--- /dev/null
+From 5edee61edeaaebafe584f8fb7074c1ef4658596b Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 16 Oct 2012 15:03:14 -0700
+Subject: cgroup: cgroup_subsys->fork() should be called after the task is added to css_set
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 5edee61edeaaebafe584f8fb7074c1ef4658596b upstream.
+
+cgroup core has a bug which violates a basic rule about event
+notifications - when a new entity needs to be added, you add that to
+the notification list first and then make the new entity conform to
+the current state. If done in the reverse order, an event happening
+inbetween will be lost.
+
+cgroup_subsys->fork() is invoked way before the new task is added to
+the css_set. Currently, cgroup_freezer is the only user of ->fork()
+and uses it to make new tasks conform to the current state of the
+freezer. If FROZEN state is requested while fork is in progress
+between cgroup_fork_callbacks() and cgroup_post_fork(), the child
+could escape freezing - the cgroup isn't frozen when ->fork() is
+called and the freezer couldn't see the new task on the css_set.
+
+This patch moves cgroup_subsys->fork() invocation to
+cgroup_post_fork() after the new task is added to the css_set.
+cgroup_fork_callbacks() is removed.
+
+Because now a task may be migrated during cgroup_subsys->fork(),
+freezer_fork() is updated so that it adheres to the usual RCU locking
+and the rather pointless comment on why locking can be different there
+is removed (if it doesn't make anything simpler, why even bother?).
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/cgroup.h | 1
+ kernel/cgroup.c | 62 +++++++++++++++++++++++-------------------------
+ kernel/cgroup_freezer.c | 13 +++-------
+ kernel/fork.c | 9 ------
+ 4 files changed, 35 insertions(+), 50 deletions(-)
+
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -34,7 +34,6 @@ extern int cgroup_lock_is_held(void);
+ extern bool cgroup_lock_live_group(struct cgroup *cgrp);
+ extern void cgroup_unlock(void);
+ extern void cgroup_fork(struct task_struct *p);
+-extern void cgroup_fork_callbacks(struct task_struct *p);
+ extern void cgroup_post_fork(struct task_struct *p);
+ extern void cgroup_exit(struct task_struct *p, int run_callbacks);
+ extern int cgroupstats_build(struct cgroupstats *stats,
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -4832,44 +4832,19 @@ void cgroup_fork(struct task_struct *chi
+ }
+
+ /**
+- * cgroup_fork_callbacks - run fork callbacks
+- * @child: the new task
+- *
+- * Called on a new task very soon before adding it to the
+- * tasklist. No need to take any locks since no-one can
+- * be operating on this task.
+- */
+-void cgroup_fork_callbacks(struct task_struct *child)
+-{
+- if (need_forkexit_callback) {
+- int i;
+- for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+- struct cgroup_subsys *ss = subsys[i];
+-
+- /*
+- * forkexit callbacks are only supported for
+- * builtin subsystems.
+- */
+- if (!ss || ss->module)
+- continue;
+-
+- if (ss->fork)
+- ss->fork(child);
+- }
+- }
+-}
+-
+-/**
+ * cgroup_post_fork - called on a new task after adding it to the task list
+ * @child: the task in question
+ *
+- * Adds the task to the list running through its css_set if necessary.
+- * Has to be after the task is visible on the task list in case we race
+- * with the first call to cgroup_iter_start() - to guarantee that the
+- * new task ends up on its list.
++ * Adds the task to the list running through its css_set if necessary and
++ * call the subsystem fork() callbacks. Has to be after the task is
++ * visible on the task list in case we race with the first call to
++ * cgroup_iter_start() - to guarantee that the new task ends up on its
++ * list.
+ */
+ void cgroup_post_fork(struct task_struct *child)
+ {
++ int i;
++
+ /*
+ * use_task_css_set_links is set to 1 before we walk the tasklist
+ * under the tasklist_lock and we read it here after we added the child
+@@ -4889,7 +4864,30 @@ void cgroup_post_fork(struct task_struct
+ task_unlock(child);
+ write_unlock(&css_set_lock);
+ }
++
++ /*
++ * Call ss->fork(). This must happen after @child is linked on
++ * css_set; otherwise, @child might change state between ->fork()
++ * and addition to css_set.
++ */
++ if (need_forkexit_callback) {
++ for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
++ struct cgroup_subsys *ss = subsys[i];
++
++ /*
++ * fork/exit callbacks are supported only for
++ * builtin subsystems and we don't need further
++ * synchronization as they never go away.
++ */
++ if (!ss || ss->module)
++ continue;
++
++ if (ss->fork)
++ ss->fork(child);
++ }
++ }
+ }
++
+ /**
+ * cgroup_exit - detach cgroup from exiting task
+ * @tsk: pointer to task_struct of exiting process
+--- a/kernel/cgroup_freezer.c
++++ b/kernel/cgroup_freezer.c
+@@ -186,23 +186,15 @@ static void freezer_fork(struct task_str
+ {
+ struct freezer *freezer;
+
+- /*
+- * No lock is needed, since the task isn't on tasklist yet,
+- * so it can't be moved to another cgroup, which means the
+- * freezer won't be removed and will be valid during this
+- * function call. Nevertheless, apply RCU read-side critical
+- * section to suppress RCU lockdep false positives.
+- */
+ rcu_read_lock();
+ freezer = task_freezer(task);
+- rcu_read_unlock();
+
+ /*
+ * The root cgroup is non-freezable, so we can skip the
+ * following check.
+ */
+ if (!freezer->css.cgroup->parent)
+- return;
++ goto out;
+
+ spin_lock_irq(&freezer->lock);
+ BUG_ON(freezer->state == CGROUP_FROZEN);
+@@ -210,7 +202,10 @@ static void freezer_fork(struct task_str
+ /* Locking avoids race with FREEZING -> THAWED transitions. */
+ if (freezer->state == CGROUP_FREEZING)
+ freeze_task(task);
++
+ spin_unlock_irq(&freezer->lock);
++out:
++ rcu_read_unlock();
+ }
+
+ /*
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1135,7 +1135,6 @@ static struct task_struct *copy_process(
+ {
+ int retval;
+ struct task_struct *p;
+- int cgroup_callbacks_done = 0;
+
+ if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
+ return ERR_PTR(-EINVAL);
+@@ -1393,12 +1392,6 @@ static struct task_struct *copy_process(
+ INIT_LIST_HEAD(&p->thread_group);
+ p->task_works = NULL;
+
+- /* Now that the task is set up, run cgroup callbacks if
+- * necessary. We need to run them before the task is visible
+- * on the tasklist. */
+- cgroup_fork_callbacks(p);
+- cgroup_callbacks_done = 1;
+-
+ /* Need tasklist lock for parent etc handling! */
+ write_lock_irq(&tasklist_lock);
+
+@@ -1503,7 +1496,7 @@ bad_fork_cleanup_cgroup:
+ #endif
+ if (clone_flags & CLONE_THREAD)
+ threadgroup_change_end(current);
+- cgroup_exit(p, cgroup_callbacks_done);
++ cgroup_exit(p, 0);
+ delayacct_tsk_free(p);
+ module_put(task_thread_info(p)->exec_domain->module);
+ bad_fork_cleanup_count:
--- /dev/null
+From 175431635ec09b1d1bba04979b006b99e8305a83 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 19 Nov 2012 08:13:35 -0800
+Subject: cgroup: remove incorrect dget/dput() pair in cgroup_create_dir()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 175431635ec09b1d1bba04979b006b99e8305a83 upstream.
+
+cgroup_create_dir() does weird dancing with dentry refcnt. On
+success, it gets and then puts it achieving nothing. On failure, it
+puts but there isn't no matching get anywhere leading to the following
+oops if cgroup_create_file() fails for whatever reason.
+
+ ------------[ cut here ]------------
+ kernel BUG at /work/os/work/fs/dcache.c:552!
+ invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
+ Modules linked in:
+ CPU 2
+ Pid: 697, comm: mkdir Not tainted 3.7.0-rc4-work+ #3 Bochs Bochs
+ RIP: 0010:[<ffffffff811d9c0c>] [<ffffffff811d9c0c>] dput+0x1dc/0x1e0
+ RSP: 0018:ffff88001a3ebef8 EFLAGS: 00010246
+ RAX: 0000000000000000 RBX: ffff88000e5b1ef8 RCX: 0000000000000403
+ RDX: 0000000000000303 RSI: 2000000000000000 RDI: ffff88000e5b1f58
+ RBP: ffff88001a3ebf18 R08: ffffffff82c76960 R09: 0000000000000001
+ R10: ffff880015022080 R11: ffd9bed70f48a041 R12: 00000000ffffffea
+ R13: 0000000000000001 R14: ffff88000e5b1f58 R15: 00007fff57656d60
+ FS: 00007ff05fcb3800(0000) GS:ffff88001fd00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00000000004046f0 CR3: 000000001315f000 CR4: 00000000000006e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ Process mkdir (pid: 697, threadinfo ffff88001a3ea000, task ffff880015022080)
+ Stack:
+ ffff88001a3ebf48 00000000ffffffea 0000000000000001 0000000000000000
+ ffff88001a3ebf38 ffffffff811cc889 0000000000000001 ffff88000e5b1ef8
+ ffff88001a3ebf68 ffffffff811d1fc9 ffff8800198d7f18 ffff880019106ef8
+ Call Trace:
+ [<ffffffff811cc889>] done_path_create+0x19/0x50
+ [<ffffffff811d1fc9>] sys_mkdirat+0x59/0x80
+ [<ffffffff811d2009>] sys_mkdir+0x19/0x20
+ [<ffffffff81be1e02>] system_call_fastpath+0x16/0x1b
+ Code: 00 48 8d 90 18 01 00 00 48 89 93 c0 00 00 00 4c 89 a0 18 01 00 00 48 8b 83 a0 00 00 00 83 80 28 01 00 00 01 e8 e6 6f a0 00 eb 92 <0f> 0b 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 fe 41
+ RIP [<ffffffff811d9c0c>] dput+0x1dc/0x1e0
+ RSP <ffff88001a3ebef8>
+ ---[ end trace 1277bcfd9561ddb0 ]---
+
+Fix it by dropping the unnecessary dget/dput() pair.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: Li Zefan <lizefan@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/cgroup.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2744,9 +2744,7 @@ static int cgroup_create_dir(struct cgro
+ dentry->d_fsdata = cgrp;
+ inc_nlink(parent->d_inode);
+ rcu_assign_pointer(cgrp->dentry, dentry);
+- dget(dentry);
+ }
+- dput(dentry);
+
+ return error;
+ }
--- /dev/null
+From f33fddc2b9573d8359f1007d4bbe5cd587a0c093 Mon Sep 17 00:00:00 2001
+From: Gao feng <gaofeng@cn.fujitsu.com>
+Date: Thu, 6 Dec 2012 14:38:57 +0800
+Subject: cgroup_rm_file: don't delete the uncreated files
+
+From: Gao feng <gaofeng@cn.fujitsu.com>
+
+commit f33fddc2b9573d8359f1007d4bbe5cd587a0c093 upstream.
+
+in cgroup_add_file,when creating files for cgroup,
+some of creation may be skipped. So we need to avoid
+deleting these uncreated files in cgroup_rm_file,
+otherwise the warning msg will be triggered.
+
+"cgroup_addrm_files: failed to remove memory_pressure_enabled, err=-2"
+
+Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
+Acked-by: Li Zefan <lizefan@huawei.com>
+Signed-off-by: Tejun Heo <tj@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/cgroup.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2789,12 +2789,6 @@ static int cgroup_add_file(struct cgroup
+
+ simple_xattrs_init(&cft->xattrs);
+
+- /* does @cft->flags tell us to skip creation on @cgrp? */
+- if ((cft->flags & CFTYPE_NOT_ON_ROOT) && !cgrp->parent)
+- return 0;
+- if ((cft->flags & CFTYPE_ONLY_ON_ROOT) && cgrp->parent)
+- return 0;
+-
+ if (subsys && !test_bit(ROOT_NOPREFIX, &cgrp->root->flags)) {
+ strcpy(name, subsys->name);
+ strcat(name, ".");
+@@ -2835,6 +2829,12 @@ static int cgroup_addrm_files(struct cgr
+ int err, ret = 0;
+
+ for (cft = cfts; cft->name[0] != '\0'; cft++) {
++ /* does cft->flags tell us to skip this file on @cgrp? */
++ if ((cft->flags & CFTYPE_NOT_ON_ROOT) && !cgrp->parent)
++ continue;
++ if ((cft->flags & CFTYPE_ONLY_ON_ROOT) && cgrp->parent)
++ continue;
++
+ if (is_add)
+ err = cgroup_add_file(cgrp, subsys, cft);
+ else
--- /dev/null
+From dd67d32dbc5de299d70cc9e10c6c1e29ffa56b92 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 16 Oct 2012 15:03:14 -0700
+Subject: freezer: add missing mb's to freezer_count() and freezer_should_skip()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit dd67d32dbc5de299d70cc9e10c6c1e29ffa56b92 upstream.
+
+A task is considered frozen enough between freezer_do_not_count() and
+freezer_count() and freezers use freezer_should_skip() to test this
+condition. This supposedly works because freezer_count() always calls
+try_to_freezer() after clearing %PF_FREEZER_SKIP.
+
+However, there currently is nothing which guarantees that
+freezer_count() sees %true freezing() after clearing %PF_FREEZER_SKIP
+when freezing is in progress, and vice-versa. A task can escape the
+freezing condition in effect by freezer_count() seeing !freezing() and
+freezer_should_skip() seeing %PF_FREEZER_SKIP.
+
+This patch adds smp_mb()'s to freezer_count() and
+freezer_should_skip() such that either %true freezing() is visible to
+freezer_count() or !PF_FREEZER_SKIP is visible to
+freezer_should_skip().
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/freezer.h | 50 ++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 42 insertions(+), 8 deletions(-)
+
+--- a/include/linux/freezer.h
++++ b/include/linux/freezer.h
+@@ -75,28 +75,62 @@ static inline bool cgroup_freezing(struc
+ */
+
+
+-/* Tell the freezer not to count the current task as freezable. */
++/**
++ * freezer_do_not_count - tell freezer to ignore %current
++ *
++ * Tell freezers to ignore the current task when determining whether the
++ * target frozen state is reached. IOW, the current task will be
++ * considered frozen enough by freezers.
++ *
++ * The caller shouldn't do anything which isn't allowed for a frozen task
++ * until freezer_cont() is called. Usually, freezer[_do_not]_count() pair
++ * wrap a scheduling operation and nothing much else.
++ */
+ static inline void freezer_do_not_count(void)
+ {
+ current->flags |= PF_FREEZER_SKIP;
+ }
+
+-/*
+- * Tell the freezer to count the current task as freezable again and try to
+- * freeze it.
++/**
++ * freezer_count - tell freezer to stop ignoring %current
++ *
++ * Undo freezer_do_not_count(). It tells freezers that %current should be
++ * considered again and tries to freeze if freezing condition is already in
++ * effect.
+ */
+ static inline void freezer_count(void)
+ {
+ current->flags &= ~PF_FREEZER_SKIP;
++ /*
++ * If freezing is in progress, the following paired with smp_mb()
++ * in freezer_should_skip() ensures that either we see %true
++ * freezing() or freezer_should_skip() sees !PF_FREEZER_SKIP.
++ */
++ smp_mb();
+ try_to_freeze();
+ }
+
+-/*
+- * Check if the task should be counted as freezable by the freezer
++/**
++ * freezer_should_skip - whether to skip a task when determining frozen
++ * state is reached
++ * @p: task in quesion
++ *
++ * This function is used by freezers after establishing %true freezing() to
++ * test whether a task should be skipped when determining the target frozen
++ * state is reached. IOW, if this function returns %true, @p is considered
++ * frozen enough.
+ */
+-static inline int freezer_should_skip(struct task_struct *p)
++static inline bool freezer_should_skip(struct task_struct *p)
+ {
+- return !!(p->flags & PF_FREEZER_SKIP);
++ /*
++ * The following smp_mb() paired with the one in freezer_count()
++ * ensures that either freezer_count() sees %true freezing() or we
++ * see cleared %PF_FREEZER_SKIP and return %false. This makes it
++ * impossible for a task to slip frozen state testing after
++ * clearing %PF_FREEZER_SKIP.
++ */
++ smp_mb();
++ return p->flags & PF_FREEZER_SKIP;
+ }
+
+ /*
--- /dev/null
+From 04aa530ec04f61875b99c12721162e2964e3318c Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sat, 3 Nov 2012 11:52:09 +0100
+Subject: genirq: Always force thread affinity
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 04aa530ec04f61875b99c12721162e2964e3318c upstream.
+
+Sankara reported that the genirq core code fails to adjust the
+affinity of an interrupt thread in several cases:
+
+ 1) On request/setup_irq() the call to setup_affinity() happens before
+ the new action is registered, so the new thread is not notified.
+
+ 2) For secondary shared interrupts nothing notifies the new thread to
+ change its affinity.
+
+ 3) Interrupts which have the IRQ_NO_BALANCE flag set are not moving
+ the thread either.
+
+Fix this by setting the thread affinity flag right on thread creation
+time. This ensures that under all circumstances the thread moves to
+the right place. Requires a check in irq_thread_check_affinity for an
+existing affinity mask (CONFIG_CPU_MASK_OFFSTACK=y)
+
+Reported-and-tested-by: Sankara Muthukrishnan <sankara.m@gmail.com>
+Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1209041738200.2754@ionos
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/irq/manage.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -716,6 +716,7 @@ static void
+ irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action)
+ {
+ cpumask_var_t mask;
++ bool valid = true;
+
+ if (!test_and_clear_bit(IRQTF_AFFINITY, &action->thread_flags))
+ return;
+@@ -730,10 +731,18 @@ irq_thread_check_affinity(struct irq_des
+ }
+
+ raw_spin_lock_irq(&desc->lock);
+- cpumask_copy(mask, desc->irq_data.affinity);
++ /*
++ * This code is triggered unconditionally. Check the affinity
++ * mask pointer. For CPU_MASK_OFFSTACK=n this is optimized out.
++ */
++ if (desc->irq_data.affinity)
++ cpumask_copy(mask, desc->irq_data.affinity);
++ else
++ valid = false;
+ raw_spin_unlock_irq(&desc->lock);
+
+- set_cpus_allowed_ptr(current, mask);
++ if (valid)
++ set_cpus_allowed_ptr(current, mask);
+ free_cpumask_var(mask);
+ }
+ #else
+@@ -936,6 +945,16 @@ __setup_irq(unsigned int irq, struct irq
+ */
+ get_task_struct(t);
+ new->thread = t;
++ /*
++ * Tell the thread to set its affinity. This is
++ * important for shared interrupt handlers as we do
++ * not invoke setup_affinity() for the secondary
++ * handlers as everything is already set up. Even for
++ * interrupts marked with IRQF_NO_BALANCE this is
++ * correct as we want the thread to move to the cpu(s)
++ * on which the requesting code placed the interrupt.
++ */
++ set_bit(IRQTF_AFFINITY, &new->thread_flags);
+ }
+
+ if (!alloc_cpumask_var(&mask, GFP_KERNEL)) {
--- /dev/null
+From e324ce61ef483dd26d03502d35666ad48a2e1b33 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Mon, 24 Dec 2012 09:32:46 -0800
+Subject: Input: gpio_keys - defer probing if GPIO probing is deferred
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit e324ce61ef483dd26d03502d35666ad48a2e1b33 upstream.
+
+If of_get_gpio_flags() returns an error (as in case when GPIO probe is
+deferred) the driver would attempt to claim invalid GPIO. It should
+propagate the error code up the stack instead so that the probe either
+fails or will be retried later (in case of -EPROBE_DEFER).
+
+Reported-by: Gabor Juhos <juhosg@openwrt.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/keyboard/gpio_keys.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/keyboard/gpio_keys.c
++++ b/drivers/input/keyboard/gpio_keys.c
+@@ -587,6 +587,7 @@ gpio_keys_get_devtree_pdata(struct devic
+
+ i = 0;
+ for_each_child_of_node(node, pp) {
++ int gpio;
+ enum of_gpio_flags flags;
+
+ if (!of_find_property(pp, "gpios", NULL)) {
+@@ -595,9 +596,19 @@ gpio_keys_get_devtree_pdata(struct devic
+ continue;
+ }
+
++ gpio = of_get_gpio_flags(pp, 0, &flags);
++ if (gpio < 0) {
++ error = gpio;
++ if (error != -EPROBE_DEFER)
++ dev_err(dev,
++ "Failed to get gpio flags, error: %d\n",
++ error);
++ goto err_free_pdata;
++ }
++
+ button = &pdata->buttons[i++];
+
+- button->gpio = of_get_gpio_flags(pp, 0, &flags);
++ button->gpio = gpio;
+ button->active_low = flags & OF_GPIO_ACTIVE_LOW;
+
+ if (of_property_read_u32(pp, "linux,code", &button->code)) {
--- /dev/null
+From d46329a708c1a3301e272a029266b69339c0877f Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <juhosg@openwrt.org>
+Date: Sun, 23 Dec 2012 01:54:58 -0800
+Subject: Input: gpio_keys_polled - defer probing if GPIO probing is deferred
+
+From: Gabor Juhos <juhosg@openwrt.org>
+
+commit d46329a708c1a3301e272a029266b69339c0877f upstream.
+
+If GPIO probing is deferred, the driver tries to claim an invalid GPIO line
+which leads to an error message like this:
+
+ gpio-keys-polled buttons.2: unable to claim gpio 4294966779, err=-22
+ gpio-keys-polled: probe of buttons.2 failed with error -22
+
+We should make sure that error code returned by of_get_gpio_flags (including
+-EPROBE_DEFER) is propagated up the stack.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/keyboard/gpio_keys_polled.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/keyboard/gpio_keys_polled.c
++++ b/drivers/input/keyboard/gpio_keys_polled.c
+@@ -136,6 +136,7 @@ gpio_keys_polled_get_devtree_pdata(struc
+
+ i = 0;
+ for_each_child_of_node(node, pp) {
++ int gpio;
+ enum of_gpio_flags flags;
+
+ if (!of_find_property(pp, "gpios", NULL)) {
+@@ -144,9 +145,19 @@ gpio_keys_polled_get_devtree_pdata(struc
+ continue;
+ }
+
++ gpio = of_get_gpio_flags(pp, 0, &flags);
++ if (gpio < 0) {
++ error = gpio;
++ if (error != -EPROBE_DEFER)
++ dev_err(dev,
++ "Failed to get gpio flags, error: %d\n",
++ error);
++ goto err_free_pdata;
++ }
++
+ button = &pdata->buttons[i++];
+
+- button->gpio = of_get_gpio_flags(pp, 0, &flags);
++ button->gpio = gpio;
+ button->active_low = flags & OF_GPIO_ACTIVE_LOW;
+
+ if (of_property_read_u32(pp, "linux,code", &button->code)) {
--- /dev/null
+From a25461659050b913e114d282bf58823682eb56b6 Mon Sep 17 00:00:00 2001
+From: Christophe TORDEUX <christophe@tordeux.net>
+Date: Mon, 24 Dec 2012 09:20:40 -0800
+Subject: Input: sentelic - only report position of first finger as ST coordinates
+
+From: Christophe TORDEUX <christophe@tordeux.net>
+
+commit a25461659050b913e114d282bf58823682eb56b6 upstream.
+
+Report only the position of the first finger as absolute non-MT coordinates,
+instead of reporting both fingers alternatively. Actual MT events are
+unaffected.
+
+This fixes horizontal and improves vertical scrolling with the touchpad.
+
+Signed-off-by: Christophe TORDEUX <christophe@tordeux.net>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/sentelic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/mouse/sentelic.c
++++ b/drivers/input/mouse/sentelic.c
+@@ -791,7 +791,7 @@ static psmouse_ret_t fsp_process_byte(st
+ fsp_set_slot(dev, 0, fgrs > 0, abs_x, abs_y);
+ fsp_set_slot(dev, 1, false, 0, 0);
+ }
+- if (fgrs > 0) {
++ if (fgrs == 1 || (fgrs == 2 && !(packet[0] & FSP_PB0_MFMC_FGR2))) {
+ input_report_abs(dev, ABS_X, abs_x);
+ input_report_abs(dev, ABS_Y, abs_y);
+ }
--- /dev/null
+From e12b3cecf221644ccab64d7c30a6df58b7630cb0 Mon Sep 17 00:00:00 2001
+From: Diego Calleja <diegocg@gmail.com>
+Date: Mon, 3 Dec 2012 21:16:11 -0800
+Subject: Input: wacom - fix touch support for Bamboo Fun CTH-461
+
+From: Diego Calleja <diegocg@gmail.com>
+
+commit e12b3cecf221644ccab64d7c30a6df58b7630cb0 upstream.
+
+Commit f393ee2b814e3291c12565000210b3cf10aa5c1d forgot to add the
+touch_max property for Wacom Bamboo Fun CTH-461/S, ID 056a:00d2.
+
+This broke the touch functionality for that device. This patch,
+(done with help of Ping Cheng), adds the correct value and makes
+touch work again.
+
+Signed-off-by: Diego Calleja <diegocg@gmail.com>
+Reviewed-by: Ping Cheng <pinglinux@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/tablet/wacom_wac.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/tablet/wacom_wac.c
++++ b/drivers/input/tablet/wacom_wac.c
+@@ -2034,7 +2034,8 @@ static const struct wacom_features wacom
+ .touch_max = 2 };
+ static const struct wacom_features wacom_features_0xD2 =
+ { "Wacom Bamboo Craft", WACOM_PKGLEN_BBFUN, 14720, 9200, 1023,
+- 31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
++ 31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
++ .touch_max = 2 };
+ static const struct wacom_features wacom_features_0xD3 =
+ { "Wacom Bamboo 2FG 6x8", WACOM_PKGLEN_BBFUN, 21648, 13700, 1023,
+ 31, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES,
--- /dev/null
+From a455e2985f57e2a71566bb8850094af38b2c932d Mon Sep 17 00:00:00 2001
+From: Peter Popovec <popovec@oko.fei.tuke.sk>
+Date: Fri, 14 Dec 2012 22:57:25 -0800
+Subject: Input: walkera0701 - fix crash on startup
+
+From: Peter Popovec <popovec@oko.fei.tuke.sk>
+
+commit a455e2985f57e2a71566bb8850094af38b2c932d upstream.
+
+The driver's timer must be set up before enabling IRQ handler, otherwise
+bad things may happen.
+
+Reported-and-tested-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Peter Popovec <popovec@fei.tuke.sk>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/joystick/walkera0701.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/input/joystick/walkera0701.c
++++ b/drivers/input/joystick/walkera0701.c
+@@ -196,6 +196,7 @@ static void walkera0701_close(struct inp
+ struct walkera_dev *w = input_get_drvdata(dev);
+
+ parport_disable_irq(w->parport);
++ hrtimer_cancel(&w->timer);
+ }
+
+ static int walkera0701_connect(struct walkera_dev *w, int parport)
+@@ -224,6 +225,9 @@ static int walkera0701_connect(struct wa
+ if (parport_claim(w->pardevice))
+ goto init_err1;
+
++ hrtimer_init(&w->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++ w->timer.function = timer_handler;
++
+ w->input_dev = input_allocate_device();
+ if (!w->input_dev)
+ goto init_err2;
+@@ -254,8 +258,6 @@ static int walkera0701_connect(struct wa
+ if (err)
+ goto init_err3;
+
+- hrtimer_init(&w->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+- w->timer.function = timer_handler;
+ return 0;
+
+ init_err3:
+@@ -271,7 +273,6 @@ static int walkera0701_connect(struct wa
+
+ static void walkera0701_disconnect(struct walkera_dev *w)
+ {
+- hrtimer_cancel(&w->timer);
+ input_unregister_device(w->input_dev);
+ parport_release(w->pardevice);
+ parport_unregister_device(w->pardevice);
--- /dev/null
+From 7179e7bf4592ac5a7b30257a7df6259ee81e51da Mon Sep 17 00:00:00 2001
+From: Jianguo Wu <wujianguo@huawei.com>
+Date: Tue, 18 Dec 2012 14:23:19 -0800
+Subject: mm/hugetlb: create hugetlb cgroup file in hugetlb_init
+
+From: Jianguo Wu <wujianguo@huawei.com>
+
+commit 7179e7bf4592ac5a7b30257a7df6259ee81e51da upstream.
+
+Build kernel with CONFIG_HUGETLBFS=y,CONFIG_HUGETLB_PAGE=y and
+CONFIG_CGROUP_HUGETLB=y, then specify hugepagesz=xx boot option, system
+will fail to boot.
+
+This failure is caused by following code path:
+
+ setup_hugepagesz
+ hugetlb_add_hstate
+ hugetlb_cgroup_file_init
+ cgroup_add_cftypes
+ kzalloc <--slab is *not available* yet
+
+For this path, slab is not available yet, so memory allocated will be
+failed, and cause WARN_ON() in hugetlb_cgroup_file_init().
+
+So I move hugetlb_cgroup_file_init() into hugetlb_init().
+
+[akpm@linux-foundation.org: tweak coding-style, remove pointless __init on inlined function]
+[akpm@linux-foundation.org: fix warning]
+Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
+Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Acked-by: Michal Hocko <mhocko@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/hugetlb_cgroup.h | 5 ++---
+ mm/hugetlb.c | 11 +----------
+ mm/hugetlb_cgroup.c | 19 +++++++++++++++++--
+ 3 files changed, 20 insertions(+), 15 deletions(-)
+
+--- a/include/linux/hugetlb_cgroup.h
++++ b/include/linux/hugetlb_cgroup.h
+@@ -62,7 +62,7 @@ extern void hugetlb_cgroup_uncharge_page
+ struct page *page);
+ extern void hugetlb_cgroup_uncharge_cgroup(int idx, unsigned long nr_pages,
+ struct hugetlb_cgroup *h_cg);
+-extern int hugetlb_cgroup_file_init(int idx) __init;
++extern void hugetlb_cgroup_file_init(void) __init;
+ extern void hugetlb_cgroup_migrate(struct page *oldhpage,
+ struct page *newhpage);
+
+@@ -111,9 +111,8 @@ hugetlb_cgroup_uncharge_cgroup(int idx,
+ return;
+ }
+
+-static inline int __init hugetlb_cgroup_file_init(int idx)
++static inline void hugetlb_cgroup_file_init(void)
+ {
+- return 0;
+ }
+
+ static inline void hugetlb_cgroup_migrate(struct page *oldhpage,
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1906,14 +1906,12 @@ static int __init hugetlb_init(void)
+ default_hstate.max_huge_pages = default_hstate_max_huge_pages;
+
+ hugetlb_init_hstates();
+-
+ gather_bootmem_prealloc();
+-
+ report_hugepages();
+
+ hugetlb_sysfs_init();
+-
+ hugetlb_register_all_nodes();
++ hugetlb_cgroup_file_init();
+
+ return 0;
+ }
+@@ -1943,13 +1941,6 @@ void __init hugetlb_add_hstate(unsigned
+ h->next_nid_to_free = first_node(node_states[N_HIGH_MEMORY]);
+ snprintf(h->name, HSTATE_NAME_LEN, "hugepages-%lukB",
+ huge_page_size(h)/1024);
+- /*
+- * Add cgroup control files only if the huge page consists
+- * of more than two normal pages. This is because we use
+- * page[2].lru.next for storing cgoup details.
+- */
+- if (order >= HUGETLB_CGROUP_MIN_ORDER)
+- hugetlb_cgroup_file_init(hugetlb_max_hstate - 1);
+
+ parsed_hstate = h;
+ }
+--- a/mm/hugetlb_cgroup.c
++++ b/mm/hugetlb_cgroup.c
+@@ -340,7 +340,7 @@ static char *mem_fmt(char *buf, int size
+ return buf;
+ }
+
+-int __init hugetlb_cgroup_file_init(int idx)
++static void __init __hugetlb_cgroup_file_init(int idx)
+ {
+ char buf[32];
+ struct cftype *cft;
+@@ -382,7 +382,22 @@ int __init hugetlb_cgroup_file_init(int
+
+ WARN_ON(cgroup_add_cftypes(&hugetlb_subsys, h->cgroup_files));
+
+- return 0;
++ return;
++}
++
++void __init hugetlb_cgroup_file_init(void)
++{
++ struct hstate *h;
++
++ for_each_hstate(h) {
++ /*
++ * Add cgroup control files only if the huge page consists
++ * of more than two normal pages. This is because we use
++ * page[2].lru.next for storing cgroup details.
++ */
++ if (huge_page_order(h) >= HUGETLB_CGROUP_MIN_ORDER)
++ __hugetlb_cgroup_file_init(hstate_index(h));
++ }
+ }
+
+ /*
--- /dev/null
+From d75542263a0b005876d112bbf9ffb23180cc3149 Mon Sep 17 00:00:00 2001
+From: Afzal Mohammed <afzal@ti.com>
+Date: Tue, 6 Nov 2012 20:47:24 +0530
+Subject: Revert "usb: musb: dsps: remove explicit NOP device creation"
+
+From: Afzal Mohammed <afzal@ti.com>
+
+commit d75542263a0b005876d112bbf9ffb23180cc3149 upstream.
+
+This reverts commit d8c3ef256f88b7c6ecd673d03073b5645be9c5e4.
+
+Above mentioned change was made along with multi usb phy change and
+adding DT support for nop transceiver. But other two changes did not
+make it to mainline. This in effect makes dsps musb wrapper unusable
+even for single instance.
+
+Hence revert it so that at least single instance can be supported.
+
+Signed-off-by: Afzal Mohammed <afzal@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_dsps.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/musb/musb_dsps.c
++++ b/drivers/usb/musb/musb_dsps.c
+@@ -377,7 +377,8 @@ static int dsps_musb_init(struct musb *m
+ /* mentor core register starts at offset of 0x400 from musb base */
+ musb->mregs += wrp->musb_core_offset;
+
+- /* Get the NOP PHY */
++ /* NOP driver needs change if supporting dual instance */
++ usb_nop_xceiv_register();
+ musb->xceiv = usb_get_phy(USB_PHY_TYPE_USB2);
+ if (IS_ERR_OR_NULL(musb->xceiv))
+ return -ENODEV;
nfs-fix-null-checking-in-nfs_get_option_str.patch
nfs-ensure-that-we-free-the-rpc_task-after-read-and-write-cleanups-are-done.patch
nfs-avoid-dereferencing-null-pointer-in-initiate_bulk_draining.patch
+vfs-d_obtain_alias-needs-to-use-as-default-name.patch
+input-walkera0701-fix-crash-on-startup.patch
+input-wacom-fix-touch-support-for-bamboo-fun-cth-461.patch
+input-sentelic-only-report-position-of-first-finger-as-st-coordinates.patch
+input-gpio_keys_polled-defer-probing-if-gpio-probing-is-deferred.patch
+input-gpio_keys-defer-probing-if-gpio-probing-is-deferred.patch
+genirq-always-force-thread-affinity.patch
+usb-musb-cppi_dma-export-cppi_interrupt.patch
+revert-usb-musb-dsps-remove-explicit-nop-device-creation.patch
+xhci-fix-conditional-check-in-bandwidth-calculation.patch
+xhci-fix-td-size-calculation-on-1.0-hosts.patch
+xhci-fix-null-pointer-dereference-when-destroying-half-built-segment-rings.patch
+usb-fix-endpoint-disabling-for-failed-config-changes.patch
+usb-host-xhci-stricter-conditional-for-z1-system-models-for-compliance-mode-patch.patch
+xhci-add-lynx-point-lp-to-list-of-intel-switchable-hosts.patch
+cgroup-cgroup_subsys-fork-should-be-called-after-the-task-is-added-to-css_set.patch
+cgroup-remove-incorrect-dget-dput-pair-in-cgroup_create_dir.patch
+cgroup_rm_file-don-t-delete-the-uncreated-files.patch
+mm-hugetlb-create-hugetlb-cgroup-file-in-hugetlb_init.patch
+staging-drm-omap-fix-include-error-during-make.patch
+smb3-mounts-fail-with-access-denied-to-some-servers.patch
+freezer-add-missing-mb-s-to-freezer_count-and-freezer_should_skip.patch
--- /dev/null
+From 52c0f4ad8ed462d81f1d37f56a74a71dc0c9bf0f Mon Sep 17 00:00:00 2001
+From: Steve French <smfrench@gmail.com>
+Date: Tue, 4 Dec 2012 16:56:37 -0600
+Subject: SMB3 mounts fail with access denied to some servers
+
+From: Steve French <smfrench@gmail.com>
+
+commit 52c0f4ad8ed462d81f1d37f56a74a71dc0c9bf0f upstream.
+
+We were checking incorrectly if signatures were required to be sent,
+so were always sending signatures after the initial session establishment.
+For SMB3 mounts (vers=3.0) this was a problem because we were putting
+SMB2 signatures in SMB3 requests which would cause access denied
+on mount (the tree connection would fail).
+
+This might also be worth considering for stable (for 3.7), as the
+error message on mount (access denied) is confusing to users and
+there is no workaround if the server is configured to only
+support smb3.0. I am ok either way.
+
+Signed-off-by: Steve French <smfrench@gmail.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2pdu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -425,7 +425,7 @@ SMB2_negotiate(const unsigned int xid, s
+ }
+
+ cFYI(1, "sec_flags 0x%x", sec_flags);
+- if (sec_flags & CIFSSEC_MUST_SIGN) {
++ if ((sec_flags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) {
+ cFYI(1, "Signing required");
+ if (!(server->sec_mode & (SMB2_NEGOTIATE_SIGNING_REQUIRED |
+ SMB2_NEGOTIATE_SIGNING_ENABLED))) {
--- /dev/null
+From b9ed9f0ecf1b5675c64d069e9b53effe276b6f01 Mon Sep 17 00:00:00 2001
+From: Andy Gross <andy.gross@ti.com>
+Date: Tue, 16 Oct 2012 00:17:40 -0500
+Subject: staging: drm/omap: Fix include error during make
+
+From: Andy Gross <andy.gross@ti.com>
+
+commit b9ed9f0ecf1b5675c64d069e9b53effe276b6f01 upstream.
+
+Fixed include error for drm_mode.h
+
+Signed-off-by: Andy Gross <andy.gross@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/omapdrm/omap_crtc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/omapdrm/omap_crtc.c
++++ b/drivers/staging/omapdrm/omap_crtc.c
+@@ -19,7 +19,7 @@
+
+ #include "omap_drv.h"
+
+-#include "drm_mode.h"
++#include <drm/drm_mode.h>
+ #include "drm_crtc.h"
+ #include "drm_crtc_helper.h"
+
--- /dev/null
+From 36caff5d795429c572443894e8789c2150dd796b Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 7 Nov 2012 10:31:30 -0500
+Subject: USB: fix endpoint-disabling for failed config changes
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 36caff5d795429c572443894e8789c2150dd796b upstream.
+
+This patch (as1631) fixes a bug that shows up when a config change
+fails for a device under an xHCI controller. The controller needs to
+be told to disable the endpoints that have been enabled for the new
+config. The existing code does this, but before storing the
+information about which endpoints were enabled! As a result, any
+second attempt to install the new config is doomed to fail because
+xhci-hcd will refuse to enable an endpoint that is already enabled.
+
+The patch optimistically initializes the new endpoints' device
+structures before asking the device to switch to the new config. If
+the request fails then the endpoint information is already stored, so
+we can use usb_hcd_alloc_bandwidth() to disable the endpoints with no
+trouble. The rest of the error path is slightly more complex now; we
+have to disable the new interfaces and call put_device() rather than
+simply deallocating them.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: Matthias Schniedermeyer <ms@citd.de>
+CC: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/message.c | 54 +++++++++++++++++++++++++--------------------
+ 1 file changed, 31 insertions(+), 23 deletions(-)
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1806,29 +1806,8 @@ free_interfaces:
+ goto free_interfaces;
+ }
+
+- ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+- USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
+- NULL, 0, USB_CTRL_SET_TIMEOUT);
+- if (ret < 0) {
+- /* All the old state is gone, so what else can we do?
+- * The device is probably useless now anyway.
+- */
+- cp = NULL;
+- }
+-
+- dev->actconfig = cp;
+- if (!cp) {
+- usb_set_device_state(dev, USB_STATE_ADDRESS);
+- usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
+- /* Leave LPM disabled while the device is unconfigured. */
+- mutex_unlock(hcd->bandwidth_mutex);
+- usb_autosuspend_device(dev);
+- goto free_interfaces;
+- }
+- mutex_unlock(hcd->bandwidth_mutex);
+- usb_set_device_state(dev, USB_STATE_CONFIGURED);
+-
+- /* Initialize the new interface structures and the
++ /*
++ * Initialize the new interface structures and the
+ * hc/hcd/usbcore interface/endpoint state.
+ */
+ for (i = 0; i < nintf; ++i) {
+@@ -1872,6 +1851,35 @@ free_interfaces:
+ }
+ kfree(new_interfaces);
+
++ ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
++ USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
++ NULL, 0, USB_CTRL_SET_TIMEOUT);
++ if (ret < 0 && cp) {
++ /*
++ * All the old state is gone, so what else can we do?
++ * The device is probably useless now anyway.
++ */
++ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
++ for (i = 0; i < nintf; ++i) {
++ usb_disable_interface(dev, cp->interface[i], true);
++ put_device(&cp->interface[i]->dev);
++ cp->interface[i] = NULL;
++ }
++ cp = NULL;
++ }
++
++ dev->actconfig = cp;
++ mutex_unlock(hcd->bandwidth_mutex);
++
++ if (!cp) {
++ usb_set_device_state(dev, USB_STATE_ADDRESS);
++
++ /* Leave LPM disabled while the device is unconfigured. */
++ usb_autosuspend_device(dev);
++ return ret;
++ }
++ usb_set_device_state(dev, USB_STATE_CONFIGURED);
++
+ if (cp->string == NULL &&
+ !(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
+ cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
--- /dev/null
+From b0e4e606ff6ff26da0f60826e75577b56ba4e463 Mon Sep 17 00:00:00 2001
+From: "Alexis R. Cortes" <alexis.cortes@ti.com>
+Date: Thu, 8 Nov 2012 16:59:27 -0600
+Subject: usb: host: xhci: Stricter conditional for Z1 system models for Compliance Mode Patch
+
+From: "Alexis R. Cortes" <alexis.cortes@ti.com>
+
+commit b0e4e606ff6ff26da0f60826e75577b56ba4e463 upstream.
+
+This minor patch creates a more stricter conditional for the Z1 sytems for applying
+the Compliance Mode Patch, this to avoid the quirk to be applied to models that
+contain a "Z1" in their dmi product string but are different from Z1 systems.
+
+This patch should be backported to stable kernels as old as 3.2, that
+contain the commit 71c731a296f1b08a3724bd1b514b64f1bda87a23 "usb: host:
+xhci: Fix Compliance Mode on SN65LVPE502CP Hardware"
+
+Signed-off-by: Alexis R. Cortes <alexis.cortes@ti.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -480,7 +480,7 @@ static bool compliance_mode_recovery_tim
+ if (strstr(dmi_product_name, "Z420") ||
+ strstr(dmi_product_name, "Z620") ||
+ strstr(dmi_product_name, "Z820") ||
+- strstr(dmi_product_name, "Z1"))
++ strstr(dmi_product_name, "Z1 Workstation"))
+ return true;
+
+ return false;
--- /dev/null
+From 8b416b0b25d5d8ddb3a91c1d20e1373582c50405 Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Date: Mon, 5 Nov 2012 22:26:40 +0300
+Subject: usb: musb: cppi_dma: export cppi_interrupt()
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 8b416b0b25d5d8ddb3a91c1d20e1373582c50405 upstream.
+
+Now that DaVinci glue layer can be modular, we must export cppi_interrupt()
+that it may call...
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/cppi_dma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/musb/cppi_dma.c
++++ b/drivers/usb/musb/cppi_dma.c
+@@ -1314,6 +1314,7 @@ irqreturn_t cppi_interrupt(int irq, void
+
+ return IRQ_HANDLED;
+ }
++EXPORT_SYMBOL_GPL(cppi_interrupt);
+
+ /* Instantiate a software object representing a DMA controller. */
+ struct dma_controller *__devinit
--- /dev/null
+From b911a6bdeef5848c468597d040e3407e0aee04ce Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 8 Nov 2012 16:09:37 -0800
+Subject: vfs: d_obtain_alias() needs to use "/" as default name.
+
+From: NeilBrown <neilb@suse.de>
+
+commit b911a6bdeef5848c468597d040e3407e0aee04ce upstream.
+
+NFS appears to use d_obtain_alias() to create the root dentry rather than
+d_make_root. This can cause 'prepend_path()' to complain that the root
+has a weird name if an NFS filesystem is lazily unmounted. e.g. if
+"/mnt" is an NFS mount then
+
+ { cd /mnt; umount -l /mnt ; ls -l /proc/self/cwd; }
+
+will cause a WARN message like
+ WARNING: at /home/git/linux/fs/dcache.c:2624 prepend_path+0x1d7/0x1e0()
+ ...
+ Root dentry has weird name <>
+
+to appear in kernel logs.
+
+So change d_obtain_alias() to use "/" rather than "" as the anonymous
+name.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1583,7 +1583,7 @@ EXPORT_SYMBOL(d_find_any_alias);
+ */
+ struct dentry *d_obtain_alias(struct inode *inode)
+ {
+- static const struct qstr anonstring = { .name = "" };
++ static const struct qstr anonstring = QSTR_INIT("/", 1);
+ struct dentry *tmp;
+ struct dentry *res;
+
--- /dev/null
+From bb1e5dd7113d2fd178d3af9aca8f480ae0468edf Mon Sep 17 00:00:00 2001
+From: Russell Webb <russell.webb@linux.intel.com>
+Date: Fri, 9 Nov 2012 13:58:49 -0800
+Subject: xhci: Add Lynx Point LP to list of Intel switchable hosts
+
+From: Russell Webb <russell.webb@linux.intel.com>
+
+commit bb1e5dd7113d2fd178d3af9aca8f480ae0468edf upstream.
+
+Like Lynx Point, Lynx Point LP is also switchable. See
+1c12443ab8eba71a658fae4572147e56d1f84f66 for more details.
+
+This patch should be backported to stable kernels as old as 3.0,
+that contain commit 69e848c2090aebba5698a1620604c7dccb448684
+"Intel xhci: Support EHCI/xHCI port switching."
+
+Signed-off-by: Russell Webb <russell.webb@linux.intel.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-pci.c | 3 ++-
+ drivers/usb/host/pci-quirks.c | 4 +++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -334,7 +334,8 @@ static bool usb_is_intel_switchable_ehci
+ pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ (pdev->device == 0x1E26 ||
+ pdev->device == 0x8C2D ||
+- pdev->device == 0x8C26);
++ pdev->device == 0x8C26 ||
++ pdev->device == 0x9C26);
+ }
+
+ static void ehci_enable_xhci_companion(void)
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -723,6 +723,7 @@ static int handshake(void __iomem *ptr,
+ }
+
+ #define PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI 0x8C31
++#define PCI_DEVICE_ID_INTEL_LYNX_POINT_LP_XHCI 0x9C31
+
+ bool usb_is_intel_ppt_switchable_xhci(struct pci_dev *pdev)
+ {
+@@ -736,7 +737,8 @@ bool usb_is_intel_lpt_switchable_xhci(st
+ {
+ return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
+ pdev->vendor == PCI_VENDOR_ID_INTEL &&
+- pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI;
++ (pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_LP_XHCI);
+ }
+
+ bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
--- /dev/null
+From 392a07ae3316f2b90b39ce41e66d6f6b5c95de90 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Thu, 25 Oct 2012 13:44:12 -0700
+Subject: xhci: Fix conditional check in bandwidth calculation.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 392a07ae3316f2b90b39ce41e66d6f6b5c95de90 upstream.
+
+David reports that at drivers/usb/host/xhci.c:2257:
+
+static bool xhci_is_sync_in_ep(unsigned int ep_type)
+{
+ return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
+}
+
+The static analyser cppcheck says
+
+[linux-3.7-rc2/drivers/usb/host/xhci.c:2257]: (style) Redundant condition: If ep_type == 5, the comparison ep_type != 7 is always true.
+
+Maybe the original programmer intention was something like
+
+static bool xhci_is_sync_in_ep(unsigned int ep_type)
+{
+ return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
+}
+
+Fix this.
+
+This patch should be backported to stable kernels as old as 3.2, that
+contain the commit 2b69899934c63b7b9432568584fb4c4a2924f40c "xhci: USB
+3.0 BW checking."
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -2254,7 +2254,7 @@ static bool xhci_is_async_ep(unsigned in
+
+ static bool xhci_is_sync_in_ep(unsigned int ep_type)
+ {
+- return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
++ return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
+ }
+
+ static unsigned int xhci_get_ss_bw_consumed(struct xhci_bw_info *ep_bw)
--- /dev/null
+From 68e5254adb88bede68285f11fb442a4d34fb550c Mon Sep 17 00:00:00 2001
+From: Julius Werner <jwerner@chromium.org>
+Date: Thu, 1 Nov 2012 12:47:59 -0700
+Subject: xhci: fix null-pointer dereference when destroying half-built segment rings
+
+From: Julius Werner <jwerner@chromium.org>
+
+commit 68e5254adb88bede68285f11fb442a4d34fb550c upstream.
+
+xhci_alloc_segments_for_ring() builds a list of xhci_segments and links
+the tail to head at the end (forming a ring). When it bails out for OOM
+reasons half-way through, it tries to destroy its half-built list with
+xhci_free_segments_for_ring(), even though it is not a ring yet. This
+causes a null-pointer dereference upon hitting the last element.
+
+Furthermore, one of its callers (xhci_ring_alloc()) mistakenly believes
+the output parameters to be valid upon this kind of OOM failure, and
+calls xhci_ring_free() on them. Since the (incomplete) list/ring should
+already be destroyed in that case, this would lead to a use after free.
+
+This patch fixes those issues by having xhci_alloc_segments_for_ring()
+destroy its half-built, non-circular list manually and destroying the
+invalid struct xhci_ring in xhci_ring_alloc() with a plain kfree().
+
+This patch should be backported to kernels as old as 2.6.31, that
+contains the commit 0ebbab37422315a5d0cb29792271085bafdf38c0 "USB: xhci:
+Ring allocation and initialization."
+
+A separate patch will need to be developed for kernels older than 3.4,
+since the ring allocation code was refactored in that kernel.
+
+Signed-off-by: Julius Werner <jwerner@chromium.org>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-mem.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -205,7 +205,12 @@ static int xhci_alloc_segments_for_ring(
+
+ next = xhci_segment_alloc(xhci, cycle_state, flags);
+ if (!next) {
+- xhci_free_segments_for_ring(xhci, *first);
++ prev = *first;
++ while (prev) {
++ next = prev->next;
++ xhci_segment_free(xhci, prev);
++ prev = next;
++ }
+ return -ENOMEM;
+ }
+ xhci_link_segments(xhci, prev, next, type);
+@@ -258,7 +263,7 @@ static struct xhci_ring *xhci_ring_alloc
+ return ring;
+
+ fail:
+- xhci_ring_free(xhci, ring);
++ kfree(ring);
+ return NULL;
+ }
+
--- /dev/null
+From 4525c0a10dff7ad3669763c28016c7daffc3900e Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Thu, 25 Oct 2012 15:56:40 -0700
+Subject: xHCI: Fix TD Size calculation on 1.0 hosts.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 4525c0a10dff7ad3669763c28016c7daffc3900e upstream.
+
+The xHCI 1.0 specification made a change to the TD Size field in TRBs.
+The value is now the number of packets that remain to be sent in the TD,
+not including this TRB. The TD Size value for the last TRB in a TD must
+always be zero.
+
+The xHCI function xhci_v1_0_td_remainder() attempts to calculate this,
+but it gets it wrong. First, it erroneously reuses the old
+xhci_td_remainder function, which will right shift the value by 10. The
+xHCI 1.0 spec as of June 2011 says nothing about right shifting by 10.
+Second, it does not set the TD size for the last TRB in a TD to zero.
+
+Third, it uses roundup instead of DIV_ROUND_UP. The total packet count
+is supposed to be the total number of bytes in this TD, divided by the
+max packet size, rounded up. DIV_ROUND_UP is the right function to use
+in that case.
+
+With the old code, a TD on an endpoint with max packet size 1024 would
+be set up like so:
+TRB 1, TRB length = 600 bytes, TD size = 0
+TRB 1, TRB length = 200 bytes, TD size = 0
+TRB 1, TRB length = 100 bytes, TD size = 0
+
+With the new code, the TD would be set up like this:
+TRB 1, TRB length = 600 bytes, TD size = 1
+TRB 1, TRB length = 200 bytes, TD size = 1
+TRB 1, TRB length = 100 bytes, TD size = 0
+
+This commit should be backported to kernels as old as 3.0, that contain
+the commit 4da6e6f247a2601ab9f1e63424e4d944ed4124f3 "xhci 1.0: Update TD
+size field format."
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: Chintan Mehta <chintan.mehta@sibridgetech.com>
+Reported-by: Shimmer Huang <shimmering.h@gmail.com>
+Tested-by: Bhavik Kothari <bhavik.kothari@sibridgetech.com>
+Tested-by: Shimmer Huang <shimmering.h@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 32 +++++++++++++++++++-------------
+ 1 file changed, 19 insertions(+), 13 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3071,11 +3071,11 @@ static u32 xhci_td_remainder(unsigned in
+ }
+
+ /*
+- * For xHCI 1.0 host controllers, TD size is the number of packets remaining in
+- * the TD (*not* including this TRB).
++ * For xHCI 1.0 host controllers, TD size is the number of max packet sized
++ * packets remaining in the TD (*not* including this TRB).
+ *
+ * Total TD packet count = total_packet_count =
+- * roundup(TD size in bytes / wMaxPacketSize)
++ * DIV_ROUND_UP(TD size in bytes / wMaxPacketSize)
+ *
+ * Packets transferred up to and including this TRB = packets_transferred =
+ * rounddown(total bytes transferred including this TRB / wMaxPacketSize)
+@@ -3083,15 +3083,16 @@ static u32 xhci_td_remainder(unsigned in
+ * TD size = total_packet_count - packets_transferred
+ *
+ * It must fit in bits 21:17, so it can't be bigger than 31.
++ * The last TRB in a TD must have the TD size set to zero.
+ */
+-
+ static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len,
+- unsigned int total_packet_count, struct urb *urb)
++ unsigned int total_packet_count, struct urb *urb,
++ unsigned int num_trbs_left)
+ {
+ int packets_transferred;
+
+ /* One TRB with a zero-length data packet. */
+- if (running_total == 0 && trb_buff_len == 0)
++ if (num_trbs_left == 0 || (running_total == 0 && trb_buff_len == 0))
+ return 0;
+
+ /* All the TRB queueing functions don't count the current TRB in
+@@ -3100,7 +3101,9 @@ static u32 xhci_v1_0_td_remainder(int ru
+ packets_transferred = (running_total + trb_buff_len) /
+ usb_endpoint_maxp(&urb->ep->desc);
+
+- return xhci_td_remainder(total_packet_count - packets_transferred);
++ if ((total_packet_count - packets_transferred) > 31)
++ return 31 << 17;
++ return (total_packet_count - packets_transferred) << 17;
+ }
+
+ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+@@ -3127,7 +3130,7 @@ static int queue_bulk_sg_tx(struct xhci_
+
+ num_trbs = count_sg_trbs_needed(xhci, urb);
+ num_sgs = urb->num_mapped_sgs;
+- total_packet_count = roundup(urb->transfer_buffer_length,
++ total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length,
+ usb_endpoint_maxp(&urb->ep->desc));
+
+ trb_buff_len = prepare_transfer(xhci, xhci->devs[slot_id],
+@@ -3210,7 +3213,8 @@ static int queue_bulk_sg_tx(struct xhci_
+ running_total);
+ } else {
+ remainder = xhci_v1_0_td_remainder(running_total,
+- trb_buff_len, total_packet_count, urb);
++ trb_buff_len, total_packet_count, urb,
++ num_trbs - 1);
+ }
+ length_field = TRB_LEN(trb_buff_len) |
+ remainder |
+@@ -3318,7 +3322,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ start_cycle = ep_ring->cycle_state;
+
+ running_total = 0;
+- total_packet_count = roundup(urb->transfer_buffer_length,
++ total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length,
+ usb_endpoint_maxp(&urb->ep->desc));
+ /* How much data is in the first TRB? */
+ addr = (u64) urb->transfer_dma;
+@@ -3364,7 +3368,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+ running_total);
+ } else {
+ remainder = xhci_v1_0_td_remainder(running_total,
+- trb_buff_len, total_packet_count, urb);
++ trb_buff_len, total_packet_count, urb,
++ num_trbs - 1);
+ }
+ length_field = TRB_LEN(trb_buff_len) |
+ remainder |
+@@ -3627,7 +3632,7 @@ static int xhci_queue_isoc_tx(struct xhc
+ addr = start_addr + urb->iso_frame_desc[i].offset;
+ td_len = urb->iso_frame_desc[i].length;
+ td_remain_len = td_len;
+- total_packet_count = roundup(td_len,
++ total_packet_count = DIV_ROUND_UP(td_len,
+ usb_endpoint_maxp(&urb->ep->desc));
+ /* A zero-length transfer still involves at least one packet. */
+ if (total_packet_count == 0)
+@@ -3706,7 +3711,8 @@ static int xhci_queue_isoc_tx(struct xhc
+ } else {
+ remainder = xhci_v1_0_td_remainder(
+ running_total, trb_buff_len,
+- total_packet_count, urb);
++ total_packet_count, urb,
++ (trbs_per_td - j - 1));
+ }
+ length_field = TRB_LEN(trb_buff_len) |
+ remainder |
projects / thirdparty / kernel / stable-queue.git / commitdiff
