--- /dev/null
+From 333c2aa029b847051a2db76a6ca59f699a520030 Mon Sep 17 00:00:00 2001
+From: Hante Meuleman <meuleman@broadcom.com>
+Date: Wed, 3 Dec 2014 21:05:27 +0100
+Subject: brcmfmac: Fix bitmap malloc bug in msgbuf.
+
+From: Hante Meuleman <meuleman@broadcom.com>
+
+commit 333c2aa029b847051a2db76a6ca59f699a520030 upstream.
+
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+@@ -1355,6 +1355,7 @@ int brcmf_proto_msgbuf_attach(struct brc
+ }
+ INIT_WORK(&msgbuf->txflow_work, brcmf_msgbuf_txflow_worker);
+ count = BITS_TO_LONGS(if_msgbuf->nrof_flowrings);
++ count = count * sizeof(unsigned long);
+ msgbuf->flow_map = kzalloc(count, GFP_KERNEL);
+ if (!msgbuf->flow_map)
+ goto fail;
--- /dev/null
+From 0b46b8a718c6e90910a1b1b0fe797be3c167e186 Mon Sep 17 00:00:00 2001
+From: Sonny Rao <sonnyrao@chromium.org>
+Date: Sun, 23 Nov 2014 23:02:44 -0800
+Subject: clocksource: arch_timer: Fix code to use physical timers when
+ requested
+
+From: Sonny Rao <sonnyrao@chromium.org>
+
+commit 0b46b8a718c6e90910a1b1b0fe797be3c167e186 upstream.
+
+This is a bug fix for using physical arch timers when
+the arch_timer_use_virtual boolean is false. It restores the
+arch_counter_get_cntpct() function after removal in
+
+0d651e4e "clocksource: arch_timer: use virtual counters"
+
+We need this on certain ARMv7 systems which are architected like this:
+
+* The firmware doesn't know and doesn't care about hypervisor mode and
+ we don't want to add the complexity of hypervisor there.
+
+* The firmware isn't involved in SMP bringup or resume.
+
+* The ARCH timer come up with an uninitialized offset between the
+ virtual and physical counters. Each core gets a different random
+ offset.
+
+* The device boots in "Secure SVC" mode.
+
+* Nothing has touched the reset value of CNTHCTL.PL1PCEN or
+ CNTHCTL.PL1PCTEN (both default to 1 at reset)
+
+One example of such as system is RK3288 where it is much simpler to
+use the physical counter since there's nobody managing the offset and
+each time a core goes down and comes back up it will get reinitialized
+to some other random value.
+
+Fixes: 0d651e4e65e9 ("clocksource: arch_timer: use virtual counters")
+Signed-off-by: Sonny Rao <sonnyrao@chromium.org>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/arch_timer.h | 9 +++++++++
+ arch/arm64/include/asm/arch_timer.h | 9 +++++++++
+ drivers/clocksource/arm_arch_timer.c | 5 ++++-
+ 3 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/include/asm/arch_timer.h
++++ b/arch/arm/include/asm/arch_timer.h
+@@ -78,6 +78,15 @@ static inline u32 arch_timer_get_cntfrq(
+ return val;
+ }
+
++static inline u64 arch_counter_get_cntpct(void)
++{
++ u64 cval;
++
++ isb();
++ asm volatile("mrrc p15, 0, %Q0, %R0, c14" : "=r" (cval));
++ return cval;
++}
++
+ static inline u64 arch_counter_get_cntvct(void)
+ {
+ u64 cval;
+--- a/arch/arm64/include/asm/arch_timer.h
++++ b/arch/arm64/include/asm/arch_timer.h
+@@ -104,6 +104,15 @@ static inline void arch_timer_set_cntkct
+ asm volatile("msr cntkctl_el1, %0" : : "r" (cntkctl));
+ }
+
++static inline u64 arch_counter_get_cntpct(void)
++{
++ /*
++ * AArch64 kernel and user space mandate the use of CNTVCT.
++ */
++ BUG();
++ return 0;
++}
++
+ static inline u64 arch_counter_get_cntvct(void)
+ {
+ u64 cval;
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -462,7 +462,10 @@ static void __init arch_counter_register
+
+ /* Register the CP15 based counter if we have one */
+ if (type & ARCH_CP15_TIMER) {
+- arch_timer_read_counter = arch_counter_get_cntvct;
++ if (arch_timer_use_virtual)
++ arch_timer_read_counter = arch_counter_get_cntvct;
++ else
++ arch_timer_read_counter = arch_counter_get_cntpct;
+ } else {
+ arch_timer_read_counter = arch_counter_get_cntvct_mem;
+
--- /dev/null
+From 1a5fb99de4850cba710d91becfa2c65653048589 Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Date: Fri, 24 Oct 2014 21:19:57 +0400
+Subject: mfd: tc6393xb: Fail ohci suspend if full state restore is required
+
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+
+commit 1a5fb99de4850cba710d91becfa2c65653048589 upstream.
+
+Some boards with TC6393XB chip require full state restore during system
+resume thanks to chip's VCC being cut off during suspend (Sharp SL-6000
+tosa is one of them). Failing to do so would result in ohci Oops on
+resume due to internal memory contentes being changed. Fail ohci suspend
+on tc6393xb is full state restore is required.
+
+Recommended workaround is to unbind tmio-ohci driver before suspend and
+rebind it after resume.
+
+Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/tc6393xb.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/mfd/tc6393xb.c
++++ b/drivers/mfd/tc6393xb.c
+@@ -263,6 +263,17 @@ static int tc6393xb_ohci_disable(struct
+ return 0;
+ }
+
++static int tc6393xb_ohci_suspend(struct platform_device *dev)
++{
++ struct tc6393xb_platform_data *tcpd = dev_get_platdata(dev->dev.parent);
++
++ /* We can't properly store/restore OHCI state, so fail here */
++ if (tcpd->resume_restore)
++ return -EBUSY;
++
++ return tc6393xb_ohci_disable(dev);
++}
++
+ static int tc6393xb_fb_enable(struct platform_device *dev)
+ {
+ struct tc6393xb *tc6393xb = dev_get_drvdata(dev->dev.parent);
+@@ -403,7 +414,7 @@ static struct mfd_cell tc6393xb_cells[]
+ .num_resources = ARRAY_SIZE(tc6393xb_ohci_resources),
+ .resources = tc6393xb_ohci_resources,
+ .enable = tc6393xb_ohci_enable,
+- .suspend = tc6393xb_ohci_disable,
++ .suspend = tc6393xb_ohci_suspend,
+ .resume = tc6393xb_ohci_enable,
+ .disable = tc6393xb_ohci_disable,
+ },
--- /dev/null
+From 1b9b46d05f887aec418b3a5f4f55abf79316fcda Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Sun, 2 Nov 2014 10:09:38 -0800
+Subject: mfd: twl4030-power: Fix regression with missing compatible flag
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 1b9b46d05f887aec418b3a5f4f55abf79316fcda upstream.
+
+Commit e7cd1d1eb16f ("mfd: twl4030-power: Add generic reset
+configuration") accidentally removed the compatible flag for
+"ti,twl4030-power" that should be there as documented in the
+binding.
+
+If "ti,twl4030-power" only the poweroff configuration is done
+by the driver.
+
+Fixes: e7cd1d1eb16f ("mfd: twl4030-power: Add generic reset configuration")
+Reported-by: "Dr. H. Nikolaus Schaller" <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/twl4030-power.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mfd/twl4030-power.c
++++ b/drivers/mfd/twl4030-power.c
+@@ -831,6 +831,9 @@ static struct twl4030_power_data osc_off
+
+ static struct of_device_id twl4030_power_of_match[] = {
+ {
++ .compatible = "ti,twl4030-power",
++ },
++ {
+ .compatible = "ti,twl4030-power-reset",
+ .data = &omap3_reset,
+ },
--- /dev/null
+From 0031a98a85e9fca282624bfc887f9531b2768396 Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Mon, 22 Sep 2014 10:12:51 +0300
+Subject: mmc: block: add newline to sysfs display of force_ro
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+commit 0031a98a85e9fca282624bfc887f9531b2768396 upstream.
+
+Make force_ro consistent with other sysfs entries.
+
+Fixes: 371a689f64b0d ('mmc: MMC boot partitions support')
+Cc: Andrei Warkentin <andrey.warkentin@gmail.com>
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/card/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -260,7 +260,7 @@ static ssize_t force_ro_show(struct devi
+ int ret;
+ struct mmc_blk_data *md = mmc_blk_get(dev_to_disk(dev));
+
+- ret = snprintf(buf, PAGE_SIZE, "%d",
++ ret = snprintf(buf, PAGE_SIZE, "%d\n",
+ get_disk_ro(dev_to_disk(dev)) ^
+ md->read_only);
+ mmc_blk_put(md);
--- /dev/null
+From 66dfd10173159cafa9cb0d39936b8daeaab8e3e0 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Mon, 17 Nov 2014 17:49:05 +0000
+Subject: mmc: dw_mmc: avoid write to CDTHRCTL on older versions
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 66dfd10173159cafa9cb0d39936b8daeaab8e3e0 upstream.
+
+Commit f1d2736c8156 (mmc: dw_mmc: control card read threshold) added
+dw_mci_ctrl_rd_thld() with an unconditional write to the CDTHRCTL
+register at offset 0x100. However before version 240a, the FIFO region
+started at 0x100, so the write messes with the FIFO and completely
+breaks the driver.
+
+If the version id < 240A, return early from dw_mci_ctl_rd_thld() so as
+not to hit this problem.
+
+Fixes: f1d2736c8156 (mmc: dw_mmc: control card read threshold)
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/dw_mmc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -626,6 +626,13 @@ static void dw_mci_ctrl_rd_thld(struct d
+
+ WARN_ON(!(data->flags & MMC_DATA_READ));
+
++ /*
++ * CDTHRCTL doesn't exist prior to 240A (in fact that register offset is
++ * in the FIFO region, so we really shouldn't access it).
++ */
++ if (host->verid < DW_MMC_240A)
++ return;
++
+ if (host->timing != MMC_TIMING_MMC_HS200 &&
+ host->timing != MMC_TIMING_UHS_SDR104)
+ goto disable;
--- /dev/null
+From 903101a83949d6fc77c092cef07e9c1e10c07e46 Mon Sep 17 00:00:00 2001
+From: Ulf Hansson <ulf.hansson@linaro.org>
+Date: Tue, 25 Nov 2014 13:05:13 +0100
+Subject: mmc: omap_hsmmc: Fix UHS card with DDR50 support
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+commit 903101a83949d6fc77c092cef07e9c1e10c07e46 upstream.
+
+The commit, mmc: omap: clarify DDR timing mode between SD-UHS and eMMC,
+switched omap_hsmmc to support MMC DDR mode instead of UHS DDR50 mode.
+
+Add UHS DDR50 mode again and this time let's also keep the MMC DDR mode.
+
+Fixes: 5438ad95a57c (mmc: omap: clarify DDR timing mode between SD-UHS and eMMC)
+Reported-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/omap_hsmmc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -609,6 +609,7 @@ static void omap_hsmmc_set_clock(struct
+ */
+ if ((mmc_slot(host).features & HSMMC_HAS_HSPE_SUPPORT) &&
+ (ios->timing != MMC_TIMING_MMC_DDR52) &&
++ (ios->timing != MMC_TIMING_UHS_DDR50) &&
+ ((OMAP_HSMMC_READ(host->base, CAPA) & HSS) == HSS)) {
+ regval = OMAP_HSMMC_READ(host->base, HCTL);
+ if (clkdiv && (clk_get_rate(host->fclk)/clkdiv) > 25000000)
+@@ -628,7 +629,8 @@ static void omap_hsmmc_set_bus_width(str
+ u32 con;
+
+ con = OMAP_HSMMC_READ(host->base, CON);
+- if (ios->timing == MMC_TIMING_MMC_DDR52)
++ if (ios->timing == MMC_TIMING_MMC_DDR52 ||
++ ios->timing == MMC_TIMING_UHS_DDR50)
+ con |= DDR; /* configure in DDR mode */
+ else
+ con &= ~DDR;
--- /dev/null
+From 6380ea099cdd46d7377b6fbec0291cf2aa387bad Mon Sep 17 00:00:00 2001
+From: Peter Guo <peter.guo@bayhubtech.com>
+Date: Wed, 24 Sep 2014 04:29:04 +0200
+Subject: mmc: sdhci-pci-o2micro: Fix Dell E5440 issue
+
+From: Peter Guo <peter.guo@bayhubtech.com>
+
+commit 6380ea099cdd46d7377b6fbec0291cf2aa387bad upstream.
+
+Fix Dell E5440 when reboot Linux, can't find o2micro sd host chip issue.
+
+Fixes: 01acf6917aed (mmc: sdhci-pci: add support of O2Micro/BayHubTech SD hosts)
+Signed-off-by: Peter Guo <peter.guo@bayhubtech.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pci-o2micro.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -127,8 +127,6 @@ void sdhci_pci_o2_fujin2_pci_init(struct
+ return;
+ scratch_32 &= ~((1 << 21) | (1 << 30));
+
+- /* Set RTD3 function disabled */
+- scratch_32 |= ((1 << 29) | (1 << 28));
+ pci_write_config_dword(chip->pdev, O2_SD_FUNC_REG3, scratch_32);
+
+ /* Set L1 Entrance Timer */