--- /dev/null
+From 862474f8b46f6c1e600d4934e40ba40646c696ec Mon Sep 17 00:00:00 2001
+From: Olivier Sobrie <olivier@sobrie.be>
+Date: Tue, 11 Feb 2014 11:01:23 +0100
+Subject: can: kvaser_usb: check number of channels returned by HW
+
+From: Olivier Sobrie <olivier@sobrie.be>
+
+commit 862474f8b46f6c1e600d4934e40ba40646c696ec upstream.
+
+It is needed to check the number of channels returned by the HW because it
+cannot be greater than MAX_NET_DEVICES otherwise it will crash.
+
+Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/kvaser_usb.c
++++ b/drivers/net/can/usb/kvaser_usb.c
+@@ -474,6 +474,8 @@ static int kvaser_usb_get_card_info(stru
+ return err;
+
+ dev->nchannels = msg.u.cardinfo.nchannels;
++ if (dev->nchannels > MAX_NET_DEVICES)
++ return -EINVAL;
+
+ return 0;
+ }
--- /dev/null
+From 500a91571f0a5d0d3242d83802ea2fd1faccc66e Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sat, 15 Feb 2014 17:54:06 -0800
+Subject: hwmon: (max1668) Fix writing the minimum temperature
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 500a91571f0a5d0d3242d83802ea2fd1faccc66e upstream.
+
+When trying to set the minimum temperature, the driver was erroneously
+writing the maximum temperature into the chip.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/max1668.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/max1668.c
++++ b/drivers/hwmon/max1668.c
+@@ -243,7 +243,7 @@ static ssize_t set_temp_min(struct devic
+ data->temp_min[index] = clamp_val(temp/1000, -128, 127);
+ if (i2c_smbus_write_byte_data(client,
+ MAX1668_REG_LIML_WR(index),
+- data->temp_max[index]))
++ data->temp_min[index]))
+ count = -EIO;
+ mutex_unlock(&data->update_lock);
+
--- /dev/null
+From 4042e7570cff740460b75c6fc604c629621d3dd2 Mon Sep 17 00:00:00 2001
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Date: Wed, 12 Feb 2014 10:01:06 -0800
+Subject: intel_pstate: Use LFM bus ratio as min ratio/P state
+
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+
+commit 4042e7570cff740460b75c6fc604c629621d3dd2 upstream.
+
+LFM (max efficiency ratio) is the max frequency at minimum voltage
+supported by the processor. Using LFM as the minimum P state
+increases performmance without affecting power. By not using P states
+below LFM we avoid using P states that are less power efficient.
+
+Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -348,7 +348,7 @@ static int byt_get_min_pstate(void)
+ {
+ u64 value;
+ rdmsrl(BYT_RATIOS, value);
+- return value & 0xFF;
++ return (value >> 8) & 0xFF;
+ }
+
+ static int byt_get_max_pstate(void)
--- /dev/null
+From accb884b32e82f943340688c9cd30290531e73e0 Mon Sep 17 00:00:00 2001
+From: Chao Bi <chao.bi@intel.com>
+Date: Wed, 12 Feb 2014 21:27:25 +0200
+Subject: mei: set client's read_cb to NULL when flow control fails
+
+From: Chao Bi <chao.bi@intel.com>
+
+commit accb884b32e82f943340688c9cd30290531e73e0 upstream.
+
+In mei_cl_read_start(), if it fails to send flow control request, it
+will release "cl->read_cb" but forget to set pointer to NULL, leaving
+"cl->read_cb" still pointing to random memory, next time this client is
+operated like mei_release(), it has chance to refer to this wrong pointer.
+
+Fixes: PANIC at kfree in mei_release()
+
+[228781.826904] Call Trace:
+[228781.829737] [<c16249b8>] ? mei_cl_unlink+0x48/0xa0
+[228781.835283] [<c1624487>] mei_io_cb_free+0x17/0x30
+[228781.840733] [<c16265d8>] mei_release+0xa8/0x180
+[228781.845989] [<c135c610>] ? __fsnotify_parent+0xa0/0xf0
+[228781.851925] [<c1325a69>] __fput+0xd9/0x200
+[228781.856696] [<c1325b9d>] ____fput+0xd/0x10
+[228781.861467] [<c125cae1>] task_work_run+0x81/0xb0
+[228781.866821] [<c1242e53>] do_exit+0x283/0xa00
+[228781.871786] [<c1a82b36>] ? kprobe_flush_task+0x66/0xc0
+[228781.877722] [<c124eeb8>] ? __dequeue_signal+0x18/0x1a0
+[228781.883657] [<c124f072>] ? dequeue_signal+0x32/0x190
+[228781.889397] [<c1243744>] do_group_exit+0x34/0xa0
+[228781.894750] [<c12517b6>] get_signal_to_deliver+0x206/0x610
+[228781.901075] [<c12018d8>] do_signal+0x38/0x100
+[228781.906136] [<c1626d1c>] ? mei_read+0x42c/0x4e0
+[228781.911393] [<c12600a0>] ? wake_up_bit+0x30/0x30
+[228781.916745] [<c16268f0>] ? mei_poll+0x120/0x120
+[228781.922001] [<c1324be9>] ? vfs_read+0x89/0x160
+[228781.927158] [<c16268f0>] ? mei_poll+0x120/0x120
+[228781.932414] [<c133ca34>] ? fget_light+0x44/0xe0
+[228781.937670] [<c1324e58>] ? SyS_read+0x68/0x80
+[228781.942730] [<c12019f5>] do_notify_resume+0x55/0x70
+[228781.948376] [<c1a7de5d>] work_notifysig+0x29/0x30
+[228781.953827] [<c1a70000>] ? bad_area+0x5/0x3e
+
+Signed-off-by: Chao Bi <chao.bi@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/client.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -667,7 +667,6 @@ int mei_cl_read_start(struct mei_cl *cl,
+ goto err;
+
+ cb->fop_type = MEI_FOP_READ;
+- cl->read_cb = cb;
+ if (dev->hbuf_is_ready) {
+ dev->hbuf_is_ready = false;
+ if (mei_hbm_cl_flow_control_req(dev, cl)) {
+@@ -679,6 +678,9 @@ int mei_cl_read_start(struct mei_cl *cl,
+ } else {
+ list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
+ }
++
++ cl->read_cb = cb;
++
+ return rets;
+ err:
+ mei_io_cb_free(cb);
--- /dev/null
+From bb38eefb6858ce16b34716145b9597a5680aa54c Mon Sep 17 00:00:00 2001
+From: Pekon Gupta <pekon@ti.com>
+Date: Mon, 17 Feb 2014 13:11:25 +0530
+Subject: mtd: nand: omap: fix ecclayout->oobfree->length
+
+From: Pekon Gupta <pekon@ti.com>
+
+commit bb38eefb6858ce16b34716145b9597a5680aa54c upstream.
+
+This patch excludes reserved-marker byte-position from oobfree->length
+calculation. Thus all bytes from oobfree->offset till end of OOB are free.
+
+Signed-off-by: Pekon Gupta <pekon@ti.com>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/omap2.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -2000,9 +2000,8 @@ static int omap_nand_probe(struct platfo
+ goto return_error;
+ }
+
+- /* populate remaining ECC layout data */
+- ecclayout->oobfree->length = mtd->oobsize - (BADBLOCK_MARKER_LENGTH +
+- ecclayout->eccbytes);
++ /* all OOB bytes from oobfree->offset till end off OOB are free */
++ ecclayout->oobfree->length = mtd->oobsize - ecclayout->oobfree->offset;
+ /* check if NAND device's OOB is enough to store ECC signatures */
+ if (mtd->oobsize < (ecclayout->eccbytes + BADBLOCK_MARKER_LENGTH)) {
+ pr_err("not enough OOB bytes required = %d, available=%d\n",
--- /dev/null
+From aa6092f9835893290e77c3e24649def49dac1583 Mon Sep 17 00:00:00 2001
+From: Pekon Gupta <pekon@ti.com>
+Date: Mon, 17 Feb 2014 13:11:24 +0530
+Subject: mtd: nand: omap: fix ecclayout->oobfree->offset
+
+From: Pekon Gupta <pekon@ti.com>
+
+commit aa6092f9835893290e77c3e24649def49dac1583 upstream.
+
+1) In current implementation, ecclayout->oobfree->offset is calculated with
+ respect to ecclayout->eccpos[0] which is incorrect because ECC bytes may not
+ be stored contiguously in OOB.
+ So, this patch calculates ecclayout->oobfree->offset with respect to last
+ ECC byte-position 'eccpos[ecclayout->eccbytes-1]'.
+
+2) ECC layout of some ecc-schemes expects reserved-markers at specific eccpos[]
+ which should not be over-written by any file-system metadata.
+ So this patch aligns oobfree->offset taking into account of such markers.
+
+Tested-by: Enric Balletbo i Serra <eballetbo@gmail.com>
+Tested-by: Stefan Roese <sr@denx.de>
+Signed-off-by: Pekon Gupta <pekon@ti.com>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/omap2.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -1838,8 +1838,9 @@ static int omap_nand_probe(struct platfo
+ oob_index = 1;
+ for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+ ecclayout->eccpos[i] = oob_index;
+- ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+- ecclayout->eccbytes;
++ /* no reserved-marker in ecclayout for this ecc-scheme */
++ ecclayout->oobfree->offset =
++ ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
+ break;
+
+ case OMAP_ECC_BCH4_CODE_HW_DETECTION_SW:
+@@ -1862,8 +1863,9 @@ static int omap_nand_probe(struct platfo
+ if (((i + 1) % nand_chip->ecc.bytes) == 0)
+ oob_index++;
+ }
+- ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+- ecclayout->eccbytes;
++ /* include reserved-marker in ecclayout->oobfree calculation */
++ ecclayout->oobfree->offset = 1 +
++ ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
+ /* software bch library is used for locating errors */
+ nand_chip->ecc.priv = nand_bch_init(mtd,
+ nand_chip->ecc.size,
+@@ -1900,8 +1902,9 @@ static int omap_nand_probe(struct platfo
+ oob_index = BADBLOCK_MARKER_LENGTH;
+ for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+ ecclayout->eccpos[i] = oob_index;
+- ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+- ecclayout->eccbytes;
++ /* reserved marker already included in ecclayout->eccbytes */
++ ecclayout->oobfree->offset =
++ ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
+ /* This ECC scheme requires ELM H/W block */
+ if (is_elm_present(info, pdata->elm_of_node, BCH4_ECC) < 0) {
+ pr_err("nand: error: could not initialize ELM\n");
+@@ -1935,8 +1938,9 @@ static int omap_nand_probe(struct platfo
+ if (((i + 1) % nand_chip->ecc.bytes) == 0)
+ oob_index++;
+ }
+- ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+- ecclayout->eccbytes;
++ /* include reserved-marker in ecclayout->oobfree calculation */
++ ecclayout->oobfree->offset = 1 +
++ ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
+ /* software bch library is used for locating errors */
+ nand_chip->ecc.priv = nand_bch_init(mtd,
+ nand_chip->ecc.size,
+@@ -1980,8 +1984,9 @@ static int omap_nand_probe(struct platfo
+ oob_index = BADBLOCK_MARKER_LENGTH;
+ for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
+ ecclayout->eccpos[i] = oob_index;
+- ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+- ecclayout->eccbytes;
++ /* reserved marker already included in ecclayout->eccbytes */
++ ecclayout->oobfree->offset =
++ ecclayout->eccpos[ecclayout->eccbytes - 1] + 1;
+ break;
+ #else
+ pr_err("nand: error: CONFIG_MTD_NAND_OMAP_BCH not enabled\n");
--- /dev/null
+From eae39cb4934d3daab3ec828c5201c955b2e56af9 Mon Sep 17 00:00:00 2001
+From: Pekon Gupta <pekon@ti.com>
+Date: Mon, 17 Feb 2014 13:11:23 +0530
+Subject: mtd: nand: omap: fix ecclayout to be in sync with u-boot NAND driver
+
+From: Pekon Gupta <pekon@ti.com>
+
+commit eae39cb4934d3daab3ec828c5201c955b2e56af9 upstream.
+
+Fixes: commit a919e51161b58ed7e6e663daba99ab7d558808f3
+ mtd: nand: omap2: clean-up BCHx_HW and BCHx_SW ECC configurations in device_probe
+
+Fixes ecclayout mismatch introduced in above commit for following ecc-schemes:
+ - OMAP_ECC_BCH4_CODE_HW_DETECTION_SW
+ - OMAP_ECC_BCH8_CODE_HW_DETECTION_SW
+ However, this patch also touches other ecc-schemes as the fix required
+ refactoring common code, into ecc-scheme specific code.
+
+This patch aligns ecc-layout for below ecc-schemes as per reference [1],[2],[3]
+
+ +---+------------+-------------++-------------+-------------+
+ |OOB|BCH8_CODE_HW|BCH8_CODE_HW_||HAM1_CODE_HW |HAM1_CODE_HW |
+ |pos| | DETECTION_SW||(x8 device) |(x16 device) |
+ +---+------------+-------------++-------------+-------------+
+ | 0 |BADBLK_MARK | BADBLK_MARK || BADBLK_MARK | BADBLK_MARK |
+ | 1 |BADBLK_MARK | BADBLK_MARK || eccpos[0] | BADBLK_MARK |
+ | 2 | eccpos[0] | eccpos[0] || eccpos[1] | eccpos[0] |
+ | 3 | eccpos[1] | eccpos[1] || eccpos[2] | eccpos[1] |
+ | 4 | eccpos[2] | eccpos[2] || eccpos[3] | eccpos[2] |
+ | 5 | eccpos[3] | eccpos[3] || eccpos[4] | eccpos[3] |
+ | 6 | eccpos[4] | eccpos[4] || eccpos[5] | eccpos[4] |
+ | 7 | eccpos[5] | eccpos[5] || eccpos[6] | eccpos[5] |
+ | 8 | eccpos[6] | eccpos[6] || eccpos[7] | eccpos[6] |
+ | 9 | eccpos[7] | eccpos[7] || eccpos[8] | eccpos[7] |
+ |10 | eccpos[8] | eccpos[8] || eccpos[9] | eccpos[8] |
+ |11 | eccpos[9] | eccpos[9] || eccpos[10] | eccpos[9] |
+ |12 | eccpos[10] | eccpos[10] || eccpos[11] | eccpos[10] |
+ |13 | eccpos[11] | eccpos[11] || oobfree[0] | eccpos[11] |
+ |14 | eccpos[12] | eccpos[12] || oobfree[1] | oobfree[0] |
+ |15 | eccpos[13] | <reserved> || oobfree[2] | oobfree[1] |
+ +---+------------+-------------++-------------+-------------+
+ |16 | eccpos[14] | eccpos[13] || oobfree[3] | oobfree[2] |
+ |...| [...] | [...] || [...] | [...] |
+ |56 | eccpos[54] | eccpos[51] || oobfree[43] | oobfree[42] |
+ |57 | eccpos[55] | <reserved> || oobfree[44] | oobfree[43] |
+ +===+============+=============+==============+=============+
+ |58 | oobfree[0] | oobfree[0] || oobfree[45] | oobfree[44] |
+ |59 | oobfree[1] | oobfree[1] || oobfree[46] | oobfree[45] |
+ |60 | oobfree[2] | oobfree[2] || oobfree[47] | oobfree[46] |
+ |61 | oobfree[3] | oobfree[3] || oobfree[48] | oobfree[47] |
+ |62 | oobfree[4] | oobfree[4] || oobfree[49] | oobfree[48] |
+ |63 | oobfree[5] | oobfree[5] || oobfree[50] | oobfree[49] |
+ +---+------------+-------------+--------------+-------------+
+
+[1] ecc-layout expected by ROM code, as specified in SoC TRM under:
+ Chapter="Initialization"
+ Section="Device Initialization by ROM code"
+ Sub-Section="Memory Booting"
+ Heading="NAND"
+ Figure="ECC Locations in NAND Spare Areas"
+
+[2] ecc-layout updates in u-boot
+ http://lists.denx.de/pipermail/u-boot/2013-November/167551.html
+
+[3] u-boot configurations to match above ecc-layout are documented at
+ https://processors.wiki.ti.com/index.php/Linux_Core_NAND_User%27s_Guide
+
+Reported-by: Enric Balletbo Serra <eballetbo@iseebcn.com>
+Tested-by: Enric Balletbo i Serra <eballetbo@gmail.com>
+Tested-by: Stefan Roese <sr@denx.de>
+Signed-off-by: Pekon Gupta <pekon@ti.com>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/omap2.c | 31 +++++++++++++++++++++++--------
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+--- a/drivers/mtd/nand/omap2.c
++++ b/drivers/mtd/nand/omap2.c
+@@ -1633,6 +1633,7 @@ static int omap_nand_probe(struct platfo
+ int i;
+ dma_cap_mask_t mask;
+ unsigned sig;
++ unsigned oob_index;
+ struct resource *res;
+ struct mtd_part_parser_data ppdata = {};
+
+@@ -1832,9 +1833,11 @@ static int omap_nand_probe(struct platfo
+ (mtd->writesize /
+ nand_chip->ecc.size);
+ if (nand_chip->options & NAND_BUSWIDTH_16)
+- ecclayout->eccpos[0] = BADBLOCK_MARKER_LENGTH;
++ oob_index = BADBLOCK_MARKER_LENGTH;
+ else
+- ecclayout->eccpos[0] = 1;
++ oob_index = 1;
++ for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
++ ecclayout->eccpos[i] = oob_index;
+ ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+ ecclayout->eccbytes;
+ break;
+@@ -1853,7 +1856,12 @@ static int omap_nand_probe(struct platfo
+ ecclayout->eccbytes = nand_chip->ecc.bytes *
+ (mtd->writesize /
+ nand_chip->ecc.size);
+- ecclayout->eccpos[0] = BADBLOCK_MARKER_LENGTH;
++ oob_index = BADBLOCK_MARKER_LENGTH;
++ for (i = 0; i < ecclayout->eccbytes; i++, oob_index++) {
++ ecclayout->eccpos[i] = oob_index;
++ if (((i + 1) % nand_chip->ecc.bytes) == 0)
++ oob_index++;
++ }
+ ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+ ecclayout->eccbytes;
+ /* software bch library is used for locating errors */
+@@ -1889,7 +1897,9 @@ static int omap_nand_probe(struct platfo
+ ecclayout->eccbytes = nand_chip->ecc.bytes *
+ (mtd->writesize /
+ nand_chip->ecc.size);
+- ecclayout->eccpos[0] = BADBLOCK_MARKER_LENGTH;
++ oob_index = BADBLOCK_MARKER_LENGTH;
++ for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
++ ecclayout->eccpos[i] = oob_index;
+ ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+ ecclayout->eccbytes;
+ /* This ECC scheme requires ELM H/W block */
+@@ -1919,7 +1929,12 @@ static int omap_nand_probe(struct platfo
+ ecclayout->eccbytes = nand_chip->ecc.bytes *
+ (mtd->writesize /
+ nand_chip->ecc.size);
+- ecclayout->eccpos[0] = BADBLOCK_MARKER_LENGTH;
++ oob_index = BADBLOCK_MARKER_LENGTH;
++ for (i = 0; i < ecclayout->eccbytes; i++, oob_index++) {
++ ecclayout->eccpos[i] = oob_index;
++ if (((i + 1) % nand_chip->ecc.bytes) == 0)
++ oob_index++;
++ }
+ ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+ ecclayout->eccbytes;
+ /* software bch library is used for locating errors */
+@@ -1962,7 +1977,9 @@ static int omap_nand_probe(struct platfo
+ ecclayout->eccbytes = nand_chip->ecc.bytes *
+ (mtd->writesize /
+ nand_chip->ecc.size);
+- ecclayout->eccpos[0] = BADBLOCK_MARKER_LENGTH;
++ oob_index = BADBLOCK_MARKER_LENGTH;
++ for (i = 0; i < ecclayout->eccbytes; i++, oob_index++)
++ ecclayout->eccpos[i] = oob_index;
+ ecclayout->oobfree->offset = ecclayout->eccpos[0] +
+ ecclayout->eccbytes;
+ break;
+@@ -1981,8 +1998,6 @@ static int omap_nand_probe(struct platfo
+ /* populate remaining ECC layout data */
+ ecclayout->oobfree->length = mtd->oobsize - (BADBLOCK_MARKER_LENGTH +
+ ecclayout->eccbytes);
+- for (i = 1; i < ecclayout->eccbytes; i++)
+- ecclayout->eccpos[i] = ecclayout->eccpos[0] + i;
+ /* check if NAND device's OOB is enough to store ECC signatures */
+ if (mtd->oobsize < (ecclayout->eccbytes + BADBLOCK_MARKER_LENGTH)) {
+ pr_err("not enough OOB bytes required = %d, available=%d\n",
--- /dev/null
+From ebf6dad0de89677aa58a4d8b009014ff88a23452 Mon Sep 17 00:00:00 2001
+From: Steve Twiss <stwiss.opensource@diasemi.com>
+Date: Wed, 12 Feb 2014 09:57:52 +0000
+Subject: regulator: da9063: Bug fix when setting max voltage on LDOs 5-11
+
+From: Steve Twiss <stwiss.opensource@diasemi.com>
+
+commit ebf6dad0de89677aa58a4d8b009014ff88a23452 upstream.
+
+Bug fix to allow the setting of maximum voltage for certain LDOs.
+
+What the bug is:
+
+There is a problem caused by an invalid calculation of n_voltages
+in the driver. This n_voltages value has the potential to be
+different for each regulator.
+
+The value for linear_min_sel is set as DA9063_V##regl_name#
+which can be different depending upon the regulator. This is
+chosen according to the following definitions in the DA9063
+registers.h file:
+
+DA9063_VLDO1_BIAS 0
+DA9063_VLDO2_BIAS 0
+DA9063_VLDO3_BIAS 0
+DA9063_VLDO4_BIAS 0
+DA9063_VLDO5_BIAS 2
+DA9063_VLDO6_BIAS 2
+DA9063_VLDO7_BIAS 2
+DA9063_VLDO8_BIAS 2
+DA9063_VLDO9_BIAS 3
+DA9063_VLDO10_BIAS 2
+DA9063_VLDO11_BIAS 2
+
+The calculation for n_voltages is valid for LDOs whose BIAS value
+is zero but this is not correct for those LDOs which have a
+non-zero value.
+
+What the fix is:
+
+In order to take into account the non-zero linear_min_sel value which
+is set for the regulators LDO5, LDO6, LDO7, LDO8, LDO9, LDO10 and
+LDO11, the calculation for n_voltages should take into account the
+missing term defined by DA9063_V##regl_name#.
+
+This will in turn allow the core constraints calculation to set the
+maximum voltage limits correctly and therefore allow users to apply
+the maximum expected voltage to all of the LDOs.
+
+Signed-off-by: Steve Twiss <stwiss.opensource@diasemi.com>
+Signed-off-by: Mark Brown <broonie@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/da9063-regulator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/da9063-regulator.c
++++ b/drivers/regulator/da9063-regulator.c
+@@ -1,3 +1,4 @@
++
+ /*
+ * Regulator driver for DA9063 PMIC series
+ *
+@@ -60,7 +61,8 @@ struct da9063_regulator_info {
+ .desc.ops = &da9063_ldo_ops, \
+ .desc.min_uV = (min_mV) * 1000, \
+ .desc.uV_step = (step_mV) * 1000, \
+- .desc.n_voltages = (((max_mV) - (min_mV))/(step_mV) + 1), \
++ .desc.n_voltages = (((max_mV) - (min_mV))/(step_mV) + 1 \
++ + (DA9063_V##regl_name##_BIAS)), \
+ .desc.enable_reg = DA9063_REG_##regl_name##_CONT, \
+ .desc.enable_mask = DA9063_LDO_EN, \
+ .desc.vsel_reg = DA9063_REG_V##regl_name##_A, \
i7core_edac-fix-pci-device-reference-count.patch
acpi-video-filter-the-_bcl-table-for-duplicate-brightness-values.patch
acpi-processor-rework-processor-throttling-with-work_on_cpu.patch
+intel_pstate-use-lfm-bus-ratio-as-min-ratio-p-state.patch
+can-kvaser_usb-check-number-of-channels-returned-by-hw.patch
+usb-chipidea-need-to-mask-when-writting-endptflush-and-endptprime.patch
+usb-gadget-bcm63xx_udc-fix-build-failure-on-dma-channel-code.patch
+usb-serial-option-blacklist-interface-4-for-cinterion-phs8-and-pxs8.patch
+usb-ehci-add-delay-during-suspend-to-prevent-erroneous-wakeups.patch
+usb-ehci-fix-deadlock-when-threadirqs-option-is-used.patch
+usb-ftdi_sio-add-cressi-leonardo-pid.patch
+mei-set-client-s-read_cb-to-null-when-flow-control-fails.patch
+hwmon-max1668-fix-writing-the-minimum-temperature.patch
+workqueue-ensure-task-is-valid-across-kthread_stop.patch
+regulator-da9063-bug-fix-when-setting-max-voltage-on-ldos-5-11.patch
+mtd-nand-omap-fix-ecclayout-to-be-in-sync-with-u-boot-nand-driver.patch
+mtd-nand-omap-fix-ecclayout-oobfree-offset.patch
+mtd-nand-omap-fix-ecclayout-oobfree-length.patch
--- /dev/null
+From 5bf5dbeda2454296f1984adfbfc8e6f5965ac389 Mon Sep 17 00:00:00 2001
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+Date: Wed, 19 Feb 2014 13:46:31 +0800
+Subject: usb: chipidea: need to mask when writting endptflush and endptprime
+
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+
+commit 5bf5dbeda2454296f1984adfbfc8e6f5965ac389 upstream.
+
+ENDPTFLUSH and ENDPTPRIME registers are set by software and clear
+by hardware. There is a bit for each endpoint. When we are setting
+a bit for an endpoint we should make sure we do not touch other
+endpoint bit. There is a race condition if the hardware clear the
+bit between the read and the write in hw_write.
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Matthieu CASTET <matthieu.castet@parrot.com>
+Tested-by: Michael Grzeschik <mgrzeschik@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/udc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -105,7 +105,7 @@ static int hw_ep_flush(struct ci_hdrc *c
+
+ do {
+ /* flush any pending transfer */
+- hw_write(ci, OP_ENDPTFLUSH, BIT(n), BIT(n));
++ hw_write(ci, OP_ENDPTFLUSH, ~0, BIT(n));
+ while (hw_read(ci, OP_ENDPTFLUSH, BIT(n)))
+ cpu_relax();
+ } while (hw_read(ci, OP_ENDPTSTAT, BIT(n)));
+@@ -205,7 +205,7 @@ static int hw_ep_prime(struct ci_hdrc *c
+ if (is_ctrl && dir == RX && hw_read(ci, OP_ENDPTSETUPSTAT, BIT(num)))
+ return -EAGAIN;
+
+- hw_write(ci, OP_ENDPTPRIME, BIT(n), BIT(n));
++ hw_write(ci, OP_ENDPTPRIME, ~0, BIT(n));
+
+ while (hw_read(ci, OP_ENDPTPRIME, BIT(n)))
+ cpu_relax();
--- /dev/null
+From 3e8d6d85adedc59115a564c0a54b36e42087c4d9 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 13 Feb 2014 15:49:17 -0500
+Subject: USB: EHCI: add delay during suspend to prevent erroneous wakeups
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 3e8d6d85adedc59115a564c0a54b36e42087c4d9 upstream.
+
+High-speed USB connections revert back to full-speed signalling when
+the device goes into suspend. This takes several milliseconds, and
+during that time it's not possible to tell reliably whether the device
+has been disconnected.
+
+On some platforms, the Wake-On-Disconnect circuitry gets confused
+during this intermediate state. It generates a false wakeup signal,
+which can prevent the controller from going to sleep.
+
+To avoid this problem, this patch adds a 5-ms delay to the
+ehci_bus_suspend() routine if any ports have to switch over to
+full-speed signalling. (Actually, the delay was already present for
+devices using a particular kind of PHY power management; the patch
+merely causes the delay to be used more widely.)
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reviewed-by: Peter Chen <Peter.Chen@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-hub.c | 26 ++++++++++++++++++++++----
+ 1 file changed, 22 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -238,6 +238,7 @@ static int ehci_bus_suspend (struct usb_
+ int port;
+ int mask;
+ int changed;
++ bool fs_idle_delay;
+
+ ehci_dbg(ehci, "suspend root hub\n");
+
+@@ -272,6 +273,7 @@ static int ehci_bus_suspend (struct usb_
+ ehci->bus_suspended = 0;
+ ehci->owned_ports = 0;
+ changed = 0;
++ fs_idle_delay = false;
+ port = HCS_N_PORTS(ehci->hcs_params);
+ while (port--) {
+ u32 __iomem *reg = &ehci->regs->port_status [port];
+@@ -300,16 +302,32 @@ static int ehci_bus_suspend (struct usb_
+ }
+
+ if (t1 != t2) {
++ /*
++ * On some controllers, Wake-On-Disconnect will
++ * generate false wakeup signals until the bus
++ * switches over to full-speed idle. For their
++ * sake, add a delay if we need one.
++ */
++ if ((t2 & PORT_WKDISC_E) &&
++ ehci_port_speed(ehci, t2) ==
++ USB_PORT_STAT_HIGH_SPEED)
++ fs_idle_delay = true;
+ ehci_writel(ehci, t2, reg);
+ changed = 1;
+ }
+ }
++ spin_unlock_irq(&ehci->lock);
++
++ if ((changed && ehci->has_tdi_phy_lpm) || fs_idle_delay) {
++ /*
++ * Wait for HCD to enter low-power mode or for the bus
++ * to switch to full-speed idle.
++ */
++ usleep_range(5000, 5500);
++ }
+
+ if (changed && ehci->has_tdi_phy_lpm) {
+- spin_unlock_irq(&ehci->lock);
+- msleep(5); /* 5 ms for HCD to enter low-power mode */
+ spin_lock_irq(&ehci->lock);
+-
+ port = HCS_N_PORTS(ehci->hcs_params);
+ while (port--) {
+ u32 __iomem *hostpc_reg = &ehci->regs->hostpc[port];
+@@ -322,8 +340,8 @@ static int ehci_bus_suspend (struct usb_
+ port, (t3 & HOSTPC_PHCD) ?
+ "succeeded" : "failed");
+ }
++ spin_unlock_irq(&ehci->lock);
+ }
+- spin_unlock_irq(&ehci->lock);
+
+ /* Apparently some devices need a >= 1-uframe delay here */
+ if (ehci->bus_suspended)
--- /dev/null
+From a1227f3c1030e96ebc51d677d2f636268845c5fb Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 19 Feb 2014 10:29:01 +0100
+Subject: usb: ehci: fix deadlock when threadirqs option is used
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit a1227f3c1030e96ebc51d677d2f636268845c5fb upstream.
+
+ehci_irq() and ehci_hrtimer_func() can deadlock on ehci->lock when
+threadirqs option is used. To prevent the deadlock use
+spin_lock_irqsave() in ehci_irq().
+
+This change can be reverted when hrtimer callbacks become threaded.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-hcd.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -686,8 +686,15 @@ static irqreturn_t ehci_irq (struct usb_
+ struct ehci_hcd *ehci = hcd_to_ehci (hcd);
+ u32 status, masked_status, pcd_status = 0, cmd;
+ int bh;
++ unsigned long flags;
+
+- spin_lock (&ehci->lock);
++ /*
++ * For threadirqs option we use spin_lock_irqsave() variant to prevent
++ * deadlock with ehci hrtimer callback, because hrtimer callbacks run
++ * in interrupt context even when threadirqs is specified. We can go
++ * back to spin_lock() variant when hrtimer callbacks become threaded.
++ */
++ spin_lock_irqsave(&ehci->lock, flags);
+
+ status = ehci_readl(ehci, &ehci->regs->status);
+
+@@ -705,7 +712,7 @@ static irqreturn_t ehci_irq (struct usb_
+
+ /* Shared IRQ? */
+ if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
+- spin_unlock(&ehci->lock);
++ spin_unlock_irqrestore(&ehci->lock, flags);
+ return IRQ_NONE;
+ }
+
+@@ -823,7 +830,7 @@ dead:
+
+ if (bh)
+ ehci_work (ehci);
+- spin_unlock (&ehci->lock);
++ spin_unlock_irqrestore(&ehci->lock, flags);
+ if (pcd_status)
+ usb_hcd_poll_rh_status(hcd);
+ return IRQ_HANDLED;
--- /dev/null
+From 6dbd46c849e071e6afc1e0cad489b0175bca9318 Mon Sep 17 00:00:00 2001
+From: Joerg Dorchain <joerg@dorchain.net>
+Date: Fri, 21 Feb 2014 20:29:33 +0100
+Subject: USB: ftdi_sio: add Cressi Leonardo PID
+
+From: Joerg Dorchain <joerg@dorchain.net>
+
+commit 6dbd46c849e071e6afc1e0cad489b0175bca9318 upstream.
+
+Hello,
+
+the following patch adds an entry for the PID of a Cressi Leonardo
+diving computer interface to kernel 3.13.0.
+It is detected as FT232RL.
+Works with subsurface.
+
+Signed-off-by: Joerg Dorchain <joerg@dorchain.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -908,6 +908,8 @@ static struct usb_device_id id_table_com
+ /* Crucible Devices */
+ { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
++ /* Cressi Devices */
++ { USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
+ { } /* Terminating entry */
+ };
+
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1320,3 +1320,9 @@
+ * Manufacturer: Smart GSM Team
+ */
+ #define FTDI_Z3X_PID 0x0011
++
++/*
++ * Product: Cressi PC Interface
++ * Manufacturer: Cressi
++ */
++#define FTDI_CRESSI_PID 0x87d0
--- /dev/null
+From 2d1f7af3d60dd09794e0738a915d272c6c27abc5 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Tue, 14 Jan 2014 15:36:29 -0800
+Subject: usb: gadget: bcm63xx_udc: fix build failure on DMA channel code
+
+From: Florian Fainelli <florian@openwrt.org>
+
+commit 2d1f7af3d60dd09794e0738a915d272c6c27abc5 upstream.
+
+Commit 3dc6475 ("bcm63xx_enet: add support Broadcom BCM6345 Ethernet")
+changed the ENETDMA[CS] macros such that they are no longer macros, but
+actual register offset definitions. The bcm63xx_udc driver was not
+updated, and as a result, causes the following build error to pop up:
+
+ CC drivers/usb/gadget/u_ether.o
+drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_write':
+drivers/usb/gadget/bcm63xx_udc.c:642:24: error: called object '0' is not
+a function
+drivers/usb/gadget/bcm63xx_udc.c: In function 'iudma_reset_channel':
+drivers/usb/gadget/bcm63xx_udc.c:698:46: error: called object '0' is not
+a function
+drivers/usb/gadget/bcm63xx_udc.c:700:49: error: called object '0' is not
+a function
+
+Fix this by updating usb_dmac_{read,write}l and usb_dmas_{read,write}l to
+take an extra channel argument, and use the channel width
+(ENETDMA_CHAN_WIDTH) to offset the register we want to access, hence
+doing again what the macro implicitely did for us.
+
+Cc: Kevin Cernekee <cernekee@gmail.com>
+Cc: Jonas Gorski <jogo@openwrt.org>
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/bcm63xx_udc.c | 58 +++++++++++++++++++++------------------
+ 1 file changed, 32 insertions(+), 26 deletions(-)
+
+--- a/drivers/usb/gadget/bcm63xx_udc.c
++++ b/drivers/usb/gadget/bcm63xx_udc.c
+@@ -361,24 +361,30 @@ static inline void usb_dma_writel(struct
+ bcm_writel(val, udc->iudma_regs + off);
+ }
+
+-static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off)
++static inline u32 usb_dmac_readl(struct bcm63xx_udc *udc, u32 off, int chan)
+ {
+- return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off);
++ return bcm_readl(udc->iudma_regs + IUDMA_DMAC_OFFSET + off +
++ (ENETDMA_CHAN_WIDTH * chan));
+ }
+
+-static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
++static inline void usb_dmac_writel(struct bcm63xx_udc *udc, u32 val, u32 off,
++ int chan)
+ {
+- bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off);
++ bcm_writel(val, udc->iudma_regs + IUDMA_DMAC_OFFSET + off +
++ (ENETDMA_CHAN_WIDTH * chan));
+ }
+
+-static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off)
++static inline u32 usb_dmas_readl(struct bcm63xx_udc *udc, u32 off, int chan)
+ {
+- return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off);
++ return bcm_readl(udc->iudma_regs + IUDMA_DMAS_OFFSET + off +
++ (ENETDMA_CHAN_WIDTH * chan));
+ }
+
+-static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off)
++static inline void usb_dmas_writel(struct bcm63xx_udc *udc, u32 val, u32 off,
++ int chan)
+ {
+- bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off);
++ bcm_writel(val, udc->iudma_regs + IUDMA_DMAS_OFFSET + off +
++ (ENETDMA_CHAN_WIDTH * chan));
+ }
+
+ static inline void set_clocks(struct bcm63xx_udc *udc, bool is_enabled)
+@@ -639,7 +645,7 @@ static void iudma_write(struct bcm63xx_u
+ } while (!last_bd);
+
+ usb_dmac_writel(udc, ENETDMAC_CHANCFG_EN_MASK,
+- ENETDMAC_CHANCFG_REG(iudma->ch_idx));
++ ENETDMAC_CHANCFG_REG, iudma->ch_idx);
+ }
+
+ /**
+@@ -695,9 +701,9 @@ static void iudma_reset_channel(struct b
+ bcm63xx_fifo_reset_ep(udc, max(0, iudma->ep_num));
+
+ /* stop DMA, then wait for the hardware to wrap up */
+- usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG(ch_idx));
++ usb_dmac_writel(udc, 0, ENETDMAC_CHANCFG_REG, ch_idx);
+
+- while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)) &
++ while (usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx) &
+ ENETDMAC_CHANCFG_EN_MASK) {
+ udelay(1);
+
+@@ -714,10 +720,10 @@ static void iudma_reset_channel(struct b
+ dev_warn(udc->dev, "forcibly halting IUDMA channel %d\n",
+ ch_idx);
+ usb_dmac_writel(udc, ENETDMAC_CHANCFG_BUFHALT_MASK,
+- ENETDMAC_CHANCFG_REG(ch_idx));
++ ENETDMAC_CHANCFG_REG, ch_idx);
+ }
+ }
+- usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG(ch_idx));
++ usb_dmac_writel(udc, ~0, ENETDMAC_IR_REG, ch_idx);
+
+ /* don't leave "live" HW-owned entries for the next guy to step on */
+ for (d = iudma->bd_ring; d <= iudma->end_bd; d++)
+@@ -729,11 +735,11 @@ static void iudma_reset_channel(struct b
+
+ /* set up IRQs, UBUS burst size, and BD base for this channel */
+ usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK,
+- ENETDMAC_IRMASK_REG(ch_idx));
+- usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG(ch_idx));
++ ENETDMAC_IRMASK_REG, ch_idx);
++ usb_dmac_writel(udc, 8, ENETDMAC_MAXBURST_REG, ch_idx);
+
+- usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG(ch_idx));
+- usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG(ch_idx));
++ usb_dmas_writel(udc, iudma->bd_ring_dma, ENETDMAS_RSTART_REG, ch_idx);
++ usb_dmas_writel(udc, 0, ENETDMAS_SRAM2_REG, ch_idx);
+ }
+
+ /**
+@@ -2036,7 +2042,7 @@ static irqreturn_t bcm63xx_udc_data_isr(
+ spin_lock(&udc->lock);
+
+ usb_dmac_writel(udc, ENETDMAC_IR_BUFDONE_MASK,
+- ENETDMAC_IR_REG(iudma->ch_idx));
++ ENETDMAC_IR_REG, iudma->ch_idx);
+ bep = iudma->bep;
+ rc = iudma_read(udc, iudma);
+
+@@ -2176,18 +2182,18 @@ static int bcm63xx_iudma_dbg_show(struct
+ seq_printf(s, " [ep%d]:\n",
+ max_t(int, iudma_defaults[ch_idx].ep_num, 0));
+ seq_printf(s, " cfg: %08x; irqstat: %08x; irqmask: %08x; maxburst: %08x\n",
+- usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG(ch_idx)),
+- usb_dmac_readl(udc, ENETDMAC_IR_REG(ch_idx)),
+- usb_dmac_readl(udc, ENETDMAC_IRMASK_REG(ch_idx)),
+- usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG(ch_idx)));
++ usb_dmac_readl(udc, ENETDMAC_CHANCFG_REG, ch_idx),
++ usb_dmac_readl(udc, ENETDMAC_IR_REG, ch_idx),
++ usb_dmac_readl(udc, ENETDMAC_IRMASK_REG, ch_idx),
++ usb_dmac_readl(udc, ENETDMAC_MAXBURST_REG, ch_idx));
+
+- sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG(ch_idx));
+- sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG(ch_idx));
++ sram2 = usb_dmas_readl(udc, ENETDMAS_SRAM2_REG, ch_idx);
++ sram3 = usb_dmas_readl(udc, ENETDMAS_SRAM3_REG, ch_idx);
+ seq_printf(s, " base: %08x; index: %04x_%04x; desc: %04x_%04x %08x\n",
+- usb_dmas_readl(udc, ENETDMAS_RSTART_REG(ch_idx)),
++ usb_dmas_readl(udc, ENETDMAS_RSTART_REG, ch_idx),
+ sram2 >> 16, sram2 & 0xffff,
+ sram3 >> 16, sram3 & 0xffff,
+- usb_dmas_readl(udc, ENETDMAS_SRAM4_REG(ch_idx)));
++ usb_dmas_readl(udc, ENETDMAS_SRAM4_REG, ch_idx));
+ seq_printf(s, " desc: %d/%d used", iudma->n_bds_used,
+ iudma->n_bds);
+
--- /dev/null
+From 12df84d4a80278a5b1abfec3206795291da52fc9 Mon Sep 17 00:00:00 2001
+From: Aleksander Morgado <aleksander@aleksander.es>
+Date: Wed, 12 Feb 2014 16:04:45 +0100
+Subject: USB: serial: option: blacklist interface 4 for Cinterion PHS8 and PXS8
+
+From: Aleksander Morgado <aleksander@aleksander.es>
+
+commit 12df84d4a80278a5b1abfec3206795291da52fc9 upstream.
+
+This interface is to be handled by the qmi_wwan driver.
+
+CC: Hans-Christoph Schemmel <hans-christoph.schemmel@gemalto.com>
+CC: Christian Schmiedl <christian.schmiedl@gemalto.com>
+CC: Nicolaus Colberg <nicolaus.colberg@gemalto.com>
+CC: David McCullough <david.mccullough@accelecon.com>
+Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1526,7 +1526,8 @@ static const struct usb_device_id option
+ /* Cinterion */
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
--- /dev/null
+From 5bdfff96c69a4d5ab9c49e60abf9e070ecd2acbb Mon Sep 17 00:00:00 2001
+From: Lai Jiangshan <laijs@cn.fujitsu.com>
+Date: Sat, 15 Feb 2014 22:02:28 +0800
+Subject: workqueue: ensure @task is valid across kthread_stop()
+
+From: Lai Jiangshan <laijs@cn.fujitsu.com>
+
+commit 5bdfff96c69a4d5ab9c49e60abf9e070ecd2acbb upstream.
+
+When a kworker should die, the kworkre is notified through WORKER_DIE
+flag instead of kthread_should_stop(). This, IIRC, is primarily to
+keep the test synchronized inside worker_pool lock. WORKER_DIE is
+first set while holding pool->lock, the lock is dropped and
+kthread_stop() is called.
+
+Unfortunately, this means that there's a slight chance that the target
+kworker may see WORKER_DIE before kthread_stop() finishes and exits
+and frees the target task before or during kthread_stop().
+
+Fix it by pinning the target task before setting WORKER_DIE and
+putting it after kthread_stop() is done.
+
+tj: Improved patch description and comment. Moved pinning above
+ WORKER_DIE for better signify what it's protecting.
+
+Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/workqueue.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1851,6 +1851,12 @@ static void destroy_worker(struct worker
+ if (worker->flags & WORKER_IDLE)
+ pool->nr_idle--;
+
++ /*
++ * Once WORKER_DIE is set, the kworker may destroy itself at any
++ * point. Pin to ensure the task stays until we're done with it.
++ */
++ get_task_struct(worker->task);
++
+ list_del_init(&worker->entry);
+ worker->flags |= WORKER_DIE;
+
+@@ -1859,6 +1865,7 @@ static void destroy_worker(struct worker
+ spin_unlock_irq(&pool->lock);
+
+ kthread_stop(worker->task);
++ put_task_struct(worker->task);
+ kfree(worker);
+
+ spin_lock_irq(&pool->lock);
projects / thirdparty / kernel / stable-queue.git / commitdiff
