--- /dev/null
+From 470f22975448a65a1084a6f0721fa5df15323f02 Mon Sep 17 00:00:00 2001
+From: Boojin Kim <boojin.kim@samsung.com>
+Date: Fri, 27 May 2011 19:04:03 -0700
+Subject: ARM: SAMSUNG: serial: Fix on handling of one clock source
+ for UART
+
+From: Boojin Kim <boojin.kim@samsung.com>
+
+commit 470f22975448a65a1084a6f0721fa5df15323f02 upstream.
+
+This patch fixes the way of comparison for handling of two or more
+clock sources for UART.
+
+For example, if just only one clock source is defined even though
+there are two clock sources for UART, the serial driver does not
+set proper clock up. Of course, it is problem.
+
+So this patch changes the condition of comparison to avoid useless
+setup clock and adds a flag 'NO_NEED_CHECK_CLKSRC' which means
+selection of source clock is not required.
+
+In addition, since the Exynos4210 has only one clock source for UART
+this patch adds the flag into its common_init_uarts().
+
+Signed-off-by: Boojin Kim <boojin.kim@samsung.com>
+Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-exynos4/init.c | 1 +
+ arch/arm/plat-samsung/include/plat/regs-serial.h | 2 ++
+ drivers/tty/serial/s5pv210.c | 4 ++--
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-exynos4/init.c
++++ b/arch/arm/mach-exynos4/init.c
+@@ -35,6 +35,7 @@ void __init exynos4_common_init_uarts(st
+ tcfg->clocks = exynos4_serial_clocks;
+ tcfg->clocks_size = ARRAY_SIZE(exynos4_serial_clocks);
+ }
++ tcfg->flags |= NO_NEED_CHECK_CLKSRC;
+ }
+
+ s3c24xx_init_uartdevs("s5pv210-uart", s5p_uart_resources, cfg, no);
+--- a/arch/arm/plat-samsung/include/plat/regs-serial.h
++++ b/arch/arm/plat-samsung/include/plat/regs-serial.h
+@@ -224,6 +224,8 @@
+ #define S5PV210_UFSTAT_RXMASK (255<<0)
+ #define S5PV210_UFSTAT_RXSHIFT (0)
+
++#define NO_NEED_CHECK_CLKSRC 1
++
+ #ifndef __ASSEMBLY__
+
+ /* struct s3c24xx_uart_clksrc
+--- a/drivers/tty/serial/s5pv210.c
++++ b/drivers/tty/serial/s5pv210.c
+@@ -31,7 +31,7 @@ static int s5pv210_serial_setsource(stru
+ struct s3c2410_uartcfg *cfg = port->dev->platform_data;
+ unsigned long ucon = rd_regl(port, S3C2410_UCON);
+
+- if ((cfg->clocks_size) == 1)
++ if (cfg->flags & NO_NEED_CHECK_CLKSRC)
+ return 0;
+
+ if (strcmp(clk->name, "pclk") == 0)
+@@ -56,7 +56,7 @@ static int s5pv210_serial_getsource(stru
+
+ clk->divisor = 1;
+
+- if ((cfg->clocks_size) == 1)
++ if (cfg->flags & NO_NEED_CHECK_CLKSRC)
+ return 0;
+
+ switch (ucon & S5PV210_UCON_CLKMASK) {
--- /dev/null
+From a99168eece601d2a79ecfcb968ce226f2f30cf98 Mon Sep 17 00:00:00 2001
+From: Nick Kossifidis <mickflemm@gmail.com>
+Date: Thu, 2 Jun 2011 03:09:48 +0300
+Subject: ath5k: Disable fast channel switching by default
+
+From: Nick Kossifidis <mickflemm@gmail.com>
+
+commit a99168eece601d2a79ecfcb968ce226f2f30cf98 upstream.
+
+Disable fast channel change by default on AR2413/AR5413 due to
+some bug reports (it still works for me but it's better to be safe).
+Add a module parameter "fastchanswitch" in case anyone wants to enable
+it and play with it.
+
+Signed-off-by: Nick Kossifidis <mickflemm@gmail.com>
+Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/base.c | 11 ++++++++++-
+ drivers/net/wireless/ath/ath5k/reset.c | 5 ++++-
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -72,6 +72,11 @@ static int modparam_all_channels;
+ module_param_named(all_channels, modparam_all_channels, bool, S_IRUGO);
+ MODULE_PARM_DESC(all_channels, "Expose all channels the device can use.");
+
++static int modparam_fastchanswitch;
++module_param_named(fastchanswitch, modparam_fastchanswitch, bool, S_IRUGO);
++MODULE_PARM_DESC(fastchanswitch, "Enable fast channel switching for AR2413/AR5413 radios.");
++
++
+ /* Module info */
+ MODULE_AUTHOR("Jiri Slaby");
+ MODULE_AUTHOR("Nick Kossifidis");
+@@ -2644,6 +2649,7 @@ ath5k_reset(struct ath5k_softc *sc, stru
+ struct ath5k_hw *ah = sc->ah;
+ struct ath_common *common = ath5k_hw_common(ah);
+ int ret, ani_mode;
++ bool fast;
+
+ ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
+
+@@ -2663,7 +2669,10 @@ ath5k_reset(struct ath5k_softc *sc, stru
+ ath5k_drain_tx_buffs(sc);
+ if (chan)
+ sc->curchan = chan;
+- ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, chan != NULL,
++
++ fast = ((chan != NULL) && modparam_fastchanswitch) ? 1 : 0;
++
++ ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, fast,
+ skip_pcu);
+ if (ret) {
+ ATH5K_ERR(sc, "can't reset hardware (%d)\n", ret);
+--- a/drivers/net/wireless/ath/ath5k/reset.c
++++ b/drivers/net/wireless/ath/ath5k/reset.c
+@@ -1119,8 +1119,11 @@ int ath5k_hw_reset(struct ath5k_hw *ah,
+ /* Non fatal, can happen eg.
+ * on mode change */
+ ret = 0;
+- } else
++ } else {
++ ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_RESET,
++ "fast chan change successful\n");
+ return 0;
++ }
+ }
+
+ /*
--- /dev/null
+From a0b8de350be458b33248e48b2174d9af8a4c4798 Mon Sep 17 00:00:00 2001
+From: "Eugene A. Shatokhin" <dame_eugene@mail.ru>
+Date: Tue, 28 Jun 2011 23:04:51 -0400
+Subject: ath5k: fix memory leak when fewer than N_PD_CURVES are in
+ use
+
+From: "Eugene A. Shatokhin" <dame_eugene@mail.ru>
+
+commit a0b8de350be458b33248e48b2174d9af8a4c4798 upstream.
+
+We would free the proper number of curves, but in the wrong
+slots, due to a missing level of indirection through
+the pdgain_idx table.
+
+It's simpler just to try to free all four slots, so do that.
+
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/eeprom.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -1565,14 +1565,12 @@ ath5k_eeprom_free_pcal_info(struct ath5k
+ if (!chinfo[pier].pd_curves)
+ continue;
+
+- for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
++ for (pdg = 0; pdg < AR5K_EEPROM_N_PD_CURVES; pdg++) {
+ struct ath5k_pdgain_info *pd =
+ &chinfo[pier].pd_curves[pdg];
+
+- if (pd != NULL) {
+- kfree(pd->pd_step);
+- kfree(pd->pd_pwr);
+- }
++ kfree(pd->pd_step);
++ kfree(pd->pd_pwr);
+ }
+
+ kfree(chinfo[pier].pd_curves);
--- /dev/null
+From c31eb8e926835582cd186b33a7a864880a4c0c79 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Date: Tue, 28 Jun 2011 18:21:19 +0530
+Subject: ath9k: Fix suspend/resume when no interface is UP
+
+From: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+
+commit c31eb8e926835582cd186b33a7a864880a4c0c79 upstream.
+
+When no interface has been brought up, the chip's power
+state continued as AWAKE. So during resume, the chip never
+been powered up.
+
+Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/pci.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -278,6 +278,12 @@ static int ath_pci_suspend(struct device
+
+ ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
+
++ /* The device has to be moved to FULLSLEEP forcibly.
++ * Otherwise the chip never moved to full sleep,
++ * when no interface is up.
++ */
++ ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
++
+ return 0;
+ }
+
--- /dev/null
+From b5199515c25cca622495eb9c6a8a1d275e775088 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Thu, 16 Jun 2011 16:22:08 +0200
+Subject: clocksource: Make watchdog robust vs. interruption
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit b5199515c25cca622495eb9c6a8a1d275e775088 upstream.
+
+The clocksource watchdog code is interruptible and it has been
+observed that this can trigger false positives which disable the TSC.
+
+The reason is that an interrupt storm or a long running interrupt
+handler between the read of the watchdog source and the read of the
+TSC brings the two far enough apart that the delta is larger than the
+unstable treshold. Move both reads into a short interrupt disabled
+region to avoid that.
+
+Reported-and-tested-by: Vernon Mauery <vernux@us.ibm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/clocksource.h | 1 +
+ kernel/time/clocksource.c | 24 +++++++++++++-----------
+ 2 files changed, 14 insertions(+), 11 deletions(-)
+
+--- a/include/linux/clocksource.h
++++ b/include/linux/clocksource.h
+@@ -192,6 +192,7 @@ struct clocksource {
+ #ifdef CONFIG_CLOCKSOURCE_WATCHDOG
+ /* Watchdog related data, used by the framework */
+ struct list_head wd_list;
++ cycle_t cs_last;
+ cycle_t wd_last;
+ #endif
+ };
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -185,7 +185,6 @@ static struct clocksource *watchdog;
+ static struct timer_list watchdog_timer;
+ static DECLARE_WORK(watchdog_work, clocksource_watchdog_work);
+ static DEFINE_SPINLOCK(watchdog_lock);
+-static cycle_t watchdog_last;
+ static int watchdog_running;
+
+ static int clocksource_watchdog_kthread(void *data);
+@@ -254,11 +253,6 @@ static void clocksource_watchdog(unsigne
+ if (!watchdog_running)
+ goto out;
+
+- wdnow = watchdog->read(watchdog);
+- wd_nsec = clocksource_cyc2ns((wdnow - watchdog_last) & watchdog->mask,
+- watchdog->mult, watchdog->shift);
+- watchdog_last = wdnow;
+-
+ list_for_each_entry(cs, &watchdog_list, wd_list) {
+
+ /* Clocksource already marked unstable? */
+@@ -268,19 +262,28 @@ static void clocksource_watchdog(unsigne
+ continue;
+ }
+
++ local_irq_disable();
+ csnow = cs->read(cs);
++ wdnow = watchdog->read(watchdog);
++ local_irq_enable();
+
+ /* Clocksource initialized ? */
+ if (!(cs->flags & CLOCK_SOURCE_WATCHDOG)) {
+ cs->flags |= CLOCK_SOURCE_WATCHDOG;
+- cs->wd_last = csnow;
++ cs->wd_last = wdnow;
++ cs->cs_last = csnow;
+ continue;
+ }
+
+- /* Check the deviation from the watchdog clocksource. */
+- cs_nsec = clocksource_cyc2ns((csnow - cs->wd_last) &
++ wd_nsec = clocksource_cyc2ns((wdnow - cs->wd_last) & watchdog->mask,
++ watchdog->mult, watchdog->shift);
++
++ cs_nsec = clocksource_cyc2ns((csnow - cs->cs_last) &
+ cs->mask, cs->mult, cs->shift);
+- cs->wd_last = csnow;
++ cs->cs_last = csnow;
++ cs->wd_last = wdnow;
++
++ /* Check the deviation from the watchdog clocksource. */
+ if (abs(cs_nsec - wd_nsec) > WATCHDOG_THRESHOLD) {
+ clocksource_unstable(cs, cs_nsec - wd_nsec);
+ continue;
+@@ -318,7 +321,6 @@ static inline void clocksource_start_wat
+ return;
+ init_timer(&watchdog_timer);
+ watchdog_timer.function = clocksource_watchdog;
+- watchdog_last = watchdog->read(watchdog);
+ watchdog_timer.expires = jiffies + WATCHDOG_INTERVAL;
+ add_timer_on(&watchdog_timer, cpumask_first(cpu_online_mask));
+ watchdog_running = 1;
--- /dev/null
+From 663dd6dcaf7e95526e469e91f41972a9c0cca30c Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Tue, 17 May 2011 15:25:38 -0700
+Subject: Connector: Correctly set the error code in case of success
+ when dispatching receive callbacks
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit 663dd6dcaf7e95526e469e91f41972a9c0cca30c upstream.
+
+The recent changes to the connector code introduced this bug where even
+when a callback was invoked, we would return an error resulting in
+double freeing of the skb. This patch fixes this bug.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/connector/connector.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/connector/connector.c
++++ b/drivers/connector/connector.c
+@@ -139,6 +139,7 @@ static int cn_call_callback(struct sk_bu
+ spin_unlock_bh(&dev->cbdev->queue_lock);
+
+ if (cbq != NULL) {
++ err = 0;
+ cbq->callback(msg, nsp);
+ kfree_skb(skb);
+ cn_queue_release_callback(cbq);
--- /dev/null
+From ea2c00095c022846dd8dfd211de05154d3e4e1b8 Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Tue, 17 May 2011 15:25:37 -0700
+Subject: Connector: Set the CN_NETLINK_USERS correctly
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit ea2c00095c022846dd8dfd211de05154d3e4e1b8 upstream.
+
+The CN_NETLINK_USERS must be set to the highest valid index +1.
+Thanks to Evgeniy for pointing this out.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/connector.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/connector.h
++++ b/include/linux/connector.h
+@@ -44,7 +44,7 @@
+ #define CN_VAL_DRBD 0x1
+ #define CN_KVP_IDX 0x9 /* HyperV KVP */
+
+-#define CN_NETLINK_USERS 9
++#define CN_NETLINK_USERS 10 /* Highest index + 1 */
+
+ /*
+ * Maximum connector's message size.
--- /dev/null
+From 498e720b96379d8ee9c294950a01534a73defcf3 Mon Sep 17 00:00:00 2001
+From: Daniel J Blueman <daniel.blueman@gmail.com>
+Date: Fri, 17 Jun 2011 11:32:19 -0700
+Subject: drm/i915: Fix gen6 (SNB) missed BLT ring interrupts.
+
+From: Daniel J Blueman <daniel.blueman@gmail.com>
+
+commit 498e720b96379d8ee9c294950a01534a73defcf3 upstream.
+
+The failure appeared in dmesg as:
+
+[drm:i915_hangcheck_ring_idle] *ERROR* Hangcheck timer elapsed... blt
+ring idle [waiting on 35064155, at 35064155], missed IRQ?
+
+This works around that problem on by making the blitter command
+streamer write interrupt state to the Hardware Status Page when a
+MI_USER_INTERRUPT command is decoded, which appears to force the seqno
+out to memory before the interrupt happens.
+
+v1->v2: Moved to prior interrupt handler installation and RMW flags as
+per feedback.
+v2->v3: Removed RMW of flags (by anholt)
+
+Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Tested-by: Chris Wilson <chris@chris-wilson.co.uk> [v1]
+Tested-by: Eric Anholt <eric@anholt.net> [v1,v3]
+ (incidence of the bug with a testcase went from avg 2/1000 to
+ 0/12651 in the latest test run (plus more for v1))
+Tested-by: Kenneth Graunke <kenneth@whitecape.org> [v1]
+Tested-by: Robert Hooker <robert.hooker@canonical.com> [v1]
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=33394
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_irq.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -1567,6 +1567,16 @@ static void ironlake_irq_preinstall(stru
+ drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+
+ I915_WRITE(HWSTAM, 0xeffe);
++ if (IS_GEN6(dev)) {
++ /* Workaround stalls observed on Sandy Bridge GPUs by
++ * making the blitter command streamer generate a
++ * write to the Hardware Status Page for
++ * MI_USER_INTERRUPT. This appears to serialize the
++ * previous seqno write out before the interrupt
++ * happens.
++ */
++ I915_WRITE(GEN6_BLITTER_HWSTAM, ~GEN6_BLITTER_USER_INTERRUPT);
++ }
+
+ /* XXX hotplug from PCH */
+
--- /dev/null
+From 45e97ab65026a3391cb2c938f834ca5db4d2e5b3 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Wed, 15 Jun 2011 11:26:47 +0200
+Subject: drm: populate irq_by_busid-member for pci
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wolfram Sang <w.sang@pengutronix.de>
+
+commit 45e97ab65026a3391cb2c938f834ca5db4d2e5b3 upstream.
+
+Commit 8410ea (drm: rework PCI/platform driver interface) implemented
+drm_pci_irq_by_busid() but forgot to make it available in the
+drm_pci_bus-struct.
+
+This caused a freeze on my Radeon9600-equipped laptop when executing glxgears.
+Thanks to Michel for noticing the flaw.
+
+[airlied: made function static also]
+
+Reported-by: Michel Dänzer <daenzer@vmware.com>
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_pci.c
++++ b/drivers/gpu/drm/drm_pci.c
+@@ -251,7 +251,7 @@ err:
+ }
+
+
+-int drm_pci_irq_by_busid(struct drm_device *dev, struct drm_irq_busid *p)
++static int drm_pci_irq_by_busid(struct drm_device *dev, struct drm_irq_busid *p)
+ {
+ if ((p->busnum >> 8) != drm_get_pci_domain(dev) ||
+ (p->busnum & 0xff) != dev->pdev->bus->number ||
+@@ -292,6 +292,7 @@ static struct drm_bus drm_pci_bus = {
+ .get_name = drm_pci_get_name,
+ .set_busid = drm_pci_set_busid,
+ .set_unique = drm_pci_set_unique,
++ .irq_by_busid = drm_pci_irq_by_busid,
+ .agp_init = drm_pci_agp_init,
+ };
+
--- /dev/null
+From 8323fa6ba313ae2664420ec34d56a7fb0bbbe525 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Fri, 17 Jun 2011 13:13:52 -0400
+Subject: drm/radeon/kms/atom: fix duallink on some early DCE3.2 cards
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 8323fa6ba313ae2664420ec34d56a7fb0bbbe525 upstream.
+
+Certain revisions of the vbios on DCE3.2 cards have a bug
+in the transmitter control table which prevents duallink from
+being enabled properly on some cards. The action switch statement
+jumps to the wrong offset for the OUTPUT_ENABLE action. The fix
+is to use the ENABLE action rather than the OUTPUT_ENABLE action
+on the affected cards. In fixed version of the vbios, both
+actions jump to the same offset, so the change should be safe.
+
+Reported-and-tested-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_encoders.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_encoders.c
+@@ -1294,7 +1294,11 @@ radeon_atom_encoder_dpms(struct drm_enco
+ if (is_dig) {
+ switch (mode) {
+ case DRM_MODE_DPMS_ON:
+- atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
++ /* some early dce3.2 boards have a bug in their transmitter control table */
++ if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730))
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
++ else
++ atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+ if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_DP) {
+ struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+
--- /dev/null
+From daf54f1f363a61c618662ef66d4bf09d2b090941 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 30 Jun 2011 08:59:55 -0400
+Subject: drm/radeon/kms: Fix chremap setup on RV770 CE
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit daf54f1f363a61c618662ef66d4bf09d2b090941 upstream.
+
+CE variant requires a different chremap setup.
+
+Fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=35472
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/rv770.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -572,6 +572,12 @@ static void rv770_program_channel_remap(
+ else
+ tcp_chan_steer = 0x00fac688;
+
++ /* RV770 CE has special chremap setup */
++ if (rdev->pdev->device == 0x944e) {
++ tcp_chan_steer = 0x00b08b08;
++ mc_shared_chremap = 0x00b08b08;
++ }
++
+ WREG32(TCP_CHAN_STEER, tcp_chan_steer);
+ WREG32(MC_SHARED_CHREMAP, mc_shared_chremap);
+ }
--- /dev/null
+From 5db8a73a8d7cc6a66afbf25ed7fda338caa8f5f9 Mon Sep 17 00:00:00 2001
+From: Minchan Kim <minchan.kim@gmail.com>
+Date: Wed, 15 Jun 2011 15:08:48 -0700
+Subject: mm/memory-failure.c: fix page isolated count mismatch
+
+From: Minchan Kim <minchan.kim@gmail.com>
+
+commit 5db8a73a8d7cc6a66afbf25ed7fda338caa8f5f9 upstream.
+
+Pages isolated for migration are accounted with the vmstat counters
+NR_ISOLATE_[ANON|FILE]. Callers of migrate_pages() are expected to
+increment these counters when pages are isolated from the LRU. Once the
+pages have been migrated, they are put back on the LRU or freed and the
+isolated count is decremented.
+
+Memory failure is not properly accounting for pages it isolates causing
+the NR_ISOLATED counters to be negative. On SMP builds, this goes
+unnoticed as negative counters are treated as 0 due to expected per-cpu
+drift. On UP builds, the counter is treated by too_many_isolated() as a
+large value causing processes to enter D state during page reclaim or
+compaction. This patch accounts for pages isolated by memory failure
+correctly.
+
+[mel@csn.ul.ie: rewrote changelog]
+Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Minchan Kim <minchan.kim@gmail.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Acked-by: Mel Gorman <mel@csn.ul.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memory-failure.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -52,6 +52,7 @@
+ #include <linux/swapops.h>
+ #include <linux/hugetlb.h>
+ #include <linux/memory_hotplug.h>
++#include <linux/mm_inline.h>
+ #include "internal.h"
+
+ int sysctl_memory_failure_early_kill __read_mostly = 0;
+@@ -1463,7 +1464,8 @@ int soft_offline_page(struct page *page,
+ ret = isolate_lru_page(page);
+ if (!ret) {
+ LIST_HEAD(pagelist);
+-
++ inc_zone_page_state(page, NR_ISOLATED_ANON +
++ page_is_file_cache(page));
+ list_add(&page->lru, &pagelist);
+ ret = migrate_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL,
+ 0, true);
--- /dev/null
+From 8fe7e94eb71430cf63a742f3c19739d82a662758 Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter@amd.com>
+Date: Wed, 1 Jun 2011 15:31:44 +0200
+Subject: oprofile, x86: Fix race in nmi handler while starting
+ counters
+
+From: Robert Richter <robert.richter@amd.com>
+
+commit 8fe7e94eb71430cf63a742f3c19739d82a662758 upstream.
+
+In some rare cases, nmis are generated immediately after the nmi
+handler of the cpu was started. This causes the counter not to be
+enabled. Before enabling the nmi handlers we need to set variable
+ctr_running first and make sure its value is written to memory.
+
+Also, the patch makes all existing barriers a memory barrier instead
+of a compiler barrier only.
+
+Reported-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/oprofile/nmi_int.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/oprofile/nmi_int.c
++++ b/arch/x86/oprofile/nmi_int.c
+@@ -112,8 +112,10 @@ static void nmi_cpu_start(void *dummy)
+ static int nmi_start(void)
+ {
+ get_online_cpus();
+- on_each_cpu(nmi_cpu_start, NULL, 1);
+ ctr_running = 1;
++ /* make ctr_running visible to the nmi handler: */
++ smp_mb();
++ on_each_cpu(nmi_cpu_start, NULL, 1);
+ put_online_cpus();
+ return 0;
+ }
+@@ -504,15 +506,18 @@ static int nmi_setup(void)
+
+ nmi_enabled = 0;
+ ctr_running = 0;
+- barrier();
++ /* make variables visible to the nmi handler: */
++ smp_mb();
+ err = register_die_notifier(&profile_exceptions_nb);
+ if (err)
+ goto fail;
+
+ get_online_cpus();
+ register_cpu_notifier(&oprofile_cpu_nb);
+- on_each_cpu(nmi_cpu_setup, NULL, 1);
+ nmi_enabled = 1;
++ /* make nmi_enabled visible to the nmi handler: */
++ smp_mb();
++ on_each_cpu(nmi_cpu_setup, NULL, 1);
+ put_online_cpus();
+
+ return 0;
+@@ -531,7 +536,8 @@ static void nmi_shutdown(void)
+ nmi_enabled = 0;
+ ctr_running = 0;
+ put_online_cpus();
+- barrier();
++ /* make variables visible to the nmi handler: */
++ smp_mb();
+ unregister_die_notifier(&profile_exceptions_nb);
+ msrs = &get_cpu_var(cpu_msrs);
+ model->shutdown(msrs);
--- /dev/null
+From 8440f4b19494467883f8541b7aa28c7bbf6ac92b Mon Sep 17 00:00:00 2001
+From: Michal Kubecek <mkubecek@suse.cz>
+Date: Sat, 18 Jun 2011 20:34:01 +0200
+Subject: PM: Free memory bitmaps if opening /dev/snapshot fails
+
+From: Michal Kubecek <mkubecek@suse.cz>
+
+commit 8440f4b19494467883f8541b7aa28c7bbf6ac92b upstream.
+
+When opening /dev/snapshot device, snapshot_open() creates memory
+bitmaps which are freed in snapshot_release(). But if any of the
+callbacks called by pm_notifier_call_chain() returns NOTIFY_BAD, open()
+fails, snapshot_release() is never called and bitmaps are not freed.
+Next attempt to open /dev/snapshot then triggers BUG_ON() check in
+create_basic_memory_bitmaps(). This happens e.g. when vmwatchdog module
+is active on s390x.
+
+Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/power/user.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/power/user.c
++++ b/kernel/power/user.c
+@@ -113,8 +113,10 @@ static int snapshot_open(struct inode *i
+ if (error)
+ pm_notifier_call_chain(PM_POST_RESTORE);
+ }
+- if (error)
++ if (error) {
++ free_basic_memory_bitmaps();
+ atomic_inc(&snapshot_device_available);
++ }
+ data->frozen = 0;
+ data->ready = 0;
+ data->platform_support = 0;
--- /dev/null
+From 384420409d9b5d4443940abace49363d26135412 Mon Sep 17 00:00:00 2001
+From: Richard Cochran <richardcochran@gmail.com>
+Date: Sun, 19 Jun 2011 21:48:06 +0000
+Subject: pxa168_eth: fix race in transmit path.
+
+From: Richard Cochran <richardcochran@gmail.com>
+
+commit 384420409d9b5d4443940abace49363d26135412 upstream.
+
+Because the socket buffer is freed in the completion interrupt, it is not
+safe to access it after submitting it to the hardware.
+
+Cc: Sachin Sanap <ssanap@marvell.com>
+Cc: Zhangfei Gao <zgao6@marvell.com>
+Cc: Philip Rakity <prakity@marvell.com>
+Signed-off-by: Richard Cochran <richard.cochran@omicron.at>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/pxa168_eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/pxa168_eth.c
++++ b/drivers/net/pxa168_eth.c
+@@ -1273,7 +1273,7 @@ static int pxa168_eth_start_xmit(struct
+ wmb();
+ wrl(pep, SDMA_CMD, SDMA_CMD_TXDH | SDMA_CMD_ERD);
+
+- stats->tx_bytes += skb->len;
++ stats->tx_bytes += length;
+ stats->tx_packets++;
+ dev->trans_start = jiffies;
+ if (pep->tx_ring_size - pep->tx_desc_count <= 1) {
--- /dev/null
+From 826c7e4147f902737b281e8a5a7d7aa33fd63316 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Sat, 4 Jun 2011 19:34:56 +0000
+Subject: Revert "drm/i915: Enable GMBUS for post-gen2 chipsets"
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 826c7e4147f902737b281e8a5a7d7aa33fd63316 upstream.
+
+Revert commit 8f9a3f9b63b8cd3f03be9dc53533f90bd4120e5f. This fixes a
+hang when loading the eeprom driver (see bug #35572.) GMBUS will be
+re-enabled later, differently.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Reported-by: Marek Otahal <markotahal@gmail.com>
+Tested-by: Yermandu Patapitafious <yermandu.dev@gmail.com>
+Tested-by: Andrew Lutomirski <luto@mit.edu>
+Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_i2c.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_i2c.c
++++ b/drivers/gpu/drm/i915/intel_i2c.c
+@@ -401,8 +401,7 @@ int intel_setup_gmbus(struct drm_device
+ bus->reg0 = i | GMBUS_RATE_100KHZ;
+
+ /* XXX force bit banging until GMBUS is fully debugged */
+- if (IS_GEN2(dev))
+- bus->force_bit = intel_gpio_create(dev_priv, i);
++ bus->force_bit = intel_gpio_create(dev_priv, i);
+ }
+
+ intel_i2c_reset(dev_priv->dev);
hwmon-ibmaem-initialize-sysfs-attributes.patch
hwmon-s3c-initialize-sysfs-attributes.patch
hwmon-ibmpex-initialize-sysfs-attributes.patch
+revert-drm-i915-enable-gmbus-for-post-gen2-chipsets.patch
+drm-radeon-kms-atom-fix-duallink-on-some-early-dce3.2-cards.patch
+drm-radeon-kms-fix-chremap-setup-on-rv770-ce.patch
+drm-i915-fix-gen6-snb-missed-blt-ring-interrupts.patch
+drm-populate-irq_by_busid-member-for-pci.patch
+xen-support-config_maxsmp.patch
+xen-partially-revert-xen-set-max_pfn_mapped-to-the-last.patch
+xen-pci-use-the-int_src_ovr-irq-instead-of-gsi-to-preset.patch
+xen-mmu-fix-for-linker-errors-when-config_smp-is-not.patch
+xen-pci-move-check-for-acpi_sci_override_gsi-to.patch
+clocksource-make-watchdog-robust-vs.-interruption.patch
+arm-samsung-serial-fix-on-handling-of-one-clock-source.patch
+tty-ldisc-do-not-close-until-there-are-readers.patch
+connector-set-the-cn_netlink_users-correctly.patch
+connector-correctly-set-the-error-code-in-case-of-success.patch
+xhci-reject-double-add-of-active-endpoints.patch
+xhci-add-reset-on-resume-quirk-for-asrock-p67-host.patch
+xhci-always-set-urb-status-to-zero-for-isoc-endpoints.patch
+usb-free-bandwidth-when-usb_disable_device-is-called.patch
+usb-add-new-ft232h-chip-to-drivers-usb-serial-ftdi_sio.c.patch
+mm-memory-failure.c-fix-page-isolated-count-mismatch.patch
+pm-free-memory-bitmaps-if-opening-dev-snapshot-fails.patch
+ath5k-fix-memory-leak-when-fewer-than-n_pd_curves-are-in.patch
+ath5k-disable-fast-channel-switching-by-default.patch
+pxa168_eth-fix-race-in-transmit-path.patch
+ath9k-fix-suspend-resume-when-no-interface-is-up.patch
+x86-suspend-restore-misc_enable-msr-in-realmode-wakeup.patch
+oprofile-x86-fix-race-in-nmi-handler-while-starting.patch
--- /dev/null
+From 92f6fa09bd453ffe3351fa1f1377a1b7cfa911e6 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Sun, 5 Jun 2011 14:16:16 +0200
+Subject: TTY: ldisc, do not close until there are readers
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 92f6fa09bd453ffe3351fa1f1377a1b7cfa911e6 upstream.
+
+We restored tty_ldisc_wait_idle in 100eeae2c5c (TTY: restore
+tty_ldisc_wait_idle). We used it in the ldisc changing path to fix the
+case where there are tasks in n_tty_read waiting for data and somebody
+tries to change ldisc.
+
+Similar to the case above, there may be also tasks waiting in
+n_tty_read while hangup is performed. As 65b770468e98 (tty-ldisc: turn
+ldisc user count into a proper refcount) removed the wait-until-idle
+from all paths, hangup path won't wait for them to disappear either
+now. So add it back even to the hangup path.
+
+There is a difference, we need uninterruptible sleep as there is
+obviously HUP signal pending. So tty_ldisc_wait_idle now sleeps
+without possibility to be interrupted. This is what original
+tty_ldisc_wait_idle did. After the wait idle reintroduction
+(100eeae2c5c), we have had interruptible sleeps for the ldisc changing
+path. But as there is a 5s timeout anyway, we don't allow it to be
+interrupted from now on. It's not worth the added complexity of
+deciding what kind of sleep we want.
+
+Before 65b770468e98 tty_ldisc_release was called also from
+tty_ldisc_release. It is called from tty_release, so I don't think we
+need to restore that one.
+
+This is nicely reproducible after constifying the timing when
+drivers/tty/n_tty.c is patched as follows ("TTY: ntty, add one more
+sanity check" patch is needed to actually see it explode):
+%% -1548,6 +1549,7 @@ static int n_tty_open(struct tty_struct *tty)
+
+ /* These are ugly. Currently a malloc failure here can panic */
+ if (!tty->read_buf) {
++ msleep(100);
+ tty->read_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
+ if (!tty->read_buf)
+ return -ENOMEM;
+%% -1785,6 +1788,7 @@ do_it_again:
+ break;
+ }
+ timeout = schedule_timeout(timeout);
++ msleep(20);
+ continue;
+ }
+ __set_current_state(TASK_RUNNING);
+===== With a process: =====
+ while (1) {
+ int fd = open(argv[1], O_RDWR);
+ read(fd, buf, sizeof(buf));
+ close(fd);
+ }
+===== and its child: =====
+ setsid();
+ while (1) {
+ int fd = open(tty, O_RDWR|O_NOCTTY);
+ ioctl(fd, TIOCSCTTY, 1);
+ vhangup();
+ close(fd);
+ usleep(100 * (10 + random() % 1000));
+ }
+===== EOF =====
+
+References: https://bugzilla.novell.com/show_bug.cgi?id=693374
+References: https://bugzilla.novell.com/show_bug.cgi?id=694509
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/tty_ldisc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -555,7 +555,7 @@ static void tty_ldisc_flush_works(struct
+ static int tty_ldisc_wait_idle(struct tty_struct *tty)
+ {
+ int ret;
+- ret = wait_event_interruptible_timeout(tty_ldisc_idle,
++ ret = wait_event_timeout(tty_ldisc_idle,
+ atomic_read(&tty->ldisc->users) == 1, 5 * HZ);
+ if (ret < 0)
+ return ret;
+@@ -763,6 +763,8 @@ static int tty_ldisc_reinit(struct tty_s
+ if (IS_ERR(ld))
+ return -1;
+
++ WARN_ON_ONCE(tty_ldisc_wait_idle(tty));
++
+ tty_ldisc_close(tty, tty->ldisc);
+ tty_ldisc_put(tty->ldisc);
+ tty->ldisc = NULL;
--- /dev/null
+From 309427b6351b763917caac3e4b2ab5651df99823 Mon Sep 17 00:00:00 2001
+From: Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de>
+Date: Fri, 17 Jun 2011 17:30:23 +0200
+Subject: USB: Add new FT232H chip to drivers/usb/serial/ftdi_sio.c
+
+From: Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de>
+
+commit 309427b6351b763917caac3e4b2ab5651df99823 upstream.
+
+appended patch adds support for the new FTDI FT232H chip. This chip is a
+single channel version of the dual FT2232H/quad FT4232H, coming with it's
+own default PID 0x6014 (FT2232H uses the same PID 0x6010 like FT2232C,
+FT4232H has also it's own PID).
+
+The patch was checked on an UM232H module and a terminal program with TX/RX
+shorted to that typing in the terminal reproduced the characters.
+
+Signed-off-by: Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 19 ++++++++++++++-----
+ drivers/usb/serial/ftdi_sio.h | 3 ++-
+ drivers/usb/serial/ftdi_sio_ids.h | 1 +
+ 3 files changed, 17 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -179,6 +179,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_232RL_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_8U2232C_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_4232H_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_232H_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MICRO_CHAMELEON_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_RELAIS_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_PID) },
+@@ -848,7 +849,8 @@ static const char *ftdi_chip_name[] = {
+ [FT2232C] = "FT2232C",
+ [FT232RL] = "FT232RL",
+ [FT2232H] = "FT2232H",
+- [FT4232H] = "FT4232H"
++ [FT4232H] = "FT4232H",
++ [FT232H] = "FT232H"
+ };
+
+
+@@ -1168,6 +1170,7 @@ static __u32 get_ftdi_divisor(struct tty
+ break;
+ case FT2232H: /* FT2232H chip */
+ case FT4232H: /* FT4232H chip */
++ case FT232H: /* FT232H chip */
+ if ((baud <= 12000000) & (baud >= 1200)) {
+ div_value = ftdi_2232h_baud_to_divisor(baud);
+ } else if (baud < 1200) {
+@@ -1429,9 +1432,12 @@ static void ftdi_determine_type(struct u
+ } else if (version < 0x600) {
+ /* Assume it's an FT232BM (or FT245BM) */
+ priv->chip_type = FT232BM;
+- } else {
+- /* Assume it's an FT232R */
++ } else if (version < 0x900) {
++ /* Assume it's an FT232RL */
+ priv->chip_type = FT232RL;
++ } else {
++ /* Assume it's an FT232H */
++ priv->chip_type = FT232H;
+ }
+ dev_info(&udev->dev, "Detected %s\n", ftdi_chip_name[priv->chip_type]);
+ }
+@@ -1559,7 +1565,8 @@ static int create_sysfs_attrs(struct usb
+ priv->chip_type == FT2232C ||
+ priv->chip_type == FT232RL ||
+ priv->chip_type == FT2232H ||
+- priv->chip_type == FT4232H)) {
++ priv->chip_type == FT4232H ||
++ priv->chip_type == FT232H)) {
+ retval = device_create_file(&port->dev,
+ &dev_attr_latency_timer);
+ }
+@@ -1580,7 +1587,8 @@ static void remove_sysfs_attrs(struct us
+ priv->chip_type == FT2232C ||
+ priv->chip_type == FT232RL ||
+ priv->chip_type == FT2232H ||
+- priv->chip_type == FT4232H) {
++ priv->chip_type == FT4232H ||
++ priv->chip_type == FT232H) {
+ device_remove_file(&port->dev, &dev_attr_latency_timer);
+ }
+ }
+@@ -2212,6 +2220,7 @@ static int ftdi_tiocmget(struct tty_stru
+ case FT232RL:
+ case FT2232H:
+ case FT4232H:
++ case FT232H:
+ len = 2;
+ break;
+ default:
+--- a/drivers/usb/serial/ftdi_sio.h
++++ b/drivers/usb/serial/ftdi_sio.h
+@@ -156,7 +156,8 @@ enum ftdi_chip_type {
+ FT2232C = 4,
+ FT232RL = 5,
+ FT2232H = 6,
+- FT4232H = 7
++ FT4232H = 7,
++ FT232H = 8
+ };
+
+ enum ftdi_sio_baudrate {
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -22,6 +22,7 @@
+ #define FTDI_8U232AM_ALT_PID 0x6006 /* FTDI's alternate PID for above */
+ #define FTDI_8U2232C_PID 0x6010 /* Dual channel device */
+ #define FTDI_4232H_PID 0x6011 /* Quad channel hi-speed device */
++#define FTDI_232H_PID 0x6014 /* Single channel hi-speed device */
+ #define FTDI_SIO_PID 0x8372 /* Product Id SIO application of 8U100AX */
+ #define FTDI_232RL_PID 0xFBFA /* Product ID for FT232RL */
+
--- /dev/null
+From fccf4e86200b8f5edd9a65da26f150e32ba79808 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Sun, 5 Jun 2011 23:22:22 -0700
+Subject: USB: Free bandwidth when usb_disable_device is called.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit fccf4e86200b8f5edd9a65da26f150e32ba79808 upstream.
+
+Tanya ran into an issue when trying to switch a UAS device from the BOT
+configuration to the UAS configuration via the bConfigurationValue sysfs
+file. Before installing the UAS configuration, set_bConfigurationValue()
+calls usb_disable_device(). That function is supposed to remove all host
+controller resources associated with that device, but it leaves some state
+in the xHCI host controller.
+
+Commit 0791971ba8fbc44e4f476079f856335ed45e6324
+ usb: allow drivers to use allocated bandwidth until unbound
+added a call to usb_disable_device() in usb_set_configuration(), before
+the xHCI bandwidth functions were invoked. That commit fixed a bug, but
+also introduced a bug that is triggered when a configured device is
+switched to a new configuration.
+
+usb_disable_device() goes through all the motions of unbinding the drivers
+attached to active interfaces and removing the USB core structures
+associated with those interfaces, but it doesn't actually remove the
+endpoints from the internal xHCI host controller bandwidth structures.
+
+When usb_disable_device() calls usb_disable_endpoint() with reset_hardware
+set to true, the entries in udev->ep_out and udev->ep_in will be set to
+NULL. Usually, when the USB core installs a new configuration,
+usb_hcd_alloc_bandwidth() will drop all non-NULL endpoints in udev->ep_out
+and udev->ep_in before adding any new endpoints. However, when the new
+UAS configuration was added, all those entries were null, so none of the
+old endpoints in the BOT configuration were dropped.
+
+The xHCI driver blindly added the UAS configuration endpoints, and some of
+the endpoint addresses overlapped with the old BOT configuration
+endpoints. This caused the xHCI host to reject the Configure Endpoint
+command. Now that the xHCI driver code is cleaned up to reject a
+double-add of active endpoints, we need to fix the USB core to properly
+drop old endpoints in usb_disable_device().
+
+If the host controller driver needs bandwidth checking support, make
+usb_disable_device() call usb_disable_endpoint() with
+reset_hardware set to false, drop the endpoints from the xHCI host
+controller, and then call usb_disable_endpoint() again with
+reset_hardware set to true.
+
+The first call to usb_disable_endpoint() will cancel any pending URBs and
+wait on them to be freed in usb_hcd_disable_endpoint(), but will keep the
+pointers in udev->ep_out and udev->ep in intact. Then
+usb_hcd_alloc_bandwidth() will use those pointers to know which endpoints
+to drop.
+
+The final call to usb_disable_endpoint() will do two things:
+
+1. It will call usb_hcd_disable_endpoint() again, which should be harmless
+since the ep->urb_list should be empty after the first call to
+usb_disable_endpoint() returns.
+
+2. It will set the entries in udev->ep_out and udev->ep in to NULL, and call
+usb_hcd_disable_endpoint(). That call will have no effect, since the xHCI
+driver doesn't set the endpoint_disable function pointer.
+
+Note that usb_disable_device() will now need to be called with
+hcd->bandwidth_mutex held.
+
+This should be backported to kernels as old as 2.6.32.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: Tanya Brokhman <tlinder@codeaurora.org>
+Cc: ablay@codeaurora.org
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hub.c | 3 +++
+ drivers/usb/core/message.c | 15 ++++++++++++++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1643,6 +1643,7 @@ void usb_disconnect(struct usb_device **
+ {
+ struct usb_device *udev = *pdev;
+ int i;
++ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+
+ if (!udev) {
+ pr_debug ("%s nodev\n", __func__);
+@@ -1670,7 +1671,9 @@ void usb_disconnect(struct usb_device **
+ * so that the hardware is now fully quiesced.
+ */
+ dev_dbg (&udev->dev, "unregistering device\n");
++ mutex_lock(hcd->bandwidth_mutex);
+ usb_disable_device(udev, 0);
++ mutex_unlock(hcd->bandwidth_mutex);
+ usb_hcd_synchronize_unlinks(udev);
+
+ usb_remove_ep_devs(&udev->ep0);
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1135,10 +1135,13 @@ void usb_disable_interface(struct usb_de
+ * Deallocates hcd/hardware state for the endpoints (nuking all or most
+ * pending urbs) and usbcore state for the interfaces, so that usbcore
+ * must usb_set_configuration() before any interfaces could be used.
++ *
++ * Must be called with hcd->bandwidth_mutex held.
+ */
+ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ {
+ int i;
++ struct usb_hcd *hcd = bus_to_hcd(dev->bus);
+
+ /* getting rid of interfaces will disconnect
+ * any drivers bound to them (a key side effect)
+@@ -1172,6 +1175,16 @@ void usb_disable_device(struct usb_devic
+
+ dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
+ skip_ep0 ? "non-ep0" : "all");
++ if (hcd->driver->check_bandwidth) {
++ /* First pass: Cancel URBs, leave endpoint pointers intact. */
++ for (i = skip_ep0; i < 16; ++i) {
++ usb_disable_endpoint(dev, i, false);
++ usb_disable_endpoint(dev, i + USB_DIR_IN, false);
++ }
++ /* Remove endpoints from the host controller internal state */
++ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
++ /* Second pass: remove endpoint pointers */
++ }
+ for (i = skip_ep0; i < 16; ++i) {
+ usb_disable_endpoint(dev, i, true);
+ usb_disable_endpoint(dev, i + USB_DIR_IN, true);
+@@ -1727,6 +1740,7 @@ free_interfaces:
+ /* if it's already configured, clear out old state first.
+ * getting rid of old interfaces means unbinding their drivers.
+ */
++ mutex_lock(hcd->bandwidth_mutex);
+ if (dev->state != USB_STATE_ADDRESS)
+ usb_disable_device(dev, 1); /* Skip ep0 */
+
+@@ -1739,7 +1753,6 @@ free_interfaces:
+ * host controller will not allow submissions to dropped endpoints. If
+ * this call fails, the device state is unchanged.
+ */
+- mutex_lock(hcd->bandwidth_mutex);
+ ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
+ if (ret < 0) {
+ mutex_unlock(hcd->bandwidth_mutex);
--- /dev/null
+From 7a3136666bc0f0419f7aaa7b1fabb4b0e0a7fb76 Mon Sep 17 00:00:00 2001
+From: Kees Cook <kees.cook@canonical.com>
+Date: Wed, 6 Jul 2011 18:10:34 -0700
+Subject: x86, suspend: Restore MISC_ENABLE MSR in realmode wakeup
+
+From: Kees Cook <kees.cook@canonical.com>
+
+commit 7a3136666bc0f0419f7aaa7b1fabb4b0e0a7fb76 upstream.
+
+Some BIOSes will reset the Intel MISC_ENABLE MSR (specifically the
+XD_DISABLE bit) when resuming from S3, which can interact poorly with
+ebba638ae723d8a8fc2f7abce5ec18b688b791d7. In 32bit PAE mode, this can
+lead to a fault when EFER is restored by the kernel wakeup routines,
+due to it setting the NX bit for a CPU that (thanks to the BIOS reset)
+now incorrectly thinks it lacks the NX feature. (64bit is not affected
+because it uses a common CPU bring-up that specifically handles the
+XD_DISABLE bit.)
+
+The need for MISC_ENABLE being restored so early is specific to the S3
+resume path. Normally, MISC_ENABLE is saved in save_processor_state(),
+but this happens after the resume header is created, so just reproduce
+the logic here. (acpi_suspend_lowlevel() creates the header, calls
+do_suspend_lowlevel, which calls save_processor_state(), so the saved
+processor context isn't available during resume header creation.)
+
+[ hpa: Consider for stable if OK in mainline ]
+
+Signed-off-by: Kees Cook <kees.cook@canonical.com>
+Link: http://lkml.kernel.org/r/20110707011034.GA8523@outflux.net
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/acpi/realmode/wakeup.S | 14 ++++++++++++++
+ arch/x86/kernel/acpi/realmode/wakeup.h | 6 ++++++
+ arch/x86/kernel/acpi/sleep.c | 6 ++++++
+ 3 files changed, 26 insertions(+)
+
+--- a/arch/x86/kernel/acpi/realmode/wakeup.S
++++ b/arch/x86/kernel/acpi/realmode/wakeup.S
+@@ -28,6 +28,8 @@ pmode_cr3: .long 0 /* Saved %cr3 */
+ pmode_cr4: .long 0 /* Saved %cr4 */
+ pmode_efer: .quad 0 /* Saved EFER */
+ pmode_gdt: .quad 0
++pmode_misc_en: .quad 0 /* Saved MISC_ENABLE MSR */
++pmode_behavior: .long 0 /* Wakeup behavior flags */
+ realmode_flags: .long 0
+ real_magic: .long 0
+ trampoline_segment: .word 0
+@@ -91,6 +93,18 @@ wakeup_code:
+ /* Call the C code */
+ calll main
+
++ /* Restore MISC_ENABLE before entering protected mode, in case
++ BIOS decided to clear XD_DISABLE during S3. */
++ movl pmode_behavior, %eax
++ btl $WAKEUP_BEHAVIOR_RESTORE_MISC_ENABLE, %eax
++ jnc 1f
++
++ movl pmode_misc_en, %eax
++ movl pmode_misc_en + 4, %edx
++ movl $MSR_IA32_MISC_ENABLE, %ecx
++ wrmsr
++1:
++
+ /* Do any other stuff... */
+
+ #ifndef CONFIG_64BIT
+--- a/arch/x86/kernel/acpi/realmode/wakeup.h
++++ b/arch/x86/kernel/acpi/realmode/wakeup.h
+@@ -21,6 +21,9 @@ struct wakeup_header {
+ u32 pmode_efer_low; /* Protected mode EFER */
+ u32 pmode_efer_high;
+ u64 pmode_gdt;
++ u32 pmode_misc_en_low; /* Protected mode MISC_ENABLE */
++ u32 pmode_misc_en_high;
++ u32 pmode_behavior; /* Wakeup routine behavior flags */
+ u32 realmode_flags;
+ u32 real_magic;
+ u16 trampoline_segment; /* segment with trampoline code, 64-bit only */
+@@ -39,4 +42,7 @@ extern struct wakeup_header wakeup_heade
+ #define WAKEUP_HEADER_SIGNATURE 0x51ee1111
+ #define WAKEUP_END_SIGNATURE 0x65a22c82
+
++/* Wakeup behavior bits */
++#define WAKEUP_BEHAVIOR_RESTORE_MISC_ENABLE 0
++
+ #endif /* ARCH_X86_KERNEL_ACPI_RM_WAKEUP_H */
+--- a/arch/x86/kernel/acpi/sleep.c
++++ b/arch/x86/kernel/acpi/sleep.c
+@@ -77,6 +77,12 @@ int acpi_suspend_lowlevel(void)
+
+ header->pmode_cr0 = read_cr0();
+ header->pmode_cr4 = read_cr4_safe();
++ header->pmode_behavior = 0;
++ if (!rdmsr_safe(MSR_IA32_MISC_ENABLE,
++ &header->pmode_misc_en_low,
++ &header->pmode_misc_en_high))
++ header->pmode_behavior |=
++ (1 << WAKEUP_BEHAVIOR_RESTORE_MISC_ENABLE);
+ header->realmode_flags = acpi_realmode_flags;
+ header->real_magic = 0x12345678;
+
--- /dev/null
+From 32dd11942aeb47f91209a446d6b10063c5b69389 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Thu, 30 Jun 2011 09:12:40 -0400
+Subject: xen/mmu: Fix for linker errors when CONFIG_SMP is not
+ defined.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 32dd11942aeb47f91209a446d6b10063c5b69389 upstream.
+
+Simple enough - we use an extern defined symbol which is not
+defined when CONFIG_SMP is not defined. This fixes the linker
+dying.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/mmu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -1354,7 +1354,11 @@ static void xen_flush_tlb_others(const s
+ {
+ struct {
+ struct mmuext_op op;
++#ifdef CONFIG_SMP
+ DECLARE_BITMAP(mask, num_processors);
++#else
++ DECLARE_BITMAP(mask, NR_CPUS);
++#endif
+ } *args;
+ struct multicall_space mcs;
+
--- /dev/null
+From a91d92875ee94e4703fd017ccaadb48cfb344994 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Date: Fri, 3 Jun 2011 09:51:34 +0000
+Subject: xen: partially revert "xen: set max_pfn_mapped to the last
+ pfn mapped"
+
+From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+
+commit a91d92875ee94e4703fd017ccaadb48cfb344994 upstream.
+
+We only need to set max_pfn_mapped to the last pfn mapped on x86_64 to
+make sure that cleanup_highmap doesn't remove important mappings at
+_end.
+
+We don't need to do this on x86_32 because cleanup_highmap is not called
+on x86_32. Besides lowering max_pfn_mapped on x86_32 has the unwanted
+side effect of limiting the amount of memory available for the 1:1
+kernel pagetable allocation.
+
+This patch reverts the x86_32 part of the original patch.
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/mmu.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -1722,6 +1722,11 @@ static __init void xen_map_identity_earl
+ for (pteidx = 0; pteidx < PTRS_PER_PTE; pteidx++, pfn++) {
+ pte_t pte;
+
++#ifdef CONFIG_X86_32
++ if (pfn > max_pfn_mapped)
++ max_pfn_mapped = pfn;
++#endif
++
+ if (!pte_none(pte_page[pteidx]))
+ continue;
+
+@@ -1889,7 +1894,9 @@ __init pgd_t *xen_setup_kernel_pagetable
+ initial_kernel_pmd =
+ extend_brk(sizeof(pmd_t) * PTRS_PER_PMD, PAGE_SIZE);
+
+- max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->mfn_list));
++ max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->pt_base) +
++ xen_start_info->nr_pt_frames * PAGE_SIZE +
++ 512*1024);
+
+ kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
+ memcpy(initial_kernel_pmd, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
--- /dev/null
+From ee339fe63ac408e4604c1c88b1f9a428f2511b70 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Wed, 6 Jul 2011 09:43:16 -0400
+Subject: xen/pci: Move check for acpi_sci_override_gsi to
+ xen_setup_acpi_sci.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit ee339fe63ac408e4604c1c88b1f9a428f2511b70 upstream.
+
+Previously we would check for acpi_sci_override_gsi == gsi every time
+a PCI device was enabled. That works during early bootup, but later
+on it could lead to triggering unnecessarily the acpi_gsi_to_irq(..) lookup.
+The reason is that acpi_sci_override_gsi was declared in __initdata and
+after early bootup could contain bogus values.
+
+This patch moves the check for acpi_sci_override_gsi to the
+site where the ACPI SCI is preset.
+
+Reported-by: Raghavendra D Prabhu <rprabhu@wnohang.net>
+Tested-by: Raghavendra D Prabhu <rprabhu@wnohang.net>
+[http://lists.xensource.com/archives/html/xen-devel/2011-07/msg00154.html]
+Suggested-by: Ian Campbell <ijc@hellion.org.uk>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/xen.c | 56 ++++++++++++++++++++++++++---------------------------
+ 1 file changed, 28 insertions(+), 28 deletions(-)
+
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -316,13 +316,12 @@ int __init pci_xen_hvm_init(void)
+ }
+
+ #ifdef CONFIG_XEN_DOM0
+-static int xen_register_pirq(u32 gsi, int triggering)
++static int xen_register_pirq(u32 gsi, int gsi_override, int triggering)
+ {
+ int rc, pirq, irq = -1;
+ struct physdev_map_pirq map_irq;
+ int shareable = 0;
+ char *name;
+- bool gsi_override = false;
+
+ if (!xen_pv_domain())
+ return -1;
+@@ -334,31 +333,12 @@ static int xen_register_pirq(u32 gsi, in
+ shareable = 1;
+ name = "ioapic-level";
+ }
+-
+ pirq = xen_allocate_pirq_gsi(gsi);
+ if (pirq < 0)
+ goto out;
+
+- /* Before we bind the GSI to a Linux IRQ, check whether
+- * we need to override it with bus_irq (IRQ) value. Usually for
+- * IRQs below IRQ_LEGACY_IRQ this holds IRQ == GSI, as so:
+- * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
+- * but there are oddballs where the IRQ != GSI:
+- * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 20 low level)
+- * which ends up being: gsi_to_irq[9] == 20
+- * (which is what acpi_gsi_to_irq ends up calling when starting the
+- * the ACPI interpreter and keels over since IRQ 9 has not been
+- * setup as we had setup IRQ 20 for it).
+- */
+- if (gsi == acpi_sci_override_gsi) {
+- /* Check whether the GSI != IRQ */
+- acpi_gsi_to_irq(gsi, &irq);
+- if (irq != gsi)
+- /* Bugger, we MUST have that IRQ. */
+- gsi_override = true;
+- }
+- if (gsi_override)
+- irq = xen_bind_pirq_gsi_to_irq(irq, pirq, shareable, name);
++ if (gsi_override >= 0)
++ irq = xen_bind_pirq_gsi_to_irq(gsi_override, pirq, shareable, name);
+ else
+ irq = xen_bind_pirq_gsi_to_irq(gsi, pirq, shareable, name);
+ if (irq < 0)
+@@ -381,7 +361,7 @@ out:
+ return irq;
+ }
+
+-static int xen_register_gsi(u32 gsi, int triggering, int polarity)
++static int xen_register_gsi(u32 gsi, int gsi_override, int triggering, int polarity)
+ {
+ int rc, irq;
+ struct physdev_setup_gsi setup_gsi;
+@@ -392,7 +372,7 @@ static int xen_register_gsi(u32 gsi, int
+ printk(KERN_DEBUG "xen: registering gsi %u triggering %d polarity %d\n",
+ gsi, triggering, polarity);
+
+- irq = xen_register_pirq(gsi, triggering);
++ irq = xen_register_pirq(gsi, gsi_override, triggering);
+
+ setup_gsi.gsi = gsi;
+ setup_gsi.triggering = (triggering == ACPI_EDGE_SENSITIVE ? 0 : 1);
+@@ -414,6 +394,8 @@ static __init void xen_setup_acpi_sci(vo
+ int rc;
+ int trigger, polarity;
+ int gsi = acpi_sci_override_gsi;
++ int irq = -1;
++ int gsi_override = -1;
+
+ if (!gsi)
+ return;
+@@ -430,7 +412,25 @@ static __init void xen_setup_acpi_sci(vo
+ printk(KERN_INFO "xen: sci override: global_irq=%d trigger=%d "
+ "polarity=%d\n", gsi, trigger, polarity);
+
+- gsi = xen_register_gsi(gsi, trigger, polarity);
++ /* Before we bind the GSI to a Linux IRQ, check whether
++ * we need to override it with bus_irq (IRQ) value. Usually for
++ * IRQs below IRQ_LEGACY_IRQ this holds IRQ == GSI, as so:
++ * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
++ * but there are oddballs where the IRQ != GSI:
++ * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 20 low level)
++ * which ends up being: gsi_to_irq[9] == 20
++ * (which is what acpi_gsi_to_irq ends up calling when starting the
++ * the ACPI interpreter and keels over since IRQ 9 has not been
++ * setup as we had setup IRQ 20 for it).
++ */
++ /* Check whether the GSI != IRQ */
++ if (acpi_gsi_to_irq(gsi, &irq) == 0) {
++ if (irq >= 0 && irq != gsi)
++ /* Bugger, we MUST have that IRQ. */
++ gsi_override = irq;
++ }
++
++ gsi = xen_register_gsi(gsi, gsi_override, trigger, polarity);
+ printk(KERN_INFO "xen: acpi sci %d\n", gsi);
+
+ return;
+@@ -439,7 +439,7 @@ static __init void xen_setup_acpi_sci(vo
+ static int acpi_register_gsi_xen(struct device *dev, u32 gsi,
+ int trigger, int polarity)
+ {
+- return xen_register_gsi(gsi, trigger, polarity);
++ return xen_register_gsi(gsi, -1 /* no GSI override */, trigger, polarity);
+ }
+
+ static int __init pci_xen_initial_domain(void)
+@@ -478,7 +478,7 @@ void __init xen_setup_pirqs(void)
+ if (acpi_get_override_irq(irq, &trigger, &polarity) == -1)
+ continue;
+
+- xen_register_pirq(irq,
++ xen_register_pirq(irq, -1 /* no GSI override */,
+ trigger ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE);
+ }
+ }
--- /dev/null
+From 155a16f21923bc2f04161ac92acca986371ef27b Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Thu, 30 Jun 2011 09:18:27 -0400
+Subject: xen/pci: Use the INT_SRC_OVR IRQ (instead of GSI) to preset
+ the ACPI SCI IRQ.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 155a16f21923bc2f04161ac92acca986371ef27b upstream.
+
+In the past we would use the GSI value to preset the ACPI SCI
+IRQ which worked great as GSI == IRQ:
+
+ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
+
+While that is most often seen, there are some oddities:
+
+ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 20 low level)
+
+which means that GSI 20 (or pin 20) is to be overriden for IRQ 9.
+Our code that presets the interrupt for ACPI SCI however would
+use the GSI 20 instead of IRQ 9 ending up with:
+
+xen: sci override: global_irq=20 trigger=0 polarity=1
+xen: registering gsi 20 triggering 0 polarity 1
+xen: --> pirq=20 -> irq=20
+xen: acpi sci 20
+.. snip..
+calling acpi_init+0x0/0xbc @ 1
+ACPI: SCI (IRQ9) allocation failed
+ACPI Exception: AE_NOT_ACQUIRED, Unable to install System Control Interrupt handler (20110413/evevent-119)
+ACPI: Unable to start the ACPI Interpreter
+
+as the ACPI interpreter made a call to 'acpi_gsi_to_irq' which got nine.
+It used that value to request an IRQ (request_irq) and since that was not
+present it failed.
+
+The fix is to recognize that for interrupts that are overriden (in our
+case we only care about the ACPI SCI) we should use the IRQ number
+to present the IRQ instead of the using GSI. End result is that we get:
+
+xen: sci override: global_irq=20 trigger=0 polarity=1
+xen: registering gsi 20 triggering 0 polarity 1
+xen: --> pirq=20 -> irq=9 (gsi=9)
+xen: acpi sci 9
+
+which fixes the ACPI interpreter failing on startup.
+
+Reported-by: Liwei <xieliwei@gmail.com>
+Tested-by: Liwei <xieliwei@gmail.com>
+[http://lists.xensource.com/archives/html/xen-devel/2011-06/msg01727.html]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/xen.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -322,6 +322,7 @@ static int xen_register_pirq(u32 gsi, in
+ struct physdev_map_pirq map_irq;
+ int shareable = 0;
+ char *name;
++ bool gsi_override = false;
+
+ if (!xen_pv_domain())
+ return -1;
+@@ -338,11 +339,32 @@ static int xen_register_pirq(u32 gsi, in
+ if (pirq < 0)
+ goto out;
+
+- irq = xen_bind_pirq_gsi_to_irq(gsi, pirq, shareable, name);
++ /* Before we bind the GSI to a Linux IRQ, check whether
++ * we need to override it with bus_irq (IRQ) value. Usually for
++ * IRQs below IRQ_LEGACY_IRQ this holds IRQ == GSI, as so:
++ * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
++ * but there are oddballs where the IRQ != GSI:
++ * ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 20 low level)
++ * which ends up being: gsi_to_irq[9] == 20
++ * (which is what acpi_gsi_to_irq ends up calling when starting the
++ * the ACPI interpreter and keels over since IRQ 9 has not been
++ * setup as we had setup IRQ 20 for it).
++ */
++ if (gsi == acpi_sci_override_gsi) {
++ /* Check whether the GSI != IRQ */
++ acpi_gsi_to_irq(gsi, &irq);
++ if (irq != gsi)
++ /* Bugger, we MUST have that IRQ. */
++ gsi_override = true;
++ }
++ if (gsi_override)
++ irq = xen_bind_pirq_gsi_to_irq(irq, pirq, shareable, name);
++ else
++ irq = xen_bind_pirq_gsi_to_irq(gsi, pirq, shareable, name);
+ if (irq < 0)
+ goto out;
+
+- printk(KERN_DEBUG "xen: --> pirq=%d -> irq=%d\n", pirq, irq);
++ printk(KERN_DEBUG "xen: --> pirq=%d -> irq=%d (gsi=%d)\n", pirq, irq, gsi);
+
+ map_irq.domid = DOMID_SELF;
+ map_irq.type = MAP_PIRQ_TYPE_GSI;
--- /dev/null
+From 900cba8881b39dfbc7c8062098504ab93f5387a8 Mon Sep 17 00:00:00 2001
+From: Andrew Jones <drjones@redhat.com>
+Date: Fri, 18 Dec 2009 10:31:31 +0100
+Subject: xen: support CONFIG_MAXSMP
+
+From: Andrew Jones <drjones@redhat.com>
+
+commit 900cba8881b39dfbc7c8062098504ab93f5387a8 upstream.
+
+The MAXSMP config option requires CPUMASK_OFFSTACK, which in turn
+requires we init the memory for the maps while we bring up the cpus.
+MAXSMP also increases NR_CPUS to 4096. This increase in size exposed an
+issue in the argument construction for multicalls from
+xen_flush_tlb_others. The args should only need space for the actual
+number of cpus.
+
+Also in 2.6.39 it exposes a bootup problem.
+
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<ffffffff8157a1d3>] set_cpu_sibling_map+0x123/0x30d
+...
+Call Trace:
+[<ffffffff81039a3f>] ? xen_restore_fl_direct_reloc+0x4/0x4
+[<ffffffff819dc4db>] xen_smp_prepare_cpus+0x36/0x135
+..
+
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+[v2: Updated to compile on 3.0]
+[v3: Updated to compile when CONFIG_SMP is not defined]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/mmu.c | 3 ++-
+ arch/x86/xen/smp.c | 7 +++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -59,6 +59,7 @@
+ #include <asm/page.h>
+ #include <asm/init.h>
+ #include <asm/pat.h>
++#include <asm/smp.h>
+
+ #include <asm/xen/hypercall.h>
+ #include <asm/xen/hypervisor.h>
+@@ -1353,7 +1354,7 @@ static void xen_flush_tlb_others(const s
+ {
+ struct {
+ struct mmuext_op op;
+- DECLARE_BITMAP(mask, NR_CPUS);
++ DECLARE_BITMAP(mask, num_processors);
+ } *args;
+ struct multicall_space mcs;
+
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -206,11 +206,18 @@ static void __init xen_smp_prepare_boot_
+ static void __init xen_smp_prepare_cpus(unsigned int max_cpus)
+ {
+ unsigned cpu;
++ unsigned int i;
+
+ xen_init_lock_cpu(0);
+
+ smp_store_cpu_info(0);
+ cpu_data(0).x86_max_cores = 1;
++
++ for_each_possible_cpu(i) {
++ zalloc_cpumask_var(&per_cpu(cpu_sibling_map, i), GFP_KERNEL);
++ zalloc_cpumask_var(&per_cpu(cpu_core_map, i), GFP_KERNEL);
++ zalloc_cpumask_var(&per_cpu(cpu_llc_shared_map, i), GFP_KERNEL);
++ }
+ set_cpu_sibling_map(0);
+
+ if (xen_smp_intr_init(0))
--- /dev/null
+From c877b3b2ad5cb9d4fe523c5496185cc328ff3ae9 Mon Sep 17 00:00:00 2001
+From: Maarten Lankhorst <m.b.lankhorst@gmail.com>
+Date: Wed, 15 Jun 2011 23:47:21 +0200
+Subject: xhci: Add reset on resume quirk for asrock p67 host
+
+From: Maarten Lankhorst <m.b.lankhorst@gmail.com>
+
+commit c877b3b2ad5cb9d4fe523c5496185cc328ff3ae9 upstream.
+
+The asrock p67 xhci controller completely dies on resume, add a
+quirk for this, to bring the host back online after a suspend.
+
+This should be backported to stable kernels as old as 2.6.37.
+
+Signed-off-by: Maarten Lankhorst <m.b.lankhorst@gmail.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-pci.c | 8 ++++++++
+ drivers/usb/host/xhci.c | 2 ++
+ drivers/usb/host/xhci.h | 1 +
+ 3 files changed, 11 insertions(+)
+
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -28,6 +28,9 @@
+ #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000
+
++#define PCI_VENDOR_ID_ETRON 0x1b6f
++#define PCI_DEVICE_ID_ASROCK_P67 0x7023
++
+ static const char hcd_name[] = "xhci_hcd";
+
+ /* called after powerup, by probe or system-pm "wakeup" */
+@@ -120,6 +123,11 @@ static int xhci_pci_setup(struct usb_hcd
+ "has broken MSI implementation\n",
+ pdev->revision);
+ }
++ if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
++ pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
++ xhci->quirks |= XHCI_RESET_ON_RESUME;
++ xhci_dbg(xhci, "QUIRK: Resetting on resume\n");
++ }
+
+ if (pdev->vendor == PCI_VENDOR_ID_NEC)
+ xhci->quirks |= XHCI_NEC_HOST;
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -759,6 +759,8 @@ int xhci_resume(struct xhci_hcd *xhci, b
+ msleep(100);
+
+ spin_lock_irq(&xhci->lock);
++ if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ hibernated = true;
+
+ if (!hibernated) {
+ /* step 1: restore register */
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1287,6 +1287,7 @@ struct xhci_hcd {
+ #define XHCI_NEC_HOST (1 << 2)
+ #define XHCI_AMD_PLL_FIX (1 << 3)
+ #define XHCI_BROKEN_MSI (1 << 6)
++#define XHCI_RESET_ON_RESUME (1 << 7)
+ /* There are two roothubs to keep track of bus suspend info for */
+ struct xhci_bus_state bus_state[2];
+ /* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */
--- /dev/null
+From b3df3f9c7df9a8d85e03e158d35487618a160901 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Wed, 15 Jun 2011 19:57:46 -0700
+Subject: xhci: Always set urb->status to zero for isoc endpoints.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit b3df3f9c7df9a8d85e03e158d35487618a160901 upstream.
+
+When the xHCI driver encounters a Missed Service Interval event for an
+isochronous endpoint ring, it means the host controller skipped over
+one or more isochronous TDs. For TD that is skipped, skip_isoc_td() is
+called. This sets the frame descriptor status to -EXDEV, and also sets
+the value stored in the int pointed to by status to -EXDEV.
+
+If the isochronous TD happens to be the last TD in an URB,
+handle_tx_event() will use the status variable to give back the URB to
+the USB core. That means drivers will see urb->status as -EXDEV.
+
+It turns out that EHCI, UHCI, and OHCI always set urb->status to zero for
+an isochronous urb, regardless of what the frame status is. See
+itd_complete() in ehci-sched.c:
+
+ } else {
+ /* URB was too late */
+ desc->status = -EXDEV;
+ }
+ }
+
+ /* handle completion now? */
+ if (likely ((urb_index + 1) != urb->number_of_packets))
+ goto done;
+
+ /* ASSERT: it's really the last itd for this urb
+ list_for_each_entry (itd, &stream->td_list, itd_list)
+ BUG_ON (itd->urb == urb);
+ */
+
+ /* give urb back to the driver; completion often (re)submits */
+ dev = urb->dev;
+ ehci_urb_done(ehci, urb, 0);
+
+ehci_urb_done() completes the URB with the status of the third argument, which
+is always zero in this case.
+
+It turns out that many USB webcam drivers, such as uvcvideo, cannot
+handle urb->status set to a non-zero value. They will not resubmit
+their isochronous URBs in that case, and userspace will see a frozen
+video.
+
+Change the xHCI driver to be consistent with the EHCI and UHCI driver,
+and always set urb->status to 0 for isochronous URBs.
+
+This patch should be backported to kernels as old as 2.6.36
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Cc: "Xu, Andiry" <Andiry.Xu@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-ring.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1768,9 +1768,6 @@ static int process_isoc_td(struct xhci_h
+ }
+ }
+
+- if ((idx == urb_priv->length - 1) && *status == -EINPROGRESS)
+- *status = 0;
+-
+ return finish_td(xhci, td, event_trb, event, ep, status, false);
+ }
+
+@@ -1788,8 +1785,7 @@ static int skip_isoc_td(struct xhci_hcd
+ idx = urb_priv->td_cnt;
+ frame = &td->urb->iso_frame_desc[idx];
+
+- /* The transfer is partly done */
+- *status = -EXDEV;
++ /* The transfer is partly done. */
+ frame->status = -EXDEV;
+
+ /* calc actual length */
+@@ -2139,6 +2135,11 @@ cleanup:
+ "status = %d\n",
+ urb, urb->actual_length, status);
+ spin_unlock(&xhci->lock);
++ /* EHCI, UHCI, and OHCI always unconditionally set the
++ * urb->status of an isochronous endpoint to 0.
++ */
++ if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
++ status = 0;
+ usb_hcd_giveback_urb(bus_to_hcd(urb->dev->bus), urb, status);
+ spin_lock(&xhci->lock);
+ }
--- /dev/null
+From fa75ac379e63c2864e9049b5e8615e40f65c1e70 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Sun, 5 Jun 2011 23:10:04 -0700
+Subject: xhci: Reject double add of active endpoints.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit fa75ac379e63c2864e9049b5e8615e40f65c1e70 upstream.
+
+While trying to switch a UAS device from the BOT configuration to the UAS
+configuration via the bConfigurationValue file, Tanya ran into an issue in
+the USB core. usb_disable_device() sets entries in udev->ep_out and
+udev->ep_out to NULL, but doesn't call into the xHCI bandwidth management
+functions to remove the BOT configuration endpoints from the xHCI host's
+internal structures.
+
+The USB core would then attempt to add endpoints for the UAS
+configuration, and some of the endpoints had the same address as endpoints
+in the BOT configuration. The xHCI driver blindly added the endpoints
+again, but the xHCI host controller rejected the Configure Endpoint
+command because active endpoints were added without being dropped.
+
+Make the xHCI driver reject calls to xhci_add_endpoint() that attempt to
+add active endpoints without first calling xhci_drop_endpoint().
+
+This should be backported to kernels as old as 2.6.31.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: Tanya Brokhman <tlinder@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1396,6 +1396,7 @@ int xhci_add_endpoint(struct usb_hcd *hc
+ u32 added_ctxs;
+ unsigned int last_ctx;
+ u32 new_add_flags, new_drop_flags, new_slot_info;
++ struct xhci_virt_device *virt_dev;
+ int ret = 0;
+
+ ret = xhci_check_args(hcd, udev, ep, 1, true, __func__);
+@@ -1418,11 +1419,25 @@ int xhci_add_endpoint(struct usb_hcd *hc
+ return 0;
+ }
+
+- in_ctx = xhci->devs[udev->slot_id]->in_ctx;
+- out_ctx = xhci->devs[udev->slot_id]->out_ctx;
++ virt_dev = xhci->devs[udev->slot_id];
++ in_ctx = virt_dev->in_ctx;
++ out_ctx = virt_dev->out_ctx;
+ ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
+ ep_index = xhci_get_endpoint_index(&ep->desc);
+ ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
++
++ /* If this endpoint is already in use, and the upper layers are trying
++ * to add it again without dropping it, reject the addition.
++ */
++ if (virt_dev->eps[ep_index].ring &&
++ !(le32_to_cpu(ctrl_ctx->drop_flags) &
++ xhci_get_endpoint_flag(&ep->desc))) {
++ xhci_warn(xhci, "Trying to add endpoint 0x%x "
++ "without dropping it.\n",
++ (unsigned int) ep->desc.bEndpointAddress);
++ return -EINVAL;
++ }
++
+ /* If the HCD has already noted the endpoint is enabled,
+ * ignore this request.
+ */
+@@ -1437,8 +1452,7 @@ int xhci_add_endpoint(struct usb_hcd *hc
+ * process context, not interrupt context (or so documenation
+ * for usb_set_interface() and usb_set_configuration() claim).
+ */
+- if (xhci_endpoint_init(xhci, xhci->devs[udev->slot_id],
+- udev, ep, GFP_NOIO) < 0) {
++ if (xhci_endpoint_init(xhci, virt_dev, udev, ep, GFP_NOIO) < 0) {
+ dev_dbg(&udev->dev, "%s - could not initialize ep %#x\n",
+ __func__, ep->desc.bEndpointAddress);
+ return -ENOMEM;
projects / thirdparty / kernel / stable-queue.git / commitdiff
