--- /dev/null
+From 1588c51cf6d782e63a8719681d905ef0ac22ee62 Mon Sep 17 00:00:00 2001
+From: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
+Date: Thu, 9 Jan 2014 16:01:54 +0100
+Subject: ARM: at91: smc: bug fix in sam9_smc_cs_read()
+
+From: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
+
+commit 1588c51cf6d782e63a8719681d905ef0ac22ee62 upstream.
+
+There was a copy/paste error when reading the nwe_pulse value.
+
+Signed-off-by: Jean-Jacques Hiblot <jjhiblot@traphandler.com>
+Acked-by: Boris BREZILLON <b.brezillon@overkiz.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Kevin Hilman <khilman@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-at91/sam9_smc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-at91/sam9_smc.c
++++ b/arch/arm/mach-at91/sam9_smc.c
+@@ -101,7 +101,7 @@ static void sam9_smc_cs_read(void __iome
+ /* Pulse register */
+ val = __raw_readl(base + AT91_SMC_PULSE);
+
+- config->nwe_setup = val & AT91_SMC_NWEPULSE;
++ config->nwe_pulse = val & AT91_SMC_NWEPULSE;
+ config->ncs_write_pulse = (val & AT91_SMC_NCS_WRPULSE) >> 8;
+ config->nrd_pulse = (val & AT91_SMC_NRDPULSE) >> 16;
+ config->ncs_read_pulse = (val & AT91_SMC_NCS_RDPULSE) >> 24;
--- /dev/null
+From 09164043f63c947a49797750a09ca1cd7c31108e Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 12 Jan 2014 15:11:37 -0600
+Subject: b43: Fix lockdep splat
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 09164043f63c947a49797750a09ca1cd7c31108e upstream.
+
+In https://bugzilla.kernel.org/show_bug.cgi?id=67561, a locking dependency is reported
+when b43 is used with hostapd, and rfkill is used to kill the radio output.
+
+The lockdep splat (in part) is as follows:
+
+======================================================
+[ INFO: possible circular locking dependency detected ]
+3.12.0 #1 Not tainted
+-------------------------------------------------------
+rfkill/10040 is trying to acquire lock:
+ (rtnl_mutex){+.+.+.}, at: [<ffffffff8146f282>] rtnl_lock+0x12/0x20
+
+but task is already holding lock:
+ (rfkill_global_mutex){+.+.+.}, at: [<ffffffffa04832ca>] rfkill_fop_write+0x6a/0x170 [rfkill]
+
+--snip--
+
+Chain exists of:
+ rtnl_mutex --> misc_mtx --> rfkill_global_mutex
+
+The fix is to move the initialization of the hardware random number generator
+outside the code range covered by the rtnl_mutex.
+
+Reported-by: yury <urykhy@gmail.com>
+Tested-by: yury <urykhy@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/main.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -2413,6 +2413,7 @@ error:
+
+ static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
+ static void b43_one_core_detach(struct b43_bus_dev *dev);
++static int b43_rng_init(struct b43_wl *wl);
+
+ static void b43_request_firmware(struct work_struct *work)
+ {
+@@ -2459,6 +2460,10 @@ start_ieee80211:
+ if (err)
+ goto err_one_core_detach;
+ b43_leds_register(wl->current_dev);
++
++ /* Register HW RNG driver */
++ b43_rng_init(wl);
++
+ goto out;
+
+ err_one_core_detach:
+@@ -4583,9 +4588,6 @@ static void b43_wireless_core_exit(struc
+ if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
+ return;
+
+- /* Unregister HW RNG driver */
+- b43_rng_exit(dev->wl);
+-
+ b43_set_status(dev, B43_STAT_UNINIT);
+
+ /* Stop the microcode PSM. */
+@@ -4728,9 +4730,6 @@ static int b43_wireless_core_init(struct
+
+ b43_set_status(dev, B43_STAT_INITIALIZED);
+
+- /* Register HW RNG driver */
+- b43_rng_init(dev->wl);
+-
+ out:
+ return err;
+
+@@ -5388,6 +5387,9 @@ static void b43_bcma_remove(struct bcma_
+
+ b43_one_core_detach(wldev->dev);
+
++ /* Unregister HW RNG driver */
++ b43_rng_exit(wl);
++
+ b43_leds_unregister(wl);
+
+ ieee80211_free_hw(wl->hw);
+@@ -5468,6 +5470,9 @@ static void b43_ssb_remove(struct ssb_de
+
+ b43_one_core_detach(dev);
+
++ /* Unregister HW RNG driver */
++ b43_rng_exit(wl);
++
+ if (list_empty(&wl->devlist)) {
+ b43_leds_unregister(wl);
+ /* Last core on the chip unregistered.
--- /dev/null
+From 64e5acb09ca6b50c97299cff9ef51299470b29f2 Mon Sep 17 00:00:00 2001
+From: ZHAO Gang <gamerh2o@gmail.com>
+Date: Sat, 18 Jan 2014 00:17:38 +0800
+Subject: b43: fix the wrong assignment of status.freq in b43_rx()
+
+From: ZHAO Gang <gamerh2o@gmail.com>
+
+commit 64e5acb09ca6b50c97299cff9ef51299470b29f2 upstream.
+
+Use the right function to update frequency value.
+
+If rx skb is probe response or beacon, the wrong frequency value can
+cause problem that bss info can't be updated when it should be.
+
+Fixes: 8318d78a44d4 ("cfg80211 API for channels/bitrates, mac80211 and driver conversion")
+Signed-off-by: ZHAO Gang <gamerh2o@gmail.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/xmit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/b43/xmit.c
++++ b/drivers/net/wireless/b43/xmit.c
+@@ -819,10 +819,10 @@ void b43_rx(struct b43_wldev *dev, struc
+ * channel number in b43. */
+ if (chanstat & B43_RX_CHAN_5GHZ) {
+ status.band = IEEE80211_BAND_5GHZ;
+- status.freq = b43_freq_to_channel_5ghz(chanid);
++ status.freq = b43_channel_to_freq_5ghz(chanid);
+ } else {
+ status.band = IEEE80211_BAND_2GHZ;
+- status.freq = b43_freq_to_channel_2ghz(chanid);
++ status.freq = b43_channel_to_freq_2ghz(chanid);
+ }
+ break;
+ default:
--- /dev/null
+From 0673effd41dba323d6a280ef37b5ef29f3f5a653 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 12 Jan 2014 15:11:38 -0600
+Subject: b43: Fix unload oops if firmware is not available
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 0673effd41dba323d6a280ef37b5ef29f3f5a653 upstream.
+
+The asyncronous firmware load uses a completion struct to hold firmware
+processing until the user-space routines are up and running. There is.
+however, a problem in that the waiter is nevered canceled during teardown.
+As a result, unloading the driver when firmware is not available causes an oops.
+
+To be able to access the completion structure at teardown, it had to be moved
+into the b43_wldev structure.
+
+This patch also fixes a typo in a comment.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/b43.h | 4 ++--
+ drivers/net/wireless/b43/main.c | 10 +++++-----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/b43/b43.h
++++ b/drivers/net/wireless/b43/b43.h
+@@ -719,8 +719,6 @@ enum b43_firmware_file_type {
+ struct b43_request_fw_context {
+ /* The device we are requesting the fw for. */
+ struct b43_wldev *dev;
+- /* a completion event structure needed if this call is asynchronous */
+- struct completion fw_load_complete;
+ /* a pointer to the firmware object */
+ const struct firmware *blob;
+ /* The type of firmware to request. */
+@@ -797,6 +795,8 @@ enum {
+ struct b43_wldev {
+ struct b43_bus_dev *dev;
+ struct b43_wl *wl;
++ /* a completion event structure needed if this call is asynchronous */
++ struct completion fw_load_complete;
+
+ /* The device initialization status.
+ * Use b43_status() to query. */
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -2061,6 +2061,7 @@ void b43_do_release_fw(struct b43_firmwa
+
+ static void b43_release_firmware(struct b43_wldev *dev)
+ {
++ complete(&dev->fw_load_complete);
+ b43_do_release_fw(&dev->fw.ucode);
+ b43_do_release_fw(&dev->fw.pcm);
+ b43_do_release_fw(&dev->fw.initvals);
+@@ -2086,7 +2087,7 @@ static void b43_fw_cb(const struct firmw
+ struct b43_request_fw_context *ctx = context;
+
+ ctx->blob = firmware;
+- complete(&ctx->fw_load_complete);
++ complete(&ctx->dev->fw_load_complete);
+ }
+
+ int b43_do_request_fw(struct b43_request_fw_context *ctx,
+@@ -2133,7 +2134,7 @@ int b43_do_request_fw(struct b43_request
+ }
+ if (async) {
+ /* do this part asynchronously */
+- init_completion(&ctx->fw_load_complete);
++ init_completion(&ctx->dev->fw_load_complete);
+ err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
+ ctx->dev->dev->dev, GFP_KERNEL,
+ ctx, b43_fw_cb);
+@@ -2141,12 +2142,11 @@ int b43_do_request_fw(struct b43_request
+ pr_err("Unable to load firmware\n");
+ return err;
+ }
+- /* stall here until fw ready */
+- wait_for_completion(&ctx->fw_load_complete);
++ wait_for_completion(&ctx->dev->fw_load_complete);
+ if (ctx->blob)
+ goto fw_ready;
+ /* On some ARM systems, the async request will fail, but the next sync
+- * request works. For this reason, we dall through here
++ * request works. For this reason, we fall through here
+ */
+ }
+ err = request_firmware(&ctx->blob, ctx->fwname,
--- /dev/null
+From 452028665312672c6ba9e16a19248ee00ead9400 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 12 Jan 2014 15:11:39 -0600
+Subject: b43legacy: Fix unload oops if firmware is not available
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 452028665312672c6ba9e16a19248ee00ead9400 upstream.
+
+The asyncronous firmware load uses a completion struct to hold firmware
+processing until the user-space routines are up and running. There is.
+however, a problem in that the waiter is nevered canceled during teardown.
+As a result, unloading the driver when firmware is not available causes an oops.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43legacy/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/b43legacy/main.c
++++ b/drivers/net/wireless/b43legacy/main.c
+@@ -3915,6 +3915,7 @@ static void b43legacy_remove(struct ssb_
+ * as the ieee80211 unreg will destroy the workqueue. */
+ cancel_work_sync(&wldev->restart_work);
+ cancel_work_sync(&wl->firmware_load);
++ complete(&wldev->fw_load_complete);
+
+ B43legacy_WARN_ON(!wl);
+ if (!wldev->fw.ucode)
--- /dev/null
+From 743db27c526e0f31cc507959d662e97e2048a86f Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Mon, 11 Nov 2013 13:56:47 +0100
+Subject: KVM: s390: fix diagnose code extraction
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 743db27c526e0f31cc507959d662e97e2048a86f upstream.
+
+The diagnose code to be used is the contents of the base register (if not
+zero), plus the displacement. The current code ignores the base register
+contents. So let's fix that...
+
+Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kvm/diag.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/kvm/diag.c
++++ b/arch/s390/kvm/diag.c
+@@ -82,7 +82,7 @@ static int __diag_ipl_functions(struct k
+
+ int kvm_s390_handle_diag(struct kvm_vcpu *vcpu)
+ {
+- int code = (vcpu->arch.sie_block->ipb & 0xfff0000) >> 16;
++ int code = kvm_s390_get_base_disp_rs(vcpu) & 0xffff;
+
+ switch (code) {
+ case 0x10:
--- /dev/null
+From c908c74e005de780fddbe8cb6fcd44803f5d4b74 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:29 -0600
+Subject: rtlwifi: rtl8192c: Add new definitions in the dm_common header
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit c908c74e005de780fddbe8cb6fcd44803f5d4b74 upstream.
+
+Changes in the gain-control mechanism will require some changes in the header.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+@@ -125,6 +125,17 @@ struct dig_t {
+ u8 cur_ccasate;
+ };
+
++#define DYNAMIC_FUNC_DISABLE 0x0
++#define DYNAMIC_FUNC_DIG BIT(0)
++#define DYNAMIC_FUNC_HP BIT(1)
++#define DYNAMIC_FUNC_SS BIT(2) /*Tx Power Tracking*/
++#define DYNAMIC_FUNC_BT BIT(3)
++#define DYNAMIC_FUNC_ANT_DIV BIT(4)
++
++#define RSSI_CCK 0
++#define RSSI_OFDM 1
++#define RSSI_DEFAULT 2
++
+ struct swat_t {
+ u8 failure_cnt;
+ u8 try_flag;
+@@ -202,5 +213,8 @@ void rtl92c_phy_lc_calibrate(struct ieee
+ void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery);
+ void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw);
+ void rtl92c_dm_bt_coexist(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
+
+ #endif
--- /dev/null
+From 97204e93f01868eeba6ae5c4f3270f32905bb418 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:32 -0600
+Subject: rtlwifi: rtl8192c: Add routines to save/restore power index registers
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 97204e93f01868eeba6ae5c4f3270f32905bb418 upstream.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c | 36 ++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+@@ -161,6 +161,42 @@ static const u8 cckswing_table_ch14[CCK_
+ {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}
+ };
+
++static u32 power_index_reg[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
++
++void dm_restorepowerindex(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u8 index;
++
++ for (index = 0; index < 6; index++)
++ rtl_write_byte(rtlpriv, power_index_reg[index],
++ rtlpriv->dm.powerindex_backup[index]);
++}
++EXPORT_SYMBOL_GPL(dm_restorepowerindex);
++
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u8 index;
++
++ for (index = 0; index < 6; index++)
++ rtl_write_byte(rtlpriv, power_index_reg[index], value);
++}
++EXPORT_SYMBOL_GPL(dm_writepowerindex);
++
++void dm_savepowerindex(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u8 index;
++ u8 tmp;
++
++ for (index = 0; index < 6; index++) {
++ tmp = rtl_read_byte(rtlpriv, power_index_reg[index]);
++ rtlpriv->dm.powerindex_backup[index] = tmp;
++ }
++}
++EXPORT_SYMBOL_GPL(dm_savepowerindex);
++
+ static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
+ {
+ dm_digtable.dig_enable_flag = true;
--- /dev/null
+From f87f960b2fb802f26ee3b00c19320e57a9c583ff Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Thu, 9 Jan 2014 10:27:27 -0600
+Subject: rtlwifi: rtl8192cu: Add new device ID
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit f87f960b2fb802f26ee3b00c19320e57a9c583ff upstream.
+
+Reported-by: Jan Prinsloo <janroot@gmail.com>
+Tested-by: Jan Prinsloo <janroot@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -306,6 +306,7 @@ static struct usb_device_id rtl8192c_usb
+ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+ /* HP - Lite-On ,8188CUS Slim Combo */
--- /dev/null
+From e9b0784bb9de3152e787ee779868c626b137fb3b Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:34 -0600
+Subject: rtlwifi: rtl8192cu: Fix some code in RF handling
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit e9b0784bb9de3152e787ee779868c626b137fb3b upstream.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/rf.c | 29 +++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower(
+ if (mac->act_scanning) {
+ tx_agc[RF90_PATH_A] = 0x3f3f3f3f;
+ tx_agc[RF90_PATH_B] = 0x3f3f3f3f;
+- if (turbo_scanoff) {
+- for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+- tx_agc[idx1] = ppowerlevel[idx1] |
+- (ppowerlevel[idx1] << 8) |
+- (ppowerlevel[idx1] << 16) |
+- (ppowerlevel[idx1] << 24);
+- if (rtlhal->interface == INTF_USB) {
+- if (tx_agc[idx1] > 0x20 &&
+- rtlefuse->external_pa)
+- tx_agc[idx1] = 0x20;
+- }
++ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
++ tx_agc[idx1] = ppowerlevel[idx1] |
++ (ppowerlevel[idx1] << 8) |
++ (ppowerlevel[idx1] << 16) |
++ (ppowerlevel[idx1] << 24);
++ if (rtlhal->interface == INTF_USB) {
++ if (tx_agc[idx1] > 0x20 &&
++ rtlefuse->external_pa)
++ tx_agc[idx1] = 0x20;
+ }
+ }
+ } else {
+@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(
+ TXHIGHPWRLEVEL_LEVEL2) {
+ tx_agc[RF90_PATH_A] = 0x00000000;
+ tx_agc[RF90_PATH_B] = 0x00000000;
+- } else{
++ } else {
+ for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+ tx_agc[idx1] = ppowerlevel[idx1] |
+ (ppowerlevel[idx1] << 8) |
+@@ -379,7 +377,12 @@ static void _rtl92c_write_ofdm_power_reg
+ regoffset == RTXAGC_B_MCS07_MCS04)
+ regoffset = 0xc98;
+ for (i = 0; i < 3; i++) {
+- writeVal = (writeVal > 6) ? (writeVal - 6) : 0;
++ if (i != 2)
++ writeVal = (writeVal > 8) ?
++ (writeVal - 8) : 0;
++ else
++ writeVal = (writeVal > 6) ?
++ (writeVal - 6) : 0;
+ rtl_write_byte(rtlpriv, (u32)(regoffset + i),
+ (u8)writeVal);
+ }
--- /dev/null
+From 9806eacf5de27ab01d680c5d75c92a3a89734e4f Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:33 -0600
+Subject: rtlwifi: rtl8192cu: Update the power index registers
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 9806eacf5de27ab01d680c5d75c92a3a89734e4f upstream.
+
+This patch uses the newly introduced power index register routines.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/dm.c | 9 +++++++++
+ drivers/net/wireless/rtlwifi/rtl8192cu/dm.h | 3 +++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
+@@ -107,6 +107,15 @@ void rtl92cu_dm_dynamic_txpower(struct i
+ "PHY_SetTxPowerLevel8192S() Channel = %d\n",
+ rtlphy->current_channel);
+ rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel);
++ if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++ TXHIGHPWRLEVEL_NORMAL)
++ dm_restorepowerindex(hw);
++ else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++ TXHIGHPWRLEVEL_LEVEL1)
++ dm_writepowerindex(hw, 0x14);
++ else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
++ TXHIGHPWRLEVEL_LEVEL2)
++ dm_writepowerindex(hw, 0x10);
+ }
+
+ rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl;
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
+@@ -30,3 +30,6 @@
+ #include "../rtl8192ce/dm.h"
+
+ void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw);
++void dm_savepowerindex(struct ieee80211_hw *hw);
++void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
++void dm_restorepowerindex(struct ieee80211_hw *hw);
--- /dev/null
+From 619ce76f8bb850b57032501a39f26aa6c6731c70 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:28 -0600
+Subject: rtlwifi: Set the link state
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 619ce76f8bb850b57032501a39f26aa6c6731c70 upstream.
+
+The present code fails to set the linked state when an interface is
+added.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/core.c
++++ b/drivers/net/wireless/rtlwifi/core.c
+@@ -175,6 +175,7 @@ static int rtl_op_add_interface(struct i
+ rtlpriv->cfg->maps
+ [RTL_IBSS_INT_MASKS]);
+ }
++ mac->link_state = MAC80211_LINKED;
+ break;
+ case NL80211_IFTYPE_ADHOC:
+ RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
--- /dev/null
+From 65b9cc97c6852fae19dc5c7745e9abc8dd380aad Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 18 Nov 2013 11:11:31 -0600
+Subject: rtlwifi: Update beacon statistics for USB driver
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 65b9cc97c6852fae19dc5c7745e9abc8dd380aad upstream.
+
+The USB drivers were not updating the beacon statistics, which led to
+false beacon loss indications.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -480,6 +480,8 @@ static void _rtl_usb_rx_process_agg(stru
+ if (unicast)
+ rtlpriv->link_info.num_rx_inperiod++;
+ }
++ /* static bcn for roaming */
++ rtl_beacon_statistic(hw, skb);
+ }
+ }
+
--- /dev/null
+From 48c0247d7b7bf58abb85a39021099529df365c4d Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegorslists@googlemail.com>
+Date: Mon, 9 Dec 2013 12:11:15 +0100
+Subject: serial: add support for 200 v3 series Titan card
+
+From: Yegor Yefremov <yegorslists@googlemail.com>
+
+commit 48c0247d7b7bf58abb85a39021099529df365c4d upstream.
+
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1142,6 +1142,7 @@ pci_xr17c154_setup(struct serial_private
+ #define PCI_DEVICE_ID_TITAN_800E 0xA014
+ #define PCI_DEVICE_ID_TITAN_200EI 0xA016
+ #define PCI_DEVICE_ID_TITAN_200EISI 0xA017
++#define PCI_DEVICE_ID_TITAN_200V3 0xA306
+ #define PCI_DEVICE_ID_TITAN_400V3 0xA310
+ #define PCI_DEVICE_ID_TITAN_410V3 0xA312
+ #define PCI_DEVICE_ID_TITAN_800V3 0xA314
+@@ -3456,6 +3457,9 @@ static struct pci_device_id serial_pci_t
+ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_oxsemi_2_4000000 },
++ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3,
++ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++ pbn_b0_bt_2_921600 },
+ { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_b0_4_921600 },
md-raid5-fix-long-standing-problem-with-bitmap-handling-on-write-failure.patch
mm-hugetlbfs-fix-hugetlbfs-optimization.patch
e752x_edac-fix-pci_dev-usage-count.patch
+x86-x32-correct-invalid-use-of-user-timespec-in-the-kernel.patch
+usb-option-add-new-zte-3g-modem-pids-to-option-driver.patch
+usb-serial-add-support-for-iball-3.5g-connect-usb-modem.patch
+usb-cypress_m8-fix-ring-indicator-detection-and-reporting.patch
+usb-nokia-502-is-an-unusual-device.patch
+usb-xhci-check-for-xhci_plat-in-xhci_cleanup_msix.patch
+rtlwifi-rtl8192cu-add-new-device-id.patch
+rtlwifi-update-beacon-statistics-for-usb-driver.patch
+rtlwifi-set-the-link-state.patch
+rtlwifi-rtl8192c-add-new-definitions-in-the-dm_common-header.patch
+rtlwifi-rtl8192c-add-routines-to-save-restore-power-index-registers.patch
+rtlwifi-rtl8192cu-update-the-power-index-registers.patch
+rtlwifi-rtl8192cu-fix-some-code-in-rf-handling.patch
+b43-fix-lockdep-splat.patch
+b43-fix-unload-oops-if-firmware-is-not-available.patch
+b43legacy-fix-unload-oops-if-firmware-is-not-available.patch
+b43-fix-the-wrong-assignment-of-status.freq-in-b43_rx.patch
+staging-r8712u-set-device-type-to-wlan.patch
+staging-vt6656-bbvupdatepreedthreshold-always-set-sensitivity-on-bscanning.patch
+tty-serial-at91-handle-shutdown-more-safely.patch
+arm-at91-smc-bug-fix-in-sam9_smc_cs_read.patch
+serial-add-support-for-200-v3-series-titan-card.patch
+kvm-s390-fix-diagnose-code-extraction.patch
--- /dev/null
+From 3a21f00a5002b14e4aab52aef59d33ed28468a13 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 24 Dec 2013 11:22:54 -0600
+Subject: staging: r8712u: Set device type to wlan
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 3a21f00a5002b14e4aab52aef59d33ed28468a13 upstream.
+
+The latest version of NetworkManager does not recognize the device as wireless
+without this change.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/usb_intf.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -361,6 +361,10 @@ static u8 key_2char2num(u8 hch, u8 lch)
+ return (hex_to_bin(hch) << 4) | hex_to_bin(lch);
+ }
+
++static const struct device_type wlan_type = {
++ .name = "wlan",
++};
++
+ /*
+ * drv_init() - a device potentially for us
+ *
+@@ -396,6 +400,7 @@ static int r871xu_drv_init(struct usb_in
+ padapter->pusb_intf = pusb_intf;
+ usb_set_intfdata(pusb_intf, pnetdev);
+ SET_NETDEV_DEV(pnetdev, &pusb_intf->dev);
++ pnetdev->dev.type = &wlan_type;
+ /* step 2. */
+ padapter->dvobj_init = &r8712_usb_dvobj_init;
+ padapter->dvobj_deinit = &r8712_usb_dvobj_deinit;
--- /dev/null
+From 8f248dae133668bfb8e9379b4b3f0571c858b24a Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 8 Dec 2013 09:11:30 +0000
+Subject: staging: vt6656: [BUG] BBvUpdatePreEDThreshold Always set sensitivity on bScanning
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 8f248dae133668bfb8e9379b4b3f0571c858b24a upstream.
+
+byBBPreEDIndex value is initially 0, this means that from
+cold BBvUpdatePreEDThreshold is never set.
+
+This means that sensitivity may be in an ambiguous state,
+failing to scan any wireless points or at least distant ones.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/baseband.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/staging/vt6656/baseband.c
++++ b/drivers/staging/vt6656/baseband.c
+@@ -1634,7 +1634,6 @@ BBvUpdatePreEDThreshold(
+
+ if( bScanning )
+ { // need Max sensitivity //RSSI -69, -70,....
+- if(pDevice->byBBPreEDIndex == 0) break;
+ pDevice->byBBPreEDIndex = 0;
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE)
+@@ -1777,7 +1776,6 @@ BBvUpdatePreEDThreshold(
+
+ if( bScanning )
+ { // need Max sensitivity //RSSI -69, -70, ...
+- if(pDevice->byBBPreEDIndex == 0) break;
+ pDevice->byBBPreEDIndex = 0;
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE)
+@@ -1929,7 +1927,6 @@ BBvUpdatePreEDThreshold(
+ case RF_VT3342A0: //RobertYu:20060627, testing table
+ if( bScanning )
+ { // need Max sensitivity //RSSI -67, -68, ...
+- if(pDevice->byBBPreEDIndex == 0) break;
+ pDevice->byBBPreEDIndex = 0;
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+ ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE)
--- /dev/null
+From 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 Mon Sep 17 00:00:00 2001
+From: Marek Roszko <mark.roszko@gmail.com>
+Date: Tue, 7 Jan 2014 11:45:06 +0100
+Subject: tty/serial: at91: Handle shutdown more safely
+
+From: Marek Roszko <mark.roszko@gmail.com>
+
+commit 0cc7c6c7916b1b6f34350ff1473b80b9f7e459c0 upstream.
+
+Interrupts were being cleaned up late in the shutdown handler, it is possible
+that an interrupt can occur and schedule a tasklet that runs after the port is
+cleaned up. There is a null dereference due to this race condition with the
+following stacktrace:
+
+[<c02092b0>] (atmel_tasklet_func+0x514/0x814) from [<c001fd34>] (tasklet_action+0x70/0xa8)
+[<c001fd34>] (tasklet_action+0x70/0xa8) from [<c001f60c>] (__do_softirq+0x90/0x144)
+[<c001f60c>] (__do_softirq+0x90/0x144) from [<c001fa18>] (irq_exit+0x40/0x4c)
+[<c001fa18>] (irq_exit+0x40/0x4c) from [<c000e298>] (handle_IRQ+0x64/0x84)
+[<c000e298>] (handle_IRQ+0x64/0x84) from [<c000d6c0>] (__irq_svc+0x40/0x50)
+[<c000d6c0>] (__irq_svc+0x40/0x50) from [<c0208060>] (atmel_rx_dma_release+0x88/0xb8)
+[<c0208060>] (atmel_rx_dma_release+0x88/0xb8) from [<c0209740>] (atmel_shutdown+0x104/0x160)
+[<c0209740>] (atmel_shutdown+0x104/0x160) from [<c0205e8c>] (uart_port_shutdown+0x2c/0x38)
+
+Signed-off-by: Marek Roszko <mark.roszko@gmail.com>
+Acked-by: Leilei Zhao <leilei.zhao@atmel.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1022,12 +1022,24 @@ static int atmel_startup(struct uart_por
+ static void atmel_shutdown(struct uart_port *port)
+ {
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
++
++ /*
++ * Clear out any scheduled tasklets before
++ * we destroy the buffers
++ */
++ tasklet_kill(&atmel_port->tasklet);
++
+ /*
+- * Ensure everything is stopped.
++ * Ensure everything is stopped and
++ * disable all interrupts, port and break condition.
+ */
+ atmel_stop_rx(port);
+ atmel_stop_tx(port);
+
++ UART_PUT_CR(port, ATMEL_US_RSTSTA);
++ UART_PUT_IDR(port, -1);
++
++
+ /*
+ * Shut-down the DMA.
+ */
+@@ -1054,12 +1066,6 @@ static void atmel_shutdown(struct uart_p
+ }
+
+ /*
+- * Disable all interrupts, port and break condition.
+- */
+- UART_PUT_CR(port, ATMEL_US_RSTSTA);
+- UART_PUT_IDR(port, -1);
+-
+- /*
+ * Free the interrupt
+ */
+ free_irq(port->irq, port);
--- /dev/null
+From 440ebadeae9298d7de3d4d105342691841ec88d0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 2 Jan 2014 22:49:24 +0100
+Subject: USB: cypress_m8: fix ring-indicator detection and reporting
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 440ebadeae9298d7de3d4d105342691841ec88d0 upstream.
+
+Fix ring-indicator (RI) status-bit definition, which was defined as CTS,
+effectively preventing RI-changes from being detected while reporting
+false RI status.
+
+This bug predates git.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cypress_m8.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/cypress_m8.h
++++ b/drivers/usb/serial/cypress_m8.h
+@@ -63,7 +63,7 @@
+ #define UART_DSR 0x20 /* data set ready - flow control - device to host */
+ #define CONTROL_RTS 0x10 /* request to send - flow control - host to device */
+ #define UART_CTS 0x10 /* clear to send - flow control - device to host */
+-#define UART_RI 0x10 /* ring indicator - modem - device to host */
++#define UART_RI 0x80 /* ring indicator - modem - device to host */
+ #define UART_CD 0x40 /* carrier detect - modem - device to host */
+ #define CYP_ERROR 0x08 /* received from input report - device to host */
+ /* Note - the below has nothing to do with the "feature report" reset */
--- /dev/null
+From 0e16114f2db4838251fb64f3b550996ad3585890 Mon Sep 17 00:00:00 2001
+From: Mikhail Zolotaryov <lebon@lebon.org.ua>
+Date: Sat, 28 Dec 2013 01:56:35 +0200
+Subject: USB: Nokia 502 is an unusual device
+
+From: Mikhail Zolotaryov <lebon@lebon.org.ua>
+
+commit 0e16114f2db4838251fb64f3b550996ad3585890 upstream.
+
+The USB storage operation of Nokia Asha 502 Dual SIM smartphone running Asha
+Platform 1.1.1 is unreliable in respect of data consistency (i.e. transfered
+files are corrupted). A similar issue is described here:
+http://discussions.nokia.com/t5/Asha-and-other-Nokia-Series-30/Nokia-301-USB-transfers-and-corrupted-files/td-p/1974170
+
+The workaround is (MAX_SECTORS_64):
+ rmmod usb_storage && modprobe usb_storage quirks=0421:06aa:m
+
+The patch adds the tested device to the unusual list permanently.
+
+Signed-off-by: Mikhail Zolotaryov <lebon@lebon.org.ua>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -226,6 +226,13 @@ UNUSUAL_DEV( 0x0421, 0x0495, 0x0370, 0x
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64 ),
+
++/* Patch submitted by Mikhail Zolotaryov <lebon@lebon.org.ua> */
++UNUSUAL_DEV( 0x0421, 0x06aa, 0x1110, 0x1110,
++ "Nokia",
++ "502",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_MAX_SECTORS_64 ),
++
+ #ifdef NO_SDDR09
+ UNUSUAL_DEV( 0x0436, 0x0005, 0x0100, 0x0100,
+ "Microtech",
--- /dev/null
+From 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= <zjn77777@163.com>
+Date: Wed, 18 Dec 2013 15:37:17 +0800
+Subject: usb: option: add new zte 3g modem pids to option driver
+
+From: =?UTF-8?q?=E5=BC=A0=E5=90=9B?= <zjn77777@163.com>
+
+commit 4d90b819ae4c7ea8fd5e2bb7edc68c0f334be2e4 upstream.
+
+Signed-off-by: Jun zhang <zhang.jun92@zte.com.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1461,6 +1461,17 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
+
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
--- /dev/null
+From 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 Mon Sep 17 00:00:00 2001
+From: Rahul Bedarkar <rahulbedarkar89@gmail.com>
+Date: Thu, 2 Jan 2014 20:57:56 +0530
+Subject: USB: serial: add support for iBall 3.5G connect usb modem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rahul Bedarkar <rahulbedarkar89@gmail.com>
+
+commit 7d5c1b9c7cb5ec8e52b1adc65c484a923a8ea6c3 upstream.
+
+Add support for iBall 3.5G connect usb modem.
+
+$lsusb
+Bus 002 Device 006: ID 1c9e:9605 OMEGA TECHNOLOGY
+
+$usb-devices
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1c9e ProdID=9605 Rev=00.00
+S: Manufacturer=USB Modem
+S: Product=USB Modem
+S: SerialNumber=1234567890ABCDEF
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+
+Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
+Suggested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -325,6 +325,9 @@ static void option_instat_callback(struc
+ * It seems to contain a Qualcomm QSC6240/6290 chipset */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603
+
++/* iBall 3.5G connect wireless modem */
++#define IBALL_3_5G_CONNECT 0x9605
++
+ /* Zoom */
+ #define ZOOM_PRODUCT_4597 0x9607
+
+@@ -1520,6 +1523,7 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+ },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
++ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+ /* Pirelli */
+ { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)},
--- /dev/null
+From 9005355af23856c55a5538c9024355785424821b Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Fri, 15 Nov 2013 14:53:14 -0800
+Subject: usb: xhci: Check for XHCI_PLAT in xhci_cleanup_msix()
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit 9005355af23856c55a5538c9024355785424821b upstream.
+
+If CONFIG_PCI is enabled, make sure xhci_cleanup_msix()
+doesn't try to free a bogus PCI IRQ or dereference an invalid
+pci_dev when the xHCI device is actually a platform_device.
+
+This patch should be backported to kernels as old as 3.9, that
+contain the commit 52fb61250a7a132b0cfb9f4a1060a1f3c49e5a25
+"xhci-plat: Don't enable legacy PCI interrupts."
+
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -315,6 +315,9 @@ static void xhci_cleanup_msix(struct xhc
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+
++ if (xhci->quirks & XHCI_PLAT)
++ return;
++
+ xhci_free_irq(xhci);
+
+ if (xhci->msix_entries) {
--- /dev/null
+From 2def2ef2ae5f3990aabdbe8a755911902707d268 Mon Sep 17 00:00:00 2001
+From: PaX Team <pageexec@freemail.hu>
+Date: Thu, 30 Jan 2014 16:59:25 -0800
+Subject: x86, x32: Correct invalid use of user timespec in the kernel
+
+From: PaX Team <pageexec@freemail.hu>
+
+commit 2def2ef2ae5f3990aabdbe8a755911902707d268 upstream.
+
+The x32 case for the recvmsg() timout handling is broken:
+
+ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
+ unsigned int vlen, unsigned int flags,
+ struct compat_timespec __user *timeout)
+ {
+ int datagrams;
+ struct timespec ktspec;
+
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+
+ if (COMPAT_USE_64BIT_TIME)
+ return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT,
+ (struct timespec *) timeout);
+ ...
+
+The timeout pointer parameter is provided by userland (hence the __user
+annotation) but for x32 syscalls it's simply cast to a kernel pointer
+and is passed to __sys_recvmmsg which will eventually directly
+dereference it for both reading and writing. Other callers to
+__sys_recvmmsg properly copy from userland to the kernel first.
+
+The bug was introduced by commit ee4fa23c4bfc ("compat: Use
+COMPAT_USE_64BIT_TIME in net/compat.c") and should affect all kernels
+since 3.4 (and perhaps vendor kernels if they backported x32 support
+along with this code).
+
+Note that CONFIG_X86_X32_ABI gets enabled at build time and only if
+CONFIG_X86_X32 is enabled and ld can build x32 executables.
+
+Other uses of COMPAT_USE_64BIT_TIME seem fine.
+
+This addresses CVE-2014-0038.
+
+Signed-off-by: PaX Team <pageexec@freemail.hu>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/compat.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -789,21 +789,16 @@ asmlinkage long compat_sys_recvmmsg(int
+ if (flags & MSG_CMSG_COMPAT)
+ return -EINVAL;
+
+- if (COMPAT_USE_64BIT_TIME)
+- return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+- flags | MSG_CMSG_COMPAT,
+- (struct timespec *) timeout);
+-
+ if (timeout == NULL)
+ return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT, NULL);
+
+- if (get_compat_timespec(&ktspec, timeout))
++ if (compat_get_timespec(&ktspec, timeout))
+ return -EFAULT;
+
+ datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+ flags | MSG_CMSG_COMPAT, &ktspec);
+- if (datagrams > 0 && put_compat_timespec(&ktspec, timeout))
++ if (datagrams > 0 && compat_put_timespec(&ktspec, timeout))
+ datagrams = -EFAULT;
+
+ return datagrams;
projects / thirdparty / kernel / stable-queue.git / commitdiff
