--- /dev/null
+From 7b9205bd775afc4439ed86d617f9042ee9e76a71 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Fri, 11 Jan 2013 14:32:05 -0800
+Subject: audit: create explicit AUDIT_SECCOMP event type
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 7b9205bd775afc4439ed86d617f9042ee9e76a71 upstream.
+
+The seccomp path was using AUDIT_ANOM_ABEND from when seccomp mode 1
+could only kill a process. While we still want to make sure an audit
+record is forced on a kill, this should use a separate record type since
+seccomp mode 2 introduces other behaviors.
+
+In the case of "handled" behaviors (process wasn't killed), only emit a
+record if the process is under inspection. This change also fixes
+userspace examination of seccomp audit events, since it was considered
+malformed due to missing fields of the AUDIT_ANOM_ABEND event type.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Eric Paris <eparis@redhat.com>
+Cc: Jeff Layton <jlayton@redhat.com>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Cc: Julien Tinnes <jln@google.com>
+Acked-by: Will Drewry <wad@chromium.org>
+Acked-by: Steve Grubb <sgrubb@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/audit.h | 3 ++-
+ include/uapi/linux/audit.h | 1 +
+ kernel/auditsc.c | 14 +++++++++++---
+ 3 files changed, 14 insertions(+), 4 deletions(-)
+
+--- a/include/linux/audit.h
++++ b/include/linux/audit.h
+@@ -157,7 +157,8 @@ void audit_core_dumps(long signr);
+
+ static inline void audit_seccomp(unsigned long syscall, long signr, int code)
+ {
+- if (unlikely(!audit_dummy_context()))
++ /* Force a record to be reported if a signal was delivered. */
++ if (signr || unlikely(!audit_dummy_context()))
+ __audit_seccomp(syscall, signr, code);
+ }
+
+--- a/include/uapi/linux/audit.h
++++ b/include/uapi/linux/audit.h
+@@ -106,6 +106,7 @@
+ #define AUDIT_MMAP 1323 /* Record showing descriptor and flags in mmap */
+ #define AUDIT_NETFILTER_PKT 1324 /* Packets traversing netfilter chains */
+ #define AUDIT_NETFILTER_CFG 1325 /* Netfilter chain modifications */
++#define AUDIT_SECCOMP 1326 /* Secure Computing event */
+
+ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
+ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -2735,7 +2735,7 @@ void __audit_mmap_fd(int fd, int flags)
+ context->type = AUDIT_MMAP;
+ }
+
+-static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
++static void audit_log_task(struct audit_buffer *ab)
+ {
+ kuid_t auid, uid;
+ kgid_t gid;
+@@ -2753,6 +2753,11 @@ static void audit_log_abend(struct audit
+ audit_log_task_context(ab);
+ audit_log_format(ab, " pid=%d comm=", current->pid);
+ audit_log_untrustedstring(ab, current->comm);
++}
++
++static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
++{
++ audit_log_task(ab);
+ audit_log_format(ab, " reason=");
+ audit_log_string(ab, reason);
+ audit_log_format(ab, " sig=%ld", signr);
+@@ -2783,8 +2788,11 @@ void __audit_seccomp(unsigned long sysca
+ {
+ struct audit_buffer *ab;
+
+- ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
+- audit_log_abend(ab, "seccomp", signr);
++ ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_SECCOMP);
++ if (unlikely(!ab))
++ return;
++ audit_log_task(ab);
++ audit_log_format(ab, " sig=%ld", signr);
+ audit_log_format(ab, " syscall=%ld", syscall);
+ audit_log_format(ab, " compat=%d", is_compat_task());
+ audit_log_format(ab, " ip=0x%lx", KSTK_EIP(current));
--- /dev/null
+From 619c5a9ad54e6bbdafd16d1cdc6c049403710540 Mon Sep 17 00:00:00 2001
+From: Hante Meuleman <meuleman@broadcom.com>
+Date: Wed, 2 Jan 2013 15:12:39 +0100
+Subject: brcmfmac: fix parsing rsn ie for ap mode.
+
+From: Hante Meuleman <meuleman@broadcom.com>
+
+commit 619c5a9ad54e6bbdafd16d1cdc6c049403710540 upstream.
+
+RSN IEs got incorrectly parsed and therefore ap mode using WPA2
+security was not working.
+
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+@@ -3730,10 +3730,11 @@ brcmf_configure_wpaie(struct net_device
+
+ len = wpa_ie->len + TLV_HDR_LEN;
+ data = (u8 *)wpa_ie;
+- offset = 0;
++ offset = TLV_HDR_LEN;
+ if (!is_rsn_ie)
+ offset += VS_IE_FIXED_HDR_LEN;
+- offset += WPA_IE_VERSION_LEN;
++ else
++ offset += WPA_IE_VERSION_LEN;
+
+ /* check for multicast cipher suite */
+ if (offset + WPA_IE_MIN_OUI_LEN > len) {
--- /dev/null
+From 92638e2facc5330475c7d558acec77721c3214e4 Mon Sep 17 00:00:00 2001
+From: Sivaram Nair <sivaramn@nvidia.com>
+Date: Tue, 18 Dec 2012 13:52:54 +0100
+Subject: cpuidle / coupled: fix ready counter decrement
+
+From: Sivaram Nair <sivaramn@nvidia.com>
+
+commit 92638e2facc5330475c7d558acec77721c3214e4 upstream.
+
+The ready_waiting_counts atomic variable is compared against the wrong
+online cpu count. The latter is computed incorrectly using logical-OR
+instead of bit-OR. This patch fixes that.
+
+Signed-off-by: Sivaram Nair <sivaramn@nvidia.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
+Acked-by: Colin Cross <ccross@android.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpuidle/coupled.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cpuidle/coupled.c
++++ b/drivers/cpuidle/coupled.c
+@@ -209,7 +209,7 @@ inline int cpuidle_coupled_set_not_ready
+ int all;
+ int ret;
+
+- all = coupled->online_count || (coupled->online_count << WAITING_BITS);
++ all = coupled->online_count | (coupled->online_count << WAITING_BITS);
+ ret = atomic_add_unless(&coupled->ready_waiting_counts,
+ -MAX_WAITING_CPUS, all);
+
--- /dev/null
+From 0602934f302e016e2ea5dc6951681bfac77455ef Mon Sep 17 00:00:00 2001
+From: Chris Verges <kg4ysn@gmail.com>
+Date: Fri, 21 Dec 2012 01:58:34 -0800
+Subject: hwmon: (lm73} Detect and report i2c bus errors
+
+From: Chris Verges <kg4ysn@gmail.com>
+
+commit 0602934f302e016e2ea5dc6951681bfac77455ef upstream.
+
+If an LM73 device does not exist on an I2C bus, attempts to communicate
+with the device result in an error code returned from the i2c read/write
+functions. The current lm73 driver casts that return value from a s32
+type to a s16 type, then converts it to a temperature in celsius.
+Because negative temperatures are valid, it is difficult to distinguish
+between an error code printed to the response buffer and a negative
+temperature recorded by the sensor.
+
+The solution is to evaluate the return value from the i2c functions
+before performing any temperature calculations. If the i2c function did
+not succeed, the error code should be passed back through the virtual
+file system layer instead of being printed into the response buffer.
+
+Before:
+
+ $ cat /sys/class/hwmon/hwmon0/device/temp1_input
+ -46
+
+After:
+
+ $ cat /sys/class/hwmon/hwmon0/device/temp1_input
+ cat: read error: No such device or address
+
+Signed-off-by: Chris Verges <kg4ysn@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/lm73.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/hwmon/lm73.c
++++ b/drivers/hwmon/lm73.c
+@@ -49,6 +49,7 @@ static ssize_t set_temp(struct device *d
+ struct i2c_client *client = to_i2c_client(dev);
+ long temp;
+ short value;
++ s32 err;
+
+ int status = kstrtol(buf, 10, &temp);
+ if (status < 0)
+@@ -57,8 +58,8 @@ static ssize_t set_temp(struct device *d
+ /* Write value */
+ value = (short) SENSORS_LIMIT(temp/250, (LM73_TEMP_MIN*4),
+ (LM73_TEMP_MAX*4)) << 5;
+- i2c_smbus_write_word_swapped(client, attr->index, value);
+- return count;
++ err = i2c_smbus_write_word_swapped(client, attr->index, value);
++ return (err < 0) ? err : count;
+ }
+
+ static ssize_t show_temp(struct device *dev, struct device_attribute *da,
+@@ -66,11 +67,16 @@ static ssize_t show_temp(struct device *
+ {
+ struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
+ struct i2c_client *client = to_i2c_client(dev);
++ int temp;
++
++ s32 err = i2c_smbus_read_word_swapped(client, attr->index);
++ if (err < 0)
++ return err;
++
+ /* use integer division instead of equivalent right shift to
+ guarantee arithmetic shift and preserve the sign */
+- int temp = ((s16) (i2c_smbus_read_word_swapped(client,
+- attr->index))*250) / 32;
+- return sprintf(buf, "%d\n", temp);
++ temp = (((s16) err) * 250) / 32;
++ return scnprintf(buf, PAGE_SIZE, "%d\n", temp);
+ }
+
+
--- /dev/null
+From 9f6d8f6ab26b42620a914d67f29822f9bba90233 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Sat, 22 Dec 2012 23:59:01 +0100
+Subject: PM: Move disabling/enabling runtime PM to late suspend/early resume
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+commit 9f6d8f6ab26b42620a914d67f29822f9bba90233 upstream.
+
+Currently, the PM core disables runtime PM for all devices right
+after executing subsystem/driver .suspend() callbacks for them
+and re-enables it right before executing subsystem/driver .resume()
+callbacks for them. This may lead to problems when there are
+two devices such that the .suspend() callback executed for one of
+them depends on runtime PM working for the other. In that case,
+if runtime PM has already been disabled for the second device,
+the first one's .suspend() won't work correctly (and analogously
+for resume).
+
+To make those issues go away, make the PM core disable runtime PM
+for devices right before executing subsystem/driver .suspend_late()
+callbacks for them and enable runtime PM for them right after
+executing subsystem/driver .resume_early() callbacks for them. This
+way the potential conflitcs between .suspend_late()/.resume_early()
+and their runtime PM counterparts are still prevented from happening,
+but the subtle ordering issues related to disabling/enabling runtime
+PM for devices during system suspend/resume are much easier to avoid.
+
+Reported-and-tested-by: Jan-Matthias Braun <jan_braun@gmx.net>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Kevin Hilman <khilman@deeprootsystems.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/power/runtime_pm.txt | 9 +++++----
+ drivers/base/power/main.c | 9 ++++-----
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+--- a/Documentation/power/runtime_pm.txt
++++ b/Documentation/power/runtime_pm.txt
+@@ -642,12 +642,13 @@ out the following operations:
+ * During system suspend it calls pm_runtime_get_noresume() and
+ pm_runtime_barrier() for every device right before executing the
+ subsystem-level .suspend() callback for it. In addition to that it calls
+- pm_runtime_disable() for every device right after executing the
+- subsystem-level .suspend() callback for it.
++ __pm_runtime_disable() with 'false' as the second argument for every device
++ right before executing the subsystem-level .suspend_late() callback for it.
+
+ * During system resume it calls pm_runtime_enable() and pm_runtime_put_sync()
+- for every device right before and right after executing the subsystem-level
+- .resume() callback for it, respectively.
++ for every device right after executing the subsystem-level .resume_early()
++ callback and right after executing the subsystem-level .resume() callback
++ for it, respectively.
+
+ 7. Generic subsystem callbacks
+
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -513,6 +513,8 @@ static int device_resume_early(struct de
+
+ Out:
+ TRACE_RESUME(error);
++
++ pm_runtime_enable(dev);
+ return error;
+ }
+
+@@ -589,8 +591,6 @@ static int device_resume(struct device *
+ if (!dev->power.is_suspended)
+ goto Unlock;
+
+- pm_runtime_enable(dev);
+-
+ if (dev->pm_domain) {
+ info = "power domain ";
+ callback = pm_op(&dev->pm_domain->ops, state);
+@@ -930,6 +930,8 @@ static int device_suspend_late(struct de
+ pm_callback_t callback = NULL;
+ char *info = NULL;
+
++ __pm_runtime_disable(dev, false);
++
+ if (dev->power.syscore)
+ return 0;
+
+@@ -1133,11 +1135,8 @@ static int __device_suspend(struct devic
+
+ Complete:
+ complete_all(&dev->power.completion);
+-
+ if (error)
+ async_error = error;
+- else if (dev->power.is_suspended)
+- __pm_runtime_disable(dev, false);
+
+ return error;
+ }
--- /dev/null
+From e04c200f1f2de8eaa2f5af6d97e7e213a1abb424 Mon Sep 17 00:00:00 2001
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Wed, 5 Dec 2012 16:08:33 -0600
+Subject: samsung-laptop: Add quirk for broken acpi_video backlight on N250P
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+commit e04c200f1f2de8eaa2f5af6d97e7e213a1abb424 upstream.
+
+BugLink: http://bugs.launchpad.net/bugs/1086921
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/samsung-laptop.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -1523,6 +1523,16 @@ static struct dmi_system_id __initdata s
+ },
+ .driver_data = &samsung_broken_acpi_video,
+ },
++ {
++ .callback = samsung_dmi_matched,
++ .ident = "N250P",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "N250P"),
++ DMI_MATCH(DMI_BOARD_NAME, "N250P"),
++ },
++ .driver_data = &samsung_broken_acpi_video,
++ },
+ { },
+ };
+ MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
dm-persistent-data-rename-node-to-btree_node.patch
dm-ioctl-prevent-unsafe-change-to-dm_ioctl-data_size.patch
dm-thin-replace-dm_cell_release_singleton-with-cell_defer_except.patch
+staging-vt6656-out-of-bound-array-reference-in-rfbsetpower.patch
+staging-vt6656-64-bit-fixes-use-u32-for-qword-definition.patch
+staging-vt6656-64-bit-fixes-correct-all-type-sizes.patch
+staging-vt6656-64-bit-fixes-fix-long-warning-messages.patch
+staging-vt6656-64bit-fixes-key.c-h-change-unsigned-long-to-u32.patch
+staging-vt6656-64bit-fixes-vcommandtimerwait-change-calculation-of-timer.patch
+hwmon-lm73-detect-and-report-i2c-bus-errors.patch
+audit-create-explicit-audit_seccomp-event-type.patch
+xen-netfront-improve-truesize-tracking.patch
+cpuidle-coupled-fix-ready-counter-decrement.patch
+brcmfmac-fix-parsing-rsn-ie-for-ap-mode.patch
+video-mxsfb-fix-crash-when-unblanking-the-display.patch
+samsung-laptop-add-quirk-for-broken-acpi_video-backlight-on-n250p.patch
+pm-move-disabling-enabling-runtime-pm-to-late-suspend-early-resume.patch
--- /dev/null
+From 7730492855a2f9c828599bcd8d62760f96d319e4 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 11 Nov 2012 15:41:25 +0000
+Subject: staging: vt6656: 64 bit fixes : correct all type sizes
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 7730492855a2f9c828599bcd8d62760f96d319e4 upstream.
+
+After this patch all BYTE/WORD/DWORD types can be replaced with the appropriate u sizes.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/ttype.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/vt6656/ttype.h
++++ b/drivers/staging/vt6656/ttype.h
+@@ -44,9 +44,9 @@ typedef int BOOL;
+
+ /****** Simple typedefs ***************************************************/
+
+-typedef unsigned char BYTE; // 8-bit
+-typedef unsigned short WORD; // 16-bit
+-typedef unsigned long DWORD; // 32-bit
++typedef u8 BYTE;
++typedef u16 WORD;
++typedef u32 DWORD;
+
+ // QWORD is for those situation that we want
+ // an 8-byte-aligned 8 byte long structure
+@@ -62,8 +62,8 @@ typedef UQuadWord QWORD;
+
+ /****** Common pointer types ***********************************************/
+
+-typedef unsigned long ULONG_PTR; // 32-bit
+-typedef unsigned long DWORD_PTR; // 32-bit
++typedef u32 ULONG_PTR;
++typedef u32 DWORD_PTR;
+
+ // boolean pointer
+
--- /dev/null
+From b4dc03af5513774277c9c36b12a25cd3f25f4404 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 11 Nov 2012 15:45:52 +0000
+Subject: staging: vt6656: 64 bit fixes: fix long warning messages.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit b4dc03af5513774277c9c36b12a25cd3f25f4404 upstream.
+
+Fixes long warning messages from patch
+[PATCH 08/14] staging: vt6656: 64 bit fixes : correct all type sizes
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/dpc.c | 4 +--
+ drivers/staging/vt6656/key.c | 47 +++++++++++++++++++++++++++++-------------
+ drivers/staging/vt6656/mac.c | 6 +++--
+ drivers/staging/vt6656/rxtx.c | 18 ++++++++++------
+ 4 files changed, 51 insertions(+), 24 deletions(-)
+
+--- a/drivers/staging/vt6656/dpc.c
++++ b/drivers/staging/vt6656/dpc.c
+@@ -1238,7 +1238,7 @@ static BOOL s_bHandleRxEncryption (
+
+ PayloadLen -= (WLAN_HDR_ADDR3_LEN + 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc
+ *pdwRxTSC47_16 = cpu_to_le32(*(PDWORD)(pbyIV + 4));
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %lx\n",*pdwRxTSC47_16);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %x\n", *pdwRxTSC47_16);
+ if (byDecMode == KEY_CTL_TKIP) {
+ *pwRxTSC15_0 = cpu_to_le16(MAKEWORD(*(pbyIV+2), *pbyIV));
+ } else {
+@@ -1349,7 +1349,7 @@ static BOOL s_bHostWepRxEncryption (
+
+ PayloadLen -= (WLAN_HDR_ADDR3_LEN + 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc
+ *pdwRxTSC47_16 = cpu_to_le32(*(PDWORD)(pbyIV + 4));
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %lx\n",*pdwRxTSC47_16);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %x\n", *pdwRxTSC47_16);
+
+ if (byDecMode == KEY_CTL_TKIP) {
+ *pwRxTSC15_0 = cpu_to_le16(MAKEWORD(*(pbyIV+2), *pbyIV));
+--- a/drivers/staging/vt6656/key.c
++++ b/drivers/staging/vt6656/key.c
+@@ -235,7 +235,8 @@ BOOL KeybSetKey(
+ PSKeyItem pKey;
+ unsigned int uKeyIdx;
+
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Enter KeybSetKey: %lX\n", dwKeyIndex);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
++ "Enter KeybSetKey: %X\n", dwKeyIndex);
+
+ j = (MAX_KEY_TABLE-1);
+ for (i=0;i<(MAX_KEY_TABLE-1);i++) {
+@@ -261,7 +262,9 @@ BOOL KeybSetKey(
+ if ((dwKeyIndex & TRANSMIT_KEY) != 0) {
+ // Group transmit key
+ pTable->KeyTable[i].dwGTKeyIndex = dwKeyIndex;
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Group transmit key(R)[%lX]: %d\n", pTable->KeyTable[i].dwGTKeyIndex, i);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
++ "Group transmit key(R)[%X]: %d\n",
++ pTable->KeyTable[i].dwGTKeyIndex, i);
+ }
+ pTable->KeyTable[i].wKeyCtl &= 0xFF0F; // clear group key control filed
+ pTable->KeyTable[i].wKeyCtl |= (byKeyDecMode << 4);
+@@ -302,9 +305,12 @@ BOOL KeybSetKey(
+ }
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\n");
+
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %lx\n ", pKey->dwTSC47_16);
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->wTSC15_0: %x\n ", pKey->wTSC15_0);
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %lx\n ", pKey->dwKeyIndex);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %x\n ",
++ pKey->dwTSC47_16);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->wTSC15_0: %x\n ",
++ pKey->wTSC15_0);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %x\n ",
++ pKey->dwKeyIndex);
+
+ return (TRUE);
+ }
+@@ -326,7 +332,9 @@ BOOL KeybSetKey(
+ if ((dwKeyIndex & TRANSMIT_KEY) != 0) {
+ // Group transmit key
+ pTable->KeyTable[j].dwGTKeyIndex = dwKeyIndex;
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Group transmit key(N)[%lX]: %d\n", pTable->KeyTable[j].dwGTKeyIndex, j);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
++ "Group transmit key(N)[%X]: %d\n",
++ pTable->KeyTable[j].dwGTKeyIndex, j);
+ }
+ pTable->KeyTable[j].wKeyCtl &= 0xFF0F; // clear group key control filed
+ pTable->KeyTable[j].wKeyCtl |= (byKeyDecMode << 4);
+@@ -367,9 +375,11 @@ BOOL KeybSetKey(
+ }
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\n");
+
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %lx\n ", pKey->dwTSC47_16);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %x\n ",
++ pKey->dwTSC47_16);
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->wTSC15_0: %x\n ", pKey->wTSC15_0);
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %lx\n ", pKey->dwKeyIndex);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %x\n ",
++ pKey->dwKeyIndex);
+
+ return (TRUE);
+ }
+@@ -597,7 +607,8 @@ BOOL KeybGetTransmitKey(PSKeyManagement
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"%x ", pTable->KeyTable[i].abyBSSID[ii]);
+ }
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\n");
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"dwGTKeyIndex: %lX\n", pTable->KeyTable[i].dwGTKeyIndex);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"dwGTKeyIndex: %X\n",
++ pTable->KeyTable[i].dwGTKeyIndex);
+
+ return (TRUE);
+ }
+@@ -696,7 +707,10 @@ BOOL KeybSetDefaultKey(
+ if ((dwKeyIndex & TRANSMIT_KEY) != 0) {
+ // Group transmit key
+ pTable->KeyTable[MAX_KEY_TABLE-1].dwGTKeyIndex = dwKeyIndex;
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Group transmit key(R)[%lX]: %d\n", pTable->KeyTable[MAX_KEY_TABLE-1].dwGTKeyIndex, MAX_KEY_TABLE-1);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
++ "Group transmit key(R)[%X]: %d\n",
++ pTable->KeyTable[MAX_KEY_TABLE-1].dwGTKeyIndex,
++ MAX_KEY_TABLE-1);
+
+ }
+ pTable->KeyTable[MAX_KEY_TABLE-1].wKeyCtl &= 0x7F00; // clear all key control filed
+@@ -747,9 +761,11 @@ BOOL KeybSetDefaultKey(
+ }
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\n");
+
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %lx\n", pKey->dwTSC47_16);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwTSC47_16: %x\n",
++ pKey->dwTSC47_16);
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->wTSC15_0: %x\n", pKey->wTSC15_0);
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %lx\n", pKey->dwKeyIndex);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey->dwKeyIndex: %x\n",
++ pKey->dwKeyIndex);
+
+ return (TRUE);
+ }
+@@ -787,7 +803,8 @@ BOOL KeybSetAllGroupKey(
+ PSKeyItem pKey;
+ unsigned int uKeyIdx;
+
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Enter KeybSetAllGroupKey: %lX\n", dwKeyIndex);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Enter KeybSetAllGroupKey: %X\n",
++ dwKeyIndex);
+
+
+ if ((dwKeyIndex & PAIRWISE_KEY) != 0) { // Pairwise key
+@@ -804,7 +821,9 @@ BOOL KeybSetAllGroupKey(
+ if ((dwKeyIndex & TRANSMIT_KEY) != 0) {
+ // Group transmit key
+ pTable->KeyTable[i].dwGTKeyIndex = dwKeyIndex;
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Group transmit key(R)[%lX]: %d\n", pTable->KeyTable[i].dwGTKeyIndex, i);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO
++ "Group transmit key(R)[%X]: %d\n",
++ pTable->KeyTable[i].dwGTKeyIndex, i);
+
+ }
+ pTable->KeyTable[i].wKeyCtl &= 0xFF0F; // clear group key control filed
+--- a/drivers/staging/vt6656/mac.c
++++ b/drivers/staging/vt6656/mac.c
+@@ -260,7 +260,8 @@ BYTE pbyData[24];
+ dwData1 <<= 16;
+ dwData1 |= MAKEWORD(*(pbyAddr+4), *(pbyAddr+5));
+
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"1. wOffset: %d, Data: %lX, KeyCtl:%X\n", wOffset, dwData1, wKeyCtl);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"1. wOffset: %d, Data: %X,"\
++ " KeyCtl:%X\n", wOffset, dwData1, wKeyCtl);
+
+ //VNSvOutPortW(dwIoBase + MAC_REG_MISCFFNDEX, wOffset);
+ //VNSvOutPortD(dwIoBase + MAC_REG_MISCFFDATA, dwData);
+@@ -277,7 +278,8 @@ BYTE pbyData[24];
+ dwData2 <<= 8;
+ dwData2 |= *(pbyAddr+0);
+
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"2. wOffset: %d, Data: %lX\n", wOffset, dwData2);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"2. wOffset: %d, Data: %X\n",
++ wOffset, dwData2);
+
+ //VNSvOutPortW(dwIoBase + MAC_REG_MISCFFNDEX, wOffset);
+ //VNSvOutPortD(dwIoBase + MAC_REG_MISCFFDATA, dwData);
+--- a/drivers/staging/vt6656/rxtx.c
++++ b/drivers/staging/vt6656/rxtx.c
+@@ -375,7 +375,8 @@ s_vFillTxKey (
+ *(pbyIVHead+3) = (BYTE)(((pDevice->byKeyIndex << 6) & 0xc0) | 0x20); // 0x20 is ExtIV
+ // Append IV&ExtIV after Mac Header
+ *pdwExtIV = cpu_to_le32(pTransmitKey->dwTSC47_16);
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"vFillTxKey()---- pdwExtIV: %lx\n", *pdwExtIV);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"vFillTxKey()---- pdwExtIV: %x\n",
++ *pdwExtIV);
+
+ } else if (pTransmitKey->byCipherSuite == KEY_CTL_CCMP) {
+ pTransmitKey->wTSC15_0++;
+@@ -1751,7 +1752,8 @@ s_bPacketToWirelessUsb(
+ MIC_vAppend((PBYTE)&(psEthHeader->abyDstAddr[0]), 12);
+ dwMIC_Priority = 0;
+ MIC_vAppend((PBYTE)&dwMIC_Priority, 4);
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC KEY: %lX, %lX\n", dwMICKey0, dwMICKey1);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC KEY: %X, %X\n",
++ dwMICKey0, dwMICKey1);
+
+ ///////////////////////////////////////////////////////////////////
+
+@@ -2633,7 +2635,8 @@ vDMA0_tx_80211(PSDevice pDevice, struct
+ MIC_vAppend((PBYTE)&(sEthHeader.abyDstAddr[0]), 12);
+ dwMIC_Priority = 0;
+ MIC_vAppend((PBYTE)&dwMIC_Priority, 4);
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"DMA0_tx_8021:MIC KEY: %lX, %lX\n", dwMICKey0, dwMICKey1);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"DMA0_tx_8021:MIC KEY:"\
++ " %X, %X\n", dwMICKey0, dwMICKey1);
+
+ uLength = cbHeaderSize + cbMacHdLen + uPadding + cbIVlen;
+
+@@ -2653,7 +2656,8 @@ vDMA0_tx_80211(PSDevice pDevice, struct
+
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"uLength: %d, %d\n", uLength, cbFrameBodySize);
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"cbReqCount:%d, %d, %d, %d\n", cbReqCount, cbHeaderSize, uPadding, cbIVlen);
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC:%lx, %lx\n", *pdwMIC_L, *pdwMIC_R);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC:%x, %x\n",
++ *pdwMIC_L, *pdwMIC_R);
+
+ }
+
+@@ -3027,7 +3031,8 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"error: KEY is GTK!!~~\n");
+ }
+ else {
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Find PTK [%lX]\n", pTransmitKey->dwKeyIndex);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Find PTK [%X]\n",
++ pTransmitKey->dwKeyIndex);
+ bNeedEncryption = TRUE;
+ }
+ }
+@@ -3041,7 +3046,8 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+ if (pDevice->bEnableHostWEP) {
+ if ((uNodeIndex != 0) &&
+ (pMgmt->sNodeDBTable[uNodeIndex].dwKeyIndex & PAIRWISE_KEY)) {
+- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Find PTK [%lX]\n", pTransmitKey->dwKeyIndex);
++ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Find PTK [%X]\n",
++ pTransmitKey->dwKeyIndex);
+ bNeedEncryption = TRUE;
+ }
+ }
--- /dev/null
+From a552397d5e4ef0cc0bd3e9595d6acc9a3b381171 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 11 Nov 2012 15:32:05 +0000
+Subject: staging: vt6656: 64 bit fixes: use u32 for QWORD definition.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit a552397d5e4ef0cc0bd3e9595d6acc9a3b381171 upstream.
+
+Size of long issues replace with u32.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/ttype.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vt6656/ttype.h
++++ b/drivers/staging/vt6656/ttype.h
+@@ -29,6 +29,8 @@
+ #ifndef __TTYPE_H__
+ #define __TTYPE_H__
+
++#include <linux/types.h>
++
+ /******* Common definitions and typedefs ***********************************/
+
+ typedef int BOOL;
+@@ -51,8 +53,8 @@ typedef unsigned long DWORD;
+ // which is NOT really a floating point number.
+ typedef union tagUQuadWord {
+ struct {
+- DWORD dwLowDword;
+- DWORD dwHighDword;
++ u32 dwLowDword;
++ u32 dwHighDword;
+ } u;
+ double DoNotUseThisField;
+ } UQuadWord;
--- /dev/null
+From c0d05b305b00c698b0a8c1b3d46c9380bce9db45 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 11 Nov 2012 15:49:59 +0000
+Subject: staging: vt6656: 64bit fixes: key.c/h change unsigned long to u32
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit c0d05b305b00c698b0a8c1b3d46c9380bce9db45 upstream.
+
+Fixes long issues.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/key.c | 6 +++---
+ drivers/staging/vt6656/key.h | 8 ++++----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/staging/vt6656/key.c
++++ b/drivers/staging/vt6656/key.c
+@@ -223,7 +223,7 @@ BOOL KeybSetKey(
+ PSKeyManagement pTable,
+ PBYTE pbyBSSID,
+ DWORD dwKeyIndex,
+- unsigned long uKeyLength,
++ u32 uKeyLength,
+ PQWORD pKeyRSC,
+ PBYTE pbyKey,
+ BYTE byKeyDecMode
+@@ -675,7 +675,7 @@ BOOL KeybSetDefaultKey(
+ void *pDeviceHandler,
+ PSKeyManagement pTable,
+ DWORD dwKeyIndex,
+- unsigned long uKeyLength,
++ u32 uKeyLength,
+ PQWORD pKeyRSC,
+ PBYTE pbyKey,
+ BYTE byKeyDecMode
+@@ -791,7 +791,7 @@ BOOL KeybSetAllGroupKey(
+ void *pDeviceHandler,
+ PSKeyManagement pTable,
+ DWORD dwKeyIndex,
+- unsigned long uKeyLength,
++ u32 uKeyLength,
+ PQWORD pKeyRSC,
+ PBYTE pbyKey,
+ BYTE byKeyDecMode
+--- a/drivers/staging/vt6656/key.h
++++ b/drivers/staging/vt6656/key.h
+@@ -58,7 +58,7 @@
+ typedef struct tagSKeyItem
+ {
+ BOOL bKeyValid;
+- unsigned long uKeyLength;
++ u32 uKeyLength;
+ BYTE abyKey[MAX_KEY_LEN];
+ QWORD KeyRSC;
+ DWORD dwTSC47_16;
+@@ -107,7 +107,7 @@ BOOL KeybSetKey(
+ PSKeyManagement pTable,
+ PBYTE pbyBSSID,
+ DWORD dwKeyIndex,
+- unsigned long uKeyLength,
++ u32 uKeyLength,
+ PQWORD pKeyRSC,
+ PBYTE pbyKey,
+ BYTE byKeyDecMode
+@@ -146,7 +146,7 @@ BOOL KeybSetDefaultKey(
+ void *pDeviceHandler,
+ PSKeyManagement pTable,
+ DWORD dwKeyIndex,
+- unsigned long uKeyLength,
++ u32 uKeyLength,
+ PQWORD pKeyRSC,
+ PBYTE pbyKey,
+ BYTE byKeyDecMode
+@@ -156,7 +156,7 @@ BOOL KeybSetAllGroupKey(
+ void *pDeviceHandler,
+ PSKeyManagement pTable,
+ DWORD dwKeyIndex,
+- unsigned long uKeyLength,
++ u32 uKeyLength,
+ PQWORD pKeyRSC,
+ PBYTE pbyKey,
+ BYTE byKeyDecMode
--- /dev/null
+From 70e227790d4ee4590023d8041a3485f8053593fc Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 11 Nov 2012 16:07:57 +0000
+Subject: staging: vt6656: 64bit fixes: vCommandTimerWait change calculation of timer.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 70e227790d4ee4590023d8041a3485f8053593fc upstream.
+
+The timer appears to run too fast/race on 64 bit systems.
+
+Using msecs_to_jiffies seems to cause a deadlock on 64 bit.
+
+A calculation of (MSecond * HZ) / 1000 appears to run satisfactory.
+
+Change BSSIDInfoCount to u32.
+
+After this patch the driver can be successfully connect on little endian 64/32 bit systems.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/wcmd.c | 20 +++++++++++---------
+ drivers/staging/vt6656/wpa2.h | 4 ++--
+ 2 files changed, 13 insertions(+), 11 deletions(-)
+
+--- a/drivers/staging/vt6656/wcmd.c
++++ b/drivers/staging/vt6656/wcmd.c
+@@ -316,17 +316,19 @@ s_MgrMakeProbeRequest(
+ return pTxPacket;
+ }
+
+-void vCommandTimerWait(void *hDeviceContext, unsigned int MSecond)
++void vCommandTimerWait(void *hDeviceContext, unsigned long MSecond)
+ {
+- PSDevice pDevice = (PSDevice)hDeviceContext;
++ PSDevice pDevice = (PSDevice)hDeviceContext;
+
+- init_timer(&pDevice->sTimerCommand);
+- pDevice->sTimerCommand.data = (unsigned long)pDevice;
+- pDevice->sTimerCommand.function = (TimerFunction)vRunCommand;
+- // RUN_AT :1 msec ~= (HZ/1024)
+- pDevice->sTimerCommand.expires = (unsigned int)RUN_AT((MSecond * HZ) >> 10);
+- add_timer(&pDevice->sTimerCommand);
+- return;
++ init_timer(&pDevice->sTimerCommand);
++
++ pDevice->sTimerCommand.data = (unsigned long)pDevice;
++ pDevice->sTimerCommand.function = (TimerFunction)vRunCommand;
++ pDevice->sTimerCommand.expires = RUN_AT((MSecond * HZ) / 1000);
++
++ add_timer(&pDevice->sTimerCommand);
++
++ return;
+ }
+
+ void vRunCommand(void *hDeviceContext)
+--- a/drivers/staging/vt6656/wpa2.h
++++ b/drivers/staging/vt6656/wpa2.h
+@@ -45,8 +45,8 @@ typedef struct tagsPMKIDInfo {
+ } PMKIDInfo, *PPMKIDInfo;
+
+ typedef struct tagSPMKIDCache {
+- unsigned long BSSIDInfoCount;
+- PMKIDInfo BSSIDInfo[MAX_PMKID_CACHE];
++ u32 BSSIDInfoCount;
++ PMKIDInfo BSSIDInfo[MAX_PMKID_CACHE];
+ } SPMKIDCache, *PSPMKIDCache;
+
+
--- /dev/null
+From ab1dd9963137a1e122004d5378a581bf16ae9bc8 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 7 Oct 2012 08:27:00 +0100
+Subject: staging: vt6656: [BUG] out of bound array reference in RFbSetPower.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit ab1dd9963137a1e122004d5378a581bf16ae9bc8 upstream.
+
+Calling RFbSetPower with uCH zero value will cause out of bound array reference.
+
+This causes 64 bit kernels to oops on boot.
+
+Note: Driver does not function on 64 bit kernels and should be
+blacklisted on them.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/rf.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/vt6656/rf.c
++++ b/drivers/staging/vt6656/rf.c
+@@ -769,6 +769,9 @@ BYTE byPwr = pDevice->byCCKPwr;
+ return TRUE;
+ }
+
++ if (uCH == 0)
++ return -EINVAL;
++
+ switch (uRATE) {
+ case RATE_1M:
+ case RATE_2M:
--- /dev/null
+From 6c1ecba8d84841277d68140ef485335d5be28485 Mon Sep 17 00:00:00 2001
+From: Lothar Waßmann <LW@KARO-electronics.de>
+Date: Thu, 22 Nov 2012 13:49:14 +0100
+Subject: video: mxsfb: fix crash when unblanking the display
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lothar Waßmann <LW@KARO-electronics.de>
+
+commit 6c1ecba8d84841277d68140ef485335d5be28485 upstream.
+
+The VDCTRL4 register does not provide the MXS SET/CLR/TOGGLE feature.
+The write in mxsfb_disable_controller() sets the data_cnt for the LCD
+DMA to 0 which obviously means the max. count for the LCD DMA and
+leads to overwriting arbitrary memory when the display is unblanked.
+
+Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
+Acked-by: Juergen Beisert <jbe@pengutronix.de>
+Tested-by: Lauri Hintsala <lauri.hintsala@bluegiga.net>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/mxsfb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/mxsfb.c
++++ b/drivers/video/mxsfb.c
+@@ -369,7 +369,8 @@ static void mxsfb_disable_controller(str
+ loop--;
+ }
+
+- writel(VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4 + REG_CLR);
++ reg = readl(host->base + LCDC_VDCTRL4);
++ writel(reg & ~VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4);
+
+ clk_disable_unprepare(host->clk);
+
--- /dev/null
+From d9a58a782e396a0f04e8445b7ba3763c8a48c7fe Mon Sep 17 00:00:00 2001
+From: Ian Campbell <Ian.Campbell@citrix.com>
+Date: Mon, 7 Jan 2013 05:32:06 +0000
+Subject: xen/netfront: improve truesize tracking
+
+From: Ian Campbell <Ian.Campbell@citrix.com>
+
+commit d9a58a782e396a0f04e8445b7ba3763c8a48c7fe upstream.
+
+Using RX_COPY_THRESHOLD is incorrect if the SKB is actually smaller
+than that. We have already accounted for this in
+NETFRONT_SKB_CB(skb)->pull_to so use that instead.
+
+Fixes WARN_ON from skb_try_coalesce.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Cc: Sander Eikelenboom <linux@eikelenboom.it>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: annie li <annie.li@oracle.com>
+Cc: xen-devel@lists.xen.org
+Cc: netdev@vger.kernel.org
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/xen-netfront.c | 27 ++++-----------------------
+ 1 file changed, 4 insertions(+), 23 deletions(-)
+
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1015,29 +1015,10 @@ err:
+ i = xennet_fill_frags(np, skb, &tmpq);
+
+ /*
+- * Truesize approximates the size of true data plus
+- * any supervisor overheads. Adding hypervisor
+- * overheads has been shown to significantly reduce
+- * achievable bandwidth with the default receive
+- * buffer size. It is therefore not wise to account
+- * for it here.
+- *
+- * After alloc_skb(RX_COPY_THRESHOLD), truesize is set
+- * to RX_COPY_THRESHOLD + the supervisor
+- * overheads. Here, we add the size of the data pulled
+- * in xennet_fill_frags().
+- *
+- * We also adjust for any unused space in the main
+- * data area by subtracting (RX_COPY_THRESHOLD -
+- * len). This is especially important with drivers
+- * which split incoming packets into header and data,
+- * using only 66 bytes of the main data area (see the
+- * e1000 driver for example.) On such systems,
+- * without this last adjustement, our achievable
+- * receive throughout using the standard receive
+- * buffer size was cut by 25%(!!!).
+- */
+- skb->truesize += skb->data_len - RX_COPY_THRESHOLD;
++ * Truesize is the actual allocation size, even if the
++ * allocation is only partially used.
++ */
++ skb->truesize += PAGE_SIZE * skb_shinfo(skb)->nr_frags;
+ skb->len += skb->data_len;
+
+ if (rx->flags & XEN_NETRXF_csum_blank)
projects / thirdparty / kernel / stable-queue.git / commitdiff
