--- /dev/null
+From 5e20a4b53094651d80f856ff55a916b999dbb57a Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Thu, 20 Dec 2012 15:55:01 -0600
+Subject: b43: Fix firmware loading when driver is built into the kernel
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 5e20a4b53094651d80f856ff55a916b999dbb57a upstream.
+
+Recent versions of udev cause synchronous firmware loading from the
+probe routine to fail because the request to user space would time
+out. The original fix for b43 (commit 6b6fa58) moved the firmware
+load from the probe routine to a work queue, but it still used synchronous
+firmware loading. This method is OK when b43 is built as a module;
+however, it fails when the driver is compiled into the kernel.
+
+This version changes the code to load the initial firmware file
+using request_firmware_nowait(). A completion event is used to
+hold the work queue until that file is available. This driver
+reads several firmware files - the remainder can be read synchronously.
+On some test systems, the async read fails; however, a following synch
+read works, thus the async failure falls through to the sync try.
+
+Reported-and-Tested by: Felix Janda <felix.janda@posteo.de>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/b43.h | 5 +++
+ drivers/net/wireless/b43/main.c | 54 ++++++++++++++++++++++++++++++----------
+ drivers/net/wireless/b43/main.h | 5 +--
+ 3 files changed, 48 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/wireless/b43/b43.h
++++ b/drivers/net/wireless/b43/b43.h
+@@ -7,6 +7,7 @@
+ #include <linux/hw_random.h>
+ #include <linux/bcma/bcma.h>
+ #include <linux/ssb/ssb.h>
++#include <linux/completion.h>
+ #include <net/mac80211.h>
+
+ #include "debugfs.h"
+@@ -718,6 +719,10 @@ enum b43_firmware_file_type {
+ struct b43_request_fw_context {
+ /* The device we are requesting the fw for. */
+ struct b43_wldev *dev;
++ /* a completion event structure needed if this call is asynchronous */
++ struct completion fw_load_complete;
++ /* a pointer to the firmware object */
++ const struct firmware *blob;
+ /* The type of firmware to request. */
+ enum b43_firmware_file_type req_type;
+ /* Error messages for each firmware type. */
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -2088,11 +2088,18 @@ static void b43_print_fw_helptext(struct
+ b43warn(wl, text);
+ }
+
++static void b43_fw_cb(const struct firmware *firmware, void *context)
++{
++ struct b43_request_fw_context *ctx = context;
++
++ ctx->blob = firmware;
++ complete(&ctx->fw_load_complete);
++}
++
+ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+ const char *name,
+- struct b43_firmware_file *fw)
++ struct b43_firmware_file *fw, bool async)
+ {
+- const struct firmware *blob;
+ struct b43_fw_header *hdr;
+ u32 size;
+ int err;
+@@ -2131,11 +2138,31 @@ int b43_do_request_fw(struct b43_request
+ B43_WARN_ON(1);
+ return -ENOSYS;
+ }
+- err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
++ if (async) {
++ /* do this part asynchronously */
++ init_completion(&ctx->fw_load_complete);
++ err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
++ ctx->dev->dev->dev, GFP_KERNEL,
++ ctx, b43_fw_cb);
++ if (err < 0) {
++ pr_err("Unable to load firmware\n");
++ return err;
++ }
++ /* stall here until fw ready */
++ wait_for_completion(&ctx->fw_load_complete);
++ if (ctx->blob)
++ goto fw_ready;
++ /* On some ARM systems, the async request will fail, but the next sync
++ * request works. For this reason, we dall through here
++ */
++ }
++ err = request_firmware(&ctx->blob, ctx->fwname,
++ ctx->dev->dev->dev);
+ if (err == -ENOENT) {
+ snprintf(ctx->errors[ctx->req_type],
+ sizeof(ctx->errors[ctx->req_type]),
+- "Firmware file \"%s\" not found\n", ctx->fwname);
++ "Firmware file \"%s\" not found\n",
++ ctx->fwname);
+ return err;
+ } else if (err) {
+ snprintf(ctx->errors[ctx->req_type],
+@@ -2144,14 +2171,15 @@ int b43_do_request_fw(struct b43_request
+ ctx->fwname, err);
+ return err;
+ }
+- if (blob->size < sizeof(struct b43_fw_header))
++fw_ready:
++ if (ctx->blob->size < sizeof(struct b43_fw_header))
+ goto err_format;
+- hdr = (struct b43_fw_header *)(blob->data);
++ hdr = (struct b43_fw_header *)(ctx->blob->data);
+ switch (hdr->type) {
+ case B43_FW_TYPE_UCODE:
+ case B43_FW_TYPE_PCM:
+ size = be32_to_cpu(hdr->size);
+- if (size != blob->size - sizeof(struct b43_fw_header))
++ if (size != ctx->blob->size - sizeof(struct b43_fw_header))
+ goto err_format;
+ /* fallthrough */
+ case B43_FW_TYPE_IV:
+@@ -2162,7 +2190,7 @@ int b43_do_request_fw(struct b43_request
+ goto err_format;
+ }
+
+- fw->data = blob;
++ fw->data = ctx->blob;
+ fw->filename = name;
+ fw->type = ctx->req_type;
+
+@@ -2172,7 +2200,7 @@ err_format:
+ snprintf(ctx->errors[ctx->req_type],
+ sizeof(ctx->errors[ctx->req_type]),
+ "Firmware file \"%s\" format error.\n", ctx->fwname);
+- release_firmware(blob);
++ release_firmware(ctx->blob);
+
+ return -EPROTO;
+ }
+@@ -2223,7 +2251,7 @@ static int b43_try_request_fw(struct b43
+ goto err_no_ucode;
+ }
+ }
+- err = b43_do_request_fw(ctx, filename, &fw->ucode);
++ err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
+ if (err)
+ goto err_load;
+
+@@ -2235,7 +2263,7 @@ static int b43_try_request_fw(struct b43
+ else
+ goto err_no_pcm;
+ fw->pcm_request_failed = false;
+- err = b43_do_request_fw(ctx, filename, &fw->pcm);
++ err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
+ if (err == -ENOENT) {
+ /* We did not find a PCM file? Not fatal, but
+ * core rev <= 10 must do without hwcrypto then. */
+@@ -2296,7 +2324,7 @@ static int b43_try_request_fw(struct b43
+ default:
+ goto err_no_initvals;
+ }
+- err = b43_do_request_fw(ctx, filename, &fw->initvals);
++ err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
+ if (err)
+ goto err_load;
+
+@@ -2355,7 +2383,7 @@ static int b43_try_request_fw(struct b43
+ default:
+ goto err_no_initvals;
+ }
+- err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
++ err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
+ if (err)
+ goto err_load;
+
+--- a/drivers/net/wireless/b43/main.h
++++ b/drivers/net/wireless/b43/main.h
+@@ -137,9 +137,8 @@ void b43_mac_phy_clock_set(struct b43_wl
+
+
+ struct b43_request_fw_context;
+-int b43_do_request_fw(struct b43_request_fw_context *ctx,
+- const char *name,
+- struct b43_firmware_file *fw);
++int b43_do_request_fw(struct b43_request_fw_context *ctx, const char *name,
++ struct b43_firmware_file *fw, bool async);
+ void b43_do_release_fw(struct b43_firmware_file *fw);
+
+ #endif /* B43_MAIN_H_ */
--- /dev/null
+From 34bcf71502413f8903ade93746f2d0f04b937a78 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 11 Dec 2012 10:48:23 +0100
+Subject: mac80211: fix ibss scanning
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 34bcf71502413f8903ade93746f2d0f04b937a78 upstream.
+
+Do not scan on no-IBSS and disabled channels in IBSS mode. Doing this
+can trigger Microcode errors on iwlwifi and iwlegacy drivers.
+
+Also rename ieee80211_request_internal_scan() function since it is only
+used in IBSS mode and simplify calling it from ieee80211_sta_find_ibss().
+
+This patch should address:
+https://bugzilla.redhat.com/show_bug.cgi?id=883414
+https://bugzilla.kernel.org/show_bug.cgi?id=49411
+
+Reported-by: Jesse Kahtava <jesse_kahtava@f-m.fm>
+Reported-by: Mikko Rapeli <mikko.rapeli@iki.fi>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/ibss.c | 9 ++++-----
+ net/mac80211/ieee80211_i.h | 6 +++---
+ net/mac80211/scan.c | 34 ++++++++++++++++++++++++----------
+ 3 files changed, 31 insertions(+), 18 deletions(-)
+
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -664,8 +664,8 @@ static void ieee80211_sta_merge_ibss(str
+ printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
+ "IBSS networks with same SSID (merge)\n", sdata->name);
+
+- ieee80211_request_internal_scan(sdata,
+- ifibss->ssid, ifibss->ssid_len, NULL);
++ ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len,
++ NULL);
+ }
+
+ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
+@@ -772,9 +772,8 @@ static void ieee80211_sta_find_ibss(stru
+ printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
+ "join\n", sdata->name);
+
+- ieee80211_request_internal_scan(sdata,
+- ifibss->ssid, ifibss->ssid_len,
+- ifibss->fixed_channel ? ifibss->channel : NULL);
++ ieee80211_request_ibss_scan(sdata, ifibss->ssid,
++ ifibss->ssid_len, chan);
+ } else {
+ int interval = IEEE80211_SCAN_INTERVAL;
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1233,9 +1233,9 @@ void ieee80211_mesh_rx_queued_mgmt(struc
+
+ /* scan/BSS handling */
+ void ieee80211_scan_work(struct work_struct *work);
+-int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
+- const u8 *ssid, u8 ssid_len,
+- struct ieee80211_channel *chan);
++int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
++ const u8 *ssid, u8 ssid_len,
++ struct ieee80211_channel *chan);
+ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
+ struct cfg80211_scan_request *req);
+ void ieee80211_scan_cancel(struct ieee80211_local *local);
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -761,9 +761,9 @@ int ieee80211_request_scan(struct ieee80
+ return res;
+ }
+
+-int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
+- const u8 *ssid, u8 ssid_len,
+- struct ieee80211_channel *chan)
++int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
++ const u8 *ssid, u8 ssid_len,
++ struct ieee80211_channel *chan)
+ {
+ struct ieee80211_local *local = sdata->local;
+ int ret = -EBUSY;
+@@ -777,22 +777,36 @@ int ieee80211_request_internal_scan(stru
+
+ /* fill internal scan request */
+ if (!chan) {
+- int i, nchan = 0;
++ int i, max_n;
++ int n_ch = 0;
+
+ for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+ if (!local->hw.wiphy->bands[band])
+ continue;
+- for (i = 0;
+- i < local->hw.wiphy->bands[band]->n_channels;
+- i++) {
+- local->int_scan_req->channels[nchan] =
++
++ max_n = local->hw.wiphy->bands[band]->n_channels;
++ for (i = 0; i < max_n; i++) {
++ struct ieee80211_channel *tmp_ch =
+ &local->hw.wiphy->bands[band]->channels[i];
+- nchan++;
++
++ if (tmp_ch->flags & (IEEE80211_CHAN_NO_IBSS |
++ IEEE80211_CHAN_DISABLED))
++ continue;
++
++ local->int_scan_req->channels[n_ch] = tmp_ch;
++ n_ch++;
+ }
+ }
+
+- local->int_scan_req->n_channels = nchan;
++ if (WARN_ON_ONCE(n_ch == 0))
++ goto unlock;
++
++ local->int_scan_req->n_channels = n_ch;
+ } else {
++ if (WARN_ON_ONCE(chan->flags & (IEEE80211_CHAN_NO_IBSS |
++ IEEE80211_CHAN_DISABLED)))
++ goto unlock;
++
+ local->int_scan_req->channels[0] = chan;
+ local->int_scan_req->n_channels = 1;
+ }
--- /dev/null
+From a56f992cdabc63f56b4b142885deebebf936ff76 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 13 Dec 2012 23:08:52 +0100
+Subject: mac80211: use del_timer_sync for final sta cleanup timer deletion
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit a56f992cdabc63f56b4b142885deebebf936ff76 upstream.
+
+This is a very old bug, but there's nothing that prevents the
+timer from running while the module is being removed when we
+only do del_timer() instead of del_timer_sync().
+
+The timer should normally not be running at this point, but
+it's not clearly impossible (or we could just remove this.)
+
+Tested-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/sta_info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -844,7 +844,7 @@ void sta_info_init(struct ieee80211_loca
+
+ void sta_info_stop(struct ieee80211_local *local)
+ {
+- del_timer(&local->sta_cleanup);
++ del_timer_sync(&local->sta_cleanup);
+ sta_info_flush(local, NULL);
+ }
+
--- /dev/null
+From 9c969d8ccb1e17bd20742f4ac9f00c1a64487234 Mon Sep 17 00:00:00 2001
+From: Bing Zhao <bzhao@marvell.com>
+Date: Wed, 2 Jan 2013 16:07:35 -0800
+Subject: mwifiex: check wait_event_interruptible return value
+
+From: Bing Zhao <bzhao@marvell.com>
+
+commit 9c969d8ccb1e17bd20742f4ac9f00c1a64487234 upstream.
+
+wait_event_interruptible function returns -ERESTARTSYS if it's
+interrupted by a signal. Driver should check the return value
+and handle this case properly.
+
+In mwifiex_wait_queue_complete() routine, as we are now checking
+wait_event_interruptible return value, the condition check is not
+required. Also, we have removed mwifiex_cancel_pending_ioctl()
+call to avoid a chance of sending second command to FW by other path
+as soon as we clear current command node. FW can not handle two
+commands simultaneously.
+
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/sta_ioctl.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
+@@ -53,7 +53,6 @@ int mwifiex_copy_mcast_addr(struct mwifi
+ */
+ int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
+ {
+- bool cancel_flag = false;
+ int status;
+ struct cmd_ctrl_node *cmd_queued;
+
+@@ -70,14 +69,11 @@ int mwifiex_wait_queue_complete(struct m
+ queue_work(adapter->workqueue, &adapter->main_work);
+
+ /* Wait for completion */
+- wait_event_interruptible(adapter->cmd_wait_q.wait,
+- *(cmd_queued->condition));
+- if (!*(cmd_queued->condition))
+- cancel_flag = true;
+-
+- if (cancel_flag) {
+- mwifiex_cancel_pending_ioctl(adapter);
+- dev_dbg(adapter->dev, "cmd cancel\n");
++ status = wait_event_interruptible(adapter->cmd_wait_q.wait,
++ *(cmd_queued->condition));
++ if (status) {
++ dev_err(adapter->dev, "cmd_wait_q terminated: %d\n", status);
++ return status;
+ }
+
+ status = adapter->cmd_wait_q.status;
+@@ -436,8 +432,11 @@ int mwifiex_enable_hs(struct mwifiex_ada
+ return false;
+ }
+
+- wait_event_interruptible(adapter->hs_activate_wait_q,
+- adapter->hs_activate_wait_q_woken);
++ if (wait_event_interruptible(adapter->hs_activate_wait_q,
++ adapter->hs_activate_wait_q_woken)) {
++ dev_err(adapter->dev, "hs_activate_wait_q terminated\n");
++ return false;
++ }
+
+ return true;
+ }
--- /dev/null
+From 51861d4eebc2ddc25c77084343d060fa79f6e291 Mon Sep 17 00:00:00 2001
+From: Jerome Glisse <jglisse@redhat.com>
+Date: Tue, 8 Jan 2013 18:41:01 -0500
+Subject: radeon/kms: force rn50 chip to always report connected on analog output
+
+From: Jerome Glisse <jglisse@redhat.com>
+
+commit 51861d4eebc2ddc25c77084343d060fa79f6e291 upstream.
+
+Those rn50 chip are often connected to console remoting hw and load
+detection often fails with those. Just don't try to load detect and
+report connect.
+
+Signed-off-by: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+@@ -617,6 +617,14 @@ static enum drm_connector_status radeon_
+ enum drm_connector_status found = connector_status_disconnected;
+ bool color = true;
+
++ /* just don't bother on RN50 those chip are often connected to remoting
++ * console hw and often we get failure to load detect those. So to make
++ * everyone happy report the encoder as always connected.
++ */
++ if (ASIC_IS_RN50(rdev)) {
++ return connector_status_connected;
++ }
++
+ /* save the regs we need */
+ vclk_ecp_cntl = RREG32_PLL(RADEON_VCLK_ECP_CNTL);
+ crtc_ext_cntl = RREG32(RADEON_CRTC_EXT_CNTL);
udldrmfb-udl_get_edid-drop-unneeded-i.patch
alsa-pxa27x-fix-ac97-cold-reset.patch
alsa-pxa27x-fix-ac97-warm-reset.patch
+staging-comedi-prevent-auto-unconfig-of-manually-configured-devices.patch
+staging-comedi-fix-minimum-ao-period-for-ni-625x-and-ni-628x.patch
+staging-comedi-comedi_test-fix-race-when-cancelling-command.patch
+staging-r8712u-add-new-device-id.patch
+staging-speakup-avoid-out-of-range-access-in-synth_init.patch
+staging-speakup-avoid-out-of-range-access-in-synth_add.patch
+radeon-kms-force-rn50-chip-to-always-report-connected-on-analog-output.patch
+mac80211-fix-ibss-scanning.patch
+mac80211-use-del_timer_sync-for-final-sta-cleanup-timer-deletion.patch
+mwifiex-check-wait_event_interruptible-return-value.patch
+b43-fix-firmware-loading-when-driver-is-built-into-the-kernel.patch
--- /dev/null
+From c0729eeefdcd76db338f635162bf0739fd2c5f6f Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 4 Jan 2013 11:33:21 +0000
+Subject: staging: comedi: comedi_test: fix race when cancelling command
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit c0729eeefdcd76db338f635162bf0739fd2c5f6f upstream.
+
+Éric Piel reported a kernel oops in the "comedi_test" module. It was a
+NULL pointer dereference within `waveform_ai_interrupt()` (actually a
+timer function) that sometimes occurred when a running asynchronous
+command is cancelled (either by the `COMEDI_CANCEL` ioctl or by closing
+the device file).
+
+This seems to be a race between the caller of `waveform_ai_cancel()`
+which on return from that function goes and tears down the running
+command, and the timer function which uses the command. In particular,
+`async->cmd.chanlist` gets freed (and the pointer set to NULL) by
+`do_become_nonbusy()` in "comedi_fops.c" but a previously scheduled
+`waveform_ai_interrupt()` timer function will dereference that pointer
+regardless, leading to the oops.
+
+Fix it by replacing the `del_timer()` call in `waveform_ai_cancel()`
+with `del_timer_sync()`.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Reported-by: Éric Piel <piel@delmic.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/comedi_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/drivers/comedi_test.c
++++ b/drivers/staging/comedi/drivers/comedi_test.c
+@@ -461,7 +461,7 @@ static int waveform_ai_cancel(struct com
+ struct comedi_subdevice *s)
+ {
+ devpriv->timer_running = 0;
+- del_timer(&devpriv->timer);
++ del_timer_sync(&devpriv->timer);
+ return 0;
+ }
+
--- /dev/null
+From 34b55d8c48f4f76044d8f4d6ec3dc786cf210312 Mon Sep 17 00:00:00 2001
+From: Éric Piel <piel@delmic.com>
+Date: Wed, 19 Dec 2012 13:03:13 +0100
+Subject: staging: comedi: fix minimum AO period for NI 625x and NI 628x
+
+From: Éric Piel <piel@delmic.com>
+
+commit 34b55d8c48f4f76044d8f4d6ec3dc786cf210312 upstream.
+
+The minimum period was set to 357 ns, while the divider for these boards is 50
+ns. This prevented to output at maximum speed as ni_ao_cmdtest() would return
+357 but would not accept it.
+
+Not sure why it was set to 357 ns (this was done before the git history,
+which starts 5 years ago). My guess is that it comes from reading the
+specification stating a 2.8 MHz rate (~ 357 ns). The latest
+specification states a 2.86 MHz rate (~ 350 ns), which makes a lot
+more sense.
+
+Tested on a pci-6251.
+
+Signed-off-by: Éric Piel <piel@delmic.com>
+Acked-By: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/ni_pcimio.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/ni_pcimio.c
++++ b/drivers/staging/comedi/drivers/ni_pcimio.c
+@@ -1023,7 +1023,7 @@ static const struct ni_board_struct ni_b
+ .ao_range_table = &range_ni_M_625x_ao,
+ .reg_type = ni_reg_625x,
+ .ao_unipolar = 0,
+- .ao_speed = 357,
++ .ao_speed = 350,
+ .num_p0_dio_channels = 8,
+ .caldac = {caldac_none},
+ .has_8255 = 0,
+@@ -1042,7 +1042,7 @@ static const struct ni_board_struct ni_b
+ .ao_range_table = &range_ni_M_625x_ao,
+ .reg_type = ni_reg_625x,
+ .ao_unipolar = 0,
+- .ao_speed = 357,
++ .ao_speed = 350,
+ .num_p0_dio_channels = 8,
+ .caldac = {caldac_none},
+ .has_8255 = 0,
+@@ -1061,7 +1061,7 @@ static const struct ni_board_struct ni_b
+ .ao_range_table = &range_ni_M_625x_ao,
+ .reg_type = ni_reg_625x,
+ .ao_unipolar = 0,
+- .ao_speed = 357,
++ .ao_speed = 350,
+ .num_p0_dio_channels = 8,
+ .caldac = {caldac_none},
+ .has_8255 = 0,
+@@ -1097,7 +1097,7 @@ static const struct ni_board_struct ni_b
+ .ao_range_table = &range_ni_M_625x_ao,
+ .reg_type = ni_reg_625x,
+ .ao_unipolar = 0,
+- .ao_speed = 357,
++ .ao_speed = 350,
+ .num_p0_dio_channels = 32,
+ .caldac = {caldac_none},
+ .has_8255 = 0,
+@@ -1116,7 +1116,7 @@ static const struct ni_board_struct ni_b
+ .ao_range_table = &range_ni_M_625x_ao,
+ .reg_type = ni_reg_625x,
+ .ao_unipolar = 0,
+- .ao_speed = 357,
++ .ao_speed = 350,
+ .num_p0_dio_channels = 32,
+ .caldac = {caldac_none},
+ .has_8255 = 0,
+@@ -1152,7 +1152,7 @@ static const struct ni_board_struct ni_b
+ .ao_range_table = &range_ni_M_628x_ao,
+ .reg_type = ni_reg_628x,
+ .ao_unipolar = 1,
+- .ao_speed = 357,
++ .ao_speed = 350,
+ .num_p0_dio_channels = 8,
+ .caldac = {caldac_none},
+ .has_8255 = 0,
+@@ -1171,7 +1171,7 @@ static const struct ni_board_struct ni_b
+ .ao_range_table = &range_ni_M_628x_ao,
+ .reg_type = ni_reg_628x,
+ .ao_unipolar = 1,
+- .ao_speed = 357,
++ .ao_speed = 350,
+ .num_p0_dio_channels = 8,
+ .caldac = {caldac_none},
+ .has_8255 = 0,
+@@ -1207,7 +1207,7 @@ static const struct ni_board_struct ni_b
+ .ao_range_table = &range_ni_M_628x_ao,
+ .reg_type = ni_reg_628x,
+ .ao_unipolar = 1,
+- .ao_speed = 357,
++ .ao_speed = 350,
+ .num_p0_dio_channels = 32,
+ .caldac = {caldac_none},
+ .has_8255 = 0,
--- /dev/null
+From 7d3135af399e92cf4c9bbc5f86b6c140aab3b88c Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Tue, 4 Dec 2012 15:59:55 +0000
+Subject: staging: comedi: prevent auto-unconfig of manually configured devices
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 7d3135af399e92cf4c9bbc5f86b6c140aab3b88c upstream.
+
+When a low-level comedi driver auto-configures a device, a `struct
+comedi_dev_file_info` is allocated (as well as a `struct
+comedi_device`) by `comedi_alloc_board_minor()`. A pointer to the
+hardware `struct device` is stored as a cookie in the `struct
+comedi_dev_file_info`. When the low-level comedi driver
+auto-unconfigures the device, `comedi_auto_unconfig()` uses the cookie
+to find the `struct comedi_dev_file_info` so it can detach the comedi
+device from the driver, clean it up and free it.
+
+A problem arises if the user manually unconfigures and reconfigures the
+comedi device using the `COMEDI_DEVCONFIG` ioctl so that is no longer
+associated with the original hardware device. The problem is that the
+cookie is not cleared, so that a call to `comedi_auto_unconfig()` from
+the low-level driver will still find it, detach it, clean it up and free
+it.
+
+Stop this problem occurring by always clearing the `hardware_device`
+cookie in the `struct comedi_dev_file_info` whenever the
+`COMEDI_DEVCONFIG` ioctl call is successful.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/comedi_fops.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -138,6 +138,9 @@ static long comedi_unlocked_ioctl(struct
+ if (cmd == COMEDI_DEVCONFIG) {
+ rc = do_devconfig_ioctl(dev,
+ (struct comedi_devconfig __user *)arg);
++ if (rc == 0)
++ /* Evade comedi_auto_unconfig(). */
++ dev_file_info->hardware_device = NULL;
+ goto done;
+ }
+
--- /dev/null
+From da849a92d3bafaf24d770e971c2c9e5c3f60b5d1 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 29 Dec 2012 11:36:53 -0600
+Subject: staging: r8712u: Add new device ID
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit da849a92d3bafaf24d770e971c2c9e5c3f60b5d1 upstream.
+
+The ISY IWL 1000 USB WLAN stick with USB ID 050d:11f1 is a clone of
+the Belkin F7D1101 V1 device.
+
+Reported-by: Thomas Hartmann <hartmann@ict.tuwien.ac.at>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Thomas Hartmann <hartmann@ict.tuwien.ac.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/usb_intf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -66,6 +66,8 @@ static struct usb_device_id rtl871x_usb_
+ {USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */
+ /* Belkin */
+ {USB_DEVICE(0x050D, 0x945A)},
++ /* ISY IWL - Belkin clone */
++ {USB_DEVICE(0x050D, 0x11F1)},
+ /* Corega */
+ {USB_DEVICE(0x07AA, 0x0047)},
+ /* D-Link */
--- /dev/null
+From 6102c48bd421074a33e102f2ebda3724e8d275f9 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Mon, 7 Jan 2013 22:03:51 +0100
+Subject: staging: speakup: avoid out-of-range access in synth_add()
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit 6102c48bd421074a33e102f2ebda3724e8d275f9 upstream.
+
+Check that array index is in-bounds before accessing the synths[] array.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Cc: Nickolai Zeldovich <nickolai@csail.mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/synth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/speakup/synth.c
++++ b/drivers/staging/speakup/synth.c
+@@ -423,7 +423,7 @@ int synth_add(struct spk_synth *in_synth
+ int i;
+ int status = 0;
+ mutex_lock(&spk_mutex);
+- for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++)
++ for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++)
+ /* synth_remove() is responsible for rotating the array down */
+ if (in_synth == synths[i]) {
+ mutex_unlock(&spk_mutex);
--- /dev/null
+From ae428655b826f2755a8101b27beda42a275ef8ad Mon Sep 17 00:00:00 2001
+From: Nickolai Zeldovich <nickolai@csail.mit.edu>
+Date: Sat, 5 Jan 2013 14:17:45 -0500
+Subject: staging: speakup: avoid out-of-range access in synth_init()
+
+From: Nickolai Zeldovich <nickolai@csail.mit.edu>
+
+commit ae428655b826f2755a8101b27beda42a275ef8ad upstream.
+
+Check that array index is in-bounds before accessing the synths[] array.
+
+Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
+Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/synth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/speakup/synth.c
++++ b/drivers/staging/speakup/synth.c
+@@ -342,7 +342,7 @@ int synth_init(char *synth_name)
+
+ mutex_lock(&spk_mutex);
+ /* First, check if we already have it loaded. */
+- for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++)
++ for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++)
+ if (strcmp(synths[i]->name, synth_name) == 0)
+ synth = synths[i];
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
