commit ff74ae50f01ee67764564815c023c362c87ce18b
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Fri Jun 22 11:37:50 2012 -0700

    Linux 3.4.4

commit f5f062e1be5fdafaa68c4dd97a2d64ef78458b37
Author: Roland Dreier <roland@purestorage.com>
Date:   Mon Jun 4 23:24:51 2012 -0700

    target: Return error to initiator if SET TARGET PORT GROUPS emulation fails
    
    commit 59e4f541baf728dbb426949bfa9f6862387ffd0e upstream.
    
    The error paths in target_emulate_set_target_port_groups() are all
    essentially "rc = -EINVAL; goto out;" but the code at "out:" ignores
    rc and always returns success.  This means that even if eg explicit
    ALUA is turned off, the initiator will always see a good SCSI status
    for SET TARGET PORT GROUPS.
    
    Fix this by returning rc as is intended.  It appears this bug was
    added by the following patch:
    
    commit 05d1c7c0d0db4cc25548d9aadebb416888a82327
    Author: Andy Grover <agrover@redhat.com>
    Date:   Wed Jul 20 19:13:28 2011 +0000
    
        target: Make all control CDBs scatter-gather
    
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Cc: Andy Grover <agrover@redhat.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [bwh: Backported to 3.2: we have transport_complete_task()
     and not target_complete_cmd()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 75862961e9b445a9bfce25b9da70ef930a857762
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Wed May 30 10:36:12 2012 +0200

    iwlwifi: fix TX power antenna access
    
    commit a5fdde28b4f5fb756032e7ad2c6fcdcffde20958 upstream.
    
    Since my commit
      iwlwifi: use valid TX/RX antenna from hw_params
    the config values are pure overrides, not the
    real values for all hardware. Therefore, the
    EEPROM TX power reading code checks the wrong
    values, it should check the hw_params values.
    
    Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit adf264357dfa43d9c3b79f3885a7dd4b962b36e1
Author: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Date:   Tue Jun 5 20:24:37 2012 +0200

    iwlwifi: use correct supported firmware for 6035 and 6000g2
    
    commit d2c8b15d0cb486f4938ba7f2af349d9d1220cb10 upstream.
    
    My patch
    
       iwlwifi: use correct released ucode version
    
    did not correctly report supported firmware
    for the 6035 device. This patch fixes it. The
    minimum supported firmware version for 6035
    is v6.
    
    Also correct the minimum supported firmware
    version for the 6000g2 series of devices.
    
    Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
    Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 77bcff9d8249e55b43349ddc3f5ef3b8a63600b8
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Wed May 16 22:35:58 2012 +0200

    iwlwifi: fix the Transmit Frame Descriptor rings
    
    commit ebed633c61c023e5d1aa4ed159cd67406e9e37c2 upstream.
    
    The logic that allows to have a short TFD queue was completely wrong.
    We do maintain 256 Transmit Frame Descriptors, but they point to
    recycled buffers. We used to attach and de-attach different TFDs for
    the same buffer and it worked since they pointed to the same buffer.
    
    Also zero the number of BDs after unmapping a TFD. This seems not
    necessary since we don't reclaim the same TFD twice, but I like
    housekeeping.
    
    This patch solves this warning:
    
    [ 6427.079855] WARNING: at lib/dma-debug.c:866 check_unmap+0x727/0x7a0()
    [ 6427.079859] Hardware name: Latitude E6410
    [ 6427.079865] iwlwifi 0000:02:00.0: DMA-API: device driver tries to free DMA memory it has not allocated [device address=0x00000000296d393c] [size=8 bytes]
    [ 6427.079870] Modules linked in: ...
    [ 6427.079950] Pid: 6613, comm: ifconfig Tainted: G           O 3.3.3 #5
    [ 6427.079954] Call Trace:
    [ 6427.079963]  [<c10337a2>] warn_slowpath_common+0x72/0xa0
    [ 6427.079982]  [<c1033873>] warn_slowpath_fmt+0x33/0x40
    [ 6427.079988]  [<c12dcb77>] check_unmap+0x727/0x7a0
    [ 6427.079995]  [<c12dcdaa>] debug_dma_unmap_page+0x5a/0x80
    [ 6427.080024]  [<fe2312ac>] iwlagn_unmap_tfd+0x12c/0x180 [iwlwifi]
    [ 6427.080048]  [<fe231349>] iwlagn_txq_free_tfd+0x49/0xb0 [iwlwifi]
    [ 6427.080071]  [<fe228e37>] iwl_tx_queue_unmap+0x67/0x90 [iwlwifi]
    [ 6427.080095]  [<fe22d221>] iwl_trans_pcie_stop_device+0x341/0x7b0 [iwlwifi]
    [ 6427.080113]  [<fe204b0e>] iwl_down+0x17e/0x260 [iwlwifi]
    [ 6427.080132]  [<fe20efec>] iwlagn_mac_stop+0x6c/0xf0 [iwlwifi]
    [ 6427.080168]  [<fd8480ce>] ieee80211_stop_device+0x5e/0x190 [mac80211]
    [ 6427.080198]  [<fd833208>] ieee80211_do_stop+0x288/0x620 [mac80211]
    [ 6427.080243]  [<fd8335b7>] ieee80211_stop+0x17/0x20 [mac80211]
    [ 6427.080250]  [<c148dac1>] __dev_close_many+0x81/0xd0
    [ 6427.080270]  [<c148db3d>] __dev_close+0x2d/0x50
    [ 6427.080276]  [<c148d152>] __dev_change_flags+0x82/0x150
    [ 6427.080282]  [<c148e3e3>] dev_change_flags+0x23/0x60
    [ 6427.080289]  [<c14f6320>] devinet_ioctl+0x6a0/0x770
    [ 6427.080296]  [<c14f8705>] inet_ioctl+0x95/0xb0
    [ 6427.080304]  [<c147a0f0>] sock_ioctl+0x70/0x270
    
    Reported-by: Antonio Quartulli <ordex@autistici.org>
    Tested-by: Antonio Quartulli <ordex@autistici.org>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Reviewed-by: Wey-Yi W Guy <wey-yi.w.guy@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c17f648b6e8adb8379b2d2972e24953285332f44
Author: Richard Cochran <richardcochran@gmail.com>
Date:   Thu Apr 26 14:11:32 2012 +0200

    ntp: Correct TAI offset during leap second
    
    commit dd48d708ff3e917f6d6b6c2b696c3f18c019feed upstream.
    
    When repeating a UTC time value during a leap second (when the UTC
    time should be 23:59:60), the TAI timescale should not stop. The kernel
    NTP code increments the TAI offset one second too late. This patch fixes
    the issue by incrementing the offset during the leap second itself.
    
    Signed-off-by: Richard Cochran <richardcochran@gmail.com>
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e60a87bab7ce339c034b7d7dd365d687bbffd091
Author: Chris Boot <bootc@bootc.net>
Date:   Tue Apr 24 07:24:58 2012 +0000

    e1000e: Remove special case for 82573/82574 ASPM L1 disablement
    
    commit 59aed95263bdd0e2b48eb9be5a94346d2d4abf90 upstream.
    
    For the 82573, ASPM L1 gets disabled wholesale so this special-case code
    is not required. For the 82574 the previous patch does the same as for
    the 82573, disabling L1 on the adapter. Thus, this code is no longer
    required and can be removed.
    
    Signed-off-by: Chris Boot <bootc@bootc.net>
    Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d87325fd98f66eceec445bd0d724feb63335c40
Author: Chris Boot <bootc@bootc.net>
Date:   Tue Apr 24 07:24:52 2012 +0000

    e1000e: Disable ASPM L1 on 82574
    
    commit d4a4206ebbaf48b55803a7eb34e330530d83a889 upstream.
    
    ASPM on the 82574 causes trouble. Currently the driver disables L0s for
    this NIC but only disables L1 if the MTU is >1500. This patch simply
    causes L1 to be disabled regardless of the MTU setting.
    
    Signed-off-by: Chris Boot <bootc@bootc.net>
    Cc: "Wyborny, Carolyn" <carolyn.wyborny@intel.com>
    Cc: Nix <nix@esperi.org.uk>
    Link: https://lkml.org/lkml/2012/3/19/362
    Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6582db31eb1e89ef6b08242a16a781849dada810
Author: Sjur Brændeland <sjur.brandeland@stericsson.com>
Date:   Sun Jun 10 14:37:51 2012 +0300

    remoteproc: fix missing fault indication in error-path
    
    commit 30338cf09f82523d8747670f7363cc8af347c79f upstream.
    
    If rproc_find_rsc_table() fails, rproc_fw_boot() must set
    return-value before jumping to clean_up label. Otherwise no
    error value is returned.
    
    Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
    Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d186a40464141d201f93ee87e0be6f0d2ef029d6
Author: Sjur Brændeland <sjur.brandeland@stericsson.com>
Date:   Sun Jun 10 14:37:07 2012 +0300

    remoteproc: fix print format warnings
    
    commit e981f6d41acda2ae8c05e60feb2cb97772b4a6e6 upstream.
    
    Fix compile warnings from GCC 4.6.1 when printing values of type size_t.
    
    drivers/remoteproc/remoteproc_core.c:251:6:
    warning: format ‘%x’ expects argument of type ‘unsigned int’,
    but argument 4 has type ‘size_t’ [-Wformat]
    drivers/remoteproc/remoteproc_core.c:938:9:
    warning: format ‘%u’ expects argument of type ‘unsigned int’,
    but argument 4 has type ‘size_t’ [-Wformat]
    drivers/remoteproc/remoteproc_core.c:1023:2:
    warning: format ‘%d’ expects argument of type ‘int’,
    but argument 4 has type ‘size_t’ [-Wformat]
    
    Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
    Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit efe79381e421af64d34b926917bfb81ef11717dc
Author: Ohad Ben-Cohen <ohad@wizery.com>
Date:   Mon May 21 16:31:12 2012 +0300

    remoteproc/omap: fix dev_err typo
    
    commit 6b03976288538a94e072bbfcd12d69a20daea8aa upstream.
    
    For some reason one of the dev_err invocations is using a wrong
    device so fix that.
    
    Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eef458cb6f020f165de00a5e284048be49e9ee27
Author: Sasha Levin <levinsasha928@gmail.com>
Date:   Mon Jun 11 10:18:13 2012 -0500

    9p: BUG before corrupting memory
    
    commit 5fcb08befaf57faa1b00e514915c1660252b8c26 upstream.
    
    The BUG_ON() in pack_sg_list() would get triggered only one time after we've
    corrupted some memory by sg_set_buf() into an invalid sg buffer.
    
    I'm still working on figuring out why I manage to trigger that bug...
    
    Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9f138fc8bc57beedc154729260f909ff60490296
Author: Chen Gong <gong.chen@linux.intel.com>
Date:   Mon May 14 05:51:26 2012 -0300

    edac: fix the error about memory type detection on SandyBridge
    
    commit 2cbb587d3bc41a305168e91b4f3c5b6944a12566 upstream.
    
    On SandyBridge, DDRIOA(Dev: 17 Func: 0 Offset: 328) is used
    to detect whether DIMM is RDIMM/LRDIMM, not TA(Dev: 15 Func: 0).
    
    Signed-off-by: Chen Gong <gong.chen@linux.intel.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 40ca92aafc8135368625ba3c8825bcd54f3569a8
Author: Chen Gong <gong.chen@linux.intel.com>
Date:   Tue May 8 20:40:12 2012 -0300

    edac: avoid mce decoding crash after edac driver unloaded
    
    commit e35fca4791fcdd43dc1fd769797df40c562ab491 upstream.
    
    Some edac drivers register themselves as mce decoders via
    notifier_chain. But in current notifier_chain implementation logic,
    it doesn't accept same notifier registered twice. If so, it will be
    wrong when adding/removing the element from the list. For example,
    on one SandyBridge platform, remove module sb_edac and then trigger
    one error, it will hit oops because it has no mce decoder registered
    but related notifier_chain still points to an invalid callback
    function. Here is an example:
    
    Call Trace:
     [<ffffffff8150ef6a>] atomic_notifier_call_chain+0x1a/0x20
     [<ffffffff8102b936>] mce_log+0x46/0x180
     [<ffffffff8102eaea>] apei_mce_report_mem_error+0x4a/0x60
     [<ffffffff812e19d2>] ghes_do_proc+0x192/0x210
     [<ffffffff812e2066>] ghes_proc+0x46/0x70
     [<ffffffff812e20d8>] ghes_notify_sci+0x48/0x80
     [<ffffffff8150ef05>] notifier_call_chain+0x55/0x80
     [<ffffffff81076f1a>] __blocking_notifier_call_chain+0x5a/0x80
     [<ffffffff812aea11>] ? acpi_os_wait_events_complete+0x23/0x23
     [<ffffffff81076f56>] blocking_notifier_call_chain+0x16/0x20
     [<ffffffff812ddc4d>] acpi_hed_notify+0x19/0x1b
     [<ffffffff812b16bd>] acpi_device_notify+0x19/0x1b
     [<ffffffff812beb38>] acpi_ev_notify_dispatch+0x67/0x7f
     [<ffffffff812aea3a>] acpi_os_execute_deferred+0x29/0x36
     [<ffffffff81069dc2>] process_one_work+0x132/0x450
     [<ffffffff8106bbcb>] worker_thread+0x17b/0x3c0
     [<ffffffff8106ba50>] ? manage_workers+0x120/0x120
     [<ffffffff81070aee>] kthread+0x9e/0xb0
     [<ffffffff81514724>] kernel_thread_helper+0x4/0x10
     [<ffffffff81070a50>] ? kthread_freezable_should_stop+0x70/0x70
     [<ffffffff81514720>] ? gs_change+0x13/0x13
    Code: f3 49 89 d4 45 85 ed 4d 89 c6 48 8b 0f 74 48 48 85 c9 75 17 eb 41
    0f 1f 80 00 00 00 00 41 83 ed 01 4c 89 f9 74 22 4d 85 ff 74 1d <4c> 8b
    79 08 4c 89 e2 48 89 de 48 89 cf ff 11 4d 85 f6 74 04 41
    RIP  [<ffffffff8150eef6>] notifier_call_chain+0x46/0x80
     RSP <ffff88042868fb20>
    CR2: ffffffffa01af838
    ---[ end trace 0100930068e73e6f ]---
    BUG: unable to handle kernel paging request at fffffffffffffff8
    IP: [<ffffffff810705b0>] kthread_data+0x10/0x20
    PGD 1a0d067 PUD 1a0e067 PMD 0
    Oops: 0000 [#2] SMP
    
    Only i7core_edac and sb_edac have such issues because they have more
    than one memory controller which means they have to register mce
    decoder many times.
    
    Signed-off-by: Chen Gong <gong.chen@linux.intel.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bb1b9f8f93c29dc7855703bd65435e0c442782c3
Author: Peter Korsgaard <jacmet@sunsite.dk>
Date:   Tue Jun 12 08:27:04 2012 +0800

    hwrng: atmel-rng - fix data valid check
    
    commit c475c06f4bb689d6ad87d7512e036d6dface3160 upstream.
    
    Brown paper bag: Data valid is LSB of the ISR (status register), and NOT
    of ODATA (current random data word)!
    
    With this, rngtest is a lot happier. Before:
    
    rngtest 3
    Copyright (c) 2004 by Henrique de Moraes Holschuh
    This is free software; see the source for copying conditions.  There is NO warr.
    
    rngtest: starting FIPS tests...
    rngtest: bits received from input: 20000032
    rngtest: FIPS 140-2 successes: 3
    rngtest: FIPS 140-2 failures: 997
    rngtest: FIPS 140-2(2001-10-10) Monobit: 604
    rngtest: FIPS 140-2(2001-10-10) Poker: 996
    rngtest: FIPS 140-2(2001-10-10) Runs: 36
    rngtest: FIPS 140-2(2001-10-10) Long run: 0
    rngtest: FIPS 140-2(2001-10-10) Continuous run: 117
    rngtest: input channel speed: (min=622.371; avg=23682.481; max=28224.350)Kibitss
    rngtest: FIPS tests speed: (min=12.361; avg=12.718; max=12.861)Mibits/s
    rngtest: Program run time: 2331696 microsecondsx
    
    After:
    rngtest 3
    Copyright (c) 2004 by Henrique de Moraes Holschuh
    This is free software; see the source for copying conditions.  There is NO warr.
    
    rngtest: starting FIPS tests...
    rngtest: bits received from input: 20000032
    rngtest: FIPS 140-2 successes: 999
    rngtest: FIPS 140-2 failures: 1
    rngtest: FIPS 140-2(2001-10-10) Monobit: 0
    rngtest: FIPS 140-2(2001-10-10) Poker: 0
    rngtest: FIPS 140-2(2001-10-10) Runs: 1
    rngtest: FIPS 140-2(2001-10-10) Long run: 0
    rngtest: FIPS 140-2(2001-10-10) Continuous run: 0
    rngtest: input channel speed: (min=777.363; avg=43588.270; max=47870.711)Kibitss
    rngtest: FIPS tests speed: (min=11.943; avg=12.716; max=12.844)Mibits/s
    rngtest: Program run time: 1955282 microseconds
    
    Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
    Reported-by: George Pontis <GPontis@z9.com>
    Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 064cd01904b2796438079f50f91b3b7fc90bf559
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Sat Jun 9 11:38:12 2012 +0800

    ASoC: wm8904: Fix GPIO and MICBIAS initialisation for regmap conversion
    
    commit 433897f7408b556f7dfbb98c94deea02e634d2a7 upstream.
    
    We no longer have a flat ASoC cache so can't peer directly into the array
    any more but should instead use the register I/O functions to update the
    cache.
    
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bc9b784a0be41c0966817b6f53e589f73c82392b
Author: Daniel Mack <zonque@gmail.com>
Date:   Tue Jun 12 20:23:52 2012 +0200

    USB: fix gathering of interface associations
    
    commit b3a3dd074f7053ef824ad077e5331b52220ceba1 upstream.
    
    TEAC's UD-H01 (and probably other devices) have a gap in the interface
    number allocation of their descriptors:
    
      Configuration Descriptor:
        bLength                 9
        bDescriptorType         2
        wTotalLength          220
        bNumInterfaces          3
        [...]
        Interface Descriptor:
          bLength                 9
          bDescriptorType         4
          bInterfaceNumber        0
          bAlternateSetting       0
          [...]
        Interface Association:
          bLength                 8
          bDescriptorType        11
          bFirstInterface         2
          bInterfaceCount         2
          bFunctionClass          1 Audio
          bFunctionSubClass       0
          bFunctionProtocol      32
          iFunction               4
        Interface Descriptor:
          bLength                 9
          bDescriptorType         4
          bInterfaceNumber        2
          bAlternateSetting       0
          [...]
    
    Once a configuration is selected, usb_set_configuration() walks the
    known interfaces of a given configuration and calls find_iad() on
    each of them to set the interface association pointer the interface
    is included in.
    
    The problem here is that the loop variable is taken for the interface
    number in the comparison logic that gathers the association. Which is
    fine as long as the descriptors are sane.
    
    In the case above, however, the logic gets out of sync and the
    interface association fields of all interfaces beyond the interface
    number gap are wrong.
    
    Fix this by passing the interface's bInterfaceNumber to find_iad()
    instead.
    
    Signed-off-by: Daniel Mack <zonque@gmail.com>
    Reported-by: bEN <ml_all@circa.be>
    Reported-by: Ivan Perrone <ivanperrone@hotmail.com>
    Tested-by: ivan perrone <ivanperrone@hotmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3561c241b6ef53454ac0e26e5c92f39b324a7799
Author: Bjørn Mork <bjorn@mork.no>
Date:   Wed May 30 10:00:14 2012 +0200

    USB: serial: Enforce USB driver and USB serial driver match
    
    commit 954c3f8a5f1b7716be9eee978b3bc85bae92d7c8 upstream.
    
    We need to make sure that the USB serial driver we find
    matches the USB driver whose probe we are currently
    executing. Otherwise we will end up with USB serial
    devices bound to the correct serial driver but wrong
    USB driver.
    
    An example of such cross-probing, where the usbserial_generic
    USB driver has found the sierra serial driver:
    
    May 29 18:26:15 nemi kernel: [ 4442.559246] usbserial_generic 4-4:1.0: Sierra USB modem converter detected
    May 29 18:26:20 nemi kernel: [ 4447.556747] usbserial_generic 4-4:1.2: Sierra USB modem converter detected
    May 29 18:26:25 nemi kernel: [ 4452.557288] usbserial_generic 4-4:1.3: Sierra USB modem converter detected
    
    sysfs view of the same problem:
    
    bjorn@nemi:~$ ls -l /sys/bus/usb/drivers/sierra/
    total 0
    --w------- 1 root root 4096 May 29 18:23 bind
    lrwxrwxrwx 1 root root    0 May 29 18:23 module -> ../../../../module/usbserial
    --w------- 1 root root 4096 May 29 18:23 uevent
    --w------- 1 root root 4096 May 29 18:23 unbind
    bjorn@nemi:~$ ls -l /sys/bus/usb-serial/drivers/sierra/
    total 0
    --w------- 1 root root 4096 May 29 18:23 bind
    lrwxrwxrwx 1 root root    0 May 29 18:23 module -> ../../../../module/sierra
    -rw-r--r-- 1 root root 4096 May 29 18:23 new_id
    lrwxrwxrwx 1 root root    0 May 29 18:32 ttyUSB0 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.0/ttyUSB0
    lrwxrwxrwx 1 root root    0 May 29 18:32 ttyUSB1 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.2/ttyUSB1
    lrwxrwxrwx 1 root root    0 May 29 18:32 ttyUSB2 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.3/ttyUSB2
    --w------- 1 root root 4096 May 29 18:23 uevent
    --w------- 1 root root 4096 May 29 18:23 unbind
    
    bjorn@nemi:~$ ls -l /sys/bus/usb/drivers/usbserial_generic/
    total 0
    lrwxrwxrwx 1 root root    0 May 29 18:33 4-4:1.0 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.0
    lrwxrwxrwx 1 root root    0 May 29 18:33 4-4:1.2 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.2
    lrwxrwxrwx 1 root root    0 May 29 18:33 4-4:1.3 -> ../../../../devices/pci0000:00/0000:00:1d.7/usb4/4-4/4-4:1.3
    --w------- 1 root root 4096 May 29 18:33 bind
    lrwxrwxrwx 1 root root    0 May 29 18:33 module -> ../../../../module/usbserial
    --w------- 1 root root 4096 May 29 18:22 uevent
    --w------- 1 root root 4096 May 29 18:33 unbind
    bjorn@nemi:~$ ls -l /sys/bus/usb-serial/drivers/generic/
    total 0
    --w------- 1 root root 4096 May 29 18:33 bind
    lrwxrwxrwx 1 root root    0 May 29 18:33 module -> ../../../../module/usbserial
    -rw-r--r-- 1 root root 4096 May 29 18:33 new_id
    --w------- 1 root root 4096 May 29 18:22 uevent
    --w------- 1 root root 4096 May 29 18:33 unbind
    
    So we end up with a mismatch between the USB driver and the
    USB serial driver.  The reason for the above is simple: The
    USB driver probe will succeed if *any* registered serial
    driver matches, and will use that serial driver for all
    serial driver functions.
    
    This makes ref counting go wrong. We count the USB driver
    as used, but not the USB serial driver.  This may result
    in Oops'es as demonstrated by Johan Hovold <jhovold@gmail.com>:
    
    [11811.646396] drivers/usb/serial/usb-serial.c: get_free_serial 1
    [11811.646443] drivers/usb/serial/usb-serial.c: get_free_serial - minor base = 0
    [11811.646460] drivers/usb/serial/usb-serial.c: usb_serial_probe - registering ttyUSB0
    [11811.646766] usb 6-1: pl2303 converter now attached to ttyUSB0
    [11812.264197] USB Serial deregistering driver FTDI USB Serial Device
    [11812.264865] usbcore: deregistering interface driver ftdi_sio
    [11812.282180] USB Serial deregistering driver pl2303
    [11812.283141] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0
    [11812.283272] usbcore: deregistering interface driver pl2303
    [11812.301056] USB Serial deregistering driver generic
    [11812.301186] usbcore: deregistering interface driver usbserial_generic
    [11812.301259] drivers/usb/serial/usb-serial.c: usb_serial_disconnect
    [11812.301823] BUG: unable to handle kernel paging request at f8e7438c
    [11812.301845] IP: [<f8e38445>] usb_serial_disconnect+0xb5/0x100 [usbserial]
    [11812.301871] *pde = 357ef067 *pte = 00000000
    [11812.301957] Oops: 0000 [#1] PREEMPT SMP
    [11812.301983] Modules linked in: usbserial(-) [last unloaded: pl2303]
    [11812.302008]
    [11812.302019] Pid: 1323, comm: modprobe Tainted: G        W    3.4.0-rc7+ #101 Dell Inc. Vostro 1520/0T816J
    [11812.302115] EIP: 0060:[<f8e38445>] EFLAGS: 00010246 CPU: 1
    [11812.302130] EIP is at usb_serial_disconnect+0xb5/0x100 [usbserial]
    [11812.302141] EAX: f508a180 EBX: f508a180 ECX: 00000000 EDX: f8e74300
    [11812.302151] ESI: f5050800 EDI: 00000001 EBP: f5141e78 ESP: f5141e58
    [11812.302160]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
    [11812.302170] CR0: 8005003b CR2: f8e7438c CR3: 34848000 CR4: 000007d0
    [11812.302180] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
    [11812.302189] DR6: ffff0ff0 DR7: 00000400
    [11812.302199] Process modprobe (pid: 1323, ti=f5140000 task=f61e2bc0 task.ti=f5140000)
    [11812.302209] Stack:
    [11812.302216]  f8e3be0f f8e3b29c f8e3ae00 00000000 f513641c f5136400 f513641c f507a540
    [11812.302325]  f5141e98 c133d2c1 00000000 00000000 f509c400 f513641c f507a590 f5136450
    [11812.302372]  f5141ea8 c12f0344 f513641c f507a590 f5141ebc c12f0c67 00000000 f507a590
    [11812.302419] Call Trace:
    [11812.302439]  [<c133d2c1>] usb_unbind_interface+0x51/0x190
    [11812.302456]  [<c12f0344>] __device_release_driver+0x64/0xb0
    [11812.302469]  [<c12f0c67>] driver_detach+0x97/0xa0
    [11812.302483]  [<c12f001c>] bus_remove_driver+0x6c/0xe0
    [11812.302500]  [<c145938d>] ? __mutex_unlock_slowpath+0xcd/0x140
    [11812.302514]  [<c12f0ff9>] driver_unregister+0x49/0x80
    [11812.302528]  [<c1457df6>] ? printk+0x1d/0x1f
    [11812.302540]  [<c133c50d>] usb_deregister+0x5d/0xb0
    [11812.302557]  [<f8e37c55>] ? usb_serial_deregister+0x45/0x50 [usbserial]
    [11812.302575]  [<f8e37c8d>] usb_serial_deregister_drivers+0x2d/0x40 [usbserial]
    [11812.302593]  [<f8e3a6e2>] usb_serial_generic_deregister+0x12/0x20 [usbserial]
    [11812.302611]  [<f8e3acf0>] usb_serial_exit+0x8/0x32 [usbserial]
    [11812.302716]  [<c1080b48>] sys_delete_module+0x158/0x260
    [11812.302730]  [<c110594e>] ? mntput+0x1e/0x30
    [11812.302746]  [<c145c3c3>] ? sysenter_exit+0xf/0x18
    [11812.302746]  [<c107777c>] ? trace_hardirqs_on_caller+0xec/0x170
    [11812.302746]  [<c145c390>] sysenter_do_call+0x12/0x36
    [11812.302746] Code: 24 02 00 00 e8 dd f3 20 c8 f6 86 74 02 00 00 02 74 b4 8d 86 4c 02 00 00 47 e8 78 55 4b c8 0f b6 43 0e 39 f8 7f a9 8b 53 04 89 d8 <ff> 92 8c 00 00 00 89 d8 e8 0e ff ff ff 8b 45 f0 c7 44 24 04 2f
    [11812.302746] EIP: [<f8e38445>] usb_serial_disconnect+0xb5/0x100 [usbserial] SS:ESP 0068:f5141e58
    [11812.302746] CR2: 00000000f8e7438c
    
    Fix by only evaluating serial drivers pointing back to the
    USB driver we are currently probing.  This still allows two
    or more drivers to match the same device, running their
    serial driver probes to sort out which one to use.
    
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Reviewed-by: Felipe Balbi <balbi@ti.com>
    Tested-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7eec718ac79fd0533a9a6aedc5ac9e1ee82b6028
Author: Tom Cassidy <tomas.cassidy@gmail.com>
Date:   Wed Jun 6 17:08:48 2012 +1000

    USB: serial: sierra: Add support for Sierra Wireless AirCard 320U modem
    
    commit 19a3dd1575e954e8c004413bee3e12d3962f2525 upstream.
    
    Add support for Sierra Wireless AirCard 320U modem
    
    Signed-off-by: Tomas Cassidy <tomas.cassidy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9cc2d461d9ae92fdabd9097fb5ff2977fe59d995
Author: Otto Meta <otto.patches@sister-shadow.de>
Date:   Wed Jun 6 18:46:21 2012 +0200

    usb: cdc-acm: fix devices not unthrottled on open
    
    commit 6c4707f3f8c44ec18282e1c014c80e1c257042f9 upstream.
    
    Currently CDC-ACM devices stay throttled when their TTY is closed while
    throttled, stalling further communication attempts after the next open.
    
    Unthrottling during open/activate got lost starting with kernel
    3.0.0 and this patch reintroduces it.
    
    Signed-off-by: Otto Meta <otto.patches@sister-shadow.de>
    Acked-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b81405d1683801862cce030aafb062dcbe5c88f
Author: Bjørn Mork <bjorn@mork.no>
Date:   Sat May 19 19:19:48 2012 +0200

    USB: cdc-wdm: Add Vodafone/Huawei K5005 support
    
    commit de102ef41f24a4c251c4a3838796bb27557d4d93 upstream.
    
    Tested-by: Thomas Schäfer <tschaefer@t-online.de>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 12ad741b1c60c341bf85a90c828b6fa1df47dba5
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Wed Jun 13 11:20:19 2012 -0400

    USB: add NO_D3_DURING_SLEEP flag and revert 151b61284776be2
    
    commit c2fb8a3fa25513de8fedb38509b1f15a5bbee47b upstream.
    
    This patch (as1558) fixes a problem affecting several ASUS computers:
    The machine crashes or corrupts memory when going into suspend if the
    ehci-hcd driver is bound to any controllers.  Users have been forced
    to unbind or unload ehci-hcd before putting their systems to sleep.
    
    After extensive testing, it was determined that the machines don't
    like going into suspend when any EHCI controllers are in the PCI D3
    power state.  Presumably this is a firmware bug, but there's nothing
    we can do about it except to avoid putting the controllers in D3
    during system sleep.
    
    The patch adds a new flag to indicate whether the problem is present,
    and avoids changing the controller's power state if the flag is set.
    Runtime suspend is unaffected; this matters only for system suspend.
    However as a side effect, the controller will not respond to remote
    wakeup requests while the system is asleep.  Hence USB wakeup is not
    functional -- but of course, this is already true in the current state
    of affairs.
    
    A similar patch has already been applied as commit
    151b61284776be2d6f02d48c23c3625678960b97 (USB: EHCI: fix crash during
    suspend on ASUS computers).  The patch supersedes that one and reverts
    it.  There are two differences:
    
    	The old patch added the flag at the USB level; this patch
    	adds it at the PCI level.
    
    	The old patch applied to all chipsets with the same vendor,
    	subsystem vendor, and product IDs; this patch makes an
    	exception for a known-good system (based on DMI information).
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Tested-by: Dâniel Fraga <fragabr@gmail.com>
    Tested-by: Andrey Rahmatullin <wrar@wrar.name>
    Tested-by: Steven Rostedt <rostedt@goodmis.org>
    Reviewed-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9a12826c11fc0b7cebe6ee0b0711f5ccaf8f6323
Author: Evan McNabb <evan@mcnabbs.org>
Date:   Fri May 25 22:46:14 2012 -0400

    USB: ftdi-sio: Add support for RT Systems USB-RTS01 serial adapter
    
    commit e00a54d772210d450e5c1a801534c3c8a448549f upstream.
    
    Add support for RT Systems USB-RTS01 USB to Serial adapter:
    http://www.rtsystemsinc.com/Photos/USBRTS01.html
    
    Tested by controlling Icom IC-718 amateur radio transceiver via hamlib.
    
    Signed-off-by: Evan McNabb <evan@mcnabbs.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 74351aa4f061229e40e44ae8e150f8de8c45fc13
Author: Mikko Tuumanen <mikko.tuumanen@qemsoftware.com>
Date:   Fri Jun 1 11:28:55 2012 +0300

    USB: serial: cp210x: add Optris MS Pro usb id
    
    commit 5bbfa6f427c1d7244a5ee154ab8fa37265a5e049 upstream.
    
    Signed-off-by: Mikko Tuumanen <mikko.tuumanen@qemsoftware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5c551ead8ae210031fc241729f4391dff7e682ce
Author: Ricardo Martins <rasm@fe.up.pt>
Date:   Tue May 22 18:02:03 2012 +0100

    USB: fix PS3 EHCI systems
    
    commit 4f7a67e2dd49fbfba002c453bc24bf00e701cc71 upstream.
    
    After commit aaa0ef289afe9186f81e2340114ea413eef0492a "PS3 EHCI QH
    read work-around", Terratec Grabby (em28xx) stopped working with AMD
    Geode LX 800 (USB controller AMD CS5536). Since this is a PS3 only
    fix, the following patch adds a conditional block around it.
    
    Signed-off-by: Ricardo Martins <rasm@fe.up.pt>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6fe7df7f2d8c9523deed36bd24036f100b8844b
Author: Grazvydas Ignotas <notasas@gmail.com>
Date:   Sat May 26 00:21:33 2012 +0300

    usb: musb_gadget: fix crash caused by dangling pointer
    
    commit 08f75bf14fadaa81fe362d5acda9b77b113dd0a2 upstream.
    
    usb_ep_ops.disable must clear external copy of the endpoint descriptor,
    otherwise musb crashes after loading/unloading several gadget modules
    in a row:
    
    Unable to handle kernel paging request at virtual address bf013730
    pgd = c0004000
    [bf013730] *pgd=8f26d811, *pte=00000000, *ppte=00000000
    Internal error: Oops: 7 [#1]
    Modules linked in: g_cdc [last unloaded: g_file_storage]
    CPU: 0    Not tainted  (3.2.17 #647)
    PC is at musb_gadget_enable+0x4c/0x24c
    LR is at _raw_spin_lock_irqsave+0x4c/0x58
    [<c027c030>] (musb_gadget_enable+0x4c/0x24c) from [<bf01b760>] (gether_connect+0x3c/0x19c [g_cdc])
    [<bf01b760>] (gether_connect+0x3c/0x19c [g_cdc]) from [<bf01ba1c>] (ecm_set_alt+0x15c/0x180 [g_cdc])
    [<bf01ba1c>] (ecm_set_alt+0x15c/0x180 [g_cdc]) from [<bf01ecd4>] (composite_setup+0x85c/0xac4 [g_cdc])
    [<bf01ecd4>] (composite_setup+0x85c/0xac4 [g_cdc]) from [<c027b744>] (musb_g_ep0_irq+0x844/0x924)
    [<c027b744>] (musb_g_ep0_irq+0x844/0x924) from [<c027a97c>] (musb_interrupt+0x79c/0x864)
    [<c027a97c>] (musb_interrupt+0x79c/0x864) from [<c027aaa8>] (generic_interrupt+0x64/0x7c)
    [<c027aaa8>] (generic_interrupt+0x64/0x7c) from [<c00797cc>] (handle_irq_event_percpu+0x28/0x178)
    ...
    
    Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b85ecf1acde49dcc2be67fa4777db259af8ed136
Author: Jon Povey <jon.povey@racelogic.co.uk>
Date:   Fri May 25 10:50:18 2012 +0900

    usb: musb: davinci: Fix build breakage
    
    commit 6594b2d7b1ef8260e6e36ddc96bd37a40e39ba80 upstream.
    
    This appears to have been broken by
    commit 5cfb19ac604a68c030b245561f575c2d1bac1d49
    (ARM: davinci: streamline sysmod access)
    
    For now, fix by hardcoding USB_PHY_CTRL and DM355_DEEPSLEEP
    
    Tested on DM365 with defconfig changes.
    
    Signed-off-by: Jon Povey <jon.povey@racelogic.co.uk>
    Acked-by: Sekhar Nori <nsekhar@ti.com>
    CC: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8951420c6c7a04504659319692435ac627f3f795
Author: Alan Cox <alan@linux.intel.com>
Date:   Tue May 22 20:45:13 2012 +0100

    USB: mct_u232: Fix incorrect TIOCMSET return
    
    commit 1aa3c63cf0a79153ee13c8f82e4eb6c40b66a161 upstream.
    
    The low level helper returns 1 on success. The ioctl should however return
    0. As this is the only user of the helper return, make the helper return 0 or
    an error code.
    
    Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=43009
    Signed-off-by: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c1cbfb94dab7c2f5092d0eef4ce87fdb4119a7ce
Author: Bjørn Mork <bjorn@mork.no>
Date:   Thu May 24 11:19:04 2012 +0200

    USB: qcserial: Add Sierra Wireless device IDs
    
    commit c41444ccfa33a1c20efa319e554cb531576e64a2 upstream.
    
    Some additional IDs found in the BSD/GPL licensed out-of-tree
    GobiSerial driver from Sierra Wireless.
    
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0fd47a3802d9fd08a65625572c5c4089aa6f3e78
Author: Tony Zelenoff <antonz@parallels.com>
Date:   Tue Jun 5 17:58:04 2012 +0400

    USB: mos7840: Fix compilation of usb serial driver
    
    commit b9c87663eead64c767e72a373ae6f8a94bead459 upstream.
    
    The __devinitconst section can't be referenced
    from usb_serial_device structure. Thus removed it as
    it done in other mos* device drivers.
    
    Error itself:
    WARNING: drivers/usb/serial/mos7840.o(.data+0x8): Section mismatch in reference
    from the variable moschip7840_4port_device to the variable
    .devinit.rodata:id_table
    The variable moschip7840_4port_device references
    the variable __devinitconst id_table
    
    [v2] no attach now
    
    Signed-off-by: Tony Zelenoff <antonz@parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bd1031c0027fab25f9d1e8229bc380298ae6d0a0
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Wed Jun 13 11:44:58 2012 +0200

    usb-storage: Add 090c:1000 to unusal-devs
    
    commit afff07e61a5243e14ee3f0a272a0380cd744a8a3 upstream.
    
    This device gives a bogus answer to get_capacity(16):
    [ 8628.278614] scsi 8:0:0:0: Direct-Access     USB 2.0  USB Flash Drive  1100 PQ: 0 ANSI: 4
    [ 8628.279452] sd 8:0:0:0: Attached scsi generic sg4 type 0
    [ 8628.280338] sd 8:0:0:0: [sdd] 35747322042253313 512-byte logical blocks: (18.3 EB/15.8 EiB)
    
    So set the quirk flag to avoid using get_capacity(16) with it:
    [11731.386014] usb-storage 2-1.6:1.0: Quirks match for vid 090c pid 1000: 80000
    [11731.386075] scsi9 : usb-storage 2-1.6:1.0
    [11731.386172] usbcore: registered new interface driver usb-storage
    [11731.386175] USB Mass Storage support registered.
    [11732.387394] scsi 9:0:0:0: Direct-Access     USB 2.0  USB Flash Drive  1100 PQ: 0 ANSI: 4
    [11732.388462] sd 9:0:0:0: Attached scsi generic sg3 type 0
    [11732.389432] sd 9:0:0:0: [sdc] 7975296 512-byte logical blocks: (4.08 GB/3.80 GiB)
    
    Which makes the capacity look a lot more sane :)
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Tested-by: Simon Raffeiner <sturmflut@lieberbiber.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5dc6fed88a3ed8ce57c2e3bc0db97527b59a3977
Author: Andiry Xu <andiry.xu@gmail.com>
Date:   Wed Jun 13 10:51:57 2012 +0800

    xHCI: Increase the timeout for controller save/restore state operation
    
    commit 622eb783fe6ff4c1baa47db16c3a5db97f9e6e50 upstream.
    
    When system software decides to power down the xHC with the intent of
    resuming operation at a later time, it will ask xHC to save the internal
    state and restore it when resume to correctly recover from a power event.
    Two bits are used to enable this operation: Save State and Restore State.
    
    xHCI spec 4.23.2 says software should "Set the Controller Save/Restore
    State flag in the USBCMD register and wait for the Save/Restore State
    Status flag in the USBSTS register to transition to '0'". However, it does
    not define how long software should wait for the SSS/RSS bit to transition
    to 0.
    
    Currently the timeout is set to 1ms. There is bug report
    (https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1002697)
    indicates that the timeout is too short for ASMedia ASM1042 host controller
    to save/restore the state successfully. Increase the timeout to 10ms helps to
    resolve the issue.
    
    This patch should be backported to stable kernels as old as 2.6.37, that
    contain the commit 5535b1d5f8885695c6ded783c692e3c0d0eda8ca "USB: xHCI:
    PCI power management implementation"
    
    Signed-off-by: Andiry Xu <andiry.xu@gmail.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Cc: Ming Lei <ming.lei@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 708053a5a4e304915aae1ecab2e5fea9921c9f82
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Jun 1 10:06:24 2012 +0200

    xhci: Don't free endpoints in xhci_mem_cleanup()
    
    commit 32f1d2c536d0c26c5814cb0e6a0606c42d02fac1 upstream.
    
    This patch fixes a few issues introduced in the recent fix
    [f8a9e72d: USB: fix resource leak in xhci power loss path]
    
    - The endpoints listed in bw table are just links and each entry is an
     array member of dev->eps[].  But the commit above adds a kfree() call
     to these instances, and thus it results in memory corruption.
    
    - It clears only the first entry of rh_bw[], but there can be multiple
      ports.
    
    - It'd be safer to clear the list_head of ep as well, not only
      removing from the list, as it's checked in
      xhci_discover_or_reset_device().
    
    This patch should be backported to kernels as old as 3.2, that contain
    the commit 839c817ce67178ca3c7c7ad534c571bba1e69ebe "xhci: Store
    information about roothubs and TTs."
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Reviewed-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b063a624f08cfa64c2d9162d1525da95519e6156
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Jun 1 10:06:23 2012 +0200

    xhci: Fix invalid loop check in xhci_free_tt_info()
    
    commit 46ed8f00d8982e49f8fe2c1a9cea192f640cb3ba upstream.
    
    xhci_free_tt_info() may access the invalid memory when it removes the
    last entry but the list is not empty.  Then tt_next reaches to the
    list head but it still tries to check the tt_info of that entry.
    
    This patch fixes the bug and cleans up the messy code by rewriting
    with a simple list_for_each_entry_safe().
    
    This patch should be backported to kernels as old as 3.2, that contain
    the commit 839c817ce67178ca3c7c7ad534c571bba1e69ebe "xhci: Store
    information about roothubs and TTs."
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Reviewed-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6bc383209efd8a57b3c73ef2524a98df32c7bcc
Author: Paul Mackerras <paulus@samba.org>
Date:   Fri Jun 15 14:51:39 2012 +1000

    Make hard_irq_disable() actually hard-disable interrupts
    
    commit f948501b36c6b3d9352ce212a197098a7e958971 upstream.
    
    At present, hard_irq_disable() does nothing on powerpc because of
    this code in include/linux/interrupt.h:
    
        #ifndef hard_irq_disable
        #define hard_irq_disable()      do { } while(0)
        #endif
    
    So we need to make our hard_irq_disable be a macro.  It was previously
    a macro until commit 7230c56441 ("powerpc: Rework lazy-interrupt
    handling") changed it to a static inline function.
    
    Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Paul Mackerras <paulus@samba.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    --
     arch/powerpc/include/asm/hw_irq.h |    3 +++
     1 file changed, 3 insertions(+)

commit 231afb7c7ded9bf798b71efdf576615e91c367af
Author: Matthew Garrett <mjg@redhat.com>
Date:   Sun Jun 17 17:05:25 2012 -0400

    hfsplus: fix bless ioctl when used with hardlinks
    
    commit 7dea9665fee828fb56db3bae5b9685d9fa006d33 upstream.
    
    HFS+ doesn't really implement hard links - instead, hardlinks are indicated
    by a magic file type which refers to an indirect node in a hidden
    directory. The spec indicates that stat() should return the inode number
    of the indirect node, but it turns out that this doesn't satisfy the
    firmware when it's looking for a bootloader - it wants the catalog ID of
    the hardlink file instead. Fix up this case.
    
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 152a4f421da62406d8836aa2c9e53b7b3e405e59
Author: Janne Kalliomäki <janne@tuxera.com>
Date:   Sun Jun 17 17:05:24 2012 -0400

    hfsplus: fix overflow in sector calculations in hfsplus_submit_bio
    
    commit a6dc8c04218eb752ff79cdc24a995cf51866caed upstream.
    
    The variable io_size was unsigned int, which caused the wrong sector number
    to be calculated after aligning it. This then caused mount to fail with big
    volumes, as backup volume header information was searched from a
    wrong sector.
    
    Signed-off-by: Janne Kalliomäki <janne@tuxera.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d64cbbc9603861015cd616327f63b10394c0418a
Author: Seiji Aguchi <seiji.aguchi@hds.com>
Date:   Tue May 15 17:35:09 2012 -0400

    kdump: Execute kmsg_dump(KMSG_DUMP_PANIC) after smp_send_stop()
    
    commit 62be73eafaa045d3233337303fb140f7f8a61135 upstream.
    
    This patch moves kmsg_dump(KMSG_DUMP_PANIC) below smp_send_stop(),
    to serialize the crash-logging process via smp_send_stop() and to
    thus retrieve a more stable crash image of all CPUs stopped.
    
    Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com>
    Acked-by: Don Zickus <dzickus@redhat.com>
    Cc: dle-develop@lists.sourceforge.net <dle-develop@lists.sourceforge.net>
    Cc: Satoru Moriya <satoru.moriya@hds.com>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: a.p.zijlstra@chello.nl <a.p.zijlstra@chello.nl>
    Link: http://lkml.kernel.org/r/5C4C569E8A4B9B42A84A977CF070A35B2E4D7A5CE2@USINDEVS01.corp.hds.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a0ae72b68662f833a56c060fbd483609941e8284
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue May 29 17:57:52 2012 +0200

    USB: option: fix port-data abuse
    
    commit 4273f9878b0a8271df055e3c8f2e7f08c6a4a2f4 upstream.
    
    Commit 8b4c6a3ab596961b78465 ("USB: option: Use generic USB wwan code")
    moved option port-data allocation to usb_wwan_startup but still cast the
    port data to the old struct...
    
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d2002eb8a3a9c6d9182e1652b3ec22f6dd20741b
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue May 29 18:22:48 2012 +0200

    USB: option: fix memory leak
    
    commit b9c3aab315b51f81649a0d737c4c73783fbd8de0 upstream.
    
    Fix memory leak introduced by commit 383cedc3bb435de7a2 ("USB: serial:
    full autosuspend support for the option driver") which allocates
    usb-serial data but never frees it.
    
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c4962879787761e53777b1811787acb1753df7db
Author: 说不得 <gavin.kx@qq.com>
Date:   Mon May 28 21:31:29 2012 +0800

    USB: option: add more YUGA device ids
    
    commit 0ef0be15fd2564767f114c249fc4af704d8e16f4 upstream.
    
    Signed-off-by: gavin zhu <gavin.zhu@qq.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 18246bfb1f51368b2d1386d2775124b207e158cb
Author: Andrew Bird <ajb@spheresystems.co.uk>
Date:   Mon May 28 12:43:06 2012 +0100

    USB: option: Updated Huawei K4605 has better id
    
    commit 42ca7da1c2363dbef4ba1b6917c4c02274b6a5e2 upstream.
    
    Later firmwares for this device now have proper subclass and
    protocol info so we can identify it nicely without needing to use
    the blacklist. I'm not removing the old 0xff matching as there
    may be devices in the field that still need that.
    
    Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 781259df8b5637b7ea0810b633c6da3570c7b4db
Author: Bjørn Mork <bjorn@mork.no>
Date:   Sat May 19 19:20:50 2012 +0200

    USB: option: Add Vodafone/Huawei K5005 support
    
    commit 4cbbb039a9719fb3bba73d255c6a95bc6dc6428b upstream.
    
    Tested-by: Thomas Schäfer <tschaefer@t-online.de>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78ac34ad3199ad0cd9c23d6084c8627daa748a2b
Author: Hugh Dickins <hughd@google.com>
Date:   Fri Jun 15 17:55:50 2012 -0700

    swap: fix shmem swapping when more than 8 areas
    
    commit 9b15b817f3d62409290fd56fe3cbb076a931bb0a upstream.
    
    Minchan Kim reports that when a system has many swap areas, and tmpfs
    swaps out to the ninth or more, shmem_getpage_gfp()'s attempts to read
    back the page cannot locate it, and the read fails with -ENOMEM.
    
    Whoops.  Yes, I blindly followed read_swap_header()'s pte_to_swp_entry(
    swp_entry_to_pte()) technique for determining maximum usable swap
    offset, without stopping to realize that that actually depends upon the
    pte swap encoding shifting swap offset to the higher bits and truncating
    it there.  Whereas our radix_tree swap encoding leaves offset in the
    lower bits: it's swap "type" (that is, index of swap area) that was
    truncated.
    
    Fix it by reducing the SWP_TYPE_SHIFT() in swapops.h, and removing the
    broken radix_to_swp_entry(swp_to_radix_entry()) from read_swap_header().
    
    This does not reduce the usable size of a swap area any further, it
    leaves it as claimed when making the original commit: no change from 3.0
    on x86_64, nor on i386 without PAE; but 3.0's 512GB is reduced to 128GB
    per swapfile on i386 with PAE.  It's not a change I would have risked
    five years ago, but with x86_64 supported for ten years, I believe it's
    appropriate now.
    
    Hmm, and what if some architecture implements its swap pte with offset
    encoded below type? That would equally break the maximum usable swap
    offset check.  Happily, they all follow the same tradition of encoding
    offset above type, but I'll prepare a check on that for next.
    
    Reported-and-Reviewed-and-Tested-by: Minchan Kim <minchan@kernel.org>
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 696615b7f9872cf81a840cde982775c521f56ea3
Author: nagalakshmi.nandigama@lsi.com <nagalakshmi.nandigama@lsi.com>
Date:   Tue Apr 17 11:25:04 2012 +0530

    SCSI: mpt2sas: Fix unsafe using smp_processor_id() in preemptible
    
    commit a2c658505bf5c75516ee0a79287223e86a2474af upstream.
    
    When CONFIG_DEBUG_PREEMPT is enabled, bug is observed in the smp_processor_id().
    This is because smp_processor_id() is not called in preempt safe condition.
    
    To fix this issue, use raw_smp_processor_id instead of smp_processor_id.
    
    Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b7013d0a16b881481dc25ba4d42c5203bebe5ff1
Author: Jeff Layton <jlayton@redhat.com>
Date:   Mon Jun 11 10:03:42 2012 -0400

    rpc_pipefs: allow rpc_purge_list to take a NULL waitq pointer
    
    commit 92123e068efa310b09e9943ac1cfd10ff6b6d2e4 upstream.
    
    In the event that we don't have a dentry for a rpc_pipefs pipe, we still
    need to allow the queue_timeout job to clean out the queue. There's just
    no waitq to wake up in that event.
    
    Reported-by: Hans de Bruin <jmdebruin@xmsnet.nl>
    Reported-by: Joerg Platte <jplatte@naasa.net>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3993b24649773080897fde524ea2d9f311eba2aa
Author: Steven Rostedt <srostedt@redhat.com>
Date:   Wed Jun 6 19:50:40 2012 -0400

    tracing: Have tracing_off() actually turn tracing off
    
    commit f2bf1f6f5f89d031245067512449fc889b2f4bb2 upstream.
    
    A recent update to have tracing_on/off() only affect the ftrace ring
    buffers instead of all ring buffers had a cut and paste error.
    The tracing_off() did the exact same thing as tracing_on() and
    would not actually turn off tracing. Unfortunately, tracing_off()
    is more important to be working than tracing_on() as this is a key
    development tool, as it lets the developer turn off tracing as soon
    as a problem is discovered. It is also used by panic and oops code.
    
    This bug also breaks the 'echo func:traceoff > set_ftrace_filter'
    
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d946d96cd89b13fc354b6f7ed2c4de3e72c87d8e
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Tue Jun 12 08:28:48 2012 -0400

    nfsd4: BUG_ON(!is_spin_locked()) no good on UP kernels
    
    commit bc2df47a408f2d64cf81bcfd0f6e3e14c84cb0ab upstream.
    
    Most frequent symptom was a BUG triggering in expire_client, with the
    server locking up shortly thereafter.
    
    Introduced by 508dc6e110c6dbdc0bbe84298ccfe22de7538486 "nfsd41:
    free_session/free_client must be called under the client_lock".
    
    Cc: Benny Halevy <bhalevy@tonian.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5e74cfe1feb56745cecce815adf6fd2c7dfb6a58
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Fri Jun 8 10:58:09 2012 -0400

    NFSv4: Fix unnecessary delegation returns in nfs4_do_open
    
    commit 2d0dbc6ae8a5194aaecb9cfffb9053f38fce8b86 upstream.
    
    While nfs4_do_open() expects the fmode argument to be restricted to
    combinations of FMODE_READ and FMODE_WRITE, both nfs4_atomic_open()
    and nfs4_proc_create will pass the nfs_open_context->mode,
    which contains the full fmode_t.
    
    This patch ensures that nfs4_do_open strips the other fmode_t bits,
    fixing a problem in which the nfs4_do_open call would result in an
    unnecessary delegation return.
    
    Reported-by: Fred Isaman <iisaman@netapp.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5f1d81e9fb6c05e8ab89a610bb63cdc8f0f66d81
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Thu May 31 15:26:38 2012 -0400

    NFSv4.1: Fix a request leak on the back channel
    
    commit b3b02ae5865c2dcd506322e0fc6def59a042e72f upstream.
    
    If the call to svc_process_common() fails, then the request
    needs to be freed before we can exit bc_svc_process.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7aa88da6b435fb45b01fe6076caf73ee6e529ae
Author: Andre Przywara <andre.przywara@amd.com>
Date:   Tue May 29 13:07:31 2012 +0200

    xen/setup: filter APERFMPERF cpuid feature out
    
    commit 5e626254206a709c6e937f3dda69bf26c7344f6f upstream.
    
    Xen PV kernels allow access to the APERF/MPERF registers to read the
    effective frequency. Access to the MSRs is however redirected to the
    currently scheduled physical CPU, making consecutive read and
    compares unreliable. In addition each rdmsr traps into the hypervisor.
    So to avoid bogus readouts and expensive traps, disable the kernel
    internal feature flag for APERF/MPERF if running under Xen.
    This will
    a) remove the aperfmperf flag from /proc/cpuinfo
    b) not mislead the power scheduler (arch/x86/kernel/cpu/sched.c) to
       use the feature to improve scheduling (by default disabled)
    c) not mislead the cpufreq driver to use the MSRs
    
    This does not cover userland programs which access the MSRs via the
    device file interface, but this will be addressed separately.
    
    Signed-off-by: Andre Przywara <andre.przywara@amd.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2da19ffd395d0fdba4ccbc4a3c751554059d4aa3
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Wed May 23 12:56:59 2012 -0400

    xen/hvc: Check HVM_PARAM_CONSOLE_[EVTCHN|PFN] for correctness.
    
    commit 5842f5768599094758931b74190cdf93641a8e35 upstream.
    
    We need to make sure that those parameters are setup to be correct.
    As such the value of 0 is deemed invalid and we find that we
    bail out. The hypervisor sets by default all of them to be zero
    and when the hypercall is done does a simple:
    
     a.value = d->arch.hvm_domain.params[a.index];
    
    Which means that if the Xen toolstack forgot to setup the proper
    HVM_PARAM_CONSOLE_EVTCHN (or the PFN one), we would get the
    default value of 0 and use that.
    
    Fixes-Oracle-Bug: 14091238
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 85fc3e3eba89272acb005f320ccafa0588a48f49
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Wed May 23 12:55:38 2012 -0400

    xen/hvc: Fix error cases around HVM_PARAM_CONSOLE_PFN
    
    commit a32c88b9386ce3df87f28dd46bdc3776cd6edf75 upstream.
    
    We weren't resetting the parameter to be passed in to a
    known default. Nor were we checking the return value of
    hvm_get_parameter.
    
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6a07cbc4ef9cea9f9eabc676fd6b8c03c11f51cc
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Wed May 23 12:53:11 2012 -0400

    xen/hvc: Collapse error logic.
    
    commit 2e5ad6b9c45d43cc4e7b8ac5ded1c55a7c4a3893 upstream.
    
    All of the error paths are doing the same logic. In which
    case we might as well collapse them in one path.
    
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ebbd13c9d27ab013fdf7005829a80d504b0cb32e
Author: Márton Németh <nm127@freemail.hu>
Date:   Mon Jun 11 19:09:25 2012 +0200

    drm sis: initialize object_idr
    
    commit 648ccc7d35e3416fdc739d2e520e85de3125361b upstream.
    
    The filed object_idr of struct drm_sis_private was introduced with
    commit http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=6de8a748881f1cd9d795454da2b6db616d5ca3d7 .
    
    The idr_init(&dev->object_name_idr) is called instead of
    idr_init(&dev_priv->object_idr) by mistake, leaving object_idr
    uninitialized. Correct this.
    
    This patch was not tested because of lack of hardware.
    
    Signed-off-by: Márton Németh <nm127@freemail.hu>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8d96bccced28ba3c12ffb923aa264aa6b0d604a1
Author: Dave Airlie <airlied@redhat.com>
Date:   Sat Jun 16 07:41:28 2012 +0100

    drm/udl: only bind to the video devices on the hub.
    
    commit e5a867a51d9b009f90d5dca6a320608e4e8a37ec upstream.
    
    This is ported from udlfb.
    
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=832188
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eda8cc4ce07d538bb4170330e53ae52c5f637be8
Author: Márton Németh <nm127@freemail.hu>
Date:   Sun Jun 10 23:39:55 2012 +0200

    drm via: initialize object_idr
    
    commit ce020ea53264f1460ae619cfc12f968dbd0b8974 upstream.
    
    The field obejct_idr of struct drm_via_private was introduced with the
    commit http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=77ee8f3825054f23b17e9c8f728f061defd86cdc .
    In that patch idr_init(&dev->object_name_idr) was called instead of
    idr_init(&dev_priv->object_idr) by mistake, leaving the dev_priv->object_idr
    uninitialized. To be more exact, the object_idr buffer is filled with zeros
    because of kzalloc(), but the dev_priv->object_idr.lock spinlock can cause
    system freeze at lib/idr.c:move_to_free_list() when spin_lock_irqsave()
    is called on this spinlock.
    
    The patch was tested on Clevo D4J, model D410J laptop, on the following
    hardware, without AGP kernel module loaded:
    
      # lspci -s 01:00.0 -n
      01:00.0 0300: 1106:3108 (rev 01)
      # lspci -s 01:00.0 -v
      01:00.0 VGA compatible controller: VIA Technologies, Inc. K8M800/K8N800/K8N800A [S3 UniChrome Pro] (rev 01) (prog-if 00 [VGA controller])
              Subsystem: CLEVO/KAPOK Computer Device 4702
              Flags: bus master, 66MHz, medium devsel, latency 64, IRQ 16
              Memory at f0000000 (32-bit, prefetchable) [size=64M]
              Memory at d1000000 (32-bit, non-prefetchable) [size=16M]
              Expansion ROM at <unassigned> [disabled]
              Capabilities: [60] Power Management version 2
              Capabilities: [70] AGP version 3.0
    
    Signed-off-by: Márton Németh <nm127@freemail.hu>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 789ed2afd385af95798c6ec419ad41f8801975a4
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Jun 14 22:06:36 2012 +0200

    drm/radeon: add some additional 6xx/7xx/EG register init
    
    commit b866d1334ba2d544bc575d75357dea6bdcdc7f46 upstream.
    
    - SMX_SAR_CTL0 needs to be programmed correctly to prevent
    problems with memory exports in certain cases.
    - VC_ENHANCE needs to be initialized on 6xx/7xx.
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2a82d9e11ab5f467e0faa2253204c75de675b037
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Thu Jun 14 22:15:00 2012 +0200

    Revert "drm/i915/dp: Use auxch precharge value of 5 everywhere"
    
    commit 6b4e0a93ff6e45714c72bdce193f719ed94810e3 upstream.
    
    This reverts commit 092945e11c5b84f66dd08f0b87fb729715d377bc.
    
    This commit prevents a DP screen from properly training the link.
    Oddly enough it works, once the machine has been warm-booted with an
    older kernel.
    
    According to DP docs this _should_ have been the right precharge time.
    Also, the commit that originally introduces this was just general snb
    DP enabling and didn't mention any specific reason for this special
    value. Whatever, trust the reporter that this makes things worse and
    let's just revert it.
    
    v2: Less spelling fail.
    
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
    Reported-by: "Wouter M. Koolen" <W.M.Koolen-Wijkstra@cwi.nl>
    Buglink: https://lkml.org/lkml/2012/6/14/301
    Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 688b04fe535dafad0849c1980361d9f2a1596a7e
Author: Jaccon Bastiaansen <jaccon.bastiaansen@gmail.com>
Date:   Mon Apr 30 11:53:43 2012 +0200

    ARM i.MX imx21ads: Fix overlapping static i/o mappings
    
    commit 350ab15bb2ffe7103bc6bf6c634f3c5b286eaf2a upstream.
    
    The statically defined I/O memory regions for the i.MX21 on chip
    peripherals and the on board I/O peripherals of the i.MX21ADS board
    overlap. This results in a kernel crash during startup. This is fixed
    by reducing the memory range for the on board I/O peripherals to the
    actually required range.
    
    Signed-off-by: Jaccon Bastiaansen <jaccon.bastiaansen@gmail.com>
    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9ffa519e1b6c7db54ce371a809dd45584aff42bf
Author: Shawn Guo <shawn.guo@linaro.org>
Date:   Tue May 22 22:13:46 2012 +0800

    ARM: imx6: exit coherency when shutting down a cpu
    
    commit 602bf40971d7f9a1ec0b7ba2b7e6427849828651 upstream.
    
    There is a system hang issue on imx6q which can easily be seen with
    running a cpu hotplug stress testing (hotplug secondary cores from
    user space via sysfs interface for thousands iterations).
    
    It turns out that the issue is caused by coherency of the cpu that
    is being shut down.  When shutting down a cpu, we need to have the
    cpu exit coherency to prevent it from receiving cache, TLB, or BTB
    maintenance operations broadcast by other CPUs in the cluster.
    
    Copy cpu_enter_lowpower() and cpu_leave_lowpower() from mach-vexpress
    to have coherency properly handled in platform_cpu_die(), thus fix
    the issue.
    
    Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8bca81891d1b2a8849bbfb54dcd0ac74ce5de85f
Author: Sascha Hauer <s.hauer@pengutronix.de>
Date:   Mon Jun 4 14:58:07 2012 +0200

    ARM i.MX53: Fix PLL4 base address
    
    commit cdd781ab1906d039c2a93078385645d2d5af8491 upstream.
    
    MX53_DPLL4_BASE accidently returned the base address of PLL3.
    Fix this.
    
    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>