--- /dev/null
+From 81ef447950bf0955aca46f4a7617d8ce435cf0ce Mon Sep 17 00:00:00 2001
+From: Gary Bisson <bisson.gary@gmail.com>
+Date: Wed, 3 Dec 2014 15:03:51 -0800
+Subject: ARM: clk-imx6q: fix video divider for rev T0 1.0
+
+From: Gary Bisson <bisson.gary@gmail.com>
+
+commit 81ef447950bf0955aca46f4a7617d8ce435cf0ce upstream.
+
+The post dividers do not work on i.MX6Q rev T0 1.0 so they must be fixed
+to 1. As the table index was wrong, a divider a of 4 could still be
+requested which implied the clock not to be set properly. This is the
+root cause of the HDMI not working at high resolution on rev T0 1.0 of
+the SoC.
+
+Signed-off-by: Gary Bisson <bisson.gary@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/clk-imx6q.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-imx/clk-imx6q.c
++++ b/arch/arm/mach-imx/clk-imx6q.c
+@@ -161,7 +161,7 @@ static void __init imx6q_clocks_init(str
+ post_div_table[1].div = 1;
+ post_div_table[2].div = 1;
+ video_div_table[1].div = 1;
+- video_div_table[2].div = 1;
++ video_div_table[3].div = 1;
+ }
+
+ /* type name parent_name base div_mask */
--- /dev/null
+From 7a87e9cbc3a2f0ff0955815335e08c9862359130 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@freescale.com>
+Date: Fri, 5 Dec 2014 16:16:07 -0200
+Subject: ARM: dts: imx25: Fix the SPI1 clocks
+
+From: Fabio Estevam <fabio.estevam@freescale.com>
+
+commit 7a87e9cbc3a2f0ff0955815335e08c9862359130 upstream.
+
+From Documentation/devicetree/bindings/clock/imx25-clock.txt:
+
+ cspi1_ipg 78
+ cspi2_ipg 79
+ cspi3_ipg 80
+
+, so fix the SPI1 clocks accordingly to avoid a kernel hang when trying to
+access SPI1.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx25.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -158,7 +158,7 @@
+ #size-cells = <0>;
+ compatible = "fsl,imx25-cspi", "fsl,imx35-cspi";
+ reg = <0x43fa4000 0x4000>;
+- clocks = <&clks 62>, <&clks 62>;
++ clocks = <&clks 78>, <&clks 78>;
+ clock-names = "ipg", "per";
+ interrupts = <14>;
+ status = "disabled";
--- /dev/null
+From d2a10a1727b3948019128e83162f22c65859f1fd Mon Sep 17 00:00:00 2001
+From: Dmitry Voytik <voytikd@gmail.com>
+Date: Thu, 6 Nov 2014 22:46:20 +0400
+Subject: ARM: imx6q: drop unnecessary semicolon
+
+From: Dmitry Voytik <voytikd@gmail.com>
+
+commit d2a10a1727b3948019128e83162f22c65859f1fd upstream.
+
+Drop unnecessary semicolon after closing curly bracket.
+
+Signed-off-by: Dmitry Voytik <voytikd@gmail.com>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/clk-imx6q.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-imx/clk-imx6q.c
++++ b/arch/arm/mach-imx/clk-imx6q.c
+@@ -162,7 +162,7 @@ static void __init imx6q_clocks_init(str
+ post_div_table[2].div = 1;
+ video_div_table[1].div = 1;
+ video_div_table[2].div = 1;
+- };
++ }
+
+ /* type name parent_name base div_mask */
+ clk[pll1_sys] = imx_clk_pllv3(IMX_PLLV3_SYS, "pll1_sys", "osc", base, 0x7f);
--- /dev/null
+From 572b24e6d85d98cdc552f07e9fb9870d9460d81b Mon Sep 17 00:00:00 2001
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+Date: Mon, 5 Jan 2015 15:45:45 -0800
+Subject: ARM: omap5/dra7xx: Fix frequency typos
+
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+
+commit 572b24e6d85d98cdc552f07e9fb9870d9460d81b upstream.
+
+The switch statement of the possible list of SYSCLK1 frequencies is
+missing a 0 in 4 out of the 7 frequencies.
+
+Fixes: fa6d79d27614 ("ARM: OMAP: Add initialisation for the real-time counter")
+Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
+Reviewed-by: Lokesh Vutla <lokeshvutla@ti.com>
+Acked-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/timer.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-omap2/timer.c
++++ b/arch/arm/mach-omap2/timer.c
+@@ -513,11 +513,11 @@ static void __init realtime_counter_init
+ rate = clk_get_rate(sys_clk);
+ /* Numerator/denumerator values refer TRM Realtime Counter section */
+ switch (rate) {
+- case 1200000:
++ case 12000000:
+ num = 64;
+ den = 125;
+ break;
+- case 1300000:
++ case 13000000:
+ num = 768;
+ den = 1625;
+ break;
+@@ -529,11 +529,11 @@ static void __init realtime_counter_init
+ num = 192;
+ den = 625;
+ break;
+- case 2600000:
++ case 26000000:
+ num = 384;
+ den = 1625;
+ break;
+- case 2700000:
++ case 27000000:
+ num = 256;
+ den = 1125;
+ break;
--- /dev/null
+From b0ddb319db3d7a1943445f0de0a45c07a7f3457a Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 6 Jan 2015 14:39:10 +0100
+Subject: ARM: shmobile: sh73a0 legacy: Set .control_parent for all irqpin instances
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit b0ddb319db3d7a1943445f0de0a45c07a7f3457a upstream.
+
+The sh73a0 INTC can't mask interrupts properly most likely due to a
+hardware bug. Set the .control_parent flag to delegate masking to the
+parent interrupt controller, like was already done for irqpin1.
+
+Without this, accessing the three-axis digital accelerometer ADXL345
+on kzm9g through /dev/input/event1 causes an interrupt storm, which
+requires a power-cycle to recover from.
+
+This was inspired by a patch for arch/arm/boot/dts/sh73a0.dtsi from
+Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Fixes: 341eb5465f67437a ("ARM: shmobile: INTC External IRQ pin driver on sh73a0")
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-shmobile/setup-sh73a0.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm/mach-shmobile/setup-sh73a0.c
++++ b/arch/arm/mach-shmobile/setup-sh73a0.c
+@@ -617,6 +617,7 @@ static struct platform_device ipmmu_devi
+
+ static struct renesas_intc_irqpin_config irqpin0_platform_data = {
+ .irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */
++ .control_parent = true,
+ };
+
+ static struct resource irqpin0_resources[] = {
+@@ -678,6 +679,7 @@ static struct platform_device irqpin1_de
+
+ static struct renesas_intc_irqpin_config irqpin2_platform_data = {
+ .irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */
++ .control_parent = true,
+ };
+
+ static struct resource irqpin2_resources[] = {
+@@ -708,6 +710,7 @@ static struct platform_device irqpin2_de
+
+ static struct renesas_intc_irqpin_config irqpin3_platform_data = {
+ .irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */
++ .control_parent = true,
+ };
+
+ static struct resource irqpin3_resources[] = {
--- /dev/null
+From b442723fcec445fb0ae1104888dd22cd285e0a91 Mon Sep 17 00:00:00 2001
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+Date: Mon, 5 Jan 2015 12:49:10 -0500
+Subject: can: kvaser_usb: Don't free packets when tight on URBs
+
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+
+commit b442723fcec445fb0ae1104888dd22cd285e0a91 upstream.
+
+Flooding the Kvaser CAN to USB dongle with multiple reads and
+writes in high frequency caused seemingly-random panics in the
+kernel.
+
+On further inspection, it seems the driver erroneously freed the
+to-be-transmitted packet upon getting tight on URBs and returning
+NETDEV_TX_BUSY, leading to invalid memory writes and double frees
+at a later point in time.
+
+Note:
+
+Finding no more URBs/transmit-contexts and returning NETDEV_TX_BUSY
+is a driver bug in and out of itself: it means that our start/stop
+queue flow control is broken.
+
+This patch only fixes the (buggy) error handling code; the root
+cause shall be fixed in a later commit.
+
+Acked-by: Olivier Sobrie <olivier@sobrie.be>
+Signed-off-by: Ahmed S. Darwish <ahmed.darwish@valeo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1285,12 +1285,14 @@ static netdev_tx_t kvaser_usb_start_xmit
+ if (!urb) {
+ netdev_err(netdev, "No memory left for URBs\n");
+ stats->tx_dropped++;
+- goto nourbmem;
++ dev_kfree_skb(skb);
++ return NETDEV_TX_OK;
+ }
+
+ buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC);
+ if (!buf) {
+ stats->tx_dropped++;
++ dev_kfree_skb(skb);
+ goto nobufmem;
+ }
+
+@@ -1325,6 +1327,7 @@ static netdev_tx_t kvaser_usb_start_xmit
+ }
+ }
+
++ /* This should never happen; it implies a flow control bug */
+ if (!context) {
+ netdev_warn(netdev, "cannot find free context\n");
+ ret = NETDEV_TX_BUSY;
+@@ -1355,9 +1358,6 @@ static netdev_tx_t kvaser_usb_start_xmit
+ if (unlikely(err)) {
+ can_free_echo_skb(netdev, context->echo_index);
+
+- skb = NULL; /* set to NULL to avoid double free in
+- * dev_kfree_skb(skb) */
+-
+ atomic_dec(&priv->active_tx_urbs);
+ usb_unanchor_urb(urb);
+
+@@ -1379,8 +1379,6 @@ releasebuf:
+ kfree(buf);
+ nobufmem:
+ usb_free_urb(urb);
+-nourbmem:
+- dev_kfree_skb(skb);
+ return ret;
+ }
+
--- /dev/null
+From 5e7e6e0c9b47a45576c38b4a72d67927a5e049f7 Mon Sep 17 00:00:00 2001
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+Date: Mon, 5 Jan 2015 12:57:13 -0500
+Subject: can: kvaser_usb: Don't send a RESET_CHIP for non-existing channels
+
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+
+commit 5e7e6e0c9b47a45576c38b4a72d67927a5e049f7 upstream.
+
+Recent Leaf firmware versions (>= 3.1.557) do not allow to send
+commands for non-existing channels. If a command is sent for a
+non-existing channel, the firmware crashes.
+
+Reported-by: Christopher Storah <Christopher.Storah@invetech.com.au>
+Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
+Signed-off-by: Ahmed S. Darwish <ahmed.darwish@valeo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1493,6 +1493,10 @@ static int kvaser_usb_init_one(struct us
+ struct kvaser_usb_net_priv *priv;
+ int i, err;
+
++ err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
++ if (err)
++ return err;
++
+ netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
+ if (!netdev) {
+ dev_err(&intf->dev, "Cannot alloc candev\n");
+@@ -1596,9 +1600,6 @@ static int kvaser_usb_probe(struct usb_i
+
+ usb_set_intfdata(intf, dev);
+
+- for (i = 0; i < MAX_NET_DEVICES; i++)
+- kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i);
+-
+ err = kvaser_usb_get_software_info(dev);
+ if (err) {
+ dev_err(&intf->dev,
--- /dev/null
+From 889b77f7fd2bcc922493d73a4c51d8a851505815 Mon Sep 17 00:00:00 2001
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+Date: Mon, 5 Jan 2015 12:52:06 -0500
+Subject: can: kvaser_usb: Reset all URB tx contexts upon channel close
+
+From: "Ahmed S. Darwish" <ahmed.darwish@valeo.com>
+
+commit 889b77f7fd2bcc922493d73a4c51d8a851505815 upstream.
+
+Flooding the Kvaser CAN to USB dongle with multiple reads and
+writes in very high frequency (*), closing the CAN channel while
+all the transmissions are on (#), opening the device again (@),
+then sending a small number of packets would make the driver
+enter an almost infinite loop of:
+
+[....]
+[15959.853988] kvaser_usb 4-3:1.0 can0: cannot find free context
+[15959.853990] kvaser_usb 4-3:1.0 can0: cannot find free context
+[15959.853991] kvaser_usb 4-3:1.0 can0: cannot find free context
+[15959.853993] kvaser_usb 4-3:1.0 can0: cannot find free context
+[15959.853994] kvaser_usb 4-3:1.0 can0: cannot find free context
+[15959.853995] kvaser_usb 4-3:1.0 can0: cannot find free context
+[....]
+
+_dragging the whole system down_ in the process due to the
+excessive logging output.
+
+Initially, this has caused random panics in the kernel due to a
+buggy error recovery path. That got fixed in an earlier commit.(%)
+This patch aims at solving the root cause. -->
+
+16 tx URBs and contexts are allocated per CAN channel per USB
+device. Such URBs are protected by:
+
+a) A simple atomic counter, up to a value of MAX_TX_URBS (16)
+b) A flag in each URB context, stating if it's free
+c) The fact that ndo_start_xmit calls are themselves protected
+ by the networking layers higher above
+
+After grabbing one of the tx URBs, if the driver noticed that all
+of them are now taken, it stops the netif transmission queue.
+Such queue is worken up again only if an acknowedgment was received
+from the firmware on one of our earlier-sent frames.
+
+Meanwhile, upon channel close (#), the driver sends a CMD_STOP_CHIP
+to the firmware, effectively closing all further communication. In
+the high traffic case, the atomic counter remains at MAX_TX_URBS,
+and all the URB contexts remain marked as active. While opening
+the channel again (@), it cannot send any further frames since no
+more free tx URB contexts are available.
+
+Reset all tx URB contexts upon CAN channel close.
+
+(*) 50 parallel instances of `cangen0 -g 0 -ix`
+(#) `ifconfig can0 down`
+(@) `ifconfig can0 up`
+(%) "can: kvaser_usb: Don't free packets when tight on URBs"
+
+Signed-off-by: Ahmed S. Darwish <ahmed.darwish@valeo.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -1237,6 +1237,9 @@ static int kvaser_usb_close(struct net_d
+ if (err)
+ netdev_warn(netdev, "Cannot stop device, error %d\n", err);
+
++ /* reset tx contexts */
++ kvaser_usb_unlink_tx_urbs(priv);
++
+ priv->can.state = CAN_STATE_STOPPED;
+ close_candev(priv->netdev);
+
--- /dev/null
+From b5c8afe5be51078a979d86ae5ae78c4ac948063d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 12 Dec 2014 16:58:05 -0800
+Subject: decompress_bunzip2: off by one in get_next_block()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit b5c8afe5be51078a979d86ae5ae78c4ac948063d upstream.
+
+"origPtr" is used as an offset into the bd->dbuf[] array. That array is
+allocated in start_bunzip() and has "bd->dbufSize" number of elements so
+the test here should be >= instead of >.
+
+Later we check "origPtr" again before using it as an offset so I don't
+know if this bug can be triggered in real life.
+
+Fixes: bc22c17e12c1 ('bzip2/lzma: library support for gzip, bzip2 and lzma decompression')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Alain Knaff <alain@knaff.lu>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/decompress_bunzip2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/decompress_bunzip2.c
++++ b/lib/decompress_bunzip2.c
+@@ -184,7 +184,7 @@ static int INIT get_next_block(struct bu
+ if (get_bits(bd, 1))
+ return RETVAL_OBSOLETE_INPUT;
+ origPtr = get_bits(bd, 24);
+- if (origPtr > dbufSize)
++ if (origPtr >= dbufSize)
+ return RETVAL_DATA_ERROR;
+ /* mapping table: if some byte values are never used (encoding things
+ like ascii text), the compression code removes the gaps to have fewer
--- /dev/null
+From 9333caeaeae4f831054e0e127a6ed3948b604d3e Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Thu, 8 Jan 2015 14:53:23 -0800
+Subject: Input: I8042 - add Acer Aspire 7738 to the nomux list
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 9333caeaeae4f831054e0e127a6ed3948b604d3e upstream.
+
+When KBC is in active multiplexing mode the touchpad on this laptop does
+not work.
+
+Reported-by: Bilal Koc <koc.bilo@googlemail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -408,6 +408,13 @@ static const struct dmi_system_id __init
+ },
+ },
+ {
++ /* Acer Aspire 7738 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
++ },
++ },
++ {
+ /* Gericom Bellagio */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
--- /dev/null
+From 148e9a711e034e06310a8c36b64957934ebe30f2 Mon Sep 17 00:00:00 2001
+From: Srihari Vijayaraghavan <linux.bug.reporting@gmail.com>
+Date: Wed, 7 Jan 2015 16:25:53 -0800
+Subject: Input: i8042 - reset keyboard to fix Elantech touchpad detection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srihari Vijayaraghavan <linux.bug.reporting@gmail.com>
+
+commit 148e9a711e034e06310a8c36b64957934ebe30f2 upstream.
+
+On some laptops, keyboard needs to be reset in order to successfully detect
+touchpad (e.g., some Gigabyte laptop models with Elantech touchpads).
+Without resettin keyboard touchpad pretends to be completely dead.
+
+Based on the original patch by Mateusz Jończyk this version has been
+expanded to include DMI based detection & application of the fix
+automatically on the affected models of laptops. This has been confirmed to
+fix problem by three users already on three different models of laptops.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81331
+Signed-off-by: Srihari Vijayaraghavan <linux.bug.reporting@gmail.com>
+Acked-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
+Tested-by: Srihari Vijayaraghavan <linux.bug.reporting@gmail.com>
+Tested by: Zakariya Dehlawi <zdehlawi@gmail.com>
+Tested-by: Guillaum Bouchard <guillaum.bouchard@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/kernel-parameters.txt | 1 +
+ drivers/input/serio/i8042-x86ia64io.h | 32 ++++++++++++++++++++++++++++++++
+ drivers/input/serio/i8042.c | 14 ++++++++++++++
+ 3 files changed, 47 insertions(+)
+
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -1172,6 +1172,7 @@ bytes respectively. Such letter suffixes
+ i8042.notimeout [HW] Ignore timeout condition signalled by controller
+ i8042.reset [HW] Reset the controller during init and cleanup
+ i8042.unlock [HW] Unlock (ignore) the keylock
++ i8042.kbdreset [HW] Reset device connected to KBD port
+
+ i810= [HW,DRM]
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -721,6 +721,35 @@ static const struct dmi_system_id __init
+ { }
+ };
+
++/*
++ * Some laptops need keyboard reset before probing for the trackpad to get
++ * it detected, initialised & finally work.
++ */
++static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
++ {
++ /* Gigabyte P35 v2 - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
++ },
++ },
++ {
++ /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
++ },
++ },
++ {
++ /* Gigabyte P34 - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
++ },
++ },
++ { }
++};
++
+ #endif /* CONFIG_X86 */
+
+ #ifdef CONFIG_PNP
+@@ -1016,6 +1045,9 @@ static int __init i8042_platform_init(vo
+ if (dmi_check_system(i8042_dmi_dritek_table))
+ i8042_dritek = true;
+
++ if (dmi_check_system(i8042_dmi_kbdreset_table))
++ i8042_kbdreset = true;
++
+ /*
+ * A20 was already enabled during early kernel init. But some buggy
+ * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -67,6 +67,10 @@ static bool i8042_notimeout;
+ module_param_named(notimeout, i8042_notimeout, bool, 0);
+ MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
+
++static bool i8042_kbdreset;
++module_param_named(kbdreset, i8042_kbdreset, bool, 0);
++MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port");
++
+ #ifdef CONFIG_X86
+ static bool i8042_dritek;
+ module_param_named(dritek, i8042_dritek, bool, 0);
+@@ -790,6 +794,16 @@ static int __init i8042_check_aux(void)
+ return -1;
+
+ /*
++ * Reset keyboard (needed on some laptops to successfully detect
++ * touchpad, e.g., some Gigabyte laptop models with Elantech
++ * touchpads).
++ */
++ if (i8042_kbdreset) {
++ pr_warn("Attempting to reset device connected to KBD port\n");
++ i8042_kbd_write(NULL, (unsigned char) 0xff);
++ }
++
++/*
+ * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and
+ * used it for a PCI card or somethig else.
+ */
usb-keyspan-fix-null-deref-at-probe.patch
usb-console-fix-uninitialised-ldisc-semaphore.patch
usb-console-fix-potential-use-after-free.patch
+usb-ehci-fix-initialization-bug-in-iso_stream_schedule.patch
+usb-musb-stuff-leak-of-struct-usb_hcd.patch
+can-kvaser_usb-don-t-free-packets-when-tight-on-urbs.patch
+can-kvaser_usb-reset-all-urb-tx-contexts-upon-channel-close.patch
+can-kvaser_usb-don-t-send-a-reset_chip-for-non-existing-channels.patch
+input-i8042-reset-keyboard-to-fix-elantech-touchpad-detection.patch
+input-i8042-add-acer-aspire-7738-to-the-nomux-list.patch
+arm-dts-imx25-fix-the-spi1-clocks.patch
+arm-imx6q-drop-unnecessary-semicolon.patch
+arm-clk-imx6q-fix-video-divider-for-rev-t0-1.0.patch
+arm-omap5-dra7xx-fix-frequency-typos.patch
+arm-shmobile-sh73a0-legacy-set-.control_parent-for-all-irqpin-instances.patch
+decompress_bunzip2-off-by-one-in-get_next_block.patch
+um-skip-futex_atomic_cmpxchg_inatomic-test.patch
+x86-um-actually-mark-system-call-tables-readonly.patch
--- /dev/null
+From f911d731054ab3d82ee72a16b889e17ca3a2332a Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Wed, 10 Dec 2014 13:53:51 +0100
+Subject: um: Skip futex_atomic_cmpxchg_inatomic() test
+
+From: Richard Weinberger <richard@nod.at>
+
+commit f911d731054ab3d82ee72a16b889e17ca3a2332a upstream.
+
+futex_atomic_cmpxchg_inatomic() does not work on UML because
+it triggers a copy_from_user() in kernel context.
+On UML copy_from_user() can only be used if the kernel was called
+by a real user space process such that UML can use ptrace()
+to fetch the value.
+
+Reported-by: Miklos Szeredi <miklos@szeredi.hu>
+Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Tested-by: Daniel Walter <d.walter@0x90.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/um/Kconfig.common | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/um/Kconfig.common
++++ b/arch/um/Kconfig.common
+@@ -2,6 +2,7 @@ config UML
+ bool
+ default y
+ select HAVE_UID16
++ select HAVE_FUTEX_CMPXCHG if FUTEX
+ select GENERIC_IRQ_SHOW
+ select GENERIC_CPU_DEVICES
+ select GENERIC_IO
--- /dev/null
+From 6d89252a998a695ecb0348fc2d717dc33d90cae9 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 4 Dec 2014 10:21:56 -0500
+Subject: USB: EHCI: fix initialization bug in iso_stream_schedule()
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 6d89252a998a695ecb0348fc2d717dc33d90cae9 upstream.
+
+Commit c3ee9b76aa93 (EHCI: improved logic for isochronous scheduling)
+introduced the idea of using ehci->last_iso_frame as the origin (or
+base) for the circular calculations involved in modifying the
+isochronous schedule. However, the new code it added used
+ehci->last_iso_frame before the value was properly initialized. This
+patch rectifies the mistake by moving the initialization lines earlier
+in iso_stream_schedule().
+
+This fixes Bugzilla #72891.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Fixes: c3ee9b76aa93
+Reported-by: Joe Bryant <tenminjoe@yahoo.com>
+Tested-by: Joe Bryant <tenminjoe@yahoo.com>
+Tested-by: Martin Long <martin@longhome.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-sched.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1581,6 +1581,10 @@ iso_stream_schedule (
+ else
+ next = (now + 2 + 7) & ~0x07; /* full frame cache */
+
++ /* If needed, initialize last_iso_frame so that this URB will be seen */
++ if (ehci->isoc_count == 0)
++ ehci->last_iso_frame = now >> 3;
++
+ /*
+ * Use ehci->last_iso_frame as the base. There can't be any
+ * TDs scheduled for earlier than that.
+@@ -1671,10 +1675,6 @@ iso_stream_schedule (
+ urb->start_frame = start & (mod - 1);
+ if (!stream->highspeed)
+ urb->start_frame >>= 3;
+-
+- /* Make sure scan_isoc() sees these */
+- if (ehci->isoc_count == 0)
+- ehci->last_iso_frame = now >> 3;
+ return status;
+
+ fail:
--- /dev/null
+From 68693b8ea4e284c46bff919ac62bd9ccdfdbb6ba Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 11 Dec 2014 18:14:18 +0100
+Subject: usb: musb: stuff leak of struct usb_hcd
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit 68693b8ea4e284c46bff919ac62bd9ccdfdbb6ba upstream.
+
+since the split of host+gadget mode in commit 74c2e9360058 ("usb: musb:
+factor out hcd initalization") we leak the usb_hcd struct. We call now
+musb_host_cleanup() which does basically usb_remove_hcd() and also sets
+the hcd variable to NULL. Doing so makes the finall call to
+musb_host_free() basically a nop and the usb_hcd remains around for ever
+without anowner.
+This patch drops that NULL assignment for that reason.
+
+Fixes: 74c2e9360058 ("usb: musb: factor out hcd initalization")
+Cc: Daniel Mack <zonque@gmail.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_host.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -2640,7 +2640,6 @@ void musb_host_cleanup(struct musb *musb
+ if (musb->port_mode == MUSB_PORT_MODE_GADGET)
+ return;
+ usb_remove_hcd(musb->hcd);
+- musb->hcd = NULL;
+ }
+
+ void musb_host_free(struct musb *musb)
--- /dev/null
+From b485342bd79af363c77ef1a421c4a0aef2de9812 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <dborkman@redhat.com>
+Date: Sat, 3 Jan 2015 13:11:10 +0100
+Subject: x86, um: actually mark system call tables readonly
+
+From: Daniel Borkmann <dborkman@redhat.com>
+
+commit b485342bd79af363c77ef1a421c4a0aef2de9812 upstream.
+
+Commit a074335a370e ("x86, um: Mark system call tables readonly") was
+supposed to mark the sys_call_table in UML as RO by adding the const,
+but it doesn't have the desired effect as it's nevertheless being placed
+into the data section since __cacheline_aligned enforces sys_call_table
+being placed into .data..cacheline_aligned instead. We need to use
+the ____cacheline_aligned version instead to fix this issue.
+
+Before:
+
+$ nm -v arch/x86/um/sys_call_table_64.o | grep -1 "sys_call_table"
+ U sys_writev
+0000000000000000 D sys_call_table
+0000000000000000 D syscall_table_size
+
+After:
+
+$ nm -v arch/x86/um/sys_call_table_64.o | grep -1 "sys_call_table"
+ U sys_writev
+0000000000000000 R sys_call_table
+0000000000000000 D syscall_table_size
+
+Fixes: a074335a370e ("x86, um: Mark system call tables readonly")
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/um/sys_call_table_32.c | 2 +-
+ arch/x86/um/sys_call_table_64.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/um/sys_call_table_32.c
++++ b/arch/x86/um/sys_call_table_32.c
+@@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t
+
+ extern asmlinkage void sys_ni_syscall(void);
+
+-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
+ /*
+ * Smells like a compiler bug -- it doesn't work
+ * when the & below is removed.
+--- a/arch/x86/um/sys_call_table_64.c
++++ b/arch/x86/um/sys_call_table_64.c
+@@ -46,7 +46,7 @@ typedef void (*sys_call_ptr_t)(void);
+
+ extern void sys_ni_syscall(void);
+
+-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
+ /*
+ * Smells like a compiler bug -- it doesn't work
+ * when the & below is removed.
projects / thirdparty / kernel / stable-queue.git / commitdiff
