--- /dev/null
+From 61869db60d56417729327e0218d8b4afcd396c10 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@systec-electronic.com>
+Date: Thu, 13 Dec 2012 10:06:10 +0100
+Subject: can: c_can: Set reserved bit in IFx_MASK2 to 1 on write
+
+From: Alexander Stein <alexander.stein@systec-electronic.com>
+
+commit 2bd3bc4e8472424f1a6009825397639a8968920a upstream.
+
+According to C_CAN documentation, the reserved bit in IFx_MASK2 register is
+fixed 1.
+
+Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/c_can/c_can.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -446,8 +446,12 @@ static void c_can_setup_receive_object(s
+
+ priv->write_reg(priv, &priv->regs->ifregs[iface].mask1,
+ IFX_WRITE_LOW_16BIT(mask));
++
++ /* According to C_CAN documentation, the reserved bit
++ * in IFx_MASK2 register is fixed 1
++ */
+ priv->write_reg(priv, &priv->regs->ifregs[iface].mask2,
+- IFX_WRITE_HIGH_16BIT(mask));
++ IFX_WRITE_HIGH_16BIT(mask) | BIT(13));
+
+ priv->write_reg(priv, &priv->regs->ifregs[iface].arb1,
+ IFX_WRITE_LOW_16BIT(id));
--- /dev/null
+From d821a4c4d11ad160925dab2bb009b8444beff484 Mon Sep 17 00:00:00 2001
+From: Bruce Allan <bruce.w.allan@intel.com>
+Date: Fri, 24 Aug 2012 20:38:11 +0000
+Subject: e1000e: DoS while TSO enabled caused by link partner with small MSS
+
+From: Bruce Allan <bruce.w.allan@intel.com>
+
+commit d821a4c4d11ad160925dab2bb009b8444beff484 upstream.
+
+With a low enough MSS on the link partner and TSO enabled locally, the
+networking stack can periodically send a very large (e.g. 64KB) TCP
+message for which the driver will attempt to use more Tx descriptors than
+are available by default in the Tx ring. This is due to a workaround in
+the code that imposes a limit of only 4 MSS-sized segments per descriptor
+which appears to be a carry-over from the older e1000 driver and may be
+applicable only to some older PCI or PCIx parts which are not supported in
+e1000e. When the driver gets a message that is too large to fit across the
+configured number of Tx descriptors, it stops the upper stack from queueing
+any more and gets stuck in this state. After a timeout, the upper stack
+assumes the adapter is hung and calls the driver to reset it.
+
+Remove the unnecessary limitation of using up to only 4 MSS-sized segments
+per Tx descriptor, and put in a hard failure test to catch when attempting
+to check for message sizes larger than would fit in the whole Tx ring.
+Refactor the remaining logic that limits the size of data per Tx descriptor
+from a seemingly arbitrary 8KB to a limit based on the dynamic size of the
+Tx packet buffer as described in the hardware specification.
+
+Also, fix the logic in the check for space in the Tx ring for the next
+largest possible packet after the current one has been successfully queued
+for transmit, and use the appropriate defines for default ring sizes in
+e1000_probe instead of magic values.
+
+This issue goes back to the introduction of e1000e in 2.6.24 when it was
+split off from e1000.
+
+Reported-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/e1000e/e1000.h | 1
+ drivers/net/ethernet/intel/e1000e/netdev.c | 48 +++++++++++++----------------
+ 2 files changed, 24 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/e1000.h
++++ b/drivers/net/ethernet/intel/e1000e/e1000.h
+@@ -309,6 +309,7 @@ struct e1000_adapter {
+ */
+ struct e1000_ring *tx_ring /* One per active queue */
+ ____cacheline_aligned_in_smp;
++ u32 tx_fifo_limit;
+
+ struct napi_struct napi;
+
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -3498,6 +3498,15 @@ void e1000e_reset(struct e1000_adapter *
+ }
+
+ /*
++ * Alignment of Tx data is on an arbitrary byte boundary with the
++ * maximum size per Tx descriptor limited only to the transmit
++ * allocation of the packet buffer minus 96 bytes with an upper
++ * limit of 24KB due to receive synchronization limitations.
++ */
++ adapter->tx_fifo_limit = min_t(u32, ((er32(PBA) >> 16) << 10) - 96,
++ 24 << 10);
++
++ /*
+ * Disable Adaptive Interrupt Moderation if 2 full packets cannot
+ * fit in receive buffer.
+ */
+@@ -4766,12 +4775,9 @@ static bool e1000_tx_csum(struct e1000_r
+ return 1;
+ }
+
+-#define E1000_MAX_PER_TXD 8192
+-#define E1000_MAX_TXD_PWR 12
+-
+ static int e1000_tx_map(struct e1000_ring *tx_ring, struct sk_buff *skb,
+ unsigned int first, unsigned int max_per_txd,
+- unsigned int nr_frags, unsigned int mss)
++ unsigned int nr_frags)
+ {
+ struct e1000_adapter *adapter = tx_ring->adapter;
+ struct pci_dev *pdev = adapter->pdev;
+@@ -5004,20 +5010,19 @@ static int __e1000_maybe_stop_tx(struct
+
+ static int e1000_maybe_stop_tx(struct e1000_ring *tx_ring, int size)
+ {
++ BUG_ON(size > tx_ring->count);
++
+ if (e1000_desc_unused(tx_ring) >= size)
+ return 0;
+ return __e1000_maybe_stop_tx(tx_ring, size);
+ }
+
+-#define TXD_USE_COUNT(S, X) (((S) >> (X)) + 1)
+ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
+ struct net_device *netdev)
+ {
+ struct e1000_adapter *adapter = netdev_priv(netdev);
+ struct e1000_ring *tx_ring = adapter->tx_ring;
+ unsigned int first;
+- unsigned int max_per_txd = E1000_MAX_PER_TXD;
+- unsigned int max_txd_pwr = E1000_MAX_TXD_PWR;
+ unsigned int tx_flags = 0;
+ unsigned int len = skb_headlen(skb);
+ unsigned int nr_frags;
+@@ -5037,18 +5042,8 @@ static netdev_tx_t e1000_xmit_frame(stru
+ }
+
+ mss = skb_shinfo(skb)->gso_size;
+- /*
+- * The controller does a simple calculation to
+- * make sure there is enough room in the FIFO before
+- * initiating the DMA for each buffer. The calc is:
+- * 4 = ceil(buffer len/mss). To make sure we don't
+- * overrun the FIFO, adjust the max buffer len if mss
+- * drops.
+- */
+ if (mss) {
+ u8 hdr_len;
+- max_per_txd = min(mss << 2, max_per_txd);
+- max_txd_pwr = fls(max_per_txd) - 1;
+
+ /*
+ * TSO Workaround for 82571/2/3 Controllers -- if skb->data
+@@ -5078,12 +5073,12 @@ static netdev_tx_t e1000_xmit_frame(stru
+ count++;
+ count++;
+
+- count += TXD_USE_COUNT(len, max_txd_pwr);
++ count += DIV_ROUND_UP(len, adapter->tx_fifo_limit);
+
+ nr_frags = skb_shinfo(skb)->nr_frags;
+ for (f = 0; f < nr_frags; f++)
+- count += TXD_USE_COUNT(skb_frag_size(&skb_shinfo(skb)->frags[f]),
+- max_txd_pwr);
++ count += DIV_ROUND_UP(skb_frag_size(&skb_shinfo(skb)->frags[f]),
++ adapter->tx_fifo_limit);
+
+ if (adapter->hw.mac.tx_pkt_filtering)
+ e1000_transfer_dhcp_info(adapter, skb);
+@@ -5125,13 +5120,16 @@ static netdev_tx_t e1000_xmit_frame(stru
+ tx_flags |= E1000_TX_FLAGS_NO_FCS;
+
+ /* if count is 0 then mapping error has occurred */
+- count = e1000_tx_map(tx_ring, skb, first, max_per_txd, nr_frags, mss);
++ count = e1000_tx_map(tx_ring, skb, first, adapter->tx_fifo_limit,
++ nr_frags);
+ if (count) {
+ netdev_sent_queue(netdev, skb->len);
+ e1000_tx_queue(tx_ring, tx_flags, count);
+ /* Make sure there is space in the ring for the next send. */
+- e1000_maybe_stop_tx(tx_ring, MAX_SKB_FRAGS + 2);
+-
++ e1000_maybe_stop_tx(tx_ring,
++ (MAX_SKB_FRAGS *
++ DIV_ROUND_UP(PAGE_SIZE,
++ adapter->tx_fifo_limit) + 2));
+ } else {
+ dev_kfree_skb_any(skb);
+ tx_ring->buffer_info[first].time_stamp = 0;
+@@ -6303,8 +6301,8 @@ static int __devinit e1000_probe(struct
+ adapter->hw.phy.autoneg_advertised = 0x2f;
+
+ /* ring size defaults */
+- adapter->rx_ring->count = 256;
+- adapter->tx_ring->count = 256;
++ adapter->rx_ring->count = E1000_DEFAULT_RXD;
++ adapter->tx_ring->count = E1000_DEFAULT_TXD;
+
+ /*
+ * Initial Wake on LAN setting - If APM wake is enabled in
--- /dev/null
+From 5b4478f5dabb7f764e2fce480b47204e06095a73 Mon Sep 17 00:00:00 2001
+From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+Date: Mon, 27 Aug 2012 20:56:54 -0300
+Subject: floppy: properly handle failure on add_disk loop
+
+From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+
+commit d60e7ec18c3fb2cbf90969ccd42889eb2d03aef9 upstream.
+
+On floppy initialization, if something failed inside the loop we call
+add_disk, there was no cleanup of previous iterations in the error
+handling.
+
+Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/floppy.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4306,7 +4306,7 @@ static int __init floppy_init(void)
+
+ err = platform_device_register(&floppy_device[drive]);
+ if (err)
+- goto out_flush_work;
++ goto out_remove_drives;
+
+ err = device_create_file(&floppy_device[drive].dev,
+ &dev_attr_cmos);
+@@ -4324,6 +4324,15 @@ static int __init floppy_init(void)
+
+ out_unreg_platform_dev:
+ platform_device_unregister(&floppy_device[drive]);
++out_remove_drives:
++ while (drive--) {
++ if ((allowed_drive_mask & (1 << drive)) &&
++ fdc_state[FDC(drive)].version != FDC_NONE) {
++ del_gendisk(disks[drive]);
++ device_remove_file(&floppy_device[drive].dev, &dev_attr_cmos);
++ platform_device_unregister(&floppy_device[drive]);
++ }
++ }
+ out_flush_work:
+ flush_work_sync(&floppy_work);
+ if (atomic_read(&usage_count))
--- /dev/null
+From 850722ddad9d4307aeef02f874e2cdd33190bef0 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+Date: Mon, 15 Oct 2012 21:48:48 -0300
+Subject: i82975x_edac: Fix dimm label initialization
+
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+
+commit 479696840239e0cc43efb3c917bdcad2174d2215 upstream.
+
+The driver has only 4 hardcoded labels, but allows much more memory.
+Fix it by removing the hardcoded logic, using snprintf() instead.
+
+[ 19.833972] general protection fault: 0000 [#1] SMP
+[ 19.837733] Modules linked in: i82975x_edac(+) edac_core firewire_ohci firewire_core crc_itu_t nouveau mxm_wmi wmi video i2c_algo_bit drm_kms_helper ttm drm i2c_core
+[ 19.837733] CPU 0
+[ 19.837733] Pid: 390, comm: udevd Not tainted 3.6.1-1.fc17.x86_64.debug #1 Dell Inc. Precision WorkStation 390 /0MY510
+[ 19.837733] RIP: 0010:[<ffffffff813463a8>] [<ffffffff813463a8>] strncpy+0x18/0x30
+[ 19.837733] RSP: 0018:ffff880078535b68 EFLAGS: 00010202
+[ 19.837733] RAX: ffff880069fa9708 RBX: ffff880078588000 RCX: ffff880069fa9708
+[ 19.837733] RDX: 000000000000001f RSI: 5f706f5f63616465 RDI: ffff880069fa9708
+[ 19.837733] RBP: ffff880078535b68 R08: ffff880069fa9727 R09: 000000000000fffe
+[ 19.837733] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
+[ 19.837733] R13: 0000000000000000 R14: ffff880069fa9290 R15: ffff880079624a80
+[ 19.837733] FS: 00007f3de01ee840(0000) GS:ffff88007c400000(0000) knlGS:0000000000000000
+[ 19.837733] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 19.837733] CR2: 00007f3de00b9000 CR3: 0000000078dbc000 CR4: 00000000000007f0
+[ 19.837733] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 19.837733] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+[ 19.837733] Process udevd (pid: 390, threadinfo ffff880078534000, task ffff880079642450)
+[ 19.837733] Stack:
+[ 19.837733] ffff880078535c18 ffffffffa017c6b8 00040000816d627f ffff880079624a88
+[ 19.837733] ffffc90004cd6000 ffff880079624520 ffff88007ac21148 0000000000000000
+[ 19.837733] 0000000000000000 0004000000000000 feda000078535bc8 ffffffff810d696d
+[ 19.837733] Call Trace:
+[ 19.837733] [<ffffffffa017c6b8>] i82975x_init_one+0x2e6/0x3e6 [i82975x_edac]
+...
+
+Fix bug reported at:
+ https://bugzilla.redhat.com/show_bug.cgi?id=848149
+And, very likely:
+ https://bbs.archlinux.org/viewtopic.php?id=148033
+ https://bugzilla.kernel.org/show_bug.cgi?id=47171
+
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+[bwh: Backported to 3.2:
+ - Adjust context
+ - Use csrow->channels[chan].label not csrow->channels[chan]->dimm->label]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/i82975x_edac.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/edac/i82975x_edac.c
++++ b/drivers/edac/i82975x_edac.c
+@@ -363,10 +363,6 @@ static enum dev_type i82975x_dram_type(v
+ static void i82975x_init_csrows(struct mem_ctl_info *mci,
+ struct pci_dev *pdev, void __iomem *mch_window)
+ {
+- static const char *labels[4] = {
+- "DIMM A1", "DIMM A2",
+- "DIMM B1", "DIMM B2"
+- };
+ struct csrow_info *csrow;
+ unsigned long last_cumul_size;
+ u8 value;
+@@ -407,9 +403,10 @@ static void i82975x_init_csrows(struct m
+ * [0-3] for dual-channel; i.e. csrow->nr_channels = 2
+ */
+ for (chan = 0; chan < csrow->nr_channels; chan++)
+- strncpy(csrow->channels[chan].label,
+- labels[(index >> 1) + (chan * 2)],
+- EDAC_MC_LABEL_LEN);
++
++ snprintf(csrow->channels[chan].label, EDAC_MC_LABEL_LEN, "DIMM %c%d",
++ (chan == 0) ? 'A' : 'B',
++ index);
+
+ if (cumul_size == last_cumul_size)
+ continue; /* not populated */
--- /dev/null
+From 29abfe4ddc74a2a597f4a47f02df1f5c4ad4a521 Mon Sep 17 00:00:00 2001
+From: Krzysztof Mazur <krzysiek@podlesie.net>
+Date: Wed, 19 Dec 2012 11:03:41 +0100
+Subject: i915: ensure that VGA plane is disabled
+
+From: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit 0fde901f1ddd2ce0e380a6444f1fb7ca555859e9 upstream.
+
+Some broken systems (like HP nc6120) in some cases, usually after LID
+close/open, enable VGA plane, making display unusable (black screen on LVDS,
+some strange mode on VGA output). We used to disable VGA plane only once at
+startup. Now we also check, if VGA plane is still disabled while changing
+mode, and fix that if something changed it.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=57434
+Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+[bwh: Backported to 3.2: intel_modeset_setup_hw_state() does not
+ exist, so call i915_redisable_vga() directly from intel_lid_notify()]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 1 +
+ drivers/gpu/drm/i915/intel_display.c | 17 +++++++++++++++++
+ drivers/gpu/drm/i915/intel_lvds.c | 1 +
+ 3 files changed, 19 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1397,6 +1397,7 @@ static inline void intel_unregister_dsm_
+ #endif /* CONFIG_ACPI */
+
+ /* modesetting */
++extern void i915_redisable_vga(struct drm_device *dev);
+ extern void intel_modeset_init(struct drm_device *dev);
+ extern void intel_modeset_gem_init(struct drm_device *dev);
+ extern void intel_modeset_cleanup(struct drm_device *dev);
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -9254,6 +9254,23 @@ static void i915_disable_vga(struct drm_
+ POSTING_READ(vga_reg);
+ }
+
++void i915_redisable_vga(struct drm_device *dev)
++{
++ struct drm_i915_private *dev_priv = dev->dev_private;
++ u32 vga_reg;
++
++ if (HAS_PCH_SPLIT(dev))
++ vga_reg = CPU_VGACNTRL;
++ else
++ vga_reg = VGACNTRL;
++
++ if (I915_READ(vga_reg) != VGA_DISP_DISABLE) {
++ DRM_DEBUG_KMS("Something enabled VGA plane, disabling it\n");
++ I915_WRITE(vga_reg, VGA_DISP_DISABLE);
++ POSTING_READ(vga_reg);
++ }
++}
++
+ void intel_modeset_init(struct drm_device *dev)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -535,6 +535,7 @@ static int intel_lid_notify(struct notif
+
+ mutex_lock(&dev->mode_config.mutex);
+ drm_helper_resume_force_mode(dev);
++ i915_redisable_vga(dev);
+ mutex_unlock(&dev->mode_config.mutex);
+
+ return NOTIFY_OK;
--- /dev/null
+From 0c53cadfdcd93f76f37fd1ad45e3fa8dacc73bad Mon Sep 17 00:00:00 2001
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Fri, 28 Sep 2012 10:29:21 -0700
+Subject: Input: synaptics - adjust threshold for treating position values as negative
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+commit 824efd37415961d38821ecbd9694e213fb2e8b32 upstream.
+
+Commit c039450 (Input: synaptics - handle out of bounds values from the
+hardware) caused any hardware reported values over 7167 to be treated as
+a wrapped-around negative value. It turns out that some firmware uses
+the value 8176 to indicate a finger near the edge of the touchpad whose
+actual position cannot be determined. This value now gets treated as
+negative, which can cause pointer jumps and broken edge scrolling on
+these machines.
+
+I only know of one touchpad which reports negative values, and this
+hardware never reports any value lower than -8 (i.e. 8184). Moving the
+threshold for treating a value as negative up to 8176 should work fine
+then for any hardware we currently know about, and since we're dealing
+with unspecified behavior it's probably the best we can do. The special
+8176 value is also likely to result in sudden jumps in position, so
+let's also clamp this to the maximum specified value for the axis.
+
+BugLink: http://bugs.launchpad.net/bugs/1046512
+https://bugzilla.kernel.org/show_bug.cgi?id=46371
+
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
+Tested-by: Alan Swanson <swanson@ukfsn.org>
+Tested-by: Arteom <arutemus@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 31 +++++++++++++++++++++++--------
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -53,14 +53,19 @@
+ #define ABS_POS_BITS 13
+
+ /*
+- * Any position values from the hardware above the following limits are
+- * treated as "wrapped around negative" values that have been truncated to
+- * the 13-bit reporting range of the hardware. These are just reasonable
+- * guesses and can be adjusted if hardware is found that operates outside
+- * of these parameters.
++ * These values should represent the absolute maximum value that will
++ * be reported for a positive position value. Some Synaptics firmware
++ * uses this value to indicate a finger near the edge of the touchpad
++ * whose precise position cannot be determined.
++ *
++ * At least one touchpad is known to report positions in excess of this
++ * value which are actually negative values truncated to the 13-bit
++ * reporting range. These values have never been observed to be lower
++ * than 8184 (i.e. -8), so we treat all values greater than 8176 as
++ * negative and any other value as positive.
+ */
+-#define X_MAX_POSITIVE (((1 << ABS_POS_BITS) + XMAX) / 2)
+-#define Y_MAX_POSITIVE (((1 << ABS_POS_BITS) + YMAX) / 2)
++#define X_MAX_POSITIVE 8176
++#define Y_MAX_POSITIVE 8176
+
+ /*
+ * Synaptics touchpads report the y coordinate from bottom to top, which is
+@@ -583,11 +588,21 @@ static int synaptics_parse_hw_state(cons
+ hw->right = (buf[0] & 0x02) ? 1 : 0;
+ }
+
+- /* Convert wrap-around values to negative */
++ /*
++ * Convert wrap-around values to negative. (X|Y)_MAX_POSITIVE
++ * is used by some firmware to indicate a finger at the edge of
++ * the touchpad whose precise position cannot be determined, so
++ * convert these values to the maximum axis value.
++ */
+ if (hw->x > X_MAX_POSITIVE)
+ hw->x -= 1 << ABS_POS_BITS;
++ else if (hw->x == X_MAX_POSITIVE)
++ hw->x = XMAX;
++
+ if (hw->y > Y_MAX_POSITIVE)
+ hw->y -= 1 << ABS_POS_BITS;
++ else if (hw->y == Y_MAX_POSITIVE)
++ hw->y = YMAX;
+
+ return 0;
+ }
--- /dev/null
+From 24d64ff793d880d298aec64369babcdfd61e6bc2 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Wed, 16 Jan 2013 23:40:01 +0100
+Subject: intel_idle: Don't register CPU notifier if we are not running.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 6f8c2e7933679f54b6478945dc72e59ef9a3d5e0 upstream.
+
+The 'intel_idle_probe' probes the CPU and sets the CPU notifier.
+But if later on during the module initialization we fail (say
+in cpuidle_register_driver), we stop loading, but we neglect
+to unregister the CPU notifier. This means that during CPU
+hotplug events the system will fail:
+
+calling intel_idle_init+0x0/0x326 @ 1
+intel_idle: MWAIT substates: 0x1120
+intel_idle: v0.4 model 0x2A
+intel_idle: lapic_timer_reliable_states 0xffffffff
+intel_idle: intel_idle yielding to none
+initcall intel_idle_init+0x0/0x326 returned -19 after 14 usecs
+
+... some time later, offlining and onlining a CPU:
+
+cpu 3 spinlock event irq 62
+BUG: unable to ] __cpuidle_register_device+0x1c/0x120
+PGD 99b8b067 PUD 99b95067 PMD 0
+Oops: 0000 [#1] SMP
+Modules linked in: xen_evtchn nouveau mxm_wmi wmi radeon ttm i915 fbcon tileblit font atl1c bitblit softcursor drm_kms_helper video xen_blkfront xen_netfront fb_sys_fops sysimgblt sysfillrect syscopyarea xenfs xen_privcmd mperf
+CPU 0
+Pid: 2302, comm: udevd Not tainted 3.8.0-rc3upstream-00249-g09ad159 #1 MSI MS-7680/H61M-P23 (MS-7680)
+RIP: e030:[<ffffffff814d956c>] [<ffffffff814d956c>] __cpuidle_register_device+0x1c/0x120
+RSP: e02b:ffff88009dacfcb8 EFLAGS: 00010286
+RAX: 0000000000000000 RBX: ffff880105380000 RCX: 000000000000001c
+RDX: 0000000000000000 RSI: 0000000000000055 RDI: ffff880105380000
+RBP: ffff88009dacfce8 R08: ffffffff81a4f048 R09: 0000000000000008
+R10: 0000000000000008 R11: 0000000000000000 R12: ffff880105380000
+R13: 00000000ffffffdd R14: 0000000000000000 R15: ffffffff81a523d0
+FS: 00007f37bd83b7a0(0000) GS:ffff880105200000(0000) knlGS:0000000000000000
+CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000008 CR3: 00000000a09ea000 CR4: 0000000000042660
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process udevd (pid: 2302, threadinfo ffff88009dace000, task ffff88009afb47f0)
+Stack:
+ ffffffff8107f2d0 ffffffff810c2fb7 ffff88009dacfce8 00000000ffffffea
+ ffff880105380000 00000000ffffffdd ffff88009dacfd08 ffffffff814d9882
+ 0000000000000003 ffff880105380000 ffff88009dacfd28 ffffffff81340afd
+Call Trace:
+ [<ffffffff8107f2d0>] ? collect_cpu_info_local+0x30/0x30
+ [<ffffffff810c2fb7>] ? __might_sleep+0xe7/0x100
+ [<ffffffff814d9882>] cpuidle_register_device+0x32/0x70
+ [<ffffffff81340afd>] intel_idle_cpu_init+0xad/0x110
+ [<ffffffff81340bc8>] cpu_hotplug_notify+0x68/0x80
+ [<ffffffff8166023d>] notifier_call_chain+0x4d/0x70
+ [<ffffffff810bc369>] __raw_notifier_call_chain+0x9/0x10
+ [<ffffffff81094a4b>] __cpu_notify+0x1b/0x30
+ [<ffffffff81652cf7>] _cpu_up+0x103/0x14b
+ [<ffffffff81652e18>] cpu_up+0xd9/0xec
+ [<ffffffff8164a254>] store_online+0x94/0xd0
+ [<ffffffff814122fb>] dev_attr_store+0x1b/0x20
+ [<ffffffff81216404>] sysfs_write_file+0xf4/0x170
+ [<ffffffff811a1024>] vfs_write+0xb4/0x130
+ [<ffffffff811a17ea>] sys_write+0x5a/0xa0
+ [<ffffffff816643a9>] system_call_fastpath+0x16/0x1b
+Code: 03 18 00 c9 c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83 ec 30 48 89 5d e8 4c 89 65 f0 48 89 fb 4c 89 6d f8 e8 84 08 00 00 <48> 8b 78 08 49 89 c4 e8 f8 7f c1 ff 89 c2 b8 ea ff ff ff 84 d2
+RIP [<ffffffff814d956c>] __cpuidle_register_device+0x1c/0x120
+ RSP <ffff88009dacfcb8>
+
+This patch fixes that by moving the CPU notifier registration
+as the last item to be done by the module.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+[bwh: Backported to 3.2: notifier is registered only if we do not have ARAT]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/idle/intel_idle.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -443,10 +443,8 @@ static int intel_idle_probe(void)
+
+ if (boot_cpu_has(X86_FEATURE_ARAT)) /* Always Reliable APIC Timer */
+ lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE;
+- else {
++ else
+ on_each_cpu(__setup_broadcast_timer, (void *)true, 1);
+- register_cpu_notifier(&setup_broadcast_notifier);
+- }
+
+ pr_debug(PREFIX "v" INTEL_IDLE_VERSION
+ " model 0x%X\n", boot_cpu_data.x86_model);
+@@ -612,6 +610,9 @@ static int __init intel_idle_init(void)
+ }
+ }
+
++ if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE)
++ register_cpu_notifier(&setup_broadcast_notifier);
++
+ return 0;
+ }
+
--- /dev/null
+From 5b632fe85ec82e5c43740b52e74c66df50a37db3 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Mon, 3 Dec 2012 12:56:33 +0100
+Subject: mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 5b632fe85ec82e5c43740b52e74c66df50a37db3 upstream.
+
+Commit f0425beda4d404a6e751439b562100b902ba9c98 "mac80211: retry sending
+failed BAR frames later instead of tearing down aggr" caused regression
+on rt2x00 hardware (connection hangs). This regression was fixed by
+commit be03d4a45c09ee5100d3aaaedd087f19bc20d01 "rt2x00: Don't let
+mac80211 send a BAR when an AMPDU subframe fails". But the latter
+commit caused yet another problem reported in
+https://bugzilla.kernel.org/show_bug.cgi?id=42828#c22
+
+After long discussion in this thread:
+http://mid.gmane.org/20121018075615.GA18212@redhat.com
+and testing various alternative solutions, which failed on one or other
+setup, we have no other good fix for the issues like just revert both
+mentioned earlier commits.
+
+To do not affect other hardware which benefit from commit
+f0425beda4d404a6e751439b562100b902ba9c98, instead of reverting it,
+introduce flag that when used will restore mac80211 behaviour before
+the commit.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+[replaced link with mid.gmane.org that has message-id]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+[hq: Backported to 3.4: adjust context]
+Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/mac80211.h | 5 +++++
+ net/mac80211/status.c | 6 +++++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1174,6 +1174,10 @@ enum sta_notify_cmd {
+ * @IEEE80211_HW_SCAN_WHILE_IDLE: The device can do hw scan while
+ * being idle (i.e. mac80211 doesn't have to go idle-off during the
+ * the scan).
++ *
++ * @IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL: On this hardware TX BA session
++ * should be tear down once BAR frame will not be acked.
++ *
+ */
+ enum ieee80211_hw_flags {
+ IEEE80211_HW_HAS_RATE_CONTROL = 1<<0,
+@@ -1201,6 +1205,7 @@ enum ieee80211_hw_flags {
+ IEEE80211_HW_AP_LINK_PS = 1<<22,
+ IEEE80211_HW_TX_AMPDU_SETUP_IN_HW = 1<<23,
+ IEEE80211_HW_SCAN_WHILE_IDLE = 1<<24,
++ IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL = 1<<26,
+ };
+
+ /**
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -432,7 +432,11 @@ void ieee80211_tx_status(struct ieee8021
+ IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+ IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+
+- ieee80211_set_bar_pending(sta, tid, ssn);
++ if (local->hw.flags &
++ IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL)
++ ieee80211_stop_tx_ba_session(&sta->sta, tid);
++ else
++ ieee80211_set_bar_pending(sta, tid, ssn);
+ }
+ }
+
--- /dev/null
+From 499f98ab5a0bd25310fe45b93baa524aae61d7cc Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Thu, 13 Sep 2012 16:06:48 +0200
+Subject: MISC: hpilo, remove pci_disable_device
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit bcdee04ea7ae0406ae69094f6df1aacb66a69a0b upstream.
+
+pci_disable_device(pdev) used to be in pci remove function. But this
+PCI device has two functions with interrupt lines connected to a
+single pin. The other one is a USB host controller. So when we disable
+the PIN there e.g. by rmmod hpilo, the controller stops working. It is
+because the interrupt link is disabled in ACPI since it is not
+refcounted yet. See acpi_pci_link_free_irq called from
+acpi_pci_irq_disable.
+
+It is not the best solution whatsoever, but as a workaround until the
+ACPI irq link refcounting is sorted out this should fix the reported
+errors.
+
+References: https://lkml.org/lkml/2008/11/4/535
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Grant Grundler <grundler@parisc-linux.org>
+Cc: Nobin Mathew <nobin.mathew@gmail.com>
+Cc: Robert Hancock <hancockr@shaw.ca>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: David Altobelli <david.altobelli@hp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/hpilo.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/hpilo.c
++++ b/drivers/misc/hpilo.c
+@@ -735,7 +735,14 @@ static void ilo_remove(struct pci_dev *p
+ free_irq(pdev->irq, ilo_hw);
+ ilo_unmap_device(pdev, ilo_hw);
+ pci_release_regions(pdev);
+- pci_disable_device(pdev);
++ /*
++ * pci_disable_device(pdev) used to be here. But this PCI device has
++ * two functions with interrupt lines connected to a single pin. The
++ * other one is a USB host controller. So when we disable the PIN here
++ * e.g. by rmmod hpilo, the controller stops working. It is because
++ * the interrupt link is disabled in ACPI since it is not refcounted
++ * yet. See acpi_pci_link_free_irq called from acpi_pci_irq_disable.
++ */
+ kfree(ilo_hw);
+ ilo_hwdev[(minor / MAX_CCB)] = 0;
+ }
+@@ -820,7 +827,7 @@ unmap:
+ free_regions:
+ pci_release_regions(pdev);
+ disable:
+- pci_disable_device(pdev);
++/* pci_disable_device(pdev); see comment in ilo_remove */
+ free:
+ kfree(ilo_hw);
+ out:
--- /dev/null
+From f652e7d2916fe2fcf9e7d709aa5b7476b431e2dd Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Fri, 11 Jan 2013 12:21:15 -0700
+Subject: PCI: shpchp: Use per-slot workqueues to avoid deadlock
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit f652e7d2916fe2fcf9e7d709aa5b7476b431e2dd upstream.
+
+When we have an SHPC-capable bridge with a second SHPC-capable bridge
+below it, pushing the upstream bridge's attention button causes a
+deadlock.
+
+The deadlock happens because we use the shpchp_wq workqueue to run
+shpchp_pushbutton_thread(), which uses shpchp_disable_slot() to remove
+devices below the upstream bridge. When we remove the downstream bridge,
+we call shpc_remove(), the shpchp driver's .remove() method. That calls
+flush_workqueue(shpchp_wq), which deadlocks because the
+shpchp_pushbutton_thread() work item is still running.
+
+This patch avoids the deadlock by creating a workqueue for every slot
+and removing the single shared workqueue.
+
+Here's the call path that leads to the deadlock:
+
+ shpchp_queue_pushbutton_work
+ queue_work(shpchp_wq) # shpchp_pushbutton_thread
+ ...
+
+ shpchp_pushbutton_thread
+ shpchp_disable_slot
+ remove_board
+ shpchp_unconfigure_device
+ pci_stop_and_remove_bus_device
+ ...
+ shpc_remove # shpchp driver .remove method
+ hpc_release_ctlr
+ cleanup_slots
+ flush_workqueue(shpchp_wq)
+
+This change is based on code inspection, since we don't have hardware
+with this topology.
+
+Based-on-patch-by: Yijing Wang <wangyijing@huawei.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+[hq: Backported to 3.4: adjust context]
+Signed-off-by: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/hotplug/shpchp.h | 2 +-
+ drivers/pci/hotplug/shpchp_core.c | 26 ++++++++++++++------------
+ drivers/pci/hotplug/shpchp_ctrl.c | 6 +++---
+ 3 files changed, 18 insertions(+), 16 deletions(-)
+
+--- a/drivers/pci/hotplug/shpchp.h
++++ b/drivers/pci/hotplug/shpchp.h
+@@ -46,7 +46,6 @@
+ extern bool shpchp_poll_mode;
+ extern int shpchp_poll_time;
+ extern bool shpchp_debug;
+-extern struct workqueue_struct *shpchp_wq;
+
+ #define dbg(format, arg...) \
+ do { \
+@@ -90,6 +89,7 @@ struct slot {
+ struct list_head slot_list;
+ struct delayed_work work; /* work for button event */
+ struct mutex lock;
++ struct workqueue_struct *wq;
+ u8 hp_slot;
+ };
+
+--- a/drivers/pci/hotplug/shpchp_core.c
++++ b/drivers/pci/hotplug/shpchp_core.c
+@@ -39,7 +39,6 @@
+ bool shpchp_debug;
+ bool shpchp_poll_mode;
+ int shpchp_poll_time;
+-struct workqueue_struct *shpchp_wq;
+
+ #define DRIVER_VERSION "0.4"
+ #define DRIVER_AUTHOR "Dan Zink <dan.zink@compaq.com>, Greg Kroah-Hartman <greg@kroah.com>, Dely Sy <dely.l.sy@intel.com>"
+@@ -122,6 +121,14 @@ static int init_slots(struct controller
+ slot->device = ctrl->slot_device_offset + i;
+ slot->hpc_ops = ctrl->hpc_ops;
+ slot->number = ctrl->first_slot + (ctrl->slot_num_inc * i);
++
++ snprintf(name, sizeof(name), "shpchp-%d", slot->number);
++ slot->wq = alloc_workqueue(name, 0, 0);
++ if (!slot->wq) {
++ retval = -ENOMEM;
++ goto error_info;
++ }
++
+ mutex_init(&slot->lock);
+ INIT_DELAYED_WORK(&slot->work, shpchp_queue_pushbutton_work);
+
+@@ -141,7 +148,7 @@ static int init_slots(struct controller
+ if (retval) {
+ ctrl_err(ctrl, "pci_hp_register failed with error %d\n",
+ retval);
+- goto error_info;
++ goto error_slotwq;
+ }
+
+ get_power_status(hotplug_slot, &info->power_status);
+@@ -153,6 +160,8 @@ static int init_slots(struct controller
+ }
+
+ return 0;
++error_slotwq:
++ destroy_workqueue(slot->wq);
+ error_info:
+ kfree(info);
+ error_hpslot:
+@@ -173,7 +182,7 @@ void cleanup_slots(struct controller *ct
+ slot = list_entry(tmp, struct slot, slot_list);
+ list_del(&slot->slot_list);
+ cancel_delayed_work(&slot->work);
+- flush_workqueue(shpchp_wq);
++ destroy_workqueue(slot->wq);
+ pci_hp_deregister(slot->hotplug_slot);
+ }
+ }
+@@ -356,18 +365,12 @@ static struct pci_driver shpc_driver = {
+
+ static int __init shpcd_init(void)
+ {
+- int retval = 0;
+-
+- shpchp_wq = alloc_ordered_workqueue("shpchp", 0);
+- if (!shpchp_wq)
+- return -ENOMEM;
++ int retval;
+
+ retval = pci_register_driver(&shpc_driver);
+ dbg("%s: pci_register_driver = %d\n", __func__, retval);
+ info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
+- if (retval) {
+- destroy_workqueue(shpchp_wq);
+- }
++
+ return retval;
+ }
+
+@@ -375,7 +378,6 @@ static void __exit shpcd_cleanup(void)
+ {
+ dbg("unload_shpchpd()\n");
+ pci_unregister_driver(&shpc_driver);
+- destroy_workqueue(shpchp_wq);
+ info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
+ }
+
+--- a/drivers/pci/hotplug/shpchp_ctrl.c
++++ b/drivers/pci/hotplug/shpchp_ctrl.c
+@@ -51,7 +51,7 @@ static int queue_interrupt_event(struct
+ info->p_slot = p_slot;
+ INIT_WORK(&info->work, interrupt_event_handler);
+
+- queue_work(shpchp_wq, &info->work);
++ queue_work(p_slot->wq, &info->work);
+
+ return 0;
+ }
+@@ -456,7 +456,7 @@ void shpchp_queue_pushbutton_work(struct
+ kfree(info);
+ goto out;
+ }
+- queue_work(shpchp_wq, &info->work);
++ queue_work(p_slot->wq, &info->work);
+ out:
+ mutex_unlock(&p_slot->lock);
+ }
+@@ -504,7 +504,7 @@ static void handle_button_press_event(st
+ p_slot->hpc_ops->green_led_blink(p_slot);
+ p_slot->hpc_ops->set_attention_status(p_slot, 0);
+
+- queue_delayed_work(shpchp_wq, &p_slot->work, 5*HZ);
++ queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
+ break;
+ case BLINKINGOFF_STATE:
+ case BLINKINGON_STATE:
--- /dev/null
+From 31980f8fa9e57f23b301e91dfa79f7f5c517233d Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Fri, 28 Dec 2012 17:09:03 +0800
+Subject: regulator: max8997: Use uV in voltage_map_desc
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit bc3b7756b5ff66828acf7bc24f148d28b8d61108 upstream.
+
+Current code does integer division (min_vol = min_uV / 1000) before pass
+min_vol to max8997_get_voltage_proper_val().
+So it is possible min_vol is truncated to a smaller value.
+
+For example, if the request min_uV is 800900 for ldo.
+min_vol = 800900 / 1000 = 800 (mV)
+Then max8997_get_voltage_proper_val returns 800 mV for this case which is lower
+than the requested voltage.
+
+Use uV rather than mV in voltage_map_desc to prevent truncation by integer
+division.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+[bwh: Backported to 3.2:
+ - Adjust context
+ - voltage_map_desc also has an n_bits field]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/max8997.c | 36 +++++++++++++++++-------------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+--- a/drivers/regulator/max8997.c
++++ b/drivers/regulator/max8997.c
+@@ -71,26 +71,26 @@ struct voltage_map_desc {
+ unsigned int n_bits;
+ };
+
+-/* Voltage maps in mV */
++/* Voltage maps in uV */
+ static const struct voltage_map_desc ldo_voltage_map_desc = {
+- .min = 800, .max = 3950, .step = 50, .n_bits = 6,
++ .min = 800000, .max = 3950000, .step = 50000, .n_bits = 6,
+ }; /* LDO1 ~ 18, 21 all */
+
+ static const struct voltage_map_desc buck1245_voltage_map_desc = {
+- .min = 650, .max = 2225, .step = 25, .n_bits = 6,
++ .min = 650000, .max = 2225000, .step = 25000, .n_bits = 6,
+ }; /* Buck1, 2, 4, 5 */
+
+ static const struct voltage_map_desc buck37_voltage_map_desc = {
+- .min = 750, .max = 3900, .step = 50, .n_bits = 6,
++ .min = 750000, .max = 3900000, .step = 50000, .n_bits = 6,
+ }; /* Buck3, 7 */
+
+-/* current map in mA */
++/* current map in uA */
+ static const struct voltage_map_desc charger_current_map_desc = {
+- .min = 200, .max = 950, .step = 50, .n_bits = 4,
++ .min = 200000, .max = 950000, .step = 50000, .n_bits = 4,
+ };
+
+ static const struct voltage_map_desc topoff_current_map_desc = {
+- .min = 50, .max = 200, .step = 10, .n_bits = 4,
++ .min = 50000, .max = 200000, .step = 10000, .n_bits = 4,
+ };
+
+ static const struct voltage_map_desc *reg_voltage_map[] = {
+@@ -194,7 +194,7 @@ static int max8997_list_voltage(struct r
+ if (val > desc->max)
+ return -EINVAL;
+
+- return val * 1000;
++ return val;
+ }
+
+ static int max8997_get_enable_register(struct regulator_dev *rdev,
+@@ -496,7 +496,6 @@ static int max8997_set_voltage_ldobuck(s
+ {
+ struct max8997_data *max8997 = rdev_get_drvdata(rdev);
+ struct i2c_client *i2c = max8997->iodev->i2c;
+- int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
+ const struct voltage_map_desc *desc;
+ int rid = rdev_get_id(rdev);
+ int reg, shift = 0, mask, ret;
+@@ -522,7 +521,7 @@ static int max8997_set_voltage_ldobuck(s
+
+ desc = reg_voltage_map[rid];
+
+- i = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
++ i = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
+ if (i < 0)
+ return i;
+
+@@ -541,7 +540,7 @@ static int max8997_set_voltage_ldobuck(s
+ /* If the voltage is increasing */
+ if (org < i)
+ udelay(DIV_ROUND_UP(desc->step * (i - org),
+- max8997->ramp_delay));
++ max8997->ramp_delay * 1000));
+ }
+
+ return ret;
+@@ -640,7 +639,6 @@ static int max8997_set_voltage_buck(stru
+ const struct voltage_map_desc *desc;
+ int new_val, new_idx, damage, tmp_val, tmp_idx, tmp_dmg;
+ bool gpio_dvs_mode = false;
+- int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
+
+ if (rid < MAX8997_BUCK1 || rid > MAX8997_BUCK7)
+ return -EINVAL;
+@@ -665,7 +663,7 @@ static int max8997_set_voltage_buck(stru
+ selector);
+
+ desc = reg_voltage_map[rid];
+- new_val = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
++ new_val = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
+ if (new_val < 0)
+ return new_val;
+
+@@ -997,8 +995,8 @@ static __devinit int max8997_pmic_probe(
+ max8997->buck1_vol[i] = ret =
+ max8997_get_voltage_proper_val(
+ &buck1245_voltage_map_desc,
+- pdata->buck1_voltage[i] / 1000,
+- pdata->buck1_voltage[i] / 1000 +
++ pdata->buck1_voltage[i],
++ pdata->buck1_voltage[i] +
+ buck1245_voltage_map_desc.step);
+ if (ret < 0)
+ goto err_alloc;
+@@ -1006,8 +1004,8 @@ static __devinit int max8997_pmic_probe(
+ max8997->buck2_vol[i] = ret =
+ max8997_get_voltage_proper_val(
+ &buck1245_voltage_map_desc,
+- pdata->buck2_voltage[i] / 1000,
+- pdata->buck2_voltage[i] / 1000 +
++ pdata->buck2_voltage[i],
++ pdata->buck2_voltage[i] +
+ buck1245_voltage_map_desc.step);
+ if (ret < 0)
+ goto err_alloc;
+@@ -1015,8 +1013,8 @@ static __devinit int max8997_pmic_probe(
+ max8997->buck5_vol[i] = ret =
+ max8997_get_voltage_proper_val(
+ &buck1245_voltage_map_desc,
+- pdata->buck5_voltage[i] / 1000,
+- pdata->buck5_voltage[i] / 1000 +
++ pdata->buck5_voltage[i],
++ pdata->buck5_voltage[i] +
+ buck1245_voltage_map_desc.step);
+ if (ret < 0)
+ goto err_alloc;
--- /dev/null
+From e8d9897ff064b1683c11c15ea1296a67a45d77b0 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Wed, 9 Jan 2013 19:34:57 +0800
+Subject: regulator: max8998: Ensure enough delay time for max8998_set_voltage_buck_time_sel
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit e8d9897ff064b1683c11c15ea1296a67a45d77b0 upstream.
+
+commit 81d0a6ae7befb24c06f4aa4856af7f8d1f612171 upstream.
+
+Use DIV_ROUND_UP to prevent truncation by integer division issue.
+This ensures we return enough delay time.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+[bwh: Backported to 3.2: delay is done by driver, not returned to the caller]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/max8998.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/max8998.c
++++ b/drivers/regulator/max8998.c
+@@ -492,7 +492,7 @@ buck2_exit:
+
+ difference = desc->min + desc->step*i - previous_vol/1000;
+ if (difference > 0)
+- udelay(difference / ((val & 0x0f) + 1));
++ udelay(DIV_ROUND_UP(difference, (val & 0x0f) + 1));
+
+ return ret;
+ }
zram-avoid-access-beyond-the-zram-device.patch
zram-allow-request-end-to-coincide-with-disksize.patch
staging-zram-fix-access-of-null-pointer.patch
+ubi-erase-free-peb-with-bitflip-in-ec-header.patch
+input-synaptics-adjust-threshold-for-treating-position-values-as-negative.patch
+floppy-properly-handle-failure-on-add_disk-loop.patch
+misc-hpilo-remove-pci_disable_device.patch
+i82975x_edac-fix-dimm-label-initialization.patch
+i915-ensure-that-vga-plane-is-disabled.patch
+regulator-max8997-use-uv-in-voltage_map_desc.patch
+regulator-max8998-ensure-enough-delay-time-for-max8998_set_voltage_buck_time_sel.patch
+intel_idle-don-t-register-cpu-notifier-if-we-are-not-running.patch
+can-c_can-set-reserved-bit-in-ifx_mask2-to-1-on-write.patch
+e1000e-dos-while-tso-enabled-caused-by-link-partner-with-small-mss.patch
+mac80211-introduce-ieee80211_hw_teardown_aggr_on_bar_fail.patch
+pci-shpchp-use-per-slot-workqueues-to-avoid-deadlock.patch
--- /dev/null
+From 04ed02cc7d431eb295bf9a4cb33c13319f34c48a Mon Sep 17 00:00:00 2001
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+Date: Wed, 22 Aug 2012 16:03:46 +0200
+Subject: UBI: erase free PEB with bitflip in EC header
+
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+
+commit 193819cf2e6e395b1e1be2d36785dc5563a6edca upstream.
+
+Without this patch, these PEB are not scrubbed until we put data in them.
+Bitflip can accumulate latter and we can loose the EC header (but VID header
+should be intact and allow to recover data).
+
+Signed-off-by: Matthieu Castet <matthieu.castet@parrot.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+[bwh: Backported to 3.2: adjust filename, context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Qiang Huang <h.huangqiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/ubi/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/ubi/scan.c
++++ b/drivers/mtd/ubi/scan.c
+@@ -997,7 +997,7 @@ static int process_eb(struct ubi_device
+ return err;
+ goto adjust_mean_ec;
+ case UBI_IO_FF:
+- if (ec_err)
++ if (ec_err || bitflips)
+ err = add_to_list(si, pnum, ec, 1, &si->erase);
+ else
+ err = add_to_list(si, pnum, ec, 0, &si->free);
projects / thirdparty / kernel / stable-queue.git / commitdiff
