4c9c28b7ef9c181b1a875820d0a Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Tue, 11 Feb 2014 14:35:40 +0100
+Subject: tick: Clear broadcast pending bit when switching to oneshot
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit dd5fd9b91a77b4c9c28b7ef9c181b1a875820d0a upstream.
+
+AMD systems which use the C1E workaround in the amd_e400_idle routine
+trigger the WARN_ON_ONCE in the broadcast code when onlining a CPU.
+
+The reason is that the idle routine of those AMD systems switches the
+cpu into forced broadcast mode early on before the newly brought up
+CPU can switch over to high resolution / NOHZ mode. The timer related
+CPU1 bringup looks like this:
+
+ clockevent_register_device(local_apic);
+ tick_setup(local_apic);
+ ...
+ idle()
+ tick_broadcast_on_off(FORCE);
+ tick_broadcast_oneshot_control(ENTER)
+ cpumask_set(cpu, broadcast_oneshot_mask);
+ halt();
+
+Now the broadcast interrupt on CPU0 sets CPU1 in the
+broadcast_pending_mask and wakes CPU1. So CPU1 continues:
+
+ local_apic_timer_interrupt()
+ tick_handle_periodic();
+ softirq()
+ tick_init_highres();
+ cpumask_clr(cpu, broadcast_oneshot_mask);
+
+ tick_broadcast_oneshot_control(ENTER)
+ WARN_ON(cpumask_test(cpu, broadcast_pending_mask);
+
+So while we remove CPU1 from the broadcast_oneshot_mask when we switch
+over to highres mode, we do not clear the pending bit, which then
+triggers the warning when we go back to idle.
+
+The reason why this is only visible on C1E affected AMD systems is
+that the other machines enter the deep sleep states via
+acpi_idle/intel_idle and exit the broadcast mode before executing the
+remote triggered local_apic_timer_interrupt. So the pending bit is
+already cleared when the switch over to highres mode is clearing the
+oneshot mask.
+
+The solution is simple: Clear the pending bit together with the mask
+bit when we switch over to highres mode.
+
+Stanislaw came up independently with the same patch by enforcing the
+C1E workaround and debugging the fallout. I picked mine, because mine
+has a changelog :)
+
+Reported-by: poma <pomidorabelisima@gmail.com>
+Debugged-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Olaf Hering <olaf@aepfle.de>
+Cc: Dave Jones <davej@redhat.com>
+Cc: Justin M. Forbes <jforbes@redhat.com>
+Cc: Josh Boyer <jwboyer@redhat.com>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.02.1402111434180.21991@ionos.tec.linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/tick-broadcast.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -755,6 +755,7 @@ out:
+ static void tick_broadcast_clear_oneshot(int cpu)
+ {
+ cpumask_clear_cpu(cpu, tick_broadcast_oneshot_mask);
++ cpumask_clear_cpu(cpu, tick_broadcast_pending_mask);
+ }
+
+ static void tick_broadcast_init_next_event(struct cpumask *mask,
--- /dev/null
+From 80d767d770fd9c697e434fd080c2db7b5c60c6dd Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 24 Jan 2014 16:41:36 -0500
+Subject: time: Fix overflow when HZ is smaller than 60
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 80d767d770fd9c697e434fd080c2db7b5c60c6dd upstream.
+
+When compiling for the IA-64 ski emulator, HZ is set to 32 because the
+emulation is slow and we don't want to waste too many cycles processing
+timers. Alpha also has an option to set HZ to 32.
+
+This causes integer underflow in
+kernel/time/jiffies.c:
+kernel/time/jiffies.c:66:2: warning: large integer implicitly truncated to unsigned type [-Woverflow]
+ .mult = NSEC_PER_JIFFY << JIFFIES_SHIFT, /* details above */
+ ^
+
+This patch reduces the JIFFIES_SHIFT value to avoid the overflow.
+
+Signed-off-by: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
+Link: http://lkml.kernel.org/r/alpine.LRH.2.02.1401241639100.23871@file01.intranet.prod.int.rdu2.redhat.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/jiffies.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/kernel/time/jiffies.c
++++ b/kernel/time/jiffies.c
+@@ -51,7 +51,13 @@
+ * HZ shrinks, so values greater than 8 overflow 32bits when
+ * HZ=100.
+ */
++#if HZ < 34
++#define JIFFIES_SHIFT 6
++#elif HZ < 67
++#define JIFFIES_SHIFT 7
++#else
+ #define JIFFIES_SHIFT 8
++#endif
+
+ static cycle_t jiffies_read(struct clocksource *cs)
+ {
--- /dev/null
+From 67847baee056892dc35efb9c3fd05ae7f075588c Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Tue, 14 Jan 2014 18:56:54 +0100
+Subject: usb: ftdi_sio: add Mindstorms EV3 console adapter
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit 67847baee056892dc35efb9c3fd05ae7f075588c upstream.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -153,6 +153,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_1_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_2_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -50,6 +50,7 @@
+ #define TI_XDS100V2_PID 0xa6d0
+
+ #define FTDI_NXTCAM_PID 0xABB8 /* NXTCam for Mindstorms NXT */
++#define FTDI_EV3CON_PID 0xABB9 /* Mindstorms EV3 Console Adapter */
+
+ /* US Interface Navigator (http://www.usinterface.com/) */
+ #define FTDI_USINT_CAT_PID 0xb810 /* Navigator CAT and 2nd PTT lines */
--- /dev/null
+From 76f24e3f39a1a94bab0d54e98899d64abcd9f69c Mon Sep 17 00:00:00 2001
+From: Ulrich Hahn <uhahn@eanco.de>
+Date: Sun, 2 Feb 2014 14:42:52 +0100
+Subject: USB: ftdi_sio: add Tagsys RFID Reader IDs
+
+From: Ulrich Hahn <uhahn@eanco.de>
+
+commit 76f24e3f39a1a94bab0d54e98899d64abcd9f69c upstream.
+
+Adding two more IDs to the ftdi_sio usb serial driver.
+It now connects Tagsys RFID readers.
+There might be more IDs out there for other Tagsys models.
+
+Signed-off-by: Ulrich Hahn <uhahn@eanco.de>
+Cc: Johan Hovold <johan@hovold.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -193,6 +193,8 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
+ { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
++ { USB_DEVICE(FTDI_VID, FTDI_TAGSYS_LP101_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_TAGSYS_P200X_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_LENZ_LIUSB_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_XF_632_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_XF_634_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -364,6 +364,12 @@
+ /* Sprog II (Andrew Crosland's SprogII DCC interface) */
+ #define FTDI_SPROG_II 0xF0C8
+
++/*
++ * Two of the Tagsys RFID Readers
++ */
++#define FTDI_TAGSYS_LP101_PID 0xF0E9 /* Tagsys L-P101 RFID*/
++#define FTDI_TAGSYS_P200X_PID 0xF0EE /* Tagsys Medio P200x RFID*/
++
+ /* an infrared receiver for user access control with IR tags */
+ #define FTDI_PIEGROUP_PID 0xF208 /* Product Id */
+
--- /dev/null
+From 3635c7e2d59f7861afa6fa5e87e2a58860ff514d Mon Sep 17 00:00:00 2001
+From: Raymond Wanyoike <raymond.wanyoike@gmail.com>
+Date: Sun, 9 Feb 2014 11:59:46 +0300
+Subject: usb: option: blacklist ZTE MF667 net interface
+
+From: Raymond Wanyoike <raymond.wanyoike@gmail.com>
+
+commit 3635c7e2d59f7861afa6fa5e87e2a58860ff514d upstream.
+
+Interface #5 of 19d2:1270 is a net interface which has been submitted to the
+qmi_wwan driver so consequently remove it from the option driver.
+
+Signed-off-by: Raymond Wanyoike <raymond.wanyoike@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1362,7 +1362,8 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff),
++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
--- /dev/null
+From 2240c365108adbc4100a55654a5707e8e877a401 Mon Sep 17 00:00:00 2001
+From: Kristóf Ralovich <kristof.ralovich@gmail.com>
+Date: Fri, 24 Jan 2014 12:18:35 +0100
+Subject: USB: simple: add Dynastream ANT USB-m Stick device support
+
+From: Kristóf Ralovich <kristof.ralovich@gmail.com>
+
+commit 2240c365108adbc4100a55654a5707e8e877a401 upstream.
+
+Add support for ANT USB-m Stick from Dynastream Innovations, by listing
+USB pid
+
+[34366.944805] usb 6-1: New USB device found, idVendor=0fcf, idProduct=1009
+[34366.944817] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+[34366.944824] usb 6-1: Product: ANT USB-m Stick
+[34366.944831] usb 6-1: Manufacturer: Dynastream Innovations
+
+Device reported (https://code.google.com/p/antpm/issues/detail?id=5) to
+work through:
+$ modprobe usbserial vendor=0x0fcf product=0x1009
+
+Signed-off-by: Kristóf Ralovich <kristof.ralovich@gmail.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb-serial-simple.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/usb-serial-simple.c
++++ b/drivers/usb/serial/usb-serial-simple.c
+@@ -72,7 +72,8 @@ DEVICE(hp4x, HP4X_IDS);
+
+ /* Suunto ANT+ USB Driver */
+ #define SUUNTO_IDS() \
+- { USB_DEVICE(0x0fcf, 0x1008) }
++ { USB_DEVICE(0x0fcf, 0x1008) }, \
++ { USB_DEVICE(0x0fcf, 0x1009) } /* Dynastream ANT USB-m Stick */
+ DEVICE(suunto, SUUNTO_IDS);
+
+ /* Siemens USB/MPI adapter */
--- /dev/null
+From c5637e5119c43452a00e27c274356b072263ecbb Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 21 Jan 2014 10:38:45 -0500
+Subject: usb-storage: add unusual-devs entry for BlackBerry 9000
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit c5637e5119c43452a00e27c274356b072263ecbb upstream.
+
+This patch adds an unusual-devs entry for the BlackBerry 9000. This
+fixes Bugzilla #22442.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Moritz Moeller-Herrmann <moritz-kernel@moeller-herrmann.de>
+Tested-by: Moritz Moeller-Herrmann <moritz-kernel@moeller-herrmann.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1455,6 +1455,13 @@ UNUSUAL_DEV( 0x0f88, 0x042e, 0x0100, 0x0
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/* Reported by Moritz Moeller-Herrmann <moritz-kernel@moeller-herrmann.de> */
++UNUSUAL_DEV( 0x0fca, 0x8004, 0x0201, 0x0201,
++ "Research In Motion",
++ "BlackBerry Bold 9000",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_MAX_SECTORS_64 ),
++
+ /* Reported by Michael Stattmann <michael@stattmann.com> */
+ UNUSUAL_DEV( 0x0fce, 0xd008, 0x0000, 0x0000,
+ "Sony Ericsson",
--- /dev/null
+From 823d12c95c666fa7ab7dad208d735f6bc6afabdc Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 30 Jan 2014 10:43:22 -0500
+Subject: usb-storage: enable multi-LUN scanning when needed
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 823d12c95c666fa7ab7dad208d735f6bc6afabdc upstream.
+
+People sometimes create their own custom-configured kernels and forget
+to enable CONFIG_SCSI_MULTI_LUN. This causes problems when they plug
+in a USB storage device (such as a card reader) with more than one
+LUN.
+
+Fortunately, we can tell fairly easily when a storage device claims to
+have more than one LUN. When that happens, this patch asks the SCSI
+layer to probe all the LUNs automatically, regardless of the config
+setting.
+
+The patch also updates the Kconfig help text for usb-storage,
+explaining that CONFIG_SCSI_MULTI_LUN may be necessary.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Thomas Raschbacher <lordvan@lordvan.com>
+CC: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
+CC: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/Kconfig | 4 +++-
+ drivers/usb/storage/scsiglue.c | 6 ++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/Kconfig
++++ b/drivers/usb/storage/Kconfig
+@@ -18,7 +18,9 @@ config USB_STORAGE
+
+ This option depends on 'SCSI' support being enabled, but you
+ probably also need 'SCSI device support: SCSI disk support'
+- (BLK_DEV_SD) for most USB storage devices.
++ (BLK_DEV_SD) for most USB storage devices. Some devices also
++ will require 'Probe all LUNs on each SCSI device'
++ (SCSI_MULTI_LUN).
+
+ To compile this driver as a module, choose M here: the
+ module will be called usb-storage.
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -78,6 +78,8 @@ static const char* host_info(struct Scsi
+
+ static int slave_alloc (struct scsi_device *sdev)
+ {
++ struct us_data *us = host_to_us(sdev->host);
++
+ /*
+ * Set the INQUIRY transfer length to 36. We don't use any of
+ * the extra data and many devices choke if asked for more or
+@@ -102,6 +104,10 @@ static int slave_alloc (struct scsi_devi
+ */
+ blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
+
++ /* Tell the SCSI layer if we know there is more than one LUN */
++ if (us->protocol == USB_PR_BULK && us->max_lun > 0)
++ sdev->sdev_bflags |= BLIST_FORCELUN;
++
+ return 0;
+ }
+
--- /dev/null
+From a9c143c82608bee2a36410caa56d82cd86bdc7fa Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 30 Jan 2014 10:20:29 -0500
+Subject: usb-storage: restrict bcdDevice range for Super Top in Cypress ATACB
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit a9c143c82608bee2a36410caa56d82cd86bdc7fa upstream.
+
+The Cypress ATACB unusual-devs entry for the Super Top SATA bridge
+causes problems. Although it was originally reported only for
+bcdDevice = 0x160, its range was much larger. This resulted in a bug
+report for bcdDevice 0x220, so the range was capped at 0x219. Now
+Milan reports errors with bcdDevice 0x150.
+
+Therefore this patch restricts the range to just 0x160.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: Milan Svoboda <milan.svoboda@centrum.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_cypress.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/unusual_cypress.h
++++ b/drivers/usb/storage/unusual_cypress.h
+@@ -31,7 +31,7 @@ UNUSUAL_DEV( 0x04b4, 0x6831, 0x0000, 0x
+ "Cypress ISD-300LP",
+ USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+
+-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219,
++UNUSUAL_DEV( 0x14cd, 0x6116, 0x0160, 0x0160,
+ "Super Top",
+ "USB 2.0 SATA BRIDGE",
+ USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
--- /dev/null
+From f0342e66b397947ed8c3eef8c37b5ca2d5b1bb50 Mon Sep 17 00:00:00 2001
+From: Martyn Welch <martyn.welch@ge.com>
+Date: Fri, 7 Feb 2014 15:48:56 +0000
+Subject: VME: Correct read/write alignment algorithm
+
+From: Martyn Welch <martyn.welch@ge.com>
+
+commit f0342e66b397947ed8c3eef8c37b5ca2d5b1bb50 upstream.
+
+In order to ensure the correct width cycles on the VME bus, the VME bridge
+drivers implement an algorithm to utilise the largest possible width reads and
+writes whilst maintaining natural alignment constraints. The algorithm
+currently looks at the start address rather than the current read/write address
+when determining whether a 16-bit width cycle is required to get to 32-bit
+alignment. This results in incorrect alignment,
+
+Reported-by: Jim Strouth <james.strouth@ge.com>
+Tested-by: Jim Strouth <james.strouth@ge.com>
+Signed-off-by: Martyn Welch <martyn.welch@ge.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/vme/bridges/vme_ca91cx42.c | 4 ++--
+ drivers/vme/bridges/vme_tsi148.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/vme/bridges/vme_ca91cx42.c
++++ b/drivers/vme/bridges/vme_ca91cx42.c
+@@ -884,7 +884,7 @@ static ssize_t ca91cx42_master_read(stru
+ if (done == count)
+ goto out;
+ }
+- if ((uintptr_t)addr & 0x2) {
++ if ((uintptr_t)(addr + done) & 0x2) {
+ if ((count - done) < 2) {
+ *(u8 *)(buf + done) = ioread8(addr + done);
+ done += 1;
+@@ -938,7 +938,7 @@ static ssize_t ca91cx42_master_write(str
+ if (done == count)
+ goto out;
+ }
+- if ((uintptr_t)addr & 0x2) {
++ if ((uintptr_t)(addr + done) & 0x2) {
+ if ((count - done) < 2) {
+ iowrite8(*(u8 *)(buf + done), addr + done);
+ done += 1;
+--- a/drivers/vme/bridges/vme_tsi148.c
++++ b/drivers/vme/bridges/vme_tsi148.c
+@@ -1289,7 +1289,7 @@ static ssize_t tsi148_master_read(struct
+ if (done == count)
+ goto out;
+ }
+- if ((uintptr_t)addr & 0x2) {
++ if ((uintptr_t)(addr + done) & 0x2) {
+ if ((count - done) < 2) {
+ *(u8 *)(buf + done) = ioread8(addr + done);
+ done += 1;
+@@ -1371,7 +1371,7 @@ static ssize_t tsi148_master_write(struc
+ if (done == count)
+ goto out;
+ }
+- if ((uintptr_t)addr & 0x2) {
++ if ((uintptr_t)(addr + done) & 0x2) {
+ if ((count - done) < 2) {
+ iowrite8(*(u8 *)(buf + done), addr + done);
+ done += 1;
--- /dev/null
+From 247bf557273dd775505fb9240d2d152f4f20d304 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Fri, 31 Jan 2014 11:26:25 -0800
+Subject: xhci 1.0: Limit arbitrarily-aligned scatter gather.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 247bf557273dd775505fb9240d2d152f4f20d304 upstream.
+
+xHCI 1.0 hosts have a set of requirements on how to align transfer
+buffers on the endpoint rings called "TD fragment" rules. When the
+ax88179_178a driver added support for scatter gather in 3.12, with
+commit 804fad45411b48233b48003e33a78f290d227c8 "USBNET: ax88179_178a:
+enable tso if usb host supports sg dma", it broke the device under xHCI
+1.0 hosts. Under certain network loads, the device would see an
+unexpected short packet from the host, which would cause the device to
+stop sending ethernet packets, even through USB packets would still be
+sent.
+
+Commit 35773dac5f86 "usb: xhci: Link TRB must not occur within a USB
+payload burst" attempted to fix this. It was a quick hack to partially
+implement the TD fragment rules. However, it caused regressions in the
+usb-storage layer and userspace USB drivers using libusb. The patches
+to attempt to fix this are too far reaching into the USB core, and we
+really need to implement the TD fragment rules correctly in the xHCI
+driver, instead of continuing to wallpaper over the issues.
+
+Disable arbitrarily-aligned scatter-gather in the xHCI driver for 1.0
+hosts. Only the ax88179_178a driver checks the no_sg_constraint flag,
+so don't set it for 1.0 hosts. This should not impact usb-storage or
+usbfs behavior, since they pass down max packet sized aligned sg-list
+entries (512 for USB 2.0 and 1024 for USB 3.0).
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Tested-by: Mark Lord <mlord@pobox.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Cc: Bjørn Mork <bjorn@mork.no>
+Cc: Freddy Xin <freddy@asix.com.tw>
+Cc: Ming Lei <ming.lei@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4730,9 +4730,6 @@ int xhci_gen_setup(struct usb_hcd *hcd,
+ /* Limit the block layer scatter-gather lists to half a segment. */
+ hcd->self.sg_tablesize = TRBS_PER_SEGMENT / 2;
+
+- /* support to build packet from discontinuous buffers */
+- hcd->self.no_sg_constraint = 1;
+-
+ /* XHCI controllers don't stop the ep queue on short packets :| */
+ hcd->self.no_stop_on_short = 1;
+
+@@ -4757,6 +4754,14 @@ int xhci_gen_setup(struct usb_hcd *hcd,
+ /* xHCI private pointer was set in xhci_pci_probe for the second
+ * registered roothub.
+ */
++ xhci = hcd_to_xhci(hcd);
++ /*
++ * Support arbitrarily aligned sg-list entries on hosts without
++ * TD fragment rules (which are currently unsupported).
++ */
++ if (xhci->hci_version < 0x100)
++ hcd->self.no_sg_constraint = 1;
++
+ return 0;
+ }
+
+@@ -4783,6 +4788,9 @@ int xhci_gen_setup(struct usb_hcd *hcd,
+ if (xhci->hci_version > 0x96)
+ xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+
++ if (xhci->hci_version < 0x100)
++ hcd->self.no_sg_constraint = 1;
++
+ /* Make sure the HC is halted. */
+ retval = xhci_halt(xhci);
+ if (retval)
projects / thirdparty / kernel / stable-queue.git / commitdiff
