--- /dev/null
+From ed3770a9cd5764a575b83810ea679bbff2b03082 Mon Sep 17 00:00:00 2001
+From: Søren Holm <sgh@sgh.dk>
+Date: Mon, 17 Sep 2012 21:50:57 +0000
+Subject: asix: Support DLink DUB-E100 H/W Ver C1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Søren Holm <sgh@sgh.dk>
+
+commit ed3770a9cd5764a575b83810ea679bbff2b03082 upstream.
+
+Signed-off-by: Søren Holm <sgh@sgh.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/asix.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/usb/asix.c
++++ b/drivers/net/usb/asix.c
+@@ -1537,6 +1537,10 @@ static const struct usb_device_id produc
+ USB_DEVICE (0x2001, 0x3c05),
+ .driver_info = (unsigned long) &ax88772_info,
+ }, {
++ // DLink DUB-E100 H/W Ver C1
++ USB_DEVICE (0x2001, 0x1a02),
++ .driver_info = (unsigned long) &ax88772_info,
++}, {
+ // Linksys USB1000
+ USB_DEVICE (0x1737, 0x0039),
+ .driver_info = (unsigned long) &ax88178_info,
--- /dev/null
+From e21093ef6fb4cbecdf926102286dbe280ae965db Mon Sep 17 00:00:00 2001
+From: "Ira W. Snyder" <iws@ovro.caltech.edu>
+Date: Tue, 11 Sep 2012 15:58:15 -0700
+Subject: can: janz-ican3: fix support for older hardware revisions
+
+From: "Ira W. Snyder" <iws@ovro.caltech.edu>
+
+commit e21093ef6fb4cbecdf926102286dbe280ae965db upstream.
+
+The Revision 1.0 Janz CMOD-IO Carrier Board does not have support for
+the reset registers. To support older hardware, the code is changed to
+use the hardware reset register on the Janz VMOD-ICAN3 hardware itself.
+
+Signed-off-by: Ira W. Snyder <iws@ovro.caltech.edu>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/janz-ican3.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/can/janz-ican3.c
++++ b/drivers/net/can/janz-ican3.c
+@@ -1249,7 +1249,6 @@ static irqreturn_t ican3_irq(int irq, vo
+ */
+ static int ican3_reset_module(struct ican3_dev *mod)
+ {
+- u8 val = 1 << mod->num;
+ unsigned long start;
+ u8 runold, runnew;
+
+@@ -1263,8 +1262,7 @@ static int ican3_reset_module(struct ica
+ runold = ioread8(mod->dpm + TARGET_RUNNING);
+
+ /* reset the module */
+- iowrite8(val, &mod->ctrl->reset_assert);
+- iowrite8(val, &mod->ctrl->reset_deassert);
++ iowrite8(0x00, &mod->dpmctrl->hwreset);
+
+ /* wait until the module has finished resetting and is running */
+ start = jiffies;
--- /dev/null
+From ab04c8bd423edb03e2148350a091836c196107fc Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Wed, 19 Sep 2012 14:58:45 +0200
+Subject: can: ti_hecc: fix oops during rmmod
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit ab04c8bd423edb03e2148350a091836c196107fc upstream.
+
+This patch fixes an oops which occurs when unloading the driver, while the
+network interface is still up. The problem is that first the io mapping is
+teared own, then the CAN device is unregistered, resulting in accessing the
+hardware's iomem:
+
+[ 172.744232] Unable to handle kernel paging request at virtual address c88b0040
+[ 172.752441] pgd = c7be4000
+[ 172.755645] [c88b0040] *pgd=87821811, *pte=00000000, *ppte=00000000
+[ 172.762207] Internal error: Oops: 807 [#1] PREEMPT ARM
+[ 172.767517] Modules linked in: ti_hecc(-) can_dev
+[ 172.772430] CPU: 0 Not tainted (3.5.0alpha-00037-g3554cc0 #126)
+[ 172.778961] PC is at ti_hecc_close+0xb0/0x100 [ti_hecc]
+[ 172.784423] LR is at __dev_close_many+0x90/0xc0
+[ 172.789123] pc : [<bf00c768>] lr : [<c033be58>] psr: 60000013
+[ 172.789123] sp : c5c1de68 ip : 00040081 fp : 00000000
+[ 172.801025] r10: 00000001 r9 : c5c1c000 r8 : 00100100
+[ 172.806457] r7 : c5d0a48c r6 : c5d0a400 r5 : 00000000 r4 : c5d0a000
+[ 172.813232] r3 : c88b0000 r2 : 00000001 r1 : c5d0a000 r0 : c5d0a000
+[ 172.820037] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 172.827423] Control: 10c5387d Table: 87be4019 DAC: 00000015
+[ 172.833404] Process rmmod (pid: 600, stack limit = 0xc5c1c2f0)
+[ 172.839447] Stack: (0xc5c1de68 to 0xc5c1e000)
+[ 172.843994] de60: bf00c6b8 c5c1dec8 c5d0a000 c5d0a000 00200200 c033be58
+[ 172.852478] de80: c5c1de44 c5c1dec8 c5c1dec8 c033bf2c c5c1de90 c5c1de90 c5d0a084 c5c1de44
+[ 172.860992] dea0: c5c1dec8 c033c098 c061d3dc c5d0a000 00000000 c05edf28 c05edb34 c000d724
+[ 172.869476] dec0: 00000000 c033c2f8 c5d0a084 c5d0a084 00000000 c033c370 00000000 c5d0a000
+[ 172.877990] dee0: c05edb00 c033c3b8 c5d0a000 bf00d3ac c05edb00 bf00d7c8 bf00d7c8 c02842dc
+[ 172.886474] df00: c02842c8 c0282f90 c5c1c000 c05edb00 bf00d7c8 c0283668 bf00d7c8 00000000
+[ 172.894989] df20: c0611f98 befe2f80 c000d724 c0282d10 bf00d804 00000000 00000013 c0068a8c
+[ 172.903472] df40: c5c538e8 685f6974 00636365 c61571a8 c5cb9980 c61571a8 c6158a20 c00c9bc4
+[ 172.911987] df60: 00000000 00000000 c5cb9980 00000000 c5cb9980 00000000 c7823680 00000006
+[ 172.920471] df80: bf00d804 00000880 c5c1df8c 00000000 000d4267 befe2f80 00000001 b6d90068
+[ 172.928985] dfa0: 00000081 c000d5a0 befe2f80 00000001 befe2f80 00000880 b6d90008 00000008
+[ 172.937469] dfc0: befe2f80 00000001 b6d90068 00000081 00000001 00000000 befe2eac 00000000
+[ 172.945983] dfe0: 00000000 befe2b18 00023ba4 b6e6addc 60000010 befe2f80 a8e00190 86d2d344
+[ 172.954498] [<bf00c768>] (ti_hecc_close+0xb0/0x100 [ti_hecc]) from [<c033be58>] (__dev__registered_many+0xc0/0x2a0)
+[ 172.984161] [<c033c098>] (rollback_registered_many+0xc0/0x2a0) from [<c033c2f8>] (rollback_registered+0x20/0x30)
+[ 172.994750] [<c033c2f8>] (rollback_registered+0x20/0x30) from [<c033c370>] (unregister_netdevice_queue+0x68/0x98)
+[ 173.005401] [<c033c370>] (unregister_netdevice_queue+0x68/0x98) from [<c033c3b8>] (unregister_netdev+0x18/0x20)
+[ 173.015899] [<c033c3b8>] (unregister_netdev+0x18/0x20) from [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc])
+[ 173.026245] [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc]) from [<c02842dc>] (platform_drv_remove+0x14/0x18)
+[ 173.036712] [<c02842dc>] (platform_drv_remove+0x14/0x18) from [<c0282f90>] (__device_release_driver+0x7c/0xbc)
+
+Tested-by: Jan Luebbe <jlu@pengutronix.de>
+Cc: Anant Gole <anantgole@ti.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/ti_hecc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/ti_hecc.c
++++ b/drivers/net/can/ti_hecc.c
+@@ -969,12 +969,12 @@ static int __devexit ti_hecc_remove(stru
+ struct net_device *ndev = platform_get_drvdata(pdev);
+ struct ti_hecc_priv *priv = netdev_priv(ndev);
+
++ unregister_candev(ndev);
+ clk_disable(priv->clk);
+ clk_put(priv->clk);
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ iounmap(priv->base);
+ release_mem_region(res->start, resource_size(res));
+- unregister_candev(ndev);
+ free_candev(ndev);
+ platform_set_drvdata(pdev, NULL);
+
--- /dev/null
+From a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@do-not-panic.com>
+Date: Fri, 14 Sep 2012 15:36:57 -0700
+Subject: cfg80211: fix possible circular lock on reg_regdb_search()
+
+From: "Luis R. Rodriguez" <mcgrof@do-not-panic.com>
+
+commit a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 upstream.
+
+When call_crda() is called we kick off a witch hunt search
+for the same regulatory domain on our internal regulatory
+database and that work gets kicked off on a workqueue, this
+is done while the cfg80211_mutex is held. If that workqueue
+kicks off it will first lock reg_regdb_search_mutex and
+later cfg80211_mutex but to ensure two CPUs will not contend
+against cfg80211_mutex the right thing to do is to have the
+reg_regdb_search() wait until the cfg80211_mutex is let go.
+
+The lockdep report is pasted below.
+
+cfg80211: Calling CRDA to update world regulatory domain
+
+======================================================
+[ INFO: possible circular locking dependency detected ]
+3.3.8 #3 Tainted: G O
+-------------------------------------------------------
+kworker/0:1/235 is trying to acquire lock:
+ (cfg80211_mutex){+.+...}, at: [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
+
+but task is already holding lock:
+ (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (reg_regdb_search_mutex){+.+...}:
+ [<800a8384>] lock_acquire+0x60/0x88
+ [<802950a8>] mutex_lock_nested+0x54/0x31c
+ [<81645778>] is_world_regdom+0x9f8/0xc74 [cfg80211]
+
+-> #1 (reg_mutex#2){+.+...}:
+ [<800a8384>] lock_acquire+0x60/0x88
+ [<802950a8>] mutex_lock_nested+0x54/0x31c
+ [<8164539c>] is_world_regdom+0x61c/0xc74 [cfg80211]
+
+-> #0 (cfg80211_mutex){+.+...}:
+ [<800a77b8>] __lock_acquire+0x10d4/0x17bc
+ [<800a8384>] lock_acquire+0x60/0x88
+ [<802950a8>] mutex_lock_nested+0x54/0x31c
+ [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
+
+other info that might help us debug this:
+
+Chain exists of:
+ cfg80211_mutex --> reg_mutex#2 --> reg_regdb_search_mutex
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(reg_regdb_search_mutex);
+ lock(reg_mutex#2);
+ lock(reg_regdb_search_mutex);
+ lock(cfg80211_mutex);
+
+ *** DEADLOCK ***
+
+3 locks held by kworker/0:1/235:
+ #0: (events){.+.+..}, at: [<80089a00>] process_one_work+0x230/0x460
+ #1: (reg_regdb_work){+.+...}, at: [<80089a00>] process_one_work+0x230/0x460
+ #2: (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]
+
+stack backtrace:
+Call Trace:
+[<80290fd4>] dump_stack+0x8/0x34
+[<80291bc4>] print_circular_bug+0x2ac/0x2d8
+[<800a77b8>] __lock_acquire+0x10d4/0x17bc
+[<800a8384>] lock_acquire+0x60/0x88
+[<802950a8>] mutex_lock_nested+0x54/0x31c
+[<816468a4>] set_regdom+0x78c/0x808 [cfg80211]
+
+Reported-by: Felix Fietkau <nbd@openwrt.org>
+Tested-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/reg.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -331,6 +331,9 @@ static void reg_regdb_search(struct work
+ struct reg_regdb_search_request *request;
+ const struct ieee80211_regdomain *curdom, *regdom;
+ int i, r;
++ bool set_reg = false;
++
++ mutex_lock(&cfg80211_mutex);
+
+ mutex_lock(®_regdb_search_mutex);
+ while (!list_empty(®_regdb_search_list)) {
+@@ -346,9 +349,7 @@ static void reg_regdb_search(struct work
+ r = reg_copy_regd(®dom, curdom);
+ if (r)
+ break;
+- mutex_lock(&cfg80211_mutex);
+- set_regdom(regdom);
+- mutex_unlock(&cfg80211_mutex);
++ set_reg = true;
+ break;
+ }
+ }
+@@ -356,6 +357,11 @@ static void reg_regdb_search(struct work
+ kfree(request);
+ }
+ mutex_unlock(®_regdb_search_mutex);
++
++ if (set_reg)
++ set_regdom(regdom);
++
++ mutex_unlock(&cfg80211_mutex);
+ }
+
+ static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
--- /dev/null
+From c456797681db814f4f5b36909e8e94047bf53d9c Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Tue, 11 Sep 2012 17:21:45 +0200
+Subject: dmaengine: at_hdmac: check that each sg data length is non-null
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit c456797681db814f4f5b36909e8e94047bf53d9c upstream.
+
+Avoid the construction of a malformed DMA request sent to
+the DMA controller.
+Log message is for debug only because this condition is unlikely to
+append and may only trigger at driver development time.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -702,6 +702,11 @@ atc_prep_slave_sg(struct dma_chan *chan,
+
+ mem = sg_dma_address(sg);
+ len = sg_dma_len(sg);
++ if (unlikely(!len)) {
++ dev_dbg(chan2dev(chan),
++ "prep_slave_sg: sg(%d) data length is zero\n", i);
++ goto err;
++ }
+ mem_width = 2;
+ if (unlikely(mem & 3 || len & 3))
+ mem_width = 0;
+@@ -736,6 +741,11 @@ atc_prep_slave_sg(struct dma_chan *chan,
+
+ mem = sg_dma_address(sg);
+ len = sg_dma_len(sg);
++ if (unlikely(!len)) {
++ dev_dbg(chan2dev(chan),
++ "prep_slave_sg: sg(%d) data length is zero\n", i);
++ goto err;
++ }
+ mem_width = 2;
+ if (unlikely(mem & 3 || len & 3))
+ mem_width = 0;
+@@ -769,6 +779,7 @@ atc_prep_slave_sg(struct dma_chan *chan,
+
+ err_desc_get:
+ dev_err(chan2dev(chan), "not enough descriptors available\n");
++err:
+ atc_desc_put(atchan, first);
+ return NULL;
+ }
--- /dev/null
+From c618a9be0e8c0f36baee2560860a0118a428fb26 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Tue, 11 Sep 2012 17:21:44 +0200
+Subject: dmaengine: at_hdmac: fix comment in atc_prep_slave_sg()
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit c618a9be0e8c0f36baee2560860a0118a428fb26 upstream.
+
+s/dma_memcpy/slave_sg/ and it is sg length that we are
+talking about.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -674,7 +674,7 @@ atc_prep_slave_sg(struct dma_chan *chan,
+ flags);
+
+ if (unlikely(!atslave || !sg_len)) {
+- dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n");
++ dev_dbg(chan2dev(chan), "prep_slave_sg: sg length is zero!\n");
+ return NULL;
+ }
+
--- /dev/null
+From 7838f994b4fceff24c343f4e26a6cf4393869579 Mon Sep 17 00:00:00 2001
+From: Robin Holt <holt@sgi.com>
+Date: Tue, 21 Aug 2012 16:16:02 -0700
+Subject: drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources
+
+From: Robin Holt <holt@sgi.com>
+
+commit 7838f994b4fceff24c343f4e26a6cf4393869579 upstream.
+
+On many of our larger systems, CPU 0 has had all of its IRQ resources
+consumed before XPC loads. Worst cases on machines with multiple 10
+GigE cards and multiple IB cards have depleted the entire first socket
+of IRQs.
+
+This patch makes selecting the node upon which IRQs are allocated (as
+well as all the other GRU Message Queue structures) specifiable as a
+module load param and has a default behavior of searching all nodes/cpus
+for an available resources.
+
+[akpm@linux-foundation.org: fix build: include cpu.h and module.h]
+Signed-off-by: Robin Holt <holt@sgi.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/sgi-xp/xpc_uv.c | 84 +++++++++++++++++++++++++++++++++----------
+ 1 file changed, 65 insertions(+), 19 deletions(-)
+
+--- a/drivers/misc/sgi-xp/xpc_uv.c
++++ b/drivers/misc/sgi-xp/xpc_uv.c
+@@ -18,6 +18,8 @@
+ #include <linux/interrupt.h>
+ #include <linux/delay.h>
+ #include <linux/device.h>
++#include <linux/cpu.h>
++#include <linux/module.h>
+ #include <linux/err.h>
+ #include <linux/slab.h>
+ #include <asm/uv/uv_hub.h>
+@@ -59,6 +61,8 @@ static struct xpc_heartbeat_uv *xpc_hear
+ XPC_NOTIFY_MSG_SIZE_UV)
+ #define XPC_NOTIFY_IRQ_NAME "xpc_notify"
+
++static int xpc_mq_node = -1;
++
+ static struct xpc_gru_mq_uv *xpc_activate_mq_uv;
+ static struct xpc_gru_mq_uv *xpc_notify_mq_uv;
+
+@@ -109,11 +113,8 @@ xpc_get_gru_mq_irq_uv(struct xpc_gru_mq_
+ #if defined CONFIG_X86_64
+ mq->irq = uv_setup_irq(irq_name, cpu, mq->mmr_blade, mq->mmr_offset,
+ UV_AFFINITY_CPU);
+- if (mq->irq < 0) {
+- dev_err(xpc_part, "uv_setup_irq() returned error=%d\n",
+- -mq->irq);
++ if (mq->irq < 0)
+ return mq->irq;
+- }
+
+ mq->mmr_value = uv_read_global_mmr64(mmr_pnode, mq->mmr_offset);
+
+@@ -238,8 +239,9 @@ xpc_create_gru_mq_uv(unsigned int mq_siz
+ mq->mmr_blade = uv_cpu_to_blade_id(cpu);
+
+ nid = cpu_to_node(cpu);
+- page = alloc_pages_exact_node(nid, GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+- pg_order);
++ page = alloc_pages_exact_node(nid,
++ GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
++ pg_order);
+ if (page == NULL) {
+ dev_err(xpc_part, "xpc_create_gru_mq_uv() failed to alloc %d "
+ "bytes of memory on nid=%d for GRU mq\n", mq_size, nid);
+@@ -1731,9 +1733,50 @@ static struct xpc_arch_operations xpc_ar
+ .notify_senders_of_disconnect = xpc_notify_senders_of_disconnect_uv,
+ };
+
++static int
++xpc_init_mq_node(int nid)
++{
++ int cpu;
++
++ get_online_cpus();
++
++ for_each_cpu(cpu, cpumask_of_node(nid)) {
++ xpc_activate_mq_uv =
++ xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, nid,
++ XPC_ACTIVATE_IRQ_NAME,
++ xpc_handle_activate_IRQ_uv);
++ if (!IS_ERR(xpc_activate_mq_uv))
++ break;
++ }
++ if (IS_ERR(xpc_activate_mq_uv)) {
++ put_online_cpus();
++ return PTR_ERR(xpc_activate_mq_uv);
++ }
++
++ for_each_cpu(cpu, cpumask_of_node(nid)) {
++ xpc_notify_mq_uv =
++ xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, nid,
++ XPC_NOTIFY_IRQ_NAME,
++ xpc_handle_notify_IRQ_uv);
++ if (!IS_ERR(xpc_notify_mq_uv))
++ break;
++ }
++ if (IS_ERR(xpc_notify_mq_uv)) {
++ xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
++ put_online_cpus();
++ return PTR_ERR(xpc_notify_mq_uv);
++ }
++
++ put_online_cpus();
++ return 0;
++}
++
+ int
+ xpc_init_uv(void)
+ {
++ int nid;
++ int ret = 0;
++
+ xpc_arch_ops = xpc_arch_ops_uv;
+
+ if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
+@@ -1742,21 +1785,21 @@ xpc_init_uv(void)
+ return -E2BIG;
+ }
+
+- xpc_activate_mq_uv = xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, 0,
+- XPC_ACTIVATE_IRQ_NAME,
+- xpc_handle_activate_IRQ_uv);
+- if (IS_ERR(xpc_activate_mq_uv))
+- return PTR_ERR(xpc_activate_mq_uv);
++ if (xpc_mq_node < 0)
++ for_each_online_node(nid) {
++ ret = xpc_init_mq_node(nid);
+
+- xpc_notify_mq_uv = xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, 0,
+- XPC_NOTIFY_IRQ_NAME,
+- xpc_handle_notify_IRQ_uv);
+- if (IS_ERR(xpc_notify_mq_uv)) {
+- xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
+- return PTR_ERR(xpc_notify_mq_uv);
+- }
++ if (!ret)
++ break;
++ }
++ else
++ ret = xpc_init_mq_node(xpc_mq_node);
+
+- return 0;
++ if (ret < 0)
++ dev_err(xpc_part, "xpc_init_mq_node() returned error=%d\n",
++ -ret);
++
++ return ret;
+ }
+
+ void
+@@ -1765,3 +1808,6 @@ xpc_exit_uv(void)
+ xpc_destroy_gru_mq_uv(xpc_notify_mq_uv);
+ xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
+ }
++
++module_param(xpc_mq_node, int, 0);
++MODULE_PARM_DESC(xpc_mq_node, "Node number on which to allocate message queues.");
--- /dev/null
+From 7dbfb315b2aaef0a115765946bf3026d074c33a7 Mon Sep 17 00:00:00 2001
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Date: Tue, 21 Aug 2012 16:16:10 -0700
+Subject: drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode
+
+From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+
+commit 7dbfb315b2aaef0a115765946bf3026d074c33a7 upstream.
+
+Correct the offset by subtracting 20 from tm_hour before taking the
+modulo 12.
+
+[ "Why 20?" I hear you ask. Or at least I did.
+
+ Here's the reason why: RS5C348_BIT_PM is 32, and is - stupidly -
+ included in the RS5C348_HOURS_MASK define. So it's really subtracting
+ out that bit to get "hour+12". But then because it does things modulo
+ 12, it needs to add the 12 in again afterwards anyway.
+
+ This code is confused. It would be much clearer if RS5C348_HOURS_MASK
+ just didn't include the RS5C348_BIT_PM bit at all, then it wouldn't
+ need to do the silly subtract either.
+
+ Whatever. It's all just math, the end result is the same. - Linus ]
+
+Reported-by: James Nute <newten82@gmail.com>
+Tested-by: James Nute <newten82@gmail.com>
+Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-rs5c348.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/rtc-rs5c348.c
++++ b/drivers/rtc/rtc-rs5c348.c
+@@ -121,9 +121,12 @@ rs5c348_rtc_read_time(struct device *dev
+ tm->tm_min = bcd2bin(rxbuf[RS5C348_REG_MINS] & RS5C348_MINS_MASK);
+ tm->tm_hour = bcd2bin(rxbuf[RS5C348_REG_HOURS] & RS5C348_HOURS_MASK);
+ if (!pdata->rtc_24h) {
+- tm->tm_hour %= 12;
+- if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM)
++ if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM) {
++ tm->tm_hour -= 20;
++ tm->tm_hour %= 12;
+ tm->tm_hour += 12;
++ } else
++ tm->tm_hour %= 12;
+ }
+ tm->tm_wday = bcd2bin(rxbuf[RS5C348_REG_WDAY] & RS5C348_WDAY_MASK);
+ tm->tm_mday = bcd2bin(rxbuf[RS5C348_REG_DAY] & RS5C348_DAY_MASK);
--- /dev/null
+From 52e9b39d9a89ae33662596bd30e62dd56bddbe73 Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
+Date: Mon, 20 Aug 2012 15:16:04 +0100
+Subject: drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping
+
+From: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
+
+commit 52e9b39d9a89ae33662596bd30e62dd56bddbe73 upstream.
+
+There is a more recent APU stepping with a new PCI ID
+shipping in the same board by Fujitsu which needs the
+same quirk to correctly mark the back plane connectors.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_atombios.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -488,7 +488,7 @@ static bool radeon_atom_apply_quirks(str
+ }
+
+ /* Fujitsu D3003-S2 board lists DVI-I as DVI-D and VGA */
+- if ((dev->pdev->device == 0x9802) &&
++ if (((dev->pdev->device == 0x9802) || (dev->pdev->device == 0x9806)) &&
+ (dev->pdev->subsystem_vendor == 0x1734) &&
+ (dev->pdev->subsystem_device == 0x11bd)) {
+ if (*connector_type == DRM_MODE_CONNECTOR_VGA) {
--- /dev/null
+From 3d037774b42ed677f699b1dce7d548d55f4e4c2b Mon Sep 17 00:00:00 2001
+From: Pavankumar Kondeti <pkondeti@codeaurora.org>
+Date: Fri, 7 Sep 2012 11:23:28 +0530
+Subject: EHCI: Update qTD next pointer in QH overlay region during unlink
+
+From: Pavankumar Kondeti <pkondeti@codeaurora.org>
+
+commit 3d037774b42ed677f699b1dce7d548d55f4e4c2b upstream.
+
+There is a possibility of QH overlay region having reference to a stale
+qTD pointer during unlink.
+
+Consider an endpoint having two pending qTD before unlink process begins.
+The endpoint's QH queue looks like this.
+
+qTD1 --> qTD2 --> Dummy
+
+To unlink qTD2, QH is removed from asynchronous list and Asynchronous
+Advance Doorbell is programmed. The qTD1's next qTD pointer is set to
+qTD2'2 next qTD pointer and qTD2 is retired upon controller's doorbell
+interrupt. If QH's current qTD pointer points to qTD1, transfer overlay
+region still have reference to qTD2. But qtD2 is just unlinked and freed.
+This may cause EHCI system error. Fix this by updating qTD next pointer
+in QH overlay region with the qTD next pointer of the current qTD.
+
+Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-q.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -130,9 +130,17 @@ qh_refresh (struct ehci_hcd *ehci, struc
+ else {
+ qtd = list_entry (qh->qtd_list.next,
+ struct ehci_qtd, qtd_list);
+- /* first qtd may already be partially processed */
+- if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current)
++ /*
++ * first qtd may already be partially processed.
++ * If we come here during unlink, the QH overlay region
++ * might have reference to the just unlinked qtd. The
++ * qtd is updated in qh_completions(). Update the QH
++ * overlay here.
++ */
++ if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
++ qh->hw->hw_qtd_next = qtd->hw_next;
+ qtd = NULL;
++ }
+ }
+
+ if (qtd)
--- /dev/null
+From d8636a2717bb3da2a7ce2154bf08de90bb8c87b0 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Tue, 21 Aug 2012 16:29:47 +1000
+Subject: fbcon: fix race condition between console lock and cursor timer (v1.1)
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit d8636a2717bb3da2a7ce2154bf08de90bb8c87b0 upstream.
+
+So we've had a fair few reports of fbcon handover breakage between
+efi/vesafb and i915 surface recently, so I dedicated a couple of
+days to finding the problem.
+
+Essentially the last thing we saw was the conflicting framebuffer
+message and that was all.
+
+So after much tracing with direct netconsole writes (printks
+under console_lock not so useful), I think I found the race.
+
+Thread A (driver load) Thread B (timer thread)
+ unbind_con_driver -> |
+ bind_con_driver -> |
+ vc->vc_sw->con_deinit -> |
+ fbcon_deinit -> |
+ console_lock() |
+ | |
+ | fbcon_flashcursor timer fires
+ | console_lock() <- blocked for A
+ |
+ |
+fbcon_del_cursor_timer ->
+ del_timer_sync
+ (BOOM)
+
+Of course because all of this is under the console lock,
+we never see anything, also since we also just unbound the active
+console guess what we never see anything.
+
+Hopefully this fixes the problem for anyone seeing vesafb->kms
+driver handoff.
+
+v1.1: add comment suggestion from Alan.
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Tested-by: Josh Boyer <jwboyer@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/console/fbcon.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -373,8 +373,15 @@ static void fb_flashcursor(struct work_s
+ struct vc_data *vc = NULL;
+ int c;
+ int mode;
++ int ret;
++
++ /* FIXME: we should sort out the unbind locking instead */
++ /* instead we just fail to flash the cursor if we can't get
++ * the lock instead of blocking fbcon deinit */
++ ret = console_trylock();
++ if (ret == 0)
++ return;
+
+- console_lock();
+ if (ops && ops->currcon != -1)
+ vc = vc_cons[ops->currcon].d;
+
--- /dev/null
+From a96874a2a92feaef607ddd3137277a788cb927a6 Mon Sep 17 00:00:00 2001
+From: Keng-Yu Lin <kengyu@canonical.com>
+Date: Fri, 10 Aug 2012 01:39:23 +0800
+Subject: Intel xhci: Only switch the switchable ports
+
+From: Keng-Yu Lin <kengyu@canonical.com>
+
+commit a96874a2a92feaef607ddd3137277a788cb927a6 upstream.
+
+With a previous patch to enable the EHCI/XHCI port switching, it switches
+all the available ports.
+
+The assumption is not correct because the BIOS may expect some ports
+not switchable by the OS.
+
+There are two more registers that contains the information of the switchable
+and non-switchable ports.
+
+This patch adds the checking code for the two register so that only the
+switchable ports are altered.
+
+This patch should be backported to kernels as old as 3.0, that contain
+commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support
+EHCI/xHCI port switching."
+
+Signed-off-by: Keng-Yu Lin <kengyu@canonical.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -73,7 +73,9 @@
+ #define NB_PIF0_PWRDOWN_1 0x01100013
+
+ #define USB_INTEL_XUSB2PR 0xD0
++#define USB_INTEL_USB2PRM 0xD4
+ #define USB_INTEL_USB3_PSSEN 0xD8
++#define USB_INTEL_USB3PRM 0xDC
+
+ static struct amd_chipset_info {
+ struct pci_dev *nb_dev;
+@@ -758,10 +760,18 @@ void usb_enable_xhci_ports(struct pci_de
+ #if defined(CONFIG_USB_XHCI_HCD) || defined(CONFIG_USB_XHCI_HCD_MODULE)
+ u32 ports_available;
+
+- ports_available = 0xffffffff;
++ /* Read USB3PRM, the USB 3.0 Port Routing Mask Register
++ * Indicate the ports that can be changed from OS.
++ */
++ pci_read_config_dword(xhci_pdev, USB_INTEL_USB3PRM,
++ &ports_available);
++
++ dev_dbg(&xhci_pdev->dev, "Configurable ports to enable SuperSpeed: 0x%x\n",
++ ports_available);
++
+ /* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
+- * Register, to turn on SuperSpeed terminations for all
+- * available ports.
++ * Register, to turn on SuperSpeed terminations for the
++ * switchable ports.
+ */
+ pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
+ cpu_to_le32(ports_available));
+@@ -771,7 +781,16 @@ void usb_enable_xhci_ports(struct pci_de
+ dev_dbg(&xhci_pdev->dev, "USB 3.0 ports that are now enabled "
+ "under xHCI: 0x%x\n", ports_available);
+
+- ports_available = 0xffffffff;
++ /* Read XUSB2PRM, xHCI USB 2.0 Port Routing Mask Register
++ * Indicate the USB 2.0 ports to be controlled by the xHCI host.
++ */
++
++ pci_read_config_dword(xhci_pdev, USB_INTEL_USB2PRM,
++ &ports_available);
++
++ dev_dbg(&xhci_pdev->dev, "Configurable USB 2.0 ports to hand over to xCHI: 0x%x\n",
++ ports_available);
++
+ /* Write XUSB2PR, the xHC USB 2.0 Port Routing Register, to
+ * switch the USB 2.0 power and data lines over to the xHCI
+ * host.
--- /dev/null
+From 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 10 Aug 2012 15:22:09 +0100
+Subject: mutex: Place lock in contended state after fastpath_lock failure
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream.
+
+ARM recently moved to asm-generic/mutex-xchg.h for its mutex
+implementation after the previous implementation was found to be missing
+some crucial memory barriers. However, this has revealed some problems
+running hackbench on SMP platforms due to the way in which the
+MUTEX_SPIN_ON_OWNER code operates.
+
+The symptoms are that a bunch of hackbench tasks are left waiting on an
+unlocked mutex and therefore never get woken up to claim it. This boils
+down to the following sequence of events:
+
+ Task A Task B Task C Lock value
+0 1
+1 lock() 0
+2 lock() 0
+3 spin(A) 0
+4 unlock() 1
+5 lock() 0
+6 cmpxchg(1,0) 0
+7 contended() -1
+8 lock() 0
+9 spin(C) 0
+10 unlock() 1
+11 cmpxchg(1,0) 0
+12 unlock() 1
+
+At this point, the lock is unlocked, but Task B is in an uninterruptible
+sleep with nobody to wake it up.
+
+This patch fixes the problem by ensuring we put the lock into the
+contended state if we fail to acquire it on the fastpath, ensuring that
+any blocked waiters are woken up when the mutex is released.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Chris Mason <chris.mason@fusionio.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Reviewed-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/n/tip-6e9lrw2avczr0617fzl5vqb8@git.kernel.org
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/asm-generic/mutex-xchg.h | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/include/asm-generic/mutex-xchg.h
++++ b/include/asm-generic/mutex-xchg.h
+@@ -26,7 +26,13 @@ static inline void
+ __mutex_fastpath_lock(atomic_t *count, void (*fail_fn)(atomic_t *))
+ {
+ if (unlikely(atomic_xchg(count, 0) != 1))
+- fail_fn(count);
++ /*
++ * We failed to acquire the lock, so mark it contended
++ * to ensure that any waiting tasks are woken up by the
++ * unlock slow path.
++ */
++ if (likely(atomic_xchg(count, -1) != 1))
++ fail_fn(count);
+ }
+
+ /**
+@@ -43,7 +49,8 @@ static inline int
+ __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
+ {
+ if (unlikely(atomic_xchg(count, 0) != 1))
+- return fail_fn(count);
++ if (likely(atomic_xchg(count, -1) != 1))
++ return fail_fn(count);
+ return 0;
+ }
+
--- /dev/null
+From 872ece86ea5c367aa92f44689c2d01a1c767aeb3 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Tue, 4 Sep 2012 11:05:07 -0400
+Subject: NFS: Fix a problem with the legacy binary mount code
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 872ece86ea5c367aa92f44689c2d01a1c767aeb3 upstream.
+
+Apparently, am-utils is still using the legacy binary mountdata interface,
+and is having trouble parsing /proc/mounts due to the 'port=' field being
+incorrectly set.
+
+The following patch should fix up the regression.
+
+Reported-by: Marius Tolzmann <tolzmann@molgen.mpg.de>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1815,6 +1815,7 @@ static int nfs_validate_mount_data(void
+
+ memcpy(sap, &data->addr, sizeof(data->addr));
+ args->nfs_server.addrlen = sizeof(data->addr);
++ args->nfs_server.port = ntohs(data->addr.sin_port);
+ if (!nfs_verify_server_address(sap))
+ goto out_no_address;
+
+@@ -2528,6 +2529,7 @@ static int nfs4_validate_mount_data(void
+ return -EFAULT;
+ if (!nfs_verify_server_address(sap))
+ goto out_no_address;
++ args->nfs_server.port = ntohs(((struct sockaddr_in *)sap)->sin_port);
+
+ if (data->auth_flavourlen) {
+ if (data->auth_flavourlen > 1)
--- /dev/null
+From c3f52af3e03013db5237e339c817beaae5ec9e3a Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Mon, 3 Sep 2012 14:56:02 -0400
+Subject: NFS: Fix the initialisation of the readdir 'cookieverf' array
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit c3f52af3e03013db5237e339c817beaae5ec9e3a upstream.
+
+When the NFS_COOKIEVERF helper macro was converted into a static
+inline function in commit 99fadcd764 (nfs: convert NFS_*(inode)
+helpers to static inline), we broke the initialisation of the
+readdir cookies, since that depended on doing a memset with an
+argument of 'sizeof(NFS_COOKIEVERF(inode))' which therefore
+changed from sizeof(be32 cookieverf[2]) to sizeof(be32 *).
+
+At this point, NFS_COOKIEVERF seems to be more of an obfuscation
+than a helper, so the best thing would be to just get rid of it.
+
+Also see: https://bugzilla.kernel.org/show_bug.cgi?id=46881
+
+Reported-by: Andi Kleen <andi@firstfloor.org>
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/inode.c | 2 +-
+ fs/nfs/nfs3proc.c | 2 +-
+ fs/nfs/nfs4proc.c | 4 ++--
+ include/linux/nfs_fs.h | 5 -----
+ 4 files changed, 4 insertions(+), 9 deletions(-)
+
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -150,7 +150,7 @@ static void nfs_zap_caches_locked(struct
+ nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
+ nfsi->attrtimeo_timestamp = jiffies;
+
+- memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
++ memset(NFS_I(inode)->cookieverf, 0, sizeof(NFS_I(inode)->cookieverf));
+ if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
+ nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
+ else
+--- a/fs/nfs/nfs3proc.c
++++ b/fs/nfs/nfs3proc.c
+@@ -633,7 +633,7 @@ nfs3_proc_readdir(struct dentry *dentry,
+ u64 cookie, struct page **pages, unsigned int count, int plus)
+ {
+ struct inode *dir = dentry->d_inode;
+- __be32 *verf = NFS_COOKIEVERF(dir);
++ __be32 *verf = NFS_I(dir)->cookieverf;
+ struct nfs3_readdirargs arg = {
+ .fh = NFS_FH(dir),
+ .cookie = cookie,
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3018,11 +3018,11 @@ static int _nfs4_proc_readdir(struct den
+ dentry->d_parent->d_name.name,
+ dentry->d_name.name,
+ (unsigned long long)cookie);
+- nfs4_setup_readdir(cookie, NFS_COOKIEVERF(dir), dentry, &args);
++ nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
+ res.pgbase = args.pgbase;
+ status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
+ if (status >= 0) {
+- memcpy(NFS_COOKIEVERF(dir), res.verifier.data, NFS4_VERIFIER_SIZE);
++ memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
+ status += args.pgbase;
+ }
+
+--- a/include/linux/nfs_fs.h
++++ b/include/linux/nfs_fs.h
+@@ -261,11 +261,6 @@ static inline const struct nfs_rpc_ops *
+ return NFS_SERVER(inode)->nfs_client->rpc_ops;
+ }
+
+-static inline __be32 *NFS_COOKIEVERF(const struct inode *inode)
+-{
+- return NFS_I(inode)->cookieverf;
+-}
+-
+ static inline unsigned NFS_MINATTRTIMEO(const struct inode *inode)
+ {
+ struct nfs_server *nfss = NFS_SERVER(inode);
--- /dev/null
+From 01913b49cf1dc6409a07dd2a4cc6af2e77f3c410 Mon Sep 17 00:00:00 2001
+From: Weston Andros Adamson <dros@netapp.com>
+Date: Thu, 6 Sep 2012 15:54:27 -0400
+Subject: NFS: return error from decode_getfh in decode open
+
+From: Weston Andros Adamson <dros@netapp.com>
+
+commit 01913b49cf1dc6409a07dd2a4cc6af2e77f3c410 upstream.
+
+If decode_getfh failed, nfs4_xdr_dec_open would return 0 since the last
+decode_* call must have succeeded.
+
+Signed-off-by: Weston Andros Adamson <dros@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4xdr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -5745,7 +5745,8 @@ static int nfs4_xdr_dec_open(struct rpc_
+ status = decode_open(xdr, res);
+ if (status)
+ goto out;
+- if (decode_getfh(xdr, &res->fh) != 0)
++ status = decode_getfh(xdr, &res->fh);
++ if (status)
+ goto out;
+ if (decode_getfattr(xdr, res->f_attr, res->server,
+ !RPC_IS_ASYNC(rqstp->rq_task)) != 0)
--- /dev/null
+From 58a34de7b1a920d287d17d2ca08bc9aaf7e6d35b Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Wed, 15 Aug 2012 21:31:55 +0200
+Subject: PM / Runtime: Clear power.deferred_resume on success in rpm_suspend()
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit 58a34de7b1a920d287d17d2ca08bc9aaf7e6d35b upstream.
+
+The power.deferred_resume can only be set if the runtime PM status
+of device is RPM_SUSPENDING and it should be cleared after its
+status has been changed, regardless of whether or not the runtime
+suspend has been successful. However, it only is cleared on
+suspend failure, while it may remain set on successful suspend and
+is happily leaked to rpm_resume() executed in that case.
+
+That shouldn't happen, so if power.deferred_resume is set in
+rpm_suspend() after the status has been changed to RPM_SUSPENDED,
+clear it before calling rpm_resume(). Then, it doesn't need to be
+cleared before changing the status to RPM_SUSPENDING any more,
+because it's always cleared after the status has been changed to
+either RPM_SUSPENDED (on success) or RPM_ACTIVE (on failure).
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/power/runtime.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -360,7 +360,6 @@ static int rpm_suspend(struct device *de
+ goto repeat;
+ }
+
+- dev->power.deferred_resume = false;
+ if (dev->power.no_callbacks)
+ goto no_callback; /* Assume success. */
+
+@@ -420,6 +419,7 @@ static int rpm_suspend(struct device *de
+ wake_up_all(&dev->power.wait_queue);
+
+ if (dev->power.deferred_resume) {
++ dev->power.deferred_resume = false;
+ rpm_resume(dev, 0);
+ retval = -EAGAIN;
+ goto out;
--- /dev/null
+From 7f321c26c04807834fef4c524d2b21573423fc74 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Wed, 15 Aug 2012 21:31:45 +0200
+Subject: PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit 7f321c26c04807834fef4c524d2b21573423fc74 upstream.
+
+For devices whose power.no_callbacks flag is set, rpm_resume()
+should return 1 if the device's parent is already active, so that
+the callers of pm_runtime_get() don't think that they have to wait
+for the device to resume (asynchronously) in that case (the core
+won't queue up an asynchronous resume in that case, so there's
+nothing to wait for anyway).
+
+Modify the code accordingly (and make sure that an idle notification
+will be queued up on success, even if 1 is to be returned).
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/power/runtime.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -533,6 +533,7 @@ static int rpm_resume(struct device *dev
+ || dev->parent->power.runtime_status == RPM_ACTIVE) {
+ atomic_inc(&dev->parent->power.child_count);
+ spin_unlock(&dev->parent->power.lock);
++ retval = 1;
+ goto no_callback; /* Assume success. */
+ }
+ spin_unlock(&dev->parent->power.lock);
+@@ -610,7 +611,7 @@ static int rpm_resume(struct device *dev
+ }
+ wake_up_all(&dev->power.wait_queue);
+
+- if (!retval)
++ if (retval >= 0)
+ rpm_idle(dev, RPM_ASYNC);
+
+ out:
--- /dev/null
+From a396e10019eaf3809b0219c966865aaafec12630 Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Fri, 31 Aug 2012 19:22:11 +0200
+Subject: rt2x00: Fix rfkill polling prior to interface start.
+
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+
+commit a396e10019eaf3809b0219c966865aaafec12630 upstream.
+
+We need to program the rfkill switch GPIO pin direction to input at
+device initialization time, not only when the interface is brought up.
+Doing this only when the interface is brought up could lead to rfkill
+detecting the switch is turned on erroneously and inability to create
+the interface and bringing it up.
+
+Reported-and-tested-by: Andreas Messer <andi@bastelmap.de>
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo Van Doorn <ivdoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2400pci.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt2400pci.h | 1 +
+ drivers/net/wireless/rt2x00/rt2500pci.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt2500usb.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt2500usb.h | 1 +
+ drivers/net/wireless/rt2x00/rt2800pci.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt2800usb.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt61pci.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt61pci.h | 1 +
+ drivers/net/wireless/rt2x00/rt73usb.c | 9 +++++++++
+ drivers/net/wireless/rt2x00/rt73usb.h | 3 +++
+ 11 files changed, 69 insertions(+)
+
+--- a/drivers/net/wireless/rt2x00/rt2400pci.c
++++ b/drivers/net/wireless/rt2x00/rt2400pci.c
+@@ -1618,6 +1618,7 @@ static int rt2400pci_probe_hw_mode(struc
+ static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -1631,6 +1632,14 @@ static int rt2400pci_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00pci_register_read(rt2x00dev, GPIOCSR, ®);
++ rt2x00_set_field32(®, GPIOCSR_BIT8, 1);
++ rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2400pci_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt2400pci.h
++++ b/drivers/net/wireless/rt2x00/rt2400pci.h
+@@ -670,6 +670,7 @@
+ #define GPIOCSR_BIT5 FIELD32(0x00000020)
+ #define GPIOCSR_BIT6 FIELD32(0x00000040)
+ #define GPIOCSR_BIT7 FIELD32(0x00000080)
++#define GPIOCSR_BIT8 FIELD32(0x00000100)
+
+ /*
+ * BBPPCSR: BBP Pin control register.
+--- a/drivers/net/wireless/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/rt2x00/rt2500pci.c
+@@ -1936,6 +1936,7 @@ static int rt2500pci_probe_hw_mode(struc
+ static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -1949,6 +1950,14 @@ static int rt2500pci_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00pci_register_read(rt2x00dev, GPIOCSR, ®);
++ rt2x00_set_field32(®, GPIOCSR_DIR0, 1);
++ rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2500pci_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/rt2x00/rt2500usb.c
+@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(struc
+ static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u16 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2500usb_register_read(rt2x00dev, MAC_CSR19, ®);
++ rt2x00_set_field16(®, MAC_CSR19_BIT8, 0);
++ rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2500usb_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt2500usb.h
++++ b/drivers/net/wireless/rt2x00/rt2500usb.h
+@@ -197,6 +197,7 @@
+ #define MAC_CSR19_BIT5 FIELD16(0x0020)
+ #define MAC_CSR19_BIT6 FIELD16(0x0040)
+ #define MAC_CSR19_BIT7 FIELD16(0x0080)
++#define MAC_CSR19_BIT8 FIELD16(0x0100)
+
+ /*
+ * MAC_CSR20: LED control register.
+--- a/drivers/net/wireless/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/rt2x00/rt2800pci.c
+@@ -941,6 +941,7 @@ static int rt2800pci_validate_eeprom(str
+ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -954,6 +955,14 @@ static int rt2800pci_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, ®);
++ rt2x00_set_field32(®, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
++ rt2x00pci_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2800_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -600,6 +600,7 @@ static int rt2800usb_validate_eeprom(str
+ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -613,6 +614,14 @@ static int rt2800usb_probe_hw(struct rt2
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, ®);
++ rt2x00_set_field32(®, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
++ rt2x00usb_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt2800_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/rt2x00/rt61pci.c
+@@ -2840,6 +2840,7 @@ static int rt61pci_probe_hw_mode(struct
+ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Disable power saving.
+@@ -2858,6 +2859,14 @@ static int rt61pci_probe_hw(struct rt2x0
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00pci_register_read(rt2x00dev, MAC_CSR13, ®);
++ rt2x00_set_field32(®, MAC_CSR13_BIT13, 1);
++ rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt61pci_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt61pci.h
++++ b/drivers/net/wireless/rt2x00/rt61pci.h
+@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry {
+ #define MAC_CSR13_BIT10 FIELD32(0x00000400)
+ #define MAC_CSR13_BIT11 FIELD32(0x00000800)
+ #define MAC_CSR13_BIT12 FIELD32(0x00001000)
++#define MAC_CSR13_BIT13 FIELD32(0x00002000)
+
+ /*
+ * MAC_CSR14: LED control register.
+--- a/drivers/net/wireless/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/rt2x00/rt73usb.c
+@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(struct
+ static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ int retval;
++ u32 reg;
+
+ /*
+ * Allocate eeprom data.
+@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x0
+ return retval;
+
+ /*
++ * Enable rfkill polling by setting GPIO direction of the
++ * rfkill switch GPIO pin correctly.
++ */
++ rt2x00usb_register_read(rt2x00dev, MAC_CSR13, ®);
++ rt2x00_set_field32(®, MAC_CSR13_BIT15, 0);
++ rt2x00usb_register_write(rt2x00dev, MAC_CSR13, reg);
++
++ /*
+ * Initialize hw specifications.
+ */
+ retval = rt73usb_probe_hw_mode(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt73usb.h
++++ b/drivers/net/wireless/rt2x00/rt73usb.h
+@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry {
+ #define MAC_CSR13_BIT10 FIELD32(0x00000400)
+ #define MAC_CSR13_BIT11 FIELD32(0x00000800)
+ #define MAC_CSR13_BIT12 FIELD32(0x00001000)
++#define MAC_CSR13_BIT13 FIELD32(0x00002000)
++#define MAC_CSR13_BIT14 FIELD32(0x00004000)
++#define MAC_CSR13_BIT15 FIELD32(0x00008000)
+
+ /*
+ * MAC_CSR14: LED control register.
--- /dev/null
+From 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Fri, 31 Aug 2012 19:22:10 +0200
+Subject: rt2x00: Fix word size of rt2500usb MAC_CSR19 register.
+
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+
+commit 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 upstream.
+
+The register is 16 bits wide, not 32.
+
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo Van Doorn <ivdoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2500usb.c | 2 +-
+ drivers/net/wireless/rt2x00/rt2500usb.h | 16 ++++++++--------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/rt2x00/rt2500usb.c
+@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(struct
+ u16 reg;
+
+ rt2500usb_register_read(rt2x00dev, MAC_CSR19, ®);
+- return rt2x00_get_field32(reg, MAC_CSR19_BIT7);
++ return rt2x00_get_field16(reg, MAC_CSR19_BIT7);
+ }
+
+ #ifdef CONFIG_RT2X00_LIB_LEDS
+--- a/drivers/net/wireless/rt2x00/rt2500usb.h
++++ b/drivers/net/wireless/rt2x00/rt2500usb.h
+@@ -189,14 +189,14 @@
+ * MAC_CSR19: GPIO control register.
+ */
+ #define MAC_CSR19 0x0426
+-#define MAC_CSR19_BIT0 FIELD32(0x0001)
+-#define MAC_CSR19_BIT1 FIELD32(0x0002)
+-#define MAC_CSR19_BIT2 FIELD32(0x0004)
+-#define MAC_CSR19_BIT3 FIELD32(0x0008)
+-#define MAC_CSR19_BIT4 FIELD32(0x0010)
+-#define MAC_CSR19_BIT5 FIELD32(0x0020)
+-#define MAC_CSR19_BIT6 FIELD32(0x0040)
+-#define MAC_CSR19_BIT7 FIELD32(0x0080)
++#define MAC_CSR19_BIT0 FIELD16(0x0001)
++#define MAC_CSR19_BIT1 FIELD16(0x0002)
++#define MAC_CSR19_BIT2 FIELD16(0x0004)
++#define MAC_CSR19_BIT3 FIELD16(0x0008)
++#define MAC_CSR19_BIT4 FIELD16(0x0010)
++#define MAC_CSR19_BIT5 FIELD16(0x0020)
++#define MAC_CSR19_BIT6 FIELD16(0x0040)
++#define MAC_CSR19_BIT7 FIELD16(0x0080)
+
+ /*
+ * MAC_CSR20: LED control register.
arm-7532-1-decompressor-reset-sctlr.tre-for-vmsa-armv7-cores.patch
tracing-don-t-call-page_to_pfn-if-page-is-null.patch
input-i8042-disable-mux-on-toshiba-c850d.patch
+asix-support-dlink-dub-e100-h-w-ver-c1.patch
+can-ti_hecc-fix-oops-during-rmmod.patch
+can-janz-ican3-fix-support-for-older-hardware-revisions.patch
+cfg80211-fix-possible-circular-lock-on-reg_regdb_search.patch
+dmaengine-at_hdmac-fix-comment-in-atc_prep_slave_sg.patch
+dmaengine-at_hdmac-check-that-each-sg-data-length-is-non-null.patch
+rt2x00-fix-word-size-of-rt2500usb-mac_csr19-register.patch
+rt2x00-fix-rfkill-polling-prior-to-interface-start.patch
+nfs-fix-the-initialisation-of-the-readdir-cookieverf-array.patch
+nfs-fix-a-problem-with-the-legacy-binary-mount-code.patch
+nfs-return-error-from-decode_getfh-in-decode-open.patch
+ehci-update-qtd-next-pointer-in-qh-overlay-region-during-unlink.patch
+usb-ftdi_sio-pid-for-nzr-sem-16-usb.patch
+usb-ftdi_sio-do-not-claim-cdc-acm-function.patch
+usb-ftdi-sio-add-support-for-more-physik-instrumente-devices.patch
+usb-add-device-quirk-for-joss-optical-touchboard.patch
+intel-xhci-only-switch-the-switchable-ports.patch
+xhci-fix-a-logical-vs-bitwise-and-bug.patch
+xhci-make-handover-code-more-robust.patch
+xhci-recognize-usb-3.0-devices-as-superspeed-at-powerup.patch
+usb-host-xhci-fix-compilation-error-for-non-pci-based-stacks.patch
+xhci-fix-bug-after-deq-ptr-set-to-link-trb.patch
+mutex-place-lock-in-contended-state-after-fastpath_lock-failure.patch
+drivers-rtc-rtc-rs5c348.c-fix-hour-decoding-in-12-hour-mode.patch
+pm-runtime-fix-rpm_resume-return-value-for-power.no_callbacks-set.patch
+pm-runtime-clear-power.deferred_resume-on-success-in-rpm_suspend.patch
+drivers-misc-sgi-xp-xpc_uv.c-sgi-xpc-fails-to-load-when-cpu-0-is-out-of-irq-resources.patch
+fbcon-fix-race-condition-between-console-lock-and-cursor-timer-v1.1.patch
+drm-radeon-kms-extend-the-fujitsu-d3003-s2-board-connector-quirk-to-cover-later-silicon-stepping.patch
--- /dev/null
+From 92fc7a8b0f20bdb243c706daf42658e8e0cd2ef0 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 4 Sep 2012 10:41:02 -0400
+Subject: USB: add device quirk for Joss Optical touchboard
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 92fc7a8b0f20bdb243c706daf42658e8e0cd2ef0 upstream.
+
+This patch (as1604) adds a CONFIG_INTF_STRINGS quirk for the Joss
+infrared touchboard device. The device doesn't like to be asked for
+its interface strings.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: adam ? <adam3337@wp.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -96,6 +96,10 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x04b4, 0x0526), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ /* Microchip Joss Optical infrared touchboard device */
++ { USB_DEVICE(0x04d8, 0x000c), .driver_info =
++ USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ /* Samsung Android phone modem - ID conflict with SPH-I500 */
+ { USB_DEVICE(0x04e8, 0x6601), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
--- /dev/null
+From dafc4f7be1a556ca3868d343c00127728b397068 Mon Sep 17 00:00:00 2001
+From: Éric Piel <piel@delmic.com>
+Date: Tue, 4 Sep 2012 17:25:06 +0200
+Subject: USB: ftdi-sio: add support for more Physik Instrumente devices
+
+From: Éric Piel <piel@delmic.com>
+
+commit dafc4f7be1a556ca3868d343c00127728b397068 upstream.
+
+Commit b69cc672052540 added support for the E-861. After acquiring a C-867, I
+realised that every Physik Instrumente's device has a different PID. They are
+listed in the Windows device driver's .inf file. So here are all PIDs for the
+current (and probably future) USB devices from Physik Instrumente.
+
+Compiled, but only actually tested on the E-861 and C-867.
+
+Signed-off-by: Éric Piel <piel@delmic.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 17 +++++++++++++++++
+ drivers/usb/serial/ftdi_sio_ids.h | 21 ++++++++++++++++++++-
+ 2 files changed, 37 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -811,7 +811,24 @@ static struct usb_device_id id_table_com
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
+ { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
++ { USB_DEVICE(FTDI_VID, PI_C865_PID) },
++ { USB_DEVICE(FTDI_VID, PI_C857_PID) },
++ { USB_DEVICE(PI_VID, PI_C866_PID) },
++ { USB_DEVICE(PI_VID, PI_C663_PID) },
++ { USB_DEVICE(PI_VID, PI_C725_PID) },
++ { USB_DEVICE(PI_VID, PI_E517_PID) },
++ { USB_DEVICE(PI_VID, PI_C863_PID) },
+ { USB_DEVICE(PI_VID, PI_E861_PID) },
++ { USB_DEVICE(PI_VID, PI_C867_PID) },
++ { USB_DEVICE(PI_VID, PI_E609_PID) },
++ { USB_DEVICE(PI_VID, PI_E709_PID) },
++ { USB_DEVICE(PI_VID, PI_100F_PID) },
++ { USB_DEVICE(PI_VID, PI_1011_PID) },
++ { USB_DEVICE(PI_VID, PI_1012_PID) },
++ { USB_DEVICE(PI_VID, PI_1013_PID) },
++ { USB_DEVICE(PI_VID, PI_1014_PID) },
++ { USB_DEVICE(PI_VID, PI_1015_PID) },
++ { USB_DEVICE(PI_VID, PI_1016_PID) },
+ { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
+ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -797,8 +797,27 @@
+ * Physik Instrumente
+ * http://www.physikinstrumente.com/en/products/
+ */
++/* These two devices use the VID of FTDI */
++#define PI_C865_PID 0xe0a0 /* PI C-865 Piezomotor Controller */
++#define PI_C857_PID 0xe0a1 /* PI Encoder Trigger Box */
++
+ #define PI_VID 0x1a72 /* Vendor ID */
+-#define PI_E861_PID 0x1008 /* E-861 piezo controller USB connection */
++#define PI_C866_PID 0x1000 /* PI C-866 Piezomotor Controller */
++#define PI_C663_PID 0x1001 /* PI C-663 Mercury-Step */
++#define PI_C725_PID 0x1002 /* PI C-725 Piezomotor Controller */
++#define PI_E517_PID 0x1005 /* PI E-517 Digital Piezo Controller Operation Module */
++#define PI_C863_PID 0x1007 /* PI C-863 */
++#define PI_E861_PID 0x1008 /* PI E-861 Piezomotor Controller */
++#define PI_C867_PID 0x1009 /* PI C-867 Piezomotor Controller */
++#define PI_E609_PID 0x100D /* PI E-609 Digital Piezo Controller */
++#define PI_E709_PID 0x100E /* PI E-709 Digital Piezo Controller */
++#define PI_100F_PID 0x100F /* PI Digital Piezo Controller */
++#define PI_1011_PID 0x1011 /* PI Digital Piezo Controller */
++#define PI_1012_PID 0x1012 /* PI Motion Controller */
++#define PI_1013_PID 0x1013 /* PI Motion Controller */
++#define PI_1014_PID 0x1014 /* PI Device */
++#define PI_1015_PID 0x1015 /* PI Device */
++#define PI_1016_PID 0x1016 /* PI Digital Servo Module */
+
+ /*
+ * Kondo Kagaku Co.Ltd.
--- /dev/null
+From f08dea734844aa42ec57c229b0b73b3d7d21f810 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Mon, 10 Sep 2012 12:01:05 +0200
+Subject: USB: ftdi_sio: do not claim CDC ACM function
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit f08dea734844aa42ec57c229b0b73b3d7d21f810 upstream.
+
+The Microchip vid:pid 04d8:000a is used for their CDC ACM
+demo firmware application. This is a device with a single
+function conforming to the CDC ACM specification and with
+the intention of demonstrating CDC ACM class firmware and
+driver interaction. The demo is used on a number of
+development boards, and may also be used unmodified by
+vendors using Microchip hardware.
+
+Some vendors have re-used this vid:pid for other types of
+firmware, emulating FTDI chips. Attempting to continue to
+support such devices without breaking class based
+applications that by matching on interface
+class/subclass/proto being ff/ff/00. I have no information
+about the actual device or interface descriptors, but this
+will at least make the proper CDC ACM devices work again.
+Anyone having details of the offending device's descriptors
+should update this entry with the details.
+
+Reported-by: Florian Wöhrl <fw@woehrl.biz>
+Reported-by: Xiaofan Chen <xiaofanc@gmail.com>
+Cc: Alan Cox <alan@linux.intel.com>
+Cc: Bruno Thomsen <bruno.thomsen@gmail.com>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 4 +++-
+ drivers/usb/serial/ftdi_sio_ids.h | 5 ++++-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -803,7 +803,9 @@ static struct usb_device_id id_table_com
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+- { USB_DEVICE(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID) },
++ { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
++ USB_CLASS_VENDOR_SPEC,
++ USB_SUBCLASS_VENDOR_SPEC, 0x00) },
+ { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+ { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -542,7 +542,10 @@
+ /*
+ * Microchip Technology, Inc.
+ *
+- * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are also used by:
++ * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
++ * used by single function CDC ACM class based firmware demo
++ * applications. The VID/PID has also been used in firmware
++ * emulating FTDI serial chips by:
+ * Hornby Elite - Digital Command Control Console
+ * http://www.hornby.com/hornby-dcc/controllers/
+ */
--- /dev/null
+From 26a538b9ea2a3ee10dafc0068f0560dfd7b7ba37 Mon Sep 17 00:00:00 2001
+From: Horst Schirmeier <horst@schirmeier.com>
+Date: Fri, 31 Aug 2012 00:00:28 +0200
+Subject: USB: ftdi_sio: PID for NZR SEM 16+ USB
+
+From: Horst Schirmeier <horst@schirmeier.com>
+
+commit 26a538b9ea2a3ee10dafc0068f0560dfd7b7ba37 upstream.
+
+This adds the USB PID for the NZR SEM 16+ USB energy monitor device
+<http://www.nzr.de>. It works perfectly with the GPL software on
+<http://schou.dk/linux/sparometer/>.
+
+Signed-off-by: Horst Schirmeier <horst@schirmeier.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -702,6 +702,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_NZR_SEM_USB_PID) },
+ { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
+ { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
+ { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -75,6 +75,9 @@
+ #define FTDI_OPENDCC_GATEWAY_PID 0xBFDB
+ #define FTDI_OPENDCC_GBM_PID 0xBFDC
+
++/* NZR SEM 16+ USB (http://www.nzr.de) */
++#define FTDI_NZR_SEM_USB_PID 0xC1E0 /* NZR SEM-LOG16+ */
++
+ /*
+ * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
+ */
--- /dev/null
+From 296365781903226a3fb8758901eaeec09d2798e4 Mon Sep 17 00:00:00 2001
+From: Moiz Sonasath <m-sonasath@ti.com>
+Date: Wed, 5 Sep 2012 08:34:26 +0300
+Subject: usb: host: xhci: fix compilation error for non-PCI based stacks
+
+From: Moiz Sonasath <m-sonasath@ti.com>
+
+commit 296365781903226a3fb8758901eaeec09d2798e4 upstream.
+
+For non PCI-based stacks, this function call
+usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
+made from xhci_shutdown is not applicable.
+
+Ideally, we wouldn't have any PCI-specific code on
+a generic driver such as the xHCI stack, but it looks
+like we should just stub usb_disable_xhci_ports() out
+for non-PCI devices.
+
+[ balbi@ti.com: slight improvement to commit log ]
+
+This patch should be backported to kernels as old as 3.0, since the
+commit it fixes (e95829f474f0db3a4d940cae1423783edd966027 "xhci: Switch
+PPT ports to EHCI on shutdown.") was marked for stable.
+
+Signed-off-by: Moiz Sonasath<m-sonasath@ti.com>
+Signed-off-by: Ruchika Kharwar <ruchika@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/pci-quirks.h
++++ b/drivers/usb/host/pci-quirks.h
+@@ -15,6 +15,7 @@ void usb_disable_xhci_ports(struct pci_d
+ static inline void usb_amd_quirk_pll_disable(void) {}
+ static inline void usb_amd_quirk_pll_enable(void) {}
+ static inline void usb_amd_dev_put(void) {}
++static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
+ #endif /* CONFIG_PCI */
+
+ #endif /* __LINUX_USB_PCI_QUIRKS_H */
--- /dev/null
+From 052c7f9ffb0e95843e75448d02664459253f9ff8 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 13 Aug 2012 19:57:03 +0300
+Subject: xhci: Fix a logical vs bitwise AND bug
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 052c7f9ffb0e95843e75448d02664459253f9ff8 upstream.
+
+The intent was to test whether the flag was set.
+
+This patch should be backported to stable kernels as old as 3.0, since
+it fixes a bug in commit e95829f474f0db3a4d940cae1423783edd966027 "xhci:
+Switch PPT ports to EHCI on shutdown.", which was marked for stable.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -594,7 +594,7 @@ void xhci_shutdown(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+
+- if (xhci->quirks && XHCI_SPURIOUS_REBOOT)
++ if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
+ usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
+
+ spin_lock_irq(&xhci->lock);
--- /dev/null
+From 50d0206fcaea3e736f912fd5b00ec6233fb4ce44 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Thu, 26 Jul 2012 12:03:59 -0700
+Subject: xhci: Fix bug after deq ptr set to link TRB.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 50d0206fcaea3e736f912fd5b00ec6233fb4ce44 upstream.
+
+This patch fixes a particularly nasty bug that was revealed by the ring
+expansion patches. The bug has been present since the very beginning of
+the xHCI driver history, and could have caused general protection faults
+from bad memory accesses.
+
+The first thing to note is that a Set TR Dequeue Pointer command can
+move the dequeue pointer to a link TRB, if the canceled or stalled
+transfer TD ended just before a link TRB. The function to increment the
+dequeue pointer, inc_deq, was written before cancellation and stall
+support was added. It assumed that the dequeue pointer could never
+point to a link TRB. It would unconditionally increment the dequeue
+pointer at the start of the function, check if the pointer was now on a
+link TRB, and move it to the top of the next segment if so.
+
+This means that if a Set TR Dequeue Point command moved the dequeue
+pointer to a link TRB, a subsequent call to inc_deq() would move the
+pointer off the segment and into la-la-land. It would then read from
+that memory to determine if it was a link TRB. Other functions would
+often call inc_deq() until the dequeue pointer matched some other
+pointer, which means this function would quite happily read all of
+system memory before wrapping around to the right pointer value.
+
+Often, there would be another endpoint segment from a different ring
+allocated from the same DMA pool, which would be contiguous to the
+segment inc_deq just stepped off of. inc_deq would eventually find the
+link TRB in that segment, and blindly move the dequeue pointer back to
+the top of the correct ring segment.
+
+The only reason the original code worked at all is because there was
+only one ring segment. With the ring expansion patches, the dequeue
+pointer would eventually wrap into place, but the dequeue segment would
+be out-of-sync. On the second TD after the dequeue pointer was moved to
+a link TRB, trb_in_td() would fail (because the dequeue pointer and
+dequeue segment were out-of-sync), and this message would appear:
+
+ERROR Transfer event TRB DMA ptr not part of current TD
+
+This fixes bugzilla entry 4333 (option-based modem unhappy on USB 3.0
+port: "Transfer event TRB DMA ptr not part of current TD", "rejecting
+I/O to offline device"),
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=43333
+
+and possibly other general protection fault bugs as well.
+
+This patch should be backported to kernels as old as 2.6.31. A separate
+patch will be created for kernels older than 3.4, since inc_deq was
+modified in 3.4 and this patch will not apply.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Tested-by: James Ettle <theholyettlz@googlemail.com>
+Tested-by: Matthew Hall <mhall@mhcomputing.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 39 ++++++++++++++++++++++++---------------
+ 1 file changed, 24 insertions(+), 15 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -147,25 +147,34 @@ static void next_trb(struct xhci_hcd *xh
+ */
+ static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer)
+ {
+- union xhci_trb *next = ++(ring->dequeue);
+ unsigned long long addr;
+
+ ring->deq_updates++;
+- /* Update the dequeue pointer further if that was a link TRB or we're at
+- * the end of an event ring segment (which doesn't have link TRBS)
+- */
+- while (last_trb(xhci, ring, ring->deq_seg, next)) {
+- if (consumer && last_trb_on_last_seg(xhci, ring, ring->deq_seg, next)) {
+- ring->cycle_state = (ring->cycle_state ? 0 : 1);
+- if (!in_interrupt())
+- xhci_dbg(xhci, "Toggle cycle state for ring %p = %i\n",
+- ring,
+- (unsigned int) ring->cycle_state);
++
++ do {
++ /*
++ * Update the dequeue pointer further if that was a link TRB or
++ * we're at the end of an event ring segment (which doesn't have
++ * link TRBS)
++ */
++ if (last_trb(xhci, ring, ring->deq_seg, ring->dequeue)) {
++ if (consumer && last_trb_on_last_seg(xhci, ring,
++ ring->deq_seg, ring->dequeue)) {
++ if (!in_interrupt())
++ xhci_dbg(xhci, "Toggle cycle state "
++ "for ring %p = %i\n",
++ ring,
++ (unsigned int)
++ ring->cycle_state);
++ ring->cycle_state = (ring->cycle_state ? 0 : 1);
++ }
++ ring->deq_seg = ring->deq_seg->next;
++ ring->dequeue = ring->deq_seg->trbs;
++ } else {
++ ring->dequeue++;
+ }
+- ring->deq_seg = ring->deq_seg->next;
+- ring->dequeue = ring->deq_seg->trbs;
+- next = ring->dequeue;
+- }
++ } while (last_trb(xhci, ring, ring->deq_seg, ring->dequeue));
++
+ addr = (unsigned long long) xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue);
+ }
+
--- /dev/null
+From e955a1cd086de4d165ae0f4c7be7289d84b63bdc Mon Sep 17 00:00:00 2001
+From: Matthew Garrett <mjg@redhat.com>
+Date: Tue, 14 Aug 2012 16:44:49 -0400
+Subject: xhci: Make handover code more robust
+
+From: Matthew Garrett <mjg@redhat.com>
+
+commit e955a1cd086de4d165ae0f4c7be7289d84b63bdc upstream.
+
+My test platform (Intel DX79SI) boots reliably under BIOS, but frequently
+crashes when booting via UEFI. I finally tracked this down to the xhci
+handoff code. It seems that reads from the device occasionally just return
+0xff, resulting in xhci_find_next_cap_offset generating a value that's
+larger than the resource region. We then oops when attempting to read the
+value. Sanity checking that value lets us avoid the crash.
+
+I've no idea what's causing the underlying problem, and xhci still doesn't
+actually *work* even with this, but the machine at least boots which will
+probably make further debugging easier.
+
+This should be backported to kernels as old as 2.6.31, that contain the
+commit 66d4eadd8d067269ea8fead1a50fe87c2979a80d "USB: xhci: BIOS handoff
+and HW initialization."
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -839,12 +839,12 @@ static void __devinit quirk_usb_handoff_
+ void __iomem *op_reg_base;
+ u32 val;
+ int timeout;
++ int len = pci_resource_len(pdev, 0);
+
+ if (!mmio_resource_enabled(pdev, 0))
+ return;
+
+- base = ioremap_nocache(pci_resource_start(pdev, 0),
+- pci_resource_len(pdev, 0));
++ base = ioremap_nocache(pci_resource_start(pdev, 0), len);
+ if (base == NULL)
+ return;
+
+@@ -854,9 +854,17 @@ static void __devinit quirk_usb_handoff_
+ */
+ ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
+ do {
++ if ((ext_cap_offset + sizeof(val)) > len) {
++ /* We're reading garbage from the controller */
++ dev_warn(&pdev->dev,
++ "xHCI controller failing to respond");
++ return;
++ }
++
+ if (!ext_cap_offset)
+ /* We've reached the end of the extended capabilities */
+ goto hc_init;
++
+ val = readl(base + ext_cap_offset);
+ if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
+ break;
--- /dev/null
+From 29d214576f936db627ff62afb9ef438eea18bcd2 Mon Sep 17 00:00:00 2001
+From: Manoj Iyer <manoj.iyer@canonical.com>
+Date: Wed, 22 Aug 2012 11:53:18 -0500
+Subject: xhci: Recognize USB 3.0 devices as superspeed at powerup
+
+From: Manoj Iyer <manoj.iyer@canonical.com>
+
+commit 29d214576f936db627ff62afb9ef438eea18bcd2 upstream.
+
+On Intel Panther Point chipset USB 3.0 devices show up as
+high-speed devices on powerup, but after an s3 cycle they are
+correctly recognized as SuperSpeed. At powerup switch the port
+to xHCI so that USB 3.0 devices are correctly recognized.
+
+BugLink: http://bugs.launchpad.net/bugs/1000424
+
+This patch should be backported to kernels as old as 3.0, that contain
+commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support
+EHCI/xHCI port switching."
+
+Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -895,9 +895,10 @@ static void __devinit quirk_usb_handoff_
+ /* Disable any BIOS SMIs and clear all SMI events*/
+ writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
+
++hc_init:
+ if (usb_is_intel_switchable_xhci(pdev))
+ usb_enable_xhci_ports(pdev);
+-hc_init:
++
+ op_reg_base = base + XHCI_HC_LENGTH(readl(base));
+
+ /* Wait for the host controller to be ready before writing any
projects / thirdparty / kernel / stable-queue.git / commitdiff
