--- /dev/null
+From af65cfe9aeae03e0682bebdf4db94582d75562dd Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Mon, 2 Sep 2013 13:30:25 +0300
+Subject: ACPI / LPSS: don't crash if a device has no MMIO resources
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit af65cfe9aeae03e0682bebdf4db94582d75562dd upstream.
+
+Intel LPSS devices that are enumerated from ACPI have both MMIO and IRQ
+resources returned in their _CRS method. However, Apple Macbook Air with
+Haswell has LPSS devices enumerated from PCI bus instead and _CRS method
+returns only an interrupt number (but the device has _HID set that causes
+the scan handler to match it).
+
+The current ACPI / LPSS code sets pdata->dev_desc only when MMIO resource
+is found for the device and in case of Macbook Air it is never found. That
+leads to a NULL pointer dereference in register_device_clock().
+
+Correct this by always setting the pdata->dev_desc.
+
+Reported-and-tested-by: Imre Kaloz <kaloz@openwrt.org>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_lpss.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -155,12 +155,13 @@ static int acpi_lpss_create_device(struc
+ pdata->mmio_size = resource_size(&rentry->res);
+ pdata->mmio_base = ioremap(rentry->res.start,
+ pdata->mmio_size);
+- pdata->dev_desc = dev_desc;
+ break;
+ }
+
+ acpi_dev_free_resource_list(&resource_list);
+
++ pdata->dev_desc = dev_desc;
++
+ if (dev_desc->clk_required) {
+ ret = register_device_clock(adev, pdata);
+ if (ret) {
--- /dev/null
+From 9f6f0afbb9fdabf6dcac642dfec457f28981e3f8 Mon Sep 17 00:00:00 2001
+From: Steffen Trumtrar <s.trumtrar@pengutronix.de>
+Date: Mon, 9 Sep 2013 18:09:12 +0200
+Subject: ASoC: mc13783: add spi errata fix
+
+From: Steffen Trumtrar <s.trumtrar@pengutronix.de>
+
+commit 9f6f0afbb9fdabf6dcac642dfec457f28981e3f8 upstream.
+
+The MC13783 Chip Errata, Rev. 4 says, that depending on SPI clock
+and main audio clock speed, the Audio Codec or Stereo DAC do sometimes
+not start when programmed to do so. This is due to an internal clock
+timing issue related to the loading of the SPI bits into the audio block.
+
+On an i.MX27 based system, this issue lead to switched audio channels under
+certain circumstances: RTC + Touch + Audio are used and loaded at startup.
+
+The mentioned workaround of writing registers 40 and 41 two times is implemented
+here.
+
+Signed-off-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/mc13783.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/soc/codecs/mc13783.c
++++ b/sound/soc/codecs/mc13783.c
+@@ -126,6 +126,10 @@ static int mc13783_write(struct snd_soc_
+
+ ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
+
++ /* include errata fix for spi audio problems */
++ if (reg == MC13783_AUDIO_CODEC || reg == MC13783_AUDIO_DAC)
++ ret = mc13xxx_reg_write(priv->mc13xxx, reg, value);
++
+ mc13xxx_unlock(priv->mc13xxx);
+
+ return ret;
--- /dev/null
+From 85fa532b6ef920b32598df86b194571a7059a77c Mon Sep 17 00:00:00 2001
+From: Mike Dyer <mike.dyer@md-soft.co.uk>
+Date: Fri, 16 Aug 2013 18:36:28 +0100
+Subject: ASoC: wm8960: Fix PLL register writes
+
+From: Mike Dyer <mike.dyer@md-soft.co.uk>
+
+commit 85fa532b6ef920b32598df86b194571a7059a77c upstream.
+
+Bit 9 of PLL2,3 and 4 is reserved as '0'. The 24bit fractional part
+should be split across each register in 8bit chunks.
+
+Signed-off-by: Mike Dyer <mike.dyer@md-soft.co.uk>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8960.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -857,9 +857,9 @@ static int wm8960_set_dai_pll(struct snd
+ if (pll_div.k) {
+ reg |= 0x20;
+
+- snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
+- snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
+- snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
++ snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
++ snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
++ snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
+ }
+ snd_soc_write(codec, WM8960_PLL1, reg);
+
--- /dev/null
+From bd1c149aa9915b9abb6d83d0f01dfd2ace0680b5 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@ZenIV.linux.org.uk>
+Date: Sun, 1 Sep 2013 20:35:01 +0100
+Subject: Introduce [compat_]save_altstack_ex() to unbreak x86 SMAP
+
+From: Al Viro <viro@ZenIV.linux.org.uk>
+
+commit bd1c149aa9915b9abb6d83d0f01dfd2ace0680b5 upstream.
+
+For performance reasons, when SMAP is in use, SMAP is left open for an
+entire put_user_try { ... } put_user_catch(); block, however, calling
+__put_user() in the middle of that block will close SMAP as the
+STAC..CLAC constructs intentionally do not nest.
+
+Furthermore, using __put_user() rather than put_user_ex() here is bad
+for performance.
+
+Thus, introduce new [compat_]save_altstack_ex() helpers that replace
+__[compat_]save_altstack() for x86, being currently the only
+architecture which supports put_user_try { ... } put_user_catch().
+
+Reported-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Link: http://lkml.kernel.org/n/tip-es5p6y64if71k8p5u08agv9n@git.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/ia32/ia32_signal.c | 2 +-
+ arch/x86/kernel/signal.c | 6 +++---
+ include/linux/compat.h | 7 +++++++
+ include/linux/signal.h | 8 ++++++++
+ 4 files changed, 19 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/ia32/ia32_signal.c
++++ b/arch/x86/ia32/ia32_signal.c
+@@ -459,7 +459,7 @@ int ia32_setup_rt_frame(int sig, struct
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++ compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+ if (ksig->ka.sa.sa_flags & SA_RESTORER)
+ restorer = ksig->ka.sa.sa_restorer;
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -364,7 +364,7 @@ static int __setup_rt_frame(int sig, str
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++ save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+ /* Set up to return from userspace. */
+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+@@ -429,7 +429,7 @@ static int __setup_rt_frame(int sig, str
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
++ save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+ /* Set up to return from userspace. If provided, use a stub
+ already in userspace. */
+@@ -496,7 +496,7 @@ static int x32_setup_rt_frame(struct ksi
+ else
+ put_user_ex(0, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+- err |= __compat_save_altstack(&frame->uc.uc_stack, regs->sp);
++ compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ put_user_ex(0, &frame->uc.uc__pad0);
+
+ if (ksig->ka.sa.sa_flags & SA_RESTORER) {
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -669,6 +669,13 @@ asmlinkage long compat_sys_sigaltstack(c
+
+ int compat_restore_altstack(const compat_stack_t __user *uss);
+ int __compat_save_altstack(compat_stack_t __user *, unsigned long);
++#define compat_save_altstack_ex(uss, sp) do { \
++ compat_stack_t __user *__uss = uss; \
++ struct task_struct *t = current; \
++ put_user_ex(ptr_to_compat((void __user *)t->sas_ss_sp), &__uss->ss_sp); \
++ put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++ put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
+
+ asmlinkage long compat_sys_sched_rr_get_interval(compat_pid_t pid,
+ struct compat_timespec __user *interval);
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -434,6 +434,14 @@ void signals_init(void);
+ int restore_altstack(const stack_t __user *);
+ int __save_altstack(stack_t __user *, unsigned long);
+
++#define save_altstack_ex(uss, sp) do { \
++ stack_t __user *__uss = uss; \
++ struct task_struct *t = current; \
++ put_user_ex((void __user *)t->sas_ss_sp, &__uss->ss_sp); \
++ put_user_ex(sas_ss_flags(sp), &__uss->ss_flags); \
++ put_user_ex(t->sas_ss_size, &__uss->ss_size); \
++} while (0);
++
+ #ifdef CONFIG_PROC_FS
+ struct seq_file;
+ extern void render_sigset_t(struct seq_file *, const char *, sigset_t *);
--- /dev/null
+From c34ac00caefbe49d40058ae7200bd58725cebb45 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 28 Jun 2013 10:34:48 -0700
+Subject: rculist: list_first_or_null_rcu() should use list_entry_rcu()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit c34ac00caefbe49d40058ae7200bd58725cebb45 upstream.
+
+list_first_or_null() should test whether the list is empty and return
+pointer to the first entry if not in a RCU safe manner. It's broken
+in several ways.
+
+* It compares __kernel @__ptr with __rcu @__next triggering the
+ following sparse warning.
+
+ net/core/dev.c:4331:17: error: incompatible types in comparison expression (different address spaces)
+
+* It doesn't perform rcu_dereference*() and computes the entry address
+ using container_of() directly from the __rcu pointer which is
+ inconsitent with other rculist interface. As a result, all three
+ in-kernel users - net/core/dev.c, macvlan, cgroup - are buggy. They
+ dereference the pointer w/o going through read barrier.
+
+* While ->next dereference passes through list_next_rcu(), the
+ compiler is still free to fetch ->next more than once and thus
+ nullify the "__ptr != __next" condition check.
+
+Fix it by making list_first_or_null_rcu() dereference ->next directly
+using ACCESS_ONCE() and then use list_entry_rcu() on it like other
+rculist accessors.
+
+v2: Paul pointed out that the compiler may fetch the pointer more than
+ once nullifying the condition check. ACCESS_ONCE() added on
+ ->next dereference.
+
+v3: Restored () around macro param which was accidentally removed.
+ Spotted by Paul.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Cc: Dipankar Sarma <dipankar@in.ibm.com>
+Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Li Zefan <lizefan@huawei.com>
+Cc: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Reviewed-by: Josh Triplett <josh@joshtriplett.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/rculist.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -267,8 +267,9 @@ static inline void list_splice_init_rcu(
+ */
+ #define list_first_or_null_rcu(ptr, type, member) \
+ ({struct list_head *__ptr = (ptr); \
+- struct list_head __rcu *__next = list_next_rcu(__ptr); \
+- likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++ struct list_head *__next = ACCESS_ONCE(__ptr->next); \
++ likely(__ptr != __next) ? \
++ list_entry_rcu(__next, type, member) : NULL; \
+ })
+
+ /**
--- /dev/null
+From 8f898fbbe5ee5e20a77c4074472a1fd088dc47d1 Mon Sep 17 00:00:00 2001
+From: Rik van Riel <riel@redhat.com>
+Date: Wed, 31 Jul 2013 22:14:21 -0400
+Subject: sched/x86: Optimize switch_mm() for multi-threaded workloads
+
+From: Rik van Riel <riel@redhat.com>
+
+commit 8f898fbbe5ee5e20a77c4074472a1fd088dc47d1 upstream.
+
+Dick Fowles, Don Zickus and Joe Mario have been working on
+improvements to perf, and noticed heavy cache line contention
+on the mm_cpumask, running linpack on a 60 core / 120 thread
+system.
+
+The cause turned out to be unnecessary atomic accesses to the
+mm_cpumask. When in lazy TLB mode, the CPU is only removed from
+the mm_cpumask if there is a TLB flush event.
+
+Most of the time, no such TLB flush happens, and the kernel
+skips the TLB reload. It can also skip the atomic memory
+set & test.
+
+Here is a summary of Joe's test results:
+
+ * The __schedule function dropped from 24% of all program cycles down
+ to 5.5%.
+
+ * The cacheline contention/hotness for accesses to that bitmask went
+ from being the 1st/2nd hottest - down to the 84th hottest (0.3% of
+ all shared misses which is now quite cold)
+
+ * The average load latency for the bit-test-n-set instruction in
+ __schedule dropped from 10k-15k cycles down to an average of 600 cycles.
+
+ * The linpack program results improved from 133 GFlops to 144 GFlops.
+ Peak GFlops rose from 133 to 153.
+
+Reported-by: Don Zickus <dzickus@redhat.com>
+Reported-by: Joe Mario <jmario@redhat.com>
+Tested-by: Joe Mario <jmario@redhat.com>
+Signed-off-by: Rik van Riel <riel@redhat.com>
+Reviewed-by: Paul Turner <pjt@google.com>
+Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
+Link: http://lkml.kernel.org/r/20130731221421.616d3d20@annuminas.surriel.com
+[ Made the comments consistent around the modified code. ]
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/mmu_context.h | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -45,22 +45,28 @@ static inline void switch_mm(struct mm_s
+ /* Re-load page tables */
+ load_cr3(next->pgd);
+
+- /* stop flush ipis for the previous mm */
++ /* Stop flush ipis for the previous mm */
+ cpumask_clear_cpu(cpu, mm_cpumask(prev));
+
+- /*
+- * load the LDT, if the LDT is different:
+- */
++ /* Load the LDT, if the LDT is different: */
+ if (unlikely(prev->context.ldt != next->context.ldt))
+ load_LDT_nolock(&next->context);
+ }
+ #ifdef CONFIG_SMP
+- else {
++ else {
+ this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
+
+- if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next))) {
+- /* We were in lazy tlb mode and leave_mm disabled
++ if (!cpumask_test_cpu(cpu, mm_cpumask(next))) {
++ /*
++ * On established mms, the mm_cpumask is only changed
++ * from irq context, from ptep_clear_flush() while in
++ * lazy tlb mode, and here. Irqs are blocked during
++ * schedule, protecting us from simultaneous changes.
++ */
++ cpumask_set_cpu(cpu, mm_cpumask(next));
++ /*
++ * We were in lazy tlb mode and leave_mm disabled
+ * tlb flush IPI delivery. We must reload CR3
+ * to make sure to use no freed page tables.
+ */
staging-comedi-dt282x-dt282x_ai_insn_read-always-fails.patch
iio-mxs-lradc-fix-misuse-of-iio-trig.patch
iio-mxs-lradc-remove-useless-check-in-read_raw.patch
+acpi-lpss-don-t-crash-if-a-device-has-no-mmio-resources.patch
+usb-mos7720-use-gfp_atomic-under-spinlock.patch
+usb-mos7720-fix-big-endian-control-requests.patch
+usb-ehci-mxc-check-for-pdata-before-dereferencing.patch
+usb-cdc-wdm-fix-race-between-interrupt-handler-and-tasklet.patch
+usb-gadget-uvc-fix-error-handling-in-uvc_queue_buffer.patch
+usb-don-t-fail-port-power-resume-on-device-disconnect.patch
+usb-fix-build-error-when-config_pm_sleep-isn-t-enabled.patch
+usb-config-desc.blength-may-not-exceed-amount-of-data-returned-by-the-device.patch
+usb-handle-lpm-errors-during-device-suspend-correctly.patch
+usb-don-t-check-pm-qos-no_power_off-flag-in-usb_port_suspend.patch
+rculist-list_first_or_null_rcu-should-use-list_entry_rcu.patch
+asoc-wm8960-fix-pll-register-writes.patch
+asoc-mc13783-add-spi-errata-fix.patch
+x86-smap-handle-csum_partial_copy_-_user.patch
+introduce-save_altstack_ex-to-unbreak-x86-smap.patch
+x86-amd_nb-clarify-f15h-model-30h-gart-and-l3-support.patch
+x86-mce-pay-no-attention-to-f-bit-in-mcacod-when-parsing-uc-errors.patch
+sched-x86-optimize-switch_mm-for-multi-threaded-workloads.patch
--- /dev/null
+From 6dd433e6cf2475ce8abec1b467720858c24450eb Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.de>
+Date: Tue, 6 Aug 2013 14:22:59 +0200
+Subject: USB: cdc-wdm: fix race between interrupt handler and tasklet
+
+From: Oliver Neukum <oneukum@suse.de>
+
+commit 6dd433e6cf2475ce8abec1b467720858c24450eb upstream.
+
+Both could want to submit the same URB. Some checks of the flag
+intended to prevent that were missing.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-wdm.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -209,6 +209,7 @@ skip_error:
+ static void wdm_int_callback(struct urb *urb)
+ {
+ int rv = 0;
++ int responding;
+ int status = urb->status;
+ struct wdm_device *desc;
+ struct usb_cdc_notification *dr;
+@@ -262,8 +263,8 @@ static void wdm_int_callback(struct urb
+
+ spin_lock(&desc->iuspin);
+ clear_bit(WDM_READ, &desc->flags);
+- set_bit(WDM_RESPONDING, &desc->flags);
+- if (!test_bit(WDM_DISCONNECTING, &desc->flags)
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++ if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
+ && !test_bit(WDM_SUSPENDING, &desc->flags)) {
+ rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+ dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
+@@ -685,16 +686,20 @@ static void wdm_rxwork(struct work_struc
+ {
+ struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
+ unsigned long flags;
+- int rv;
++ int rv = 0;
++ int responding;
+
+ spin_lock_irqsave(&desc->iuspin, flags);
+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+ } else {
++ responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+- rv = usb_submit_urb(desc->response, GFP_KERNEL);
++ if (!responding)
++ rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ if (rv < 0 && rv != -EPERM) {
+ spin_lock_irqsave(&desc->iuspin, flags);
++ clear_bit(WDM_RESPONDING, &desc->flags);
+ if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ schedule_work(&desc->rxwork);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
--- /dev/null
+From b4f17a488ae2e09bfcf95c0e0b4219c246f1116a Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 3 Aug 2013 16:37:48 +0200
+Subject: usb: config->desc.bLength may not exceed amount of data returned by the device
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit b4f17a488ae2e09bfcf95c0e0b4219c246f1116a upstream.
+
+While reading the config parsing code I noticed this check is missing, without
+this check config->desc.wTotalLength can end up with a value larger then the
+dev->rawdescriptors length for the config, and when userspace then tries to
+get the rawdescriptors bad things may happen.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -424,7 +424,8 @@ static int usb_parse_configuration(struc
+
+ memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+ if (config->desc.bDescriptorType != USB_DT_CONFIG ||
+- config->desc.bLength < USB_DT_CONFIG_SIZE) {
++ config->desc.bLength < USB_DT_CONFIG_SIZE ||
++ config->desc.bLength > size) {
+ dev_err(ddev, "invalid descriptor for config index %d: "
+ "type = 0x%X, length = %d\n", cfgidx,
+ config->desc.bDescriptorType, config->desc.bLength);
--- /dev/null
+From 98a4f1ff7bea8002ab79d6776e30d27932e88244 Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Wed, 3 Jul 2013 22:17:54 +0800
+Subject: usb: don't check pm qos NO_POWER_OFF flag in usb_port_suspend()
+
+From: Lan Tianyu <tianyu.lan@intel.com>
+
+commit 98a4f1ff7bea8002ab79d6776e30d27932e88244 upstream.
+
+The pm qos NO_POWER_OFF flag is checked twice during usb device suspend
+to see if the usb port power off condition is met. This is redundant and
+also will prevent the port from being powered off if the NO_POWER_OFF
+flag is changed to 1 from 0 after the device was already suspended.
+
+More detail in the following link.
+ http://marc.info/?l=linux-usb&m=136543949130865&w=2
+
+This patch should be backported to kernels as old as 3.7, that
+contain the commit f7ac7787ad361e31a7972e2854ed8dc2eedfac3b "usb/acpi:
+Use ACPI methods to power off ports."
+
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3041,19 +3041,9 @@ int usb_port_suspend(struct usb_device *
+ usb_set_device_state(udev, USB_STATE_SUSPENDED);
+ }
+
+- /*
+- * Check whether current status meets the requirement of
+- * usb port power off mechanism
+- */
+ if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) {
+- enum pm_qos_flags_status pm_qos_stat;
+-
+- pm_qos_stat = dev_pm_qos_flags(&port_dev->dev,
+- PM_QOS_FLAG_NO_POWER_OFF);
+- if (pm_qos_stat != PM_QOS_FLAGS_ALL) {
+- pm_runtime_put_sync(&port_dev->dev);
+- port_dev->did_runtime_put = true;
+- }
++ pm_runtime_put_sync(&port_dev->dev);
++ port_dev->did_runtime_put = true;
+ }
+
+ usb_mark_last_busy(hub->hdev);
--- /dev/null
+From d49dad3e11638f66be4e16573ffaa8c46a09e3b3 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Mon, 5 Aug 2013 18:58:15 -0700
+Subject: usb: Don't fail port power resume on device disconnect.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit d49dad3e11638f66be4e16573ffaa8c46a09e3b3 upstream.
+
+Userspace can tell the kernel to power off any USB port, including ones
+that are visible and connectible to users. When an attached USB device
+goes into suspend, the port will be powered off if the
+pm_qos_no_port_poweroff file for its port is set to 0, the device does
+not have remote wakeup enabled, and the device is marked as persistent.
+
+If the user disconnects the USB device while the port is powered off,
+the current code does not handle that properly. If you disconnect a
+device, and then run `lsusb -v -s` for the device, the device disconnect
+does not get handled by the USB core. The runtime resume of the port
+fails, because hub_port_debounce_be_connected() returns -ETIMEDOUT.
+
+This means the port resume fails and khubd doesn't handle the USB device
+disconnect. This leaves the device listed in lsusb, and the port's
+runtime_status will be permanently marked as "error".
+
+Fix this by ignoring the return value of hub_port_debounce_be_connected.
+Users can disconnect USB devices while the ports are powered off, and we
+must be able to handle that.
+
+This patch should be backported to kernels as old as 3.9, that
+contain the commit ad493e5e580546e6c3024b76a41535476da1546a "usb: add
+usb port auto power off mechanism"
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Cc: Lan Tianyu <tianyu.lan@intel.com>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/port.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/core/port.c
++++ b/drivers/usb/core/port.c
+@@ -89,22 +89,19 @@ static int usb_port_runtime_resume(struc
+ retval = usb_hub_set_port_power(hdev, port1, true);
+ if (port_dev->child && !retval) {
+ /*
+- * Wait for usb hub port to be reconnected in order to make
+- * the resume procedure successful.
++ * Attempt to wait for usb hub port to be reconnected in order
++ * to make the resume procedure successful. The device may have
++ * disconnected while the port was powered off, so ignore the
++ * return status.
+ */
+ retval = hub_port_debounce_be_connected(hub, port1);
+- if (retval < 0) {
++ if (retval < 0)
+ dev_dbg(&port_dev->dev, "can't get reconnection after setting port power on, status %d\n",
+ retval);
+- goto out;
+- }
+ usb_clear_port_feature(hdev, port1, USB_PORT_FEAT_C_ENABLE);
+-
+- /* Set return value to 0 if debounce successful */
+ retval = 0;
+ }
+
+-out:
+ clear_bit(port1, hub->busy_bits);
+ usb_autopm_put_interface(intf);
+ return retval;
--- /dev/null
+From f375fc520d4df0cd9fcb570f33c103c6c0311f9e Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Wed, 21 Aug 2013 11:17:21 +0200
+Subject: usb: ehci-mxc: check for pdata before dereferencing
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit f375fc520d4df0cd9fcb570f33c103c6c0311f9e upstream.
+
+Commit 7e8d5cd93fac ("USB: Add EHCI support for MX27 and MX31 based
+boards") introduced code that could potentially lead to a NULL pointer
+dereference on driver removal.
+
+Fix this by checking for the value of pdata before dereferencing it.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-mxc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -184,7 +184,7 @@ static int ehci_mxc_drv_remove(struct pl
+ if (pdata && pdata->exit)
+ pdata->exit(pdev);
+
+- if (pdata->otg)
++ if (pdata && pdata->otg)
+ usb_phy_shutdown(pdata->otg);
+
+ clk_disable_unprepare(priv->usbclk);
--- /dev/null
+From 9d8924297cd9c256c23c02abae40202563452453 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 30 Aug 2013 10:46:00 -0400
+Subject: USB: fix build error when CONFIG_PM_SLEEP isn't enabled
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 9d8924297cd9c256c23c02abae40202563452453 upstream.
+
+This patch fixes a build error that occurs when CONFIG_PM is enabled
+and CONFIG_PM_SLEEP isn't:
+
+>> drivers/usb/host/ohci-pci.c:294:10: error: 'usb_hcd_pci_pm_ops' undeclared here (not in a function)
+ .pm = &usb_hcd_pci_pm_ops
+
+Since the usb_hcd_pci_pm_ops structure is defined and used when
+CONFIG_PM is enabled, its declaration should not be protected by
+CONFIG_PM_SLEEP.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/usb/hcd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -410,7 +410,7 @@ extern int usb_hcd_pci_probe(struct pci_
+ extern void usb_hcd_pci_remove(struct pci_dev *dev);
+ extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
+
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_PM
+ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
+ #endif
+ #endif /* CONFIG_PCI */
--- /dev/null
+From ebe864a6cb8e087ede047fa1fa6b6d06fcb9a9e4 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 29 Apr 2013 22:18:01 +0200
+Subject: usb: gadget: uvc: Fix error handling in uvc_queue_buffer()
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit ebe864a6cb8e087ede047fa1fa6b6d06fcb9a9e4 upstream.
+
+The conversion to videobuf2 failed to check the return value of
+vb2_qbuf(). Fix it.
+
+Reported-by: Michael Grzeschik <mgr@pengutronix.de>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-By: Michael Grzeschik <mgr@pengutronix.de>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/uvc_queue.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/uvc_queue.c
++++ b/drivers/usb/gadget/uvc_queue.c
+@@ -177,12 +177,16 @@ static int uvc_queue_buffer(struct uvc_v
+
+ mutex_lock(&queue->mutex);
+ ret = vb2_qbuf(&queue->queue, buf);
++ if (ret < 0)
++ goto done;
++
+ spin_lock_irqsave(&queue->irqlock, flags);
+ ret = (queue->flags & UVC_QUEUE_PAUSED) != 0;
+ queue->flags &= ~UVC_QUEUE_PAUSED;
+ spin_unlock_irqrestore(&queue->irqlock, flags);
+- mutex_unlock(&queue->mutex);
+
++done:
++ mutex_unlock(&queue->mutex);
+ return ret;
+ }
+
--- /dev/null
+From aa5ceae24bf8dff1d6fe87c6c4b08e69c6d33550 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 30 Jul 2013 15:39:02 -0400
+Subject: USB: handle LPM errors during device suspend correctly
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit aa5ceae24bf8dff1d6fe87c6c4b08e69c6d33550 upstream.
+
+The hub driver's usb_port_suspend() routine doesn't handle errors
+related to Link Power Management properly. It always returns failure,
+it doesn't try to clean up the wakeup setting, (in the case of system
+sleep) it doesn't try to go ahead with the port suspend regardless,
+and it doesn't try to apply the new power-off mechanism.
+
+This patch fixes these problems.
+
+Note: Sarah fixed this patch to apply against 3.11, since the original
+commit (4fae6f0fa86f92e6bc7429371b1e177ad0aaac66 "USB: handle LPM errors
+during device suspend correctly") called usb_disable_remote_wakeup,
+which won't be added until 3.12.
+
+This patch should be backported to kernels as old as 3.5, that
+contain the commit 8306095fd2c1100e8244c09bf560f97aca5a311d "USB:
+Disable USB 3.0 LPM in critical sections.". There will be merge
+conflicts, since LTM wasn't added until 3.6.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 71 ++++++++++++++++++++++++++-----------------------
+ 1 file changed, 38 insertions(+), 33 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2916,7 +2916,6 @@ int usb_port_suspend(struct usb_device *
+ {
+ struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
+ struct usb_port *port_dev = hub->ports[udev->portnum - 1];
+- enum pm_qos_flags_status pm_qos_stat;
+ int port1 = udev->portnum;
+ int status;
+ bool really_suspend = true;
+@@ -2954,7 +2953,7 @@ int usb_port_suspend(struct usb_device *
+ status);
+ /* bail if autosuspend is requested */
+ if (PMSG_IS_AUTO(msg))
+- return status;
++ goto err_wakeup;
+ }
+ }
+
+@@ -2963,14 +2962,16 @@ int usb_port_suspend(struct usb_device *
+ usb_set_usb2_hardware_lpm(udev, 0);
+
+ if (usb_disable_ltm(udev)) {
+- dev_err(&udev->dev, "%s Failed to disable LTM before suspend\n.",
+- __func__);
+- return -ENOMEM;
++ dev_err(&udev->dev, "Failed to disable LTM before suspend\n.");
++ status = -ENOMEM;
++ if (PMSG_IS_AUTO(msg))
++ goto err_ltm;
+ }
+ if (usb_unlocked_disable_lpm(udev)) {
+- dev_err(&udev->dev, "%s Failed to disable LPM before suspend\n.",
+- __func__);
+- return -ENOMEM;
++ dev_err(&udev->dev, "Failed to disable LPM before suspend\n.");
++ status = -ENOMEM;
++ if (PMSG_IS_AUTO(msg))
++ goto err_lpm3;
+ }
+
+ /* see 7.1.7.6 */
+@@ -2998,28 +2999,31 @@ int usb_port_suspend(struct usb_device *
+ if (status) {
+ dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
+ port1, status);
+- /* paranoia: "should not happen" */
+- if (udev->do_remote_wakeup) {
+- if (!hub_is_superspeed(hub->hdev)) {
+- (void) usb_control_msg(udev,
+- usb_sndctrlpipe(udev, 0),
+- USB_REQ_CLEAR_FEATURE,
+- USB_RECIP_DEVICE,
+- USB_DEVICE_REMOTE_WAKEUP, 0,
+- NULL, 0,
+- USB_CTRL_SET_TIMEOUT);
+- } else
+- (void) usb_disable_function_remotewakeup(udev);
+-
+- }
+
++ /* Try to enable USB3 LPM and LTM again */
++ usb_unlocked_enable_lpm(udev);
++ err_lpm3:
++ usb_enable_ltm(udev);
++ err_ltm:
+ /* Try to enable USB2 hardware LPM again */
+ if (udev->usb2_hw_lpm_capable == 1)
+ usb_set_usb2_hardware_lpm(udev, 1);
+
+- /* Try to enable USB3 LTM and LPM again */
+- usb_enable_ltm(udev);
+- usb_unlocked_enable_lpm(udev);
++ if (udev->do_remote_wakeup) {
++ if (udev->speed < USB_SPEED_SUPER)
++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++ USB_REQ_CLEAR_FEATURE,
++ USB_RECIP_DEVICE,
++ USB_DEVICE_REMOTE_WAKEUP, 0,
++ NULL, 0, USB_CTRL_SET_TIMEOUT);
++ else
++ usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++ USB_REQ_CLEAR_FEATURE,
++ USB_RECIP_INTERFACE,
++ USB_INTRF_FUNC_SUSPEND, 0,
++ NULL, 0, USB_CTRL_SET_TIMEOUT);
++ }
++ err_wakeup:
+
+ /* System sleep transitions should never fail */
+ if (!PMSG_IS_AUTO(msg))
+@@ -3041,14 +3045,15 @@ int usb_port_suspend(struct usb_device *
+ * Check whether current status meets the requirement of
+ * usb port power off mechanism
+ */
+- pm_qos_stat = dev_pm_qos_flags(&port_dev->dev,
+- PM_QOS_FLAG_NO_POWER_OFF);
+- if (!udev->do_remote_wakeup
+- && pm_qos_stat != PM_QOS_FLAGS_ALL
+- && udev->persist_enabled
+- && !status) {
+- pm_runtime_put_sync(&port_dev->dev);
+- port_dev->did_runtime_put = true;
++ if (status == 0 && !udev->do_remote_wakeup && udev->persist_enabled) {
++ enum pm_qos_flags_status pm_qos_stat;
++
++ pm_qos_stat = dev_pm_qos_flags(&port_dev->dev,
++ PM_QOS_FLAG_NO_POWER_OFF);
++ if (pm_qos_stat != PM_QOS_FLAGS_ALL) {
++ pm_runtime_put_sync(&port_dev->dev);
++ port_dev->did_runtime_put = true;
++ }
+ }
+
+ usb_mark_last_busy(hub->hdev);
--- /dev/null
+From 3b716caf190ccc6f2a09387210e0e6a26c1d81a4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Mon, 19 Aug 2013 13:05:45 +0200
+Subject: USB: mos7720: fix big-endian control requests
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 3b716caf190ccc6f2a09387210e0e6a26c1d81a4 upstream.
+
+Fix endianess bugs in parallel-port code which caused corrupt
+control-requests to be issued on big-endian machines.
+
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7720.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -382,8 +382,8 @@ static int write_parport_reg_nonblock(st
+ }
+ urbtrack->setup->bRequestType = (__u8)0x40;
+ urbtrack->setup->bRequest = (__u8)0x0e;
+- urbtrack->setup->wValue = get_reg_value(reg, dummy);
+- urbtrack->setup->wIndex = get_reg_index(reg);
++ urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
++ urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
+ urbtrack->setup->wLength = 0;
+ usb_fill_control_urb(urbtrack->urb, usbdev,
+ usb_sndctrlpipe(usbdev, 0),
--- /dev/null
+From d0bd9a41186e076ea543c397ad8a67a6cf604b55 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 16 Aug 2013 10:16:59 +0300
+Subject: USB: mos7720: use GFP_ATOMIC under spinlock
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit d0bd9a41186e076ea543c397ad8a67a6cf604b55 upstream.
+
+The write_parport_reg_nonblock() function shouldn't sleep because it's
+called with spinlocks held.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7720.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -374,7 +374,7 @@ static int write_parport_reg_nonblock(st
+ kfree(urbtrack);
+ return -ENOMEM;
+ }
+- urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++ urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
+ if (!urbtrack->setup) {
+ usb_free_urb(urbtrack->urb);
+ kfree(urbtrack);
--- /dev/null
+From 7d64ac6422092adbbdaa279ab32f9d4c90a84558 Mon Sep 17 00:00:00 2001
+From: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>
+Date: Fri, 2 Aug 2013 17:43:03 -0500
+Subject: x86, amd_nb: Clarify F15h, model 30h GART and L3 support
+
+From: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>
+
+commit 7d64ac6422092adbbdaa279ab32f9d4c90a84558 upstream.
+
+F15h, models 0x30 and later don't have a GART. Note that. Also check
+CPUID leaf 0x80000006 for L3 prescence because there are models which
+don't sport an L3 cache.
+
+Signed-off-by: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>
+[ Boris: rewrite commit message, cleanup comments. ]
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/amd_nb.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -20,6 +20,7 @@ const struct pci_device_id amd_nb_misc_i
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ {}
+ };
+@@ -27,6 +28,7 @@ EXPORT_SYMBOL(amd_nb_misc_ids);
+
+ static const struct pci_device_id amd_nb_link_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
+ {}
+ };
+@@ -81,13 +83,20 @@ int amd_cache_northbridges(void)
+ next_northbridge(misc, amd_nb_misc_ids);
+ node_to_amd_nb(i)->link = link =
+ next_northbridge(link, amd_nb_link_ids);
+- }
++ }
+
++ /* GART present only on Fam15h upto model 0fh */
+ if (boot_cpu_data.x86 == 0xf || boot_cpu_data.x86 == 0x10 ||
+- boot_cpu_data.x86 == 0x15)
++ (boot_cpu_data.x86 == 0x15 && boot_cpu_data.x86_model < 0x10))
+ amd_northbridges.flags |= AMD_NB_GART;
+
+ /*
++ * Check for L3 cache presence.
++ */
++ if (!cpuid_edx(0x80000006))
++ return 0;
++
++ /*
+ * Some CPU families support L3 Cache Index Disable. There are some
+ * limitations because of E382 and E388 on family 0x10.
+ */
--- /dev/null
+From 0ca06c0857aee11911f91621db14498496f2c2cd Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Wed, 24 Jul 2013 13:54:20 -0700
+Subject: x86/mce: Pay no attention to 'F' bit in MCACOD when parsing 'UC' errors
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit 0ca06c0857aee11911f91621db14498496f2c2cd upstream.
+
+The 0x1000 bit of the MCACOD field of machine check MCi_STATUS
+registers is only defined for corrected errors (where it means
+that hardware may be filtering errors see SDM section 15.9.2.1).
+
+For uncorrected errors it may, or may not be set - so we should mask
+it out when checking for the architecturaly defined recoverable
+error signatures (see SDM 15.9.3.1 and 15.9.3.2)
+
+Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/mce.h | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -32,11 +32,20 @@
+ #define MCI_STATUS_PCC (1ULL<<57) /* processor context corrupt */
+ #define MCI_STATUS_S (1ULL<<56) /* Signaled machine check */
+ #define MCI_STATUS_AR (1ULL<<55) /* Action required */
+-#define MCACOD 0xffff /* MCA Error Code */
++
++/*
++ * Note that the full MCACOD field of IA32_MCi_STATUS MSR is
++ * bits 15:0. But bit 12 is the 'F' bit, defined for corrected
++ * errors to indicate that errors are being filtered by hardware.
++ * We should mask out bit 12 when looking for specific signatures
++ * of uncorrected errors - so the F bit is deliberately skipped
++ * in this #define.
++ */
++#define MCACOD 0xefff /* MCA Error Code */
+
+ /* Architecturally defined codes from SDM Vol. 3B Chapter 15 */
+ #define MCACOD_SCRUB 0x00C0 /* 0xC0-0xCF Memory Scrubbing */
+-#define MCACOD_SCRUBMSK 0xfff0
++#define MCACOD_SCRUBMSK 0xeff0 /* Skip bit 12 ('F' bit) */
+ #define MCACOD_L3WB 0x017A /* L3 Explicit Writeback */
+ #define MCACOD_DATA 0x0134 /* Data Load */
+ #define MCACOD_INSTR 0x0150 /* Instruction Fetch */
--- /dev/null
+From 7263dda41b5a28ae6566fd126d9b06ada73dd721 Mon Sep 17 00:00:00 2001
+From: "H. Peter Anvin" <hpa@linux.intel.com>
+Date: Fri, 30 Aug 2013 15:43:03 -0700
+Subject: x86, smap: Handle csum_partial_copy_*_user()
+
+From: "H. Peter Anvin" <hpa@linux.intel.com>
+
+commit 7263dda41b5a28ae6566fd126d9b06ada73dd721 upstream.
+
+Add SMAP annotations to csum_partial_copy_to/from_user(). These
+functions legitimately access user space and thus need to set the AC
+flag.
+
+TODO: add explicit checks that the side with the kernel space pointer
+really points into kernel space.
+
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Link: http://lkml.kernel.org/n/tip-2aps0u00eer658fd5xyanan7@git.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/checksum_32.h | 22 +++++++++++++++++-----
+ arch/x86/lib/csum-wrappers_64.c | 12 ++++++++++--
+ 2 files changed, 27 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/include/asm/checksum_32.h
++++ b/arch/x86/include/asm/checksum_32.h
+@@ -49,9 +49,15 @@ static inline __wsum csum_partial_copy_f
+ int len, __wsum sum,
+ int *err_ptr)
+ {
++ __wsum ret;
++
+ might_sleep();
+- return csum_partial_copy_generic((__force void *)src, dst,
+- len, sum, err_ptr, NULL);
++ stac();
++ ret = csum_partial_copy_generic((__force void *)src, dst,
++ len, sum, err_ptr, NULL);
++ clac();
++
++ return ret;
+ }
+
+ /*
+@@ -176,10 +182,16 @@ static inline __wsum csum_and_copy_to_us
+ int len, __wsum sum,
+ int *err_ptr)
+ {
++ __wsum ret;
++
+ might_sleep();
+- if (access_ok(VERIFY_WRITE, dst, len))
+- return csum_partial_copy_generic(src, (__force void *)dst,
+- len, sum, NULL, err_ptr);
++ if (access_ok(VERIFY_WRITE, dst, len)) {
++ stac();
++ ret = csum_partial_copy_generic(src, (__force void *)dst,
++ len, sum, NULL, err_ptr);
++ clac();
++ return ret;
++ }
+
+ if (len)
+ *err_ptr = -EFAULT;
+--- a/arch/x86/lib/csum-wrappers_64.c
++++ b/arch/x86/lib/csum-wrappers_64.c
+@@ -6,6 +6,7 @@
+ */
+ #include <asm/checksum.h>
+ #include <linux/module.h>
++#include <asm/smap.h>
+
+ /**
+ * csum_partial_copy_from_user - Copy and checksum from user space.
+@@ -52,8 +53,10 @@ csum_partial_copy_from_user(const void _
+ len -= 2;
+ }
+ }
++ stac();
+ isum = csum_partial_copy_generic((__force const void *)src,
+ dst, len, isum, errp, NULL);
++ clac();
+ if (unlikely(*errp))
+ goto out_err;
+
+@@ -82,6 +85,8 @@ __wsum
+ csum_partial_copy_to_user(const void *src, void __user *dst,
+ int len, __wsum isum, int *errp)
+ {
++ __wsum ret;
++
+ might_sleep();
+
+ if (unlikely(!access_ok(VERIFY_WRITE, dst, len))) {
+@@ -105,8 +110,11 @@ csum_partial_copy_to_user(const void *sr
+ }
+
+ *errp = 0;
+- return csum_partial_copy_generic(src, (void __force *)dst,
+- len, isum, NULL, errp);
++ stac();
++ ret = csum_partial_copy_generic(src, (void __force *)dst,
++ len, isum, NULL, errp);
++ clac();
++ return ret;
+ }
+ EXPORT_SYMBOL(csum_partial_copy_to_user);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
