--- /dev/null
+From f64964796dedca340608fb1075ab6baad5625851 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 28 Nov 2011 14:49:26 -0500
+Subject: drm/radeon/kms: add some loop timeouts in pageflip code
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit f64964796dedca340608fb1075ab6baad5625851 upstream.
+
+Avoid infinite loops waiting for surface updates if a GPU
+reset happens while waiting for a page flip.
+
+See:
+https://bugs.freedesktop.org/show_bug.cgi?id=43191
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
+Tested-by: Simon Farnsworth <simon.farnsworth@onelan.co.uk>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 7 ++++++-
+ drivers/gpu/drm/radeon/r100.c | 7 ++++++-
+ drivers/gpu/drm/radeon/rs600.c | 7 ++++++-
+ drivers/gpu/drm/radeon/rv770.c | 7 ++++++-
+ 4 files changed, 24 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -82,6 +82,7 @@ u32 evergreen_page_flip(struct radeon_de
+ {
+ struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
+ u32 tmp = RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset);
++ int i;
+
+ /* Lock the graphics update lock */
+ tmp |= EVERGREEN_GRPH_UPDATE_LOCK;
+@@ -99,7 +100,11 @@ u32 evergreen_page_flip(struct radeon_de
+ (u32)crtc_base);
+
+ /* Wait for update_pending to go high. */
+- while (!(RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset) & EVERGREEN_GRPH_SURFACE_UPDATE_PENDING));
++ for (i = 0; i < rdev->usec_timeout; i++) {
++ if (RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset) & EVERGREEN_GRPH_SURFACE_UPDATE_PENDING)
++ break;
++ udelay(1);
++ }
+ DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n");
+
+ /* Unlock the lock, so double-buffering can take place inside vblank */
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -84,13 +84,18 @@ u32 r100_page_flip(struct radeon_device
+ {
+ struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
+ u32 tmp = ((u32)crtc_base) | RADEON_CRTC_OFFSET__OFFSET_LOCK;
++ int i;
+
+ /* Lock the graphics update lock */
+ /* update the scanout addresses */
+ WREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset, tmp);
+
+ /* Wait for update_pending to go high. */
+- while (!(RREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset) & RADEON_CRTC_OFFSET__GUI_TRIG_OFFSET));
++ for (i = 0; i < rdev->usec_timeout; i++) {
++ if (RREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset) & RADEON_CRTC_OFFSET__GUI_TRIG_OFFSET)
++ break;
++ udelay(1);
++ }
+ DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n");
+
+ /* Unlock the lock, so double-buffering can take place inside vblank */
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -62,6 +62,7 @@ u32 rs600_page_flip(struct radeon_device
+ {
+ struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
+ u32 tmp = RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset);
++ int i;
+
+ /* Lock the graphics update lock */
+ tmp |= AVIVO_D1GRPH_UPDATE_LOCK;
+@@ -74,7 +75,11 @@ u32 rs600_page_flip(struct radeon_device
+ (u32)crtc_base);
+
+ /* Wait for update_pending to go high. */
+- while (!(RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING));
++ for (i = 0; i < rdev->usec_timeout; i++) {
++ if (RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING)
++ break;
++ udelay(1);
++ }
+ DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n");
+
+ /* Unlock the lock, so double-buffering can take place inside vblank */
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -47,6 +47,7 @@ u32 rv770_page_flip(struct radeon_device
+ {
+ struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
+ u32 tmp = RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset);
++ int i;
+
+ /* Lock the graphics update lock */
+ tmp |= AVIVO_D1GRPH_UPDATE_LOCK;
+@@ -66,7 +67,11 @@ u32 rv770_page_flip(struct radeon_device
+ (u32)crtc_base);
+
+ /* Wait for update_pending to go high. */
+- while (!(RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING));
++ for (i = 0; i < rdev->usec_timeout; i++) {
++ if (RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING)
++ break;
++ udelay(1);
++ }
+ DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n");
+
+ /* Unlock the lock, so double-buffering can take place inside vblank */
--- /dev/null
+From 2ed4d9d648cbd4fb1c232a646dbdbdfdd373ca94 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 1 Dec 2011 11:02:11 -0500
+Subject: drm/radeon/kms: add some new pci ids
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 2ed4d9d648cbd4fb1c232a646dbdbdfdd373ca94 upstream.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/drm/drm_pciids.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -197,6 +197,14 @@
+ {0x1002, 0x6770, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6778, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6779, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6840, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6841, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6842, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6843, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6849, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6850, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6858, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6859, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6880, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6888, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6889, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
--- /dev/null
+From e3420901eba65b1c46bed86d360e3a8685d20734 Mon Sep 17 00:00:00 2001
+From: Matthieu CASTET <castet.matthieu@free.fr>
+Date: Mon, 28 Nov 2011 11:30:22 +0100
+Subject: EHCI : Fix a regression in the ISO scheduler
+
+From: Matthieu CASTET <castet.matthieu@free.fr>
+
+commit e3420901eba65b1c46bed86d360e3a8685d20734 upstream.
+
+Fix a regression that was introduced by commit
+811c926c538f7e8d3c08b630dd5844efd7e000f6 (USB: EHCI: fix HUB TT scheduling
+issue with iso transfer).
+
+We detect an error if next == start, but this means uframe 0 can't be allocated
+anymore for iso transfer...
+
+Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
+Signed-off-by: Matthieu CASTET <castet.matthieu@free.fr>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-sched.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1479,6 +1479,7 @@ iso_stream_schedule (
+ * jump until after the queue is primed.
+ */
+ else {
++ int done = 0;
+ start = SCHEDULE_SLOP + (now & ~0x07);
+
+ /* NOTE: assumes URB_ISO_ASAP, to limit complexity/bugs */
+@@ -1496,18 +1497,18 @@ iso_stream_schedule (
+ if (stream->highspeed) {
+ if (itd_slot_ok(ehci, mod, start,
+ stream->usecs, period))
+- break;
++ done = 1;
+ } else {
+ if ((start % 8) >= 6)
+ continue;
+ if (sitd_slot_ok(ehci, mod, stream,
+ start, sched, period))
+- break;
++ done = 1;
+ }
+- } while (start > next);
++ } while (start > next && !done);
+
+ /* no room in the schedule */
+- if (start == next) {
++ if (!done) {
+ ehci_dbg(ehci, "iso resched full %p (now %d max %d)\n",
+ urb, now, now + mod);
+ status = -ENOSPC;
--- /dev/null
+From bda63586bc5929e97288cdb371bb6456504867ed Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Mon, 28 Nov 2011 09:44:16 +0100
+Subject: firmware: Sigma: Fix endianess issues
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit bda63586bc5929e97288cdb371bb6456504867ed upstream.
+
+Currently the SigmaDSP firmware loader only works correctly on little-endian
+systems. Fix this by using the proper endianess conversion functions.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Acked-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firmware/sigma.c | 2 +-
+ include/linux/sigma.h | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/firmware/sigma.c
++++ b/drivers/firmware/sigma.c
+@@ -133,7 +133,7 @@ int process_sigma_firmware(struct i2c_cl
+ crc = crc32(0, fw->data + sizeof(*ssfw_head),
+ fw->size - sizeof(*ssfw_head));
+ pr_debug("%s: crc=%x\n", __func__, crc);
+- if (crc != ssfw_head->crc)
++ if (crc != le32_to_cpu(ssfw_head->crc))
+ goto done;
+
+ ssfw.pos = sizeof(*ssfw_head);
+--- a/include/linux/sigma.h
++++ b/include/linux/sigma.h
+@@ -24,7 +24,7 @@ struct sigma_firmware {
+ struct sigma_firmware_header {
+ unsigned char magic[7];
+ u8 version;
+- u32 crc;
++ __le32 crc;
+ };
+
+ enum {
+@@ -40,14 +40,14 @@ enum {
+ struct sigma_action {
+ u8 instr;
+ u8 len_hi;
+- u16 len;
+- u16 addr;
++ __le16 len;
++ __be16 addr;
+ unsigned char payload[];
+ };
+
+ static inline u32 sigma_action_len(struct sigma_action *sa)
+ {
+- return (sa->len_hi << 16) | sa->len;
++ return (sa->len_hi << 16) | le16_to_cpu(sa->len);
+ }
+
+ extern int process_sigma_firmware(struct i2c_client *client, const char *name);
--- /dev/null
+From 4f718a29fe4908c2cea782f751e9805319684e2b Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Mon, 28 Nov 2011 09:44:14 +0100
+Subject: firmware: Sigma: Prevent out of bounds memory access
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit 4f718a29fe4908c2cea782f751e9805319684e2b upstream.
+
+The SigmaDSP firmware loader currently does not perform enough boundary size
+checks when processing the firmware. As a result it is possible that a
+malformed firmware can cause an out of bounds memory access.
+
+This patch adds checks which ensure that both the action header and the payload
+are completely inside the firmware data boundaries before processing them.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Acked-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firmware/sigma.c | 76 ++++++++++++++++++++++++++++++++++-------------
+ include/linux/sigma.h | 5 ---
+ 2 files changed, 55 insertions(+), 26 deletions(-)
+
+--- a/drivers/firmware/sigma.c
++++ b/drivers/firmware/sigma.c
+@@ -14,13 +14,34 @@
+ #include <linux/module.h>
+ #include <linux/sigma.h>
+
+-/* Return: 0==OK, <0==error, =1 ==no more actions */
++static size_t sigma_action_size(struct sigma_action *sa)
++{
++ size_t payload = 0;
++
++ switch (sa->instr) {
++ case SIGMA_ACTION_WRITEXBYTES:
++ case SIGMA_ACTION_WRITESINGLE:
++ case SIGMA_ACTION_WRITESAFELOAD:
++ payload = sigma_action_len(sa);
++ break;
++ default:
++ break;
++ }
++
++ payload = ALIGN(payload, 2);
++
++ return payload + sizeof(struct sigma_action);
++}
++
++/*
++ * Returns a negative error value in case of an error, 0 if processing of
++ * the firmware should be stopped after this action, 1 otherwise.
++ */
+ static int
+-process_sigma_action(struct i2c_client *client, struct sigma_firmware *ssfw)
++process_sigma_action(struct i2c_client *client, struct sigma_action *sa)
+ {
+- struct sigma_action *sa = (void *)(ssfw->fw->data + ssfw->pos);
+ size_t len = sigma_action_len(sa);
+- int ret = 0;
++ int ret;
+
+ pr_debug("%s: instr:%i addr:%#x len:%zu\n", __func__,
+ sa->instr, sa->addr, len);
+@@ -29,44 +50,50 @@ process_sigma_action(struct i2c_client *
+ case SIGMA_ACTION_WRITEXBYTES:
+ case SIGMA_ACTION_WRITESINGLE:
+ case SIGMA_ACTION_WRITESAFELOAD:
+- if (ssfw->fw->size < ssfw->pos + len)
+- return -EINVAL;
+ ret = i2c_master_send(client, (void *)&sa->addr, len);
+ if (ret < 0)
+ return -EINVAL;
+ break;
+-
+ case SIGMA_ACTION_DELAY:
+- ret = 0;
+ udelay(len);
+ len = 0;
+ break;
+-
+ case SIGMA_ACTION_END:
+- return 1;
+-
++ return 0;
+ default:
+ return -EINVAL;
+ }
+
+- /* when arrive here ret=0 or sent data */
+- ssfw->pos += sigma_action_size(sa, len);
+- return ssfw->pos == ssfw->fw->size;
++ return 1;
+ }
+
+ static int
+ process_sigma_actions(struct i2c_client *client, struct sigma_firmware *ssfw)
+ {
+- pr_debug("%s: processing %p\n", __func__, ssfw);
++ struct sigma_action *sa;
++ size_t size;
++ int ret;
++
++ while (ssfw->pos + sizeof(*sa) <= ssfw->fw->size) {
++ sa = (struct sigma_action *)(ssfw->fw->data + ssfw->pos);
++
++ size = sigma_action_size(sa);
++ ssfw->pos += size;
++ if (ssfw->pos > ssfw->fw->size || size == 0)
++ break;
++
++ ret = process_sigma_action(client, sa);
+
+- while (1) {
+- int ret = process_sigma_action(client, ssfw);
+ pr_debug("%s: action returned %i\n", __func__, ret);
+- if (ret == 1)
+- return 0;
+- else if (ret)
++
++ if (ret <= 0)
+ return ret;
+ }
++
++ if (ssfw->pos != ssfw->fw->size)
++ return -EINVAL;
++
++ return 0;
+ }
+
+ int process_sigma_firmware(struct i2c_client *client, const char *name)
+@@ -89,7 +116,14 @@ int process_sigma_firmware(struct i2c_cl
+
+ /* then verify the header */
+ ret = -EINVAL;
+- if (fw->size < sizeof(*ssfw_head))
++
++ /*
++ * Reject too small or unreasonable large files. The upper limit has been
++ * chosen a bit arbitrarily, but it should be enough for all practical
++ * purposes and having the limit makes it easier to avoid integer
++ * overflows later in the loading process.
++ */
++ if (fw->size < sizeof(*ssfw_head) || fw->size >= 0x4000000)
+ goto done;
+
+ ssfw_head = (void *)fw->data;
+--- a/include/linux/sigma.h
++++ b/include/linux/sigma.h
+@@ -50,11 +50,6 @@ static inline u32 sigma_action_len(struc
+ return (sa->len_hi << 16) | sa->len;
+ }
+
+-static inline size_t sigma_action_size(struct sigma_action *sa, u32 payload_len)
+-{
+- return sizeof(*sa) + payload_len + (payload_len % 2);
+-}
+-
+ extern int process_sigma_firmware(struct i2c_client *client, const char *name);
+
+ #endif
--- /dev/null
+From c56935bdc0a8edf50237d3b0205133a5b0adc604 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Mon, 28 Nov 2011 09:44:15 +0100
+Subject: firmware: Sigma: Skip header during CRC generation
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit c56935bdc0a8edf50237d3b0205133a5b0adc604 upstream.
+
+The firmware header is not part of the CRC, so skip it. Otherwise the firmware
+will be rejected due to non-matching CRCs.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Acked-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firmware/sigma.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/firmware/sigma.c
++++ b/drivers/firmware/sigma.c
+@@ -130,7 +130,8 @@ int process_sigma_firmware(struct i2c_cl
+ if (memcmp(ssfw_head->magic, SIGMA_MAGIC, ARRAY_SIZE(ssfw_head->magic)))
+ goto done;
+
+- crc = crc32(0, fw->data, fw->size);
++ crc = crc32(0, fw->data + sizeof(*ssfw_head),
++ fw->size - sizeof(*ssfw_head));
+ pr_debug("%s: crc=%x\n", __func__, crc);
+ if (crc != ssfw_head->crc)
+ goto done;
--- /dev/null
+From b1807719f6acdf18cc4bde3b5400d05d77801494 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@gmail.com>
+Date: Wed, 16 Nov 2011 11:39:52 +0100
+Subject: HID: Correct General touch PID
+
+From: Benjamin Tissoires <benjamin.tissoires@gmail.com>
+
+commit b1807719f6acdf18cc4bde3b5400d05d77801494 upstream.
+
+Genera Touch told us that 0001 is their single point device
+and 0003 is the multitouch one. Apparently, we made the tests
+someone having a prototype, and not the final product.
+They said it should be safe to do the switch.
+
+This partially reverts 5572da0 ("HID: hid-mulitouch: add support
+for the 'Sensing Win7-TwoFinger'").
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hid-core.c | 2 +-
+ drivers/hid/hid-ids.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1721,8 +1721,8 @@ static const struct hid_device_id hid_ig
+ { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0001) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0002) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0003) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0004) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_4_PHIDGETSERVO_30) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_1_PHIDGETSERVO_30) },
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -266,7 +266,7 @@
+ #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR 0x0002
+
+ #define USB_VENDOR_ID_GENERAL_TOUCH 0x0dfc
+-#define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0001
++#define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0003
+
+ #define USB_VENDOR_ID_GLAB 0x06c2
+ #define USB_DEVICE_ID_4_PHIDGETSERVO_30 0x0038
revert-mfd-fix-twl4030-dependencies-for-audio-codec.patch
scsi-silencing-killing-requests-for-dead-queue.patch
hugetlb-release-pages-in-the-error-path-of-hugetlb_cow.patch
+drm-radeon-kms-add-some-new-pci-ids.patch
+drm-radeon-kms-add-some-loop-timeouts-in-pageflip-code.patch
+firmware-sigma-prevent-out-of-bounds-memory-access.patch
+firmware-sigma-skip-header-during-crc-generation.patch
+firmware-sigma-fix-endianess-issues.patch
+staging-usbip-bugfix-for-deadlock.patch
+staging-comedi-fix-oops-for-usb-daq-devices.patch
+staging-comedi-fix-mmap_count.patch
+staging-comedi-fix-signal-handling-in-read-and-write.patch
+usb-whci-hcd-fix-endian-conversion-in-qset_clear.patch
+hid-correct-general-touch-pid.patch
+usb-ftdi_sio-add-pid-for-propox-ispcable-iii.patch
+usb-option-add-huawei-e353-controlling-interfaces.patch
+usb-option-add-simcom-sim5218.patch
+usb-usb-storage-unusual_devs-entry-for-kingston-dt-101-g2.patch
+usb-ehci-fix-hub-tt-scheduling-issue-with-iso-transfer.patch
+ehci-fix-a-regression-in-the-iso-scheduler.patch
+xhci-fix-bug-in-xhci_clear_command_ring.patch
--- /dev/null
+From df30b21cb0eed5ba8a8e0cdfeebc66ba8cde821d Mon Sep 17 00:00:00 2001
+From: Federico Vaga <federico.vaga@gmail.com>
+Date: Sat, 29 Oct 2011 09:45:39 +0200
+Subject: Staging: comedi: fix mmap_count
+
+From: Federico Vaga <federico.vaga@gmail.com>
+
+commit df30b21cb0eed5ba8a8e0cdfeebc66ba8cde821d upstream.
+
+In comedi_fops, mmap_count is decremented at comedi_vm_ops->close but
+it is not incremented at comedi_vm_ops->open. This may result in a negative
+counter. The patch introduces the open method to keep the counter
+consistent.
+
+The bug was triggerd by this sample code:
+
+ mmap(0, ...., comedi_fd);
+ fork();
+ exit(0);
+
+Acked-by: Alessandro Rubini <rubini@gnudd.com>
+Signed-off-by: Federico Vaga <federico.vaga@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/comedi/comedi_fops.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1432,7 +1432,21 @@ static int do_cancel(struct comedi_devic
+ return ret;
+ }
+
+-static void comedi_unmap(struct vm_area_struct *area)
++
++static void comedi_vm_open(struct vm_area_struct *area)
++{
++ struct comedi_async *async;
++ struct comedi_device *dev;
++
++ async = area->vm_private_data;
++ dev = async->subdevice->device;
++
++ mutex_lock(&dev->mutex);
++ async->mmap_count++;
++ mutex_unlock(&dev->mutex);
++}
++
++static void comedi_vm_close(struct vm_area_struct *area)
+ {
+ struct comedi_async *async;
+ struct comedi_device *dev;
+@@ -1446,7 +1460,8 @@ static void comedi_unmap(struct vm_area_
+ }
+
+ static struct vm_operations_struct comedi_vm_ops = {
+- .close = comedi_unmap,
++ .open = comedi_vm_open,
++ .close = comedi_vm_close,
+ };
+
+ static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
--- /dev/null
+From 3ffab428f40849ed5f21bcfd7285bdef7902f9ca Mon Sep 17 00:00:00 2001
+From: Bernd Porr <berndporr@f2s.com>
+Date: Tue, 8 Nov 2011 21:23:03 +0000
+Subject: staging: comedi: fix oops for USB DAQ devices.
+
+From: Bernd Porr <berndporr@f2s.com>
+
+commit 3ffab428f40849ed5f21bcfd7285bdef7902f9ca upstream.
+
+This fixes kernel oops when an USB DAQ device is plugged out while it's
+communicating with the userspace software.
+
+Signed-off-by: Bernd Porr <berndporr@f2s.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/comedi/comedi_fops.c | 73 +++++++++++++++++++++++++----------
+ 1 file changed, 54 insertions(+), 19 deletions(-)
+
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1452,9 +1452,6 @@ static struct vm_operations_struct comed
+ static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+ const unsigned minor = iminor(file->f_dentry->d_inode);
+- struct comedi_device_file_info *dev_file_info =
+- comedi_get_device_file_info(minor);
+- struct comedi_device *dev = dev_file_info->device;
+ struct comedi_async *async = NULL;
+ unsigned long start = vma->vm_start;
+ unsigned long size;
+@@ -1462,6 +1459,15 @@ static int comedi_mmap(struct file *file
+ int i;
+ int retval;
+ struct comedi_subdevice *s;
++ struct comedi_device_file_info *dev_file_info;
++ struct comedi_device *dev;
++
++ dev_file_info = comedi_get_device_file_info(minor);
++ if (dev_file_info == NULL)
++ return -ENODEV;
++ dev = dev_file_info->device;
++ if (dev == NULL)
++ return -ENODEV;
+
+ mutex_lock(&dev->mutex);
+ if (!dev->attached) {
+@@ -1528,11 +1534,17 @@ static unsigned int comedi_poll(struct f
+ {
+ unsigned int mask = 0;
+ const unsigned minor = iminor(file->f_dentry->d_inode);
+- struct comedi_device_file_info *dev_file_info =
+- comedi_get_device_file_info(minor);
+- struct comedi_device *dev = dev_file_info->device;
+ struct comedi_subdevice *read_subdev;
+ struct comedi_subdevice *write_subdev;
++ struct comedi_device_file_info *dev_file_info;
++ struct comedi_device *dev;
++ dev_file_info = comedi_get_device_file_info(minor);
++
++ if (dev_file_info == NULL)
++ return -ENODEV;
++ dev = dev_file_info->device;
++ if (dev == NULL)
++ return -ENODEV;
+
+ mutex_lock(&dev->mutex);
+ if (!dev->attached) {
+@@ -1578,9 +1590,15 @@ static ssize_t comedi_write(struct file
+ int n, m, count = 0, retval = 0;
+ DECLARE_WAITQUEUE(wait, current);
+ const unsigned minor = iminor(file->f_dentry->d_inode);
+- struct comedi_device_file_info *dev_file_info =
+- comedi_get_device_file_info(minor);
+- struct comedi_device *dev = dev_file_info->device;
++ struct comedi_device_file_info *dev_file_info;
++ struct comedi_device *dev;
++ dev_file_info = comedi_get_device_file_info(minor);
++
++ if (dev_file_info == NULL)
++ return -ENODEV;
++ dev = dev_file_info->device;
++ if (dev == NULL)
++ return -ENODEV;
+
+ if (!dev->attached) {
+ DPRINTK("no driver configured on comedi%i\n", dev->minor);
+@@ -1683,9 +1701,15 @@ static ssize_t comedi_read(struct file *
+ int n, m, count = 0, retval = 0;
+ DECLARE_WAITQUEUE(wait, current);
+ const unsigned minor = iminor(file->f_dentry->d_inode);
+- struct comedi_device_file_info *dev_file_info =
+- comedi_get_device_file_info(minor);
+- struct comedi_device *dev = dev_file_info->device;
++ struct comedi_device_file_info *dev_file_info;
++ struct comedi_device *dev;
++ dev_file_info = comedi_get_device_file_info(minor);
++
++ if (dev_file_info == NULL)
++ return -ENODEV;
++ dev = dev_file_info->device;
++ if (dev == NULL)
++ return -ENODEV;
+
+ if (!dev->attached) {
+ DPRINTK("no driver configured on comedi%i\n", dev->minor);
+@@ -1885,11 +1909,17 @@ ok:
+ static int comedi_close(struct inode *inode, struct file *file)
+ {
+ const unsigned minor = iminor(inode);
+- struct comedi_device_file_info *dev_file_info =
+- comedi_get_device_file_info(minor);
+- struct comedi_device *dev = dev_file_info->device;
+ struct comedi_subdevice *s = NULL;
+ int i;
++ struct comedi_device_file_info *dev_file_info;
++ struct comedi_device *dev;
++ dev_file_info = comedi_get_device_file_info(minor);
++
++ if (dev_file_info == NULL)
++ return -ENODEV;
++ dev = dev_file_info->device;
++ if (dev == NULL)
++ return -ENODEV;
+
+ mutex_lock(&dev->mutex);
+
+@@ -1923,10 +1953,15 @@ static int comedi_close(struct inode *in
+ static int comedi_fasync(int fd, struct file *file, int on)
+ {
+ const unsigned minor = iminor(file->f_dentry->d_inode);
+- struct comedi_device_file_info *dev_file_info =
+- comedi_get_device_file_info(minor);
+-
+- struct comedi_device *dev = dev_file_info->device;
++ struct comedi_device_file_info *dev_file_info;
++ struct comedi_device *dev;
++ dev_file_info = comedi_get_device_file_info(minor);
++
++ if (dev_file_info == NULL)
++ return -ENODEV;
++ dev = dev_file_info->device;
++ if (dev == NULL)
++ return -ENODEV;
+
+ return fasync_helper(fd, file, on, &dev->async_queue);
+ }
--- /dev/null
+From 6a9ce6b654e491981f6ef7e214cbd4f63e033848 Mon Sep 17 00:00:00 2001
+From: Federico Vaga <federico.vaga@gmail.com>
+Date: Sat, 29 Oct 2011 09:47:39 +0200
+Subject: Staging: comedi: fix signal handling in read and write
+
+From: Federico Vaga <federico.vaga@gmail.com>
+
+commit 6a9ce6b654e491981f6ef7e214cbd4f63e033848 upstream.
+
+After sleeping on a wait queue, signal_pending(current) should be
+checked (not before sleeping).
+
+Acked-by: Alessandro Rubini <rubini@gnudd.com>
+Signed-off-by: Federico Vaga <federico.vaga@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/comedi/comedi_fops.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1673,11 +1673,11 @@ static ssize_t comedi_write(struct file
+ retval = -EAGAIN;
+ break;
+ }
++ schedule();
+ if (signal_pending(current)) {
+ retval = -ERESTARTSYS;
+ break;
+ }
+- schedule();
+ if (!s->busy)
+ break;
+ if (s->busy != file) {
+@@ -1780,11 +1780,11 @@ static ssize_t comedi_read(struct file *
+ retval = -EAGAIN;
+ break;
+ }
++ schedule();
+ if (signal_pending(current)) {
+ retval = -ERESTARTSYS;
+ break;
+ }
+- schedule();
+ if (!s->busy) {
+ retval = 0;
+ break;
--- /dev/null
+From 438957f8d4a84daa7fa5be6978ad5897a2e9e5e5 Mon Sep 17 00:00:00 2001
+From: Bart Westgeest <bart@elbrys.com>
+Date: Tue, 1 Nov 2011 15:01:28 -0400
+Subject: staging: usbip: bugfix for deadlock
+
+From: Bart Westgeest <bart@elbrys.com>
+
+commit 438957f8d4a84daa7fa5be6978ad5897a2e9e5e5 upstream.
+
+Interrupts must be disabled prior to calling usb_hcd_unlink_urb_from_ep.
+If interrupts are not disabled, it can potentially lead to a deadlock.
+The deadlock is readily reproduceable on a slower (ARM based) device
+such as the TI Pandaboard.
+
+Signed-off-by: Bart Westgeest <bart@elbrys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/usbip/vhci_rx.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/usbip/vhci_rx.c
++++ b/drivers/staging/usbip/vhci_rx.c
+@@ -68,6 +68,7 @@ static void vhci_recv_ret_submit(struct
+ {
+ struct usbip_device *ud = &vdev->ud;
+ struct urb *urb;
++ unsigned long flags;
+
+ spin_lock(&vdev->priv_lock);
+ urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum);
+@@ -101,9 +102,9 @@ static void vhci_recv_ret_submit(struct
+
+ usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
+
+- spin_lock(&the_controller->lock);
++ spin_lock_irqsave(&the_controller->lock, flags);
+ usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
+- spin_unlock(&the_controller->lock);
++ spin_unlock_irqrestore(&the_controller->lock, flags);
+
+ usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status);
+
+@@ -141,6 +142,7 @@ static void vhci_recv_ret_unlink(struct
+ {
+ struct vhci_unlink *unlink;
+ struct urb *urb;
++ unsigned long flags;
+
+ usbip_dump_header(pdu);
+
+@@ -170,9 +172,9 @@ static void vhci_recv_ret_unlink(struct
+ urb->status = pdu->u.ret_unlink.status;
+ pr_info("urb->status %d\n", urb->status);
+
+- spin_lock(&the_controller->lock);
++ spin_lock_irqsave(&the_controller->lock, flags);
+ usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
+- spin_unlock(&the_controller->lock);
++ spin_unlock_irqrestore(&the_controller->lock, flags);
+
+ usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
+ urb->status);
--- /dev/null
+From 811c926c538f7e8d3c08b630dd5844efd7e000f6 Mon Sep 17 00:00:00 2001
+From: Thomas Poussevin <thomas.poussevin@parrot.com>
+Date: Thu, 27 Oct 2011 18:46:48 +0200
+Subject: USB: EHCI: fix HUB TT scheduling issue with iso transfer
+
+From: Thomas Poussevin <thomas.poussevin@parrot.com>
+
+commit 811c926c538f7e8d3c08b630dd5844efd7e000f6 upstream.
+
+The current TT scheduling doesn't allow to play and then record on a
+full-speed device connected to a high speed hub.
+
+The IN iso stream can only start on the first uframe (0-2 for a 165 us)
+because of CSPLIT transactions.
+For the OUT iso stream there no such restriction. uframe 0-5 are possible.
+
+The idea of this patch is that the first uframe are precious (for IN TT iso
+stream) and we should allocate the last uframes first if possible.
+
+For that we reverse the order of uframe allocation (last uframe first).
+
+Here an example :
+
+hid interrupt stream
+----------------------------------------------------------------------
+uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+----------------------------------------------------------------------
+max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
+----------------------------------------------------------------------
+used usecs on a frame | 13 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
+----------------------------------------------------------------------
+
+iso OUT stream
+----------------------------------------------------------------------
+uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+----------------------------------------------------------------------
+max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
+----------------------------------------------------------------------
+used usecs on a frame | 13 | 125 | 39 | 0 | 0 | 0 | 0 | 0 |
+----------------------------------------------------------------------
+
+There no place for iso IN stream (uframe 0-2 are used) and we got "cannot
+submit datapipe for urb 0, error -28: not enough bandwidth" error.
+
+With the patch this become.
+
+iso OUT stream
+----------------------------------------------------------------------
+uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+----------------------------------------------------------------------
+max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
+----------------------------------------------------------------------
+used usecs on a frame | 13 | 0 | 0 | 0 | 125 | 39 | 0 | 0 |
+----------------------------------------------------------------------
+
+iso IN stream
+----------------------------------------------------------------------
+uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+----------------------------------------------------------------------
+max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
+----------------------------------------------------------------------
+used usecs on a frame | 13 | 0 | 125 | 40 | 125 | 39 | 0 | 0 |
+----------------------------------------------------------------------
+
+Signed-off-by: Matthieu Castet <matthieu.castet@parrot.com>
+Signed-off-by: Thomas Poussevin <thomas.poussevin@parrot.com>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-sched.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1483,10 +1483,15 @@ iso_stream_schedule (
+
+ /* NOTE: assumes URB_ISO_ASAP, to limit complexity/bugs */
+
+- /* find a uframe slot with enough bandwidth */
+- next = start + period;
+- for (; start < next; start++) {
+-
++ /* find a uframe slot with enough bandwidth.
++ * Early uframes are more precious because full-speed
++ * iso IN transfers can't use late uframes,
++ * and therefore they should be allocated last.
++ */
++ next = start;
++ start += period;
++ do {
++ start--;
+ /* check schedule: enough space? */
+ if (stream->highspeed) {
+ if (itd_slot_ok(ehci, mod, start,
+@@ -1499,7 +1504,7 @@ iso_stream_schedule (
+ start, sched, period))
+ break;
+ }
+- }
++ } while (start > next);
+
+ /* no room in the schedule */
+ if (start == next) {
--- /dev/null
+From 307369b0ca06b27b511b61714e335ddfccf19c4f Mon Sep 17 00:00:00 2001
+From: Marcin Kościelnicki <koriakin@0x04.net>
+Date: Wed, 30 Nov 2011 17:01:04 +0100
+Subject: usb: ftdi_sio: add PID for Propox ISPcable III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marcin Kościelnicki <koriakin@0x04.net>
+
+commit 307369b0ca06b27b511b61714e335ddfccf19c4f upstream.
+
+Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -735,6 +735,7 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
+ { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -112,6 +112,7 @@
+
+ /* Propox devices */
+ #define FTDI_PROPOX_JTAGCABLEII_PID 0xD738
++#define FTDI_PROPOX_ISPCABLEIII_PID 0xD739
+
+ /* Lenz LI-USB Computer Interface. */
+ #define FTDI_LENZ_LIUSB_PID 0xD780
--- /dev/null
+From 46b1848360c8e634e0b063932a1261062fa0f7d6 Mon Sep 17 00:00:00 2001
+From: Dirk Nehring <dnehring@gmx.net>
+Date: Thu, 24 Nov 2011 19:22:23 +0100
+Subject: usb: option: add Huawei E353 controlling interfaces
+
+From: Dirk Nehring <dnehring@gmx.net>
+
+commit 46b1848360c8e634e0b063932a1261062fa0f7d6 upstream.
+
+This patch creates the missing controlling devices for the Huawei E353
+HSPA+ stick.
+
+Signed-off-by: Dirk Nehring <dnehring@gmx.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -657,6 +657,9 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x31) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4511, 0xff, 0x01, 0x32) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x01) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x02) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x03) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E353, 0xff, 0x01, 0x08) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) },
--- /dev/null
+From ec0cd94d881ca89cc9fb61d00d0f4b2b52e605b3 Mon Sep 17 00:00:00 2001
+From: Veli-Pekka Peltola <veli-pekka.peltola@bluegiga.com>
+Date: Thu, 24 Nov 2011 22:08:56 +0200
+Subject: usb: option: add SIMCom SIM5218
+
+From: Veli-Pekka Peltola <veli-pekka.peltola@bluegiga.com>
+
+commit ec0cd94d881ca89cc9fb61d00d0f4b2b52e605b3 upstream.
+
+Tested with SIM5218EVB-KIT evaluation kit.
+
+Signed-off-by: Veli-Pekka Peltola <veli-pekka.peltola@bluegiga.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -746,6 +746,7 @@ static const struct usb_device_id option
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
--- /dev/null
+From cec28a5428793b6bc64e56687fb239759d6da74e Mon Sep 17 00:00:00 2001
+From: Qinglin Ye <yestyle@gmail.com>
+Date: Wed, 23 Nov 2011 23:39:32 +0800
+Subject: USB: usb-storage: unusual_devs entry for Kingston DT 101 G2
+
+From: Qinglin Ye <yestyle@gmail.com>
+
+commit cec28a5428793b6bc64e56687fb239759d6da74e upstream.
+
+Kingston DT 101 G2 replies a wrong tag while transporting, add an
+unusal_devs entry to ignore the tag validation.
+
+Signed-off-by: Qinglin Ye <yestyle@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1854,6 +1854,13 @@ UNUSUAL_DEV( 0x1370, 0x6828, 0x0110, 0x
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE ),
+
++/* Reported by Qinglin Ye <yestyle@gmail.com> */
++UNUSUAL_DEV( 0x13fe, 0x3600, 0x0100, 0x0100,
++ "Kingston",
++ "DT 101 G2",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BULK_IGNORE_TAG ),
++
+ /* Reported by Francesco Foresti <frafore@tiscali.it> */
+ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
+ "Super Top",
--- /dev/null
+From 8746c83d538cab273d335acb2be226d096f4a5af Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 22 Nov 2011 10:28:31 +0300
+Subject: USB: whci-hcd: fix endian conversion in qset_clear()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 8746c83d538cab273d335acb2be226d096f4a5af upstream.
+
+qset->qh.link is an __le64 field and we should be using cpu_to_le64()
+to fill it.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/whci/qset.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/whci/qset.c
++++ b/drivers/usb/host/whci/qset.c
+@@ -124,7 +124,7 @@ void qset_clear(struct whc *whc, struct
+ {
+ qset->td_start = qset->td_end = qset->ntds = 0;
+
+- qset->qh.link = cpu_to_le32(QH_LINK_NTDS(8) | QH_LINK_T);
++ qset->qh.link = cpu_to_le64(QH_LINK_NTDS(8) | QH_LINK_T);
+ qset->qh.status = qset->qh.status & QH_STATUS_SEQ_MASK;
+ qset->qh.err_count = 0;
+ qset->qh.scratch[0] = 0;
--- /dev/null
+From 158886cd2cf4599e04f9b7e10cb767f5f39b14f1 Mon Sep 17 00:00:00 2001
+From: Andiry Xu <andiry.xu@amd.com>
+Date: Wed, 30 Nov 2011 16:37:41 +0800
+Subject: xHCI: fix bug in xhci_clear_command_ring()
+
+From: Andiry Xu <andiry.xu@amd.com>
+
+commit 158886cd2cf4599e04f9b7e10cb767f5f39b14f1 upstream.
+
+When system enters suspend, xHCI driver clears command ring by writing zero
+to all the TRBs. However, this also writes zero to the Link TRB, and the ring
+is mangled. This may cause driver accesses wrong memory address and the
+result is unpredicted.
+
+When clear the command ring, keep the last Link TRB intact, only clear its
+cycle bit. This should fix the "command ring full" issue reported by Oliver
+Neukum.
+
+This should be backported to stable kernels as old as 2.6.37, since the
+commit 89821320 "xhci: Fix command ring replay after resume" is merged.
+
+Signed-off-by: Andiry Xu <andiry.xu@amd.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -657,7 +657,10 @@ static void xhci_clear_command_ring(stru
+ ring = xhci->cmd_ring;
+ seg = ring->deq_seg;
+ do {
+- memset(seg->trbs, 0, SEGMENT_SIZE);
++ memset(seg->trbs, 0,
++ sizeof(union xhci_trb) * (TRBS_PER_SEGMENT - 1));
++ seg->trbs[TRBS_PER_SEGMENT - 1].link.control &=
++ cpu_to_le32(~TRB_CYCLE);
+ seg = seg->next;
+ } while (seg != ring->deq_seg);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
