commit c75c3b96fad0df78ceef6d83164c267dfd3f3820
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Jun 11 12:25:24 2014 -0700

    Linux 3.4.93

commit 4db251fa782d61a3603414cced4361ff732dc119
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Nov 16 14:15:00 2012 -0800

    mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address
    
    commit 498c2280212327858e521e9d21345d4cc2637f54 upstream.
    
    kmap_to_page returns the corresponding struct page for a virtual address
    of an arbitrary mapping.  This works by checking whether the address
    falls in the pkmap region and using the pkmap page tables instead of the
    linear mapping if appropriate.
    
    Unfortunately, the bounds checking means that PKMAP_ADDR(LAST_PKMAP) is
    incorrectly treated as a highmem address and we can end up walking off
    the end of pkmap_page_table and subsequently passing junk to pte_page.
    
    This patch fixes the bound check to stay within the pkmap tables.
    
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 85faa17c6abc754dac48a82f3d9bc70dd1c7453b
Author: Ley Foon Tan <lftan@altera.com>
Date:   Thu Mar 7 10:28:37 2013 +0800

    tty/serial: Add support for Altera serial port
    
    commit e06c93cacb82dd147266fd1bdb2d0a0bd45ff2c1 upstream.
    
    Add support for Altera 8250/16550 compatible serial port.
    
    Signed-off-by: Ley Foon Tan <lftan@altera.com>
    [xr: Backported to 3.4: adjust filenames, context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7400ce7ee9595432b2a1402b6ffcac9faf38d9ae
Author: Stephen Hurd <shurd@broadcom.com>
Date:   Thu Jan 17 14:14:53 2013 -0800

    8250/16?50: Add support for Broadcom TruManage redirected serial port
    
    commit ebebd49a8eab5e9aa1b1f8f1614ccc3c2120f886 upstream.
    
    Add support for the UART device present in Broadcom TruManage capable
    NetXtreme chips (ie: 5761m 5762, and 5725).
    
    This implementation has a hidden transmit FIFO, so running in single-byte
    interrupt mode results in too many interrupts.  The UART_CAP_HFIFO
    capability was added to track this.  It continues to reload the THR as long
    as the THRE and TSRE bits are set in the LSR up to a specified limit (1024
    is used here).
    
    Signed-off-by: Stephen Hurd <shurd@broadcom.com>
    Signed-off-by: Michael Chan <mchan@broadcom.com>
    [xr: Backported to 3.4:
     - Adjust filenames
     - Adjust context
     - PORT_BRCM_TRUMANAGE is 22 not 24]
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eb2249dc3d9d9c6ce6f8bd292770ff72400faab6
Author: Scott Ashcroft <scott.ashcroft@talk21.com>
Date:   Sun Mar 3 21:35:06 2013 +0000

    Fix 4 port and add support for 8 port 'Unknown' PCI serial port cards
    
    commit d13402a4a944e72612a9ec5c9190e35717c02a9d upstream.
    
    I've managed to find an 8 port version of the card 4 port card which was discussed here:
    
    http://marc.info/?l=linux-serial&m=120760744205314&w=2
    
    Looking back at that thread there were two issues in the original patch.
    
    1) The I/O ports for the UARTs are within BAR2 not BAR0. This can been seen in the original post.
    2) A serial quirk isn't needed as these cards have no memory in BAR0 which makes pci_plx9050_init just return.
    
    This patch fixes the 4 port support to use BAR2, removes the bogus quirk and adds support for the 8 port card.
    
    $ lspci -vvv -n -s 00:08.0
    00:08.0 0780: 10b5:9050 (rev 01)
    	Subsystem: 10b5:1588
    	Control: I/O+ Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
    	Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
    	Interrupt: pin A routed to IRQ 17
    	Region 1: I/O ports at ff00 [size=128]
    	Region 2: I/O ports at fe00 [size=64]
    	Region 3: I/O ports at fd00 [size=8]
    	Capabilities: <access denied>
    	Kernel driver in use: serial
    
    $ dmesg | grep 0000:00:08.0:
    [    0.083320] pci 0000:00:08.0: [10b5:9050] type 0 class 0x000780
    [    0.083355] pci 0000:00:08.0: reg 14: [io  0xff00-0xff7f]
    [    0.083369] pci 0000:00:08.0: reg 18: [io  0xfe00-0xfe3f]
    [    0.083382] pci 0000:00:08.0: reg 1c: [io  0xfd00-0xfd07]
    [    0.083460] pci 0000:00:08.0: PME# supported from D0 D3hot
    [    1.212867] 0000:00:08.0: ttyS4 at I/O 0xfe00 (irq = 17) is a 16550A
    [    1.233073] 0000:00:08.0: ttyS5 at I/O 0xfe08 (irq = 17) is a 16550A
    [    1.253270] 0000:00:08.0: ttyS6 at I/O 0xfe10 (irq = 17) is a 16550A
    [    1.273468] 0000:00:08.0: ttyS7 at I/O 0xfe18 (irq = 17) is a 16550A
    [    1.293666] 0000:00:08.0: ttyS8 at I/O 0xfe20 (irq = 17) is a 16550A
    [    1.313863] 0000:00:08.0: ttyS9 at I/O 0xfe28 (irq = 17) is a 16550A
    [    1.334061] 0000:00:08.0: ttyS10 at I/O 0xfe30 (irq = 17) is a 16550A
    [    1.354258] 0000:00:08.0: ttyS11 at I/O 0xfe38 (irq = 17) is a 16550A
    
    Signed-off-by: Scott Ashcroft <scott.ashcroft@talk21.com>
    [xr: Backported to 3.4: adjust context]
    Signed-off-by: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a1843e9577d2bf2aea6c439be3bfa5038299e079
Author: Ilya Zykov <ilya@ilyx.ru>
Date:   Mon Mar 4 23:19:41 2013 +0400

    tty: Correct tty buffer flush.
    
    commit 64325a3be08d364a62ee8f84b2cf86934bc2544a upstream.
    
      The root of problem is carelessly zeroing pointer(in function __tty_buffer_flush()),
    when another thread can use it. It can be cause of "NULL pointer dereference".
      Main idea of the patch, this is never free last (struct tty_buffer) in the active buffer.
    Only flush the data for ldisc(buf->head->read = buf->head->commit).
    At that moment driver can collect(write) data in buffer without conflict.
    It is repeat behavior of flush_to_ldisc(), only without feeding data to ldisc.
    
    Signed-off-by: Ilya Zykov <ilya@ilyx.ru>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f84f26e72c1286582da55dd76752ef4296faeccd
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Sep 10 12:50:49 2013 +0200

    serial: pch_uart: fix tty-kref leak in rx-error path
    
    commit fc0919c68cb2f75bb1af759315f9d7e2a9443c28 upstream.
    
    Fix tty-kref leak introduced by commit 384e301e ("pch_uart: fix a
    deadlock when pch_uart as console") which never put its tty reference.
    
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3f88e029fd9a5e45a26614f4d8fe0d30c09c180c
Author: Johan Hovold <jhovold@gmail.com>
Date:   Tue Sep 10 12:50:50 2013 +0200

    serial: pch_uart: fix tty-kref leak in dma-rx path
    
    commit 19b85cfb190eb9980eaf416bff96aef4159a430e upstream.
    
    Fix tty_kref leak when tty_buffer_request room fails in dma-rx path.
    
    Note that the tty ref isn't really needed anymore, but as the leak has
    always been there, fixing it before removing should makes it easier to
    backport the fix.
    
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 82b9ccd651eb90f28b4336554d82ea0ab9067c63
Author: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date:   Wed Dec 5 12:08:29 2012 +0100

    target/file: Fix 32-bit highmem breakage for SGL -> iovec mapping
    
    commit 40ff2c3b3da35dd3a00ac6722056a59b4b3f2caf upstream.
    
    This patch changes vectored file I/O to use kmap + kunmap when mapping
    incoming SGL memory -> struct iovec in order to properly support 32-bit
    highmem configurations.  This is because an extra bounce buffer may be
    required when processing scatterlist pages allocated with GFP_KERNEL.
    
    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [bwh: Backported to 3.2: use task->task_sg{,_nents} for iteration]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b102fcef6a89e1bc0b7116125a82b3b03d57d89
Author: Hannes Reinecke <hare@suse.de>
Date:   Mon Dec 17 09:53:32 2012 +0100

    target: use correct sense code for LUN communication failure
    
    commit 18a9df42d53fabfa43b78be1104838cc8b9762e1 upstream.
    
    The ASC/ASCQ code for 'Logical Unit Communication failure' is
    0x08/0x00; 0x80/0x00 is vendor specific.
    
    Signed-off-by: Hannes Reinecke <hare@suse.de>
    Cc: Nicholas Bellinger <nab@risingtidesystems.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [bwh: Backported to 3.2: add offset to buffer index]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4ff5fd702a5d62a39a9d72ba58003e990a099a08
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date:   Wed May 16 21:52:10 2012 -0700

    target: Fix MAINTENANCE_IN service action CDB checks to use lower 5 bits
    
    commit ba539743b70cd160c84bab1c82910d0789b820f8 upstream.
    
    This patch fixes the MAINTENANCE_IN service action type checks to only
    look at the proper lower 5 bits of cdb byte 1.  This addresses the case
    where MI_REPORT_TARGET_PGS w/ extended header using the upper three bits of
    cdb byte 1 was not processed correctly in transport_generic_cmd_sequencer,
    as well as the three cases for standby, unavailable, and transition ALUA
    primary access state checks.
    
    Also add MAINTENANCE_IN to the excluded list in transport_generic_prepare_cdb()
    to prevent the PARAMETER DATA FORMAT bits from being cleared.
    
    Cc: Hannes Reinecke <hare@suse.de>
    Cc: Rob Evers <revers@redhat.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 422c451501b6276c8ad4bea5ac6bf85322592d1e
Author: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Date:   Fri Oct 25 21:53:33 2013 +0800

    target/pscsi: fix return value check
    
    commit 58932e96e438cd78f75e765d7b87ef39d3533d15 upstream.
    
    In case of error, the function scsi_host_lookup() returns NULL
    pointer not ERR_PTR(). The IS_ERR() test in the return value check
    should be replaced with NULL test.
    
    Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [bwh: Backported to 3.2: pscsi_configure_device() returns a pointer]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 263ee55a37e7fd03646449cbc07e16b7943f0572
Author: Roland Dreier <roland@purestorage.com>
Date:   Mon Nov 5 18:02:42 2012 -0800

    iscsi-target: Always send a response before terminating iSCSI connection
    
    commit 1c5c12c666fda27c7c494b34934a0a0631a48130 upstream.
    
    There are some cases, for example when the initiator sends an
    out-of-bounds ErrorRecoveryLevel value, where the iSCSI target
    terminates the connection without sending back any error.  Audit the
    login path and add appropriate iscsit_tx_login_rsp() calls to make
    sure this doesn't happen.
    
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 437569c5bdfb172fd13d27a82c108724b674bd63
Author: Mike Miller <mike.miller@hp.com>
Date:   Thu Sep 20 16:05:18 2012 -0500

    hpsa: gen8plus Smart Array IDs
    
    commit fe0c9610bb68dd0aad1017456f5e3c31264d70c2 upstream.
    
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0bf3ffd5075b92bf04975c18a44baceab06a848d
Author: Reddy, Sreekanth <Sreekanth.Reddy@lsi.com>
Date:   Tue Feb 26 16:59:59 2013 +0530

    mpt2sas: Fix for issue Missing delay not getting set during system bootup
    
    commit 93cfcb8c998e3fe2c075fa61ab28f7b018e5049a upstream.
    
    commit b0df96a0068daee4f9c2189c29b9053eb6e46b17 upstream.
    
    Missing delay is not getting set properly. The reason is that it is not
    defined in the same file from where it is being invoked.  The fix is to move
    the missing delay module parameter from mpt2sas_base.c to mpt2sas_scsh.c.
    
    Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ce7035a6fdded27ad961445f6796a57b9bef04bf
Author: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
Date:   Sat Feb 2 00:56:18 2013 +0530

    mpt2sas: Fix for device scan following host reset could get stuck in a infinite loop
    
    commit 6241f22ca12a26ee149cbe31b27bac97dbdc8bc4 upstream.
    
    Modified device scan routine so each configuration page read breaks from the
    while loop when the ioc_status is not equal to MPI2_IOCSTATUS_SUCCESS.
    
    [jejb: checkpatch fixes]
    Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    [bwh: Backported to 3.2; adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 21b40f509a80e8446748329d9436c8ebffff27de
Author: Jeff Skirvin <jeffrey.d.skirvin@intel.com>
Date:   Thu Jul 11 17:18:58 2013 -0700

    isci: Fix a race condition in the SSP task management path
    
    commit 96f15f29038e58e1b0a96483e2b369ff446becf1 upstream.
    
    This commit fixes a race condition in the isci driver abort task and SSP
    device task management path.  The race is caused when an I/O termination
    in the SCU hardware is necessary because of an SSP target timeout condition,
    and the check of the I/O end state races against the HW-termination-driven
    end state.  The failure of the race meant that no TMF was sent to the device
    to clean-up the pending I/O.
    
    Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com>
    Reviewed-by: Lukasz Dorau <lukasz.dorau@intel.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Rui Xiang <rui.xiang@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a6d5f5393d055ba302edf4c59e6bfcee8b8892db
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Wed Feb 26 16:50:01 2014 +0300

    nfsd: check passed socket's net matches NFSd superblock's one
    
    commit 3064639423c48d6e0eb9ecc27c512a58e38c6c57 upstream.
    
    There could be a case, when NFSd file system is mounted in network, different
    to socket's one, like below:
    
    "ip netns exec" creates new network and mount namespace, which duplicates NFSd
    mount point, created in init_net context. And thus NFS server stop in nested
    network context leads to RPCBIND client destruction in init_net.
    Then, on NFSd start in nested network context, rpc.nfsd process creates socket
    in nested net and passes it into "write_ports", which leads to RPCBIND sockets
    creation in init_net context because of the same reason (NFSd monut point was
    created in init_net context). An attempt to register passed socket in nested
    net leads to panic, because no RPCBIND client present in nexted network
    namespace.
    
    This patch add check that passed socket's net matches NFSd superblock's one.
    And returns -EINVAL error to user psace otherwise.
    
    v2: Put socket on exit.
    
    Reported-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4: adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c14fee44389ab182ceab1df8fecbf2ffeb3a641
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Fri Feb 1 15:56:12 2013 +0300

    nfsd: containerize NFSd filesystem
    
    note: this backport is just for the null pointer problem when
    start nfsd in none init netns. The nfsd is still not containerized.
    
    commit 11f779421a39b86da8a523d97e5fd3477878d44f upstream.
    
    This patch makes NFSD file system superblock to be created per net.
    This makes possible to get proper network namespace from superblock instead of
    using hard-coded "init_net".
    
    Note: NFSd fs super-block holds network namespace. This garantees, that
    network namespace won't disappear from underneath of it.
    This, obviously, means, that in case of kill of a container's "init" (which is not a mount
    namespace, but network namespace creator) netowrk namespace won't be
    destroyed.
    
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - export cache not per netns
     - NFSD service structure not per netns]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa16ac16fc1dfe1ddca4b4c9ce71aea73a878402
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Thu Dec 6 18:34:42 2012 +0300

    nfsd: pass proper net to nfsd_destroy() from NFSd kthreads
    
    commit 88c47666171989ed4c5b1a5687df09511e8c5e35 upstream.
    
    Since NFSd service is per-net now, we have to pass proper network
    context in nfsd_shutdown() from NFSd kthreads.
    
    The simplest way I found is to get proper net from one of transports
    with permanent sockets.
    
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4: adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7bdac1ecae1aed95cfb922bb7c875d6a4cd04f47
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:35 2012 +0300

    nfsd: pass net to __write_ports() and down
    
    commit 081603520b25f7b35ef63a363376a17c36ef74ed upstream.
    
    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.
    
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - adjust context
     - add net_ns parameter to __write_ports_delxprt()]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 044b2114e85758b0afee70dd4a3f61cde45bcb32
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:30 2012 +0300

    nfsd: pass net to nfsd_set_nrthreads()
    
    commit 3938a0d5eb5effcc89c6909741403f4e6a37252d upstream.
    
    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.
    
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4: adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b282713737acd21f6f921deb2eb78538c0932a7c
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:25 2012 +0300

    nfsd: pass net to nfsd_svc()
    
    commit d41a9417cd89a69f58a26935034b4264a2d882d6 upstream.
    
    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.
    
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - adjust context
     - one more parameter(int port) for nfsd_svc()]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e42e08687cd3eea10a6b43f70a4e3b0375030737
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:20 2012 +0300

    nfsd: pass net to nfsd_create_serv()
    
    commit 6777436b0f072fb20a025a73e9b67a35ad8a5451 upstream.
    
    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.
    
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4: adjust context]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4851433beb66690843ac042d947d1a0ade76873f
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:14 2012 +0300

    nfsd: pass net to nfsd_startup() and nfsd_shutdown()
    
    commit db42d1a76a8dfcaba7a2dc9c591fa4e231db22b3 upstream.
    
    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.
    
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - adjust context
     - one more parameter(int port) for nfsd_startup()
     - no net ns initialization in nfsd_shutdown()
     - pass @net to lockd_up() in nfsd_startup()
     - pass @net to lockd_down() in nfsd_shutdown()]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e0feda118a2394ff75068b2da3b80f467dff77f
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Dec 10 12:19:09 2012 +0300

    nfsd: pass net to nfsd_init_socks()
    
    commit db6e182c17cb1a7069f7f8924721ce58ac05d9a3 upstream.
    
    Precursor patch. Hard-coded "init_net" will be replaced by proper one in
    future.
    
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    [wengmeiling: backport to 3.4:
     - adjust context
     - one more parameter(int port) for nfsd_init_socks()
     - net initialization in nfsd_startup()]
    Signed-off-by: Weng Meiling <wengmeiling.weng@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0e2400e24c096092c7b4cf736160d4e5e9070dec
Author: Amit Shah <amit.shah@redhat.com>
Date:   Fri Mar 29 16:30:08 2013 +0530

    virtio: console: add locking around c_ovq operations
    
    commit 9ba5c80b1aea8648a3efe5f22dc1f7cacdfbeeb8 upstream.
    
    When multiple ovq operations are being performed (lots of open/close
    operations on virtio_console fds), the __send_control_msg() function can
    get confused without locking.
    
    A simple recipe to cause badness is:
    * create a QEMU VM with two virtio-serial ports
    * in the guest, do
      while true;do echo abc >/dev/vport0p1;done
      while true;do echo edf >/dev/vport0p2;done
    
    In one run, this caused a panic in __send_control_msg().  In another, I
    got
    
       virtio_console virtio0: control-o:id 0 is not a head!
    
    This also results repeated messages similar to these on the host:
    
      qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0
      qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0
    
    Reported-by: FuXiangChun <xfu@redhat.com>
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Reviewed-by: Wanlong Gao <gaowanlong@cn.fujitsu.com>
    Reviewed-by: Asias He <asias@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wyj: Backported to 3.4: adjust context]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e83f2e8240f4dbc8f2740f9fc999d7bb10351e61
Author: Amit Shah <amit.shah@redhat.com>
Date:   Fri Mar 29 16:30:07 2013 +0530

    virtio: console: rename cvq_lock to c_ivq_lock
    
    commit 165b1b8bbc17c9469b053bab78b11b7cbce6d161 upstream.
    
    The cvq_lock was taken for the c_ivq.  Rename the lock to make that
    obvious.
    
    We'll also add a lock around the c_ovq in the next commit, so there's no
    ambiguity.
    
    Signed-off-by: Amit Shah <amit.shah@redhat.com>
    Reviewed-by: Asias He <asias@redhat.com>
    Reviewed-by: Wanlong Gao <gaowanlong@cn.fujitsu.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    [bwh: Backported to 3.2:
     - Adjust context
     - Drop change to virtcons_restore()]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wyj: Backported to 3.4:
     - pick change to virtcons_restore() from upsteam patch]
    Signed-off-by: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c9f8a4940df47e650d39216de7bc8f21e18e2fa
Author: Michael S. Tsirkin <mst@redhat.com>
Date:   Fri May 17 10:44:15 2013 +0930

    virtio_console: fix uapi header
    
    commit 6407d75afd08545f2252bb39806ffd3f10c7faac upstream.
    
    uapi should use __u32 not u32.
    Fix a macro in virtio_console.h which uses u32.
    
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    [bwh: Backported to 3.2: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7f3874ea67992faee3a7ff4dca382d0cb0ee0c06
Author: Alexander Graf <agraf@suse.de>
Date:   Wed Jan 2 15:37:17 2013 +1030

    virtio-blk: Don't free ida when disk is in use
    
    commit f4953fe6c4aeada2d5cafd78aa97587a46d2d8f9 upstream.
    
    When a file system is mounted on a virtio-blk disk, we then remove it
    and then reattach it, the reattached disk gets the same disk name and
    ids as the hot removed one.
    
    This leads to very nasty effects - mostly rendering the newly attached
    device completely unusable.
    
    Trying what happens when I do the same thing with a USB device, I saw
    that the sd node simply doesn't get free'd when a device gets forcefully
    removed.
    
    Imitate the same behavior for vd devices. This way broken vd devices
    simply are never free'd and newly attached ones keep working just fine.
    
    Signed-off-by: Alexander Graf <agraf@suse.de>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6330a0c429c1518714283be51b86dc02b45db882
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Oct 19 14:03:32 2012 +0100

    virtio: 9p: correctly pass physical address to userspace for high pages
    
    commit 30d395b124c51db66d9f3ba0611cd62021afc392 upstream.
    
    commit b9cdc88df8e63e81c723b82c286fc97f5d0dc325 upstream.
    
    When using a virtio transport, the 9p net device may pass the physical
    address of a kernel buffer to userspace via a scatterlist inside a
    virtqueue. If the kernel buffer is mapped outside of the linear mapping
    (e.g. highmem), then virt_to_page will return a bogus value and we will
    populate the scatterlist with junk.
    
    This patch uses kmap_to_page when populating the page array for a kernel
    buffer.
    
    Cc: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ad988bcb5b18ad5e1865f638cfc7ba3e600c4d46
Author: Will Deacon <will.deacon@arm.com>
Date:   Fri Oct 19 14:03:31 2012 +0100

    mm: highmem: export kmap_to_page for modules
    
    commit f0263d2d222e9e25f2587e51a9dc58c6fb2a9352 upstream.
    
    Some virtio device drivers (9p) need to translate high virtual addresses
    to physical addresses, which are inserted into the virtqueue for
    processing by userspace.
    
    This patch exports the kmap_to_page symbol, so that the affected drivers
    can be compiled as modules.
    
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7e4d02fdb2bb0f47405a0961a7f3991a56b5981b
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Tue Jul 31 16:45:02 2012 -0700

    mm: add kmap_to_page()
    
    commit fcb8996728fb59eddf84678df7cb213b2c9a2e26 upstream.
    
    This is extracted from Mel Gorman's commit 5a178119b0fb ('mm: add
    support for direct_IO to highmem pages') upstream.
    
    Required to backport commit b9cdc88df8e6 ('virtio: 9p: correctly pass
    physical address to userspace for high pages').
    
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 984ca88a55ccf51d4eeef67ce2247c58694a2dc5
Author: Asias He <asias@redhat.com>
Date:   Fri May 25 10:34:48 2012 +0800

    virtio-blk: Reset device after blk_cleanup_queue()
    
    commit 483001c765af6892b3fc3726576cb42f17d1d6b5 upstream.
    
    blk_cleanup_queue() will call blk_drian_queue() to drain all the
    requests before queue DEAD marking. If we reset the device before
    blk_cleanup_queue() the drain would fail.
    
    1) if the queue is stopped in do_virtblk_request() because device is
    full, the q->request_fn() will not be called.
    
    blk_drain_queue() {
       while(true) {
          ...
          if (!list_empty(&q->queue_head))
            __blk_run_queue(q) {
    	    if (queue is not stoped)
    		q->request_fn()
    	}
          ...
       }
    }
    
    Do no reset the device before blk_cleanup_queue() gives the chance to
    start the queue in interrupt handler blk_done().
    
    2) In commit b79d866c8b7014a51f611a64c40546109beaf24a, We abort requests
    dispatched to driver before blk_cleanup_queue(). There is a race if
    requests are dispatched to driver after the abort and before the queue
    DEAD mark. To fix this, instead of aborting the requests explicitly, we
    can just reset the device after after blk_cleanup_queue so that the
    device can complete all the requests before queue DEAD marking in the
    drain process.
    
    Cc: Rusty Russell <rusty@rustcorp.com.au>
    Cc: virtualization@lists.linux-foundation.org
    Cc: kvm@vger.kernel.org
    Signed-off-by: Asias He <asias@redhat.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit af6e24de4b787c77070bbaa2d0cd8e479f1db2d7
Author: Asias He <asias@redhat.com>
Date:   Fri May 25 10:34:47 2012 +0800

    virtio-blk: Call del_gendisk() before disable guest kick
    
    commit 02e2b124943648fba0a2ccee5c3656a5653e0151 upstream.
    
    del_gendisk() might not return due to failing to remove the
    /sys/block/vda/serial sysfs entry when another thread (udev) is
    trying to read it.
    
    virtblk_remove()
      vdev->config->reset() : guest will not kick us through interrupt
        del_gendisk()
          device_del()
            kobject_del(): got stuck, sysfs entry ref count non zero
    
    sysfs_open_file(): user space process read /sys/block/vda/serial
       sysfs_get_active() : got sysfs entry ref count
          dev_attr_show()
            virtblk_serial_show()
               blk_execute_rq() : got stuck, interrupt is disabled
                                  request cannot be finished
    
    This patch fixes it by calling del_gendisk() before we disable guest's
    interrupt so that the request sent in virtblk_serial_show() will be
    finished and del_gendisk() will success.
    
    This fixes another race in hot-unplug process.
    
    It is save to call del_gendisk(vblk->disk) before
    flush_work(&vblk->config_work) which might access vblk->disk, because
    vblk->disk is not freed until put_disk(vblk->disk).
    
    Cc: virtualization@lists.linux-foundation.org
    Cc: kvm@vger.kernel.org
    Signed-off-by: Asias He <asias@redhat.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f515bcabb5e4514126ab1635c215256cce4163a2
Author: Asias He <asias@redhat.com>
Date:   Fri May 4 20:22:04 2012 +0800

    virtio-blk: Fix hot-unplug race in remove method
    
    commit b79d866c8b7014a51f611a64c40546109beaf24a upstream.
    
    If we reset the virtio-blk device before the requests already dispatched
    to the virtio-blk driver from the block layer are finised, we will stuck
    in blk_cleanup_queue() and the remove will fail.
    
    blk_cleanup_queue() calls blk_drain_queue() to drain all requests queued
    before DEAD marking. However it will never success if the device is
    already stopped. We'll have q->in_flight[] > 0, so the drain will not
    finish.
    
    How to reproduce the race:
    1. hot-plug a virtio-blk device
    2. keep reading/writing the device in guest
    3. hot-unplug while the device is busy serving I/O
    
    Test:
    ~1000 rounds of hot-plug/hot-unplug test passed with this patch.
    
    Changes in v3:
    - Drop blk_abort_queue and blk_abort_request
    - Use __blk_end_request_all to complete request dispatched to driver
    
    Changes in v2:
    - Drop req_in_flight
    - Use virtqueue_detach_unused_buf to get request dispatched to driver
    
    Signed-off-by: Asias He <asias@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 36bd1996971bb124f4629994376c5fbb99a0e855
Author: Asias He <asias@redhat.com>
Date:   Fri Mar 30 11:24:10 2012 +0800

    virtio_blk: Drop unused request tracking list
    
    commit f65ca1dc6a8c81c6bd72297d4399ec5f4c1f3a01 upstream.
    
    Benchmark shows small performance improvement on fusion io device.
    
    Before:
      seq-read : io=1,024MB, bw=19,982KB/s, iops=39,964, runt= 52475msec
      seq-write: io=1,024MB, bw=20,321KB/s, iops=40,641, runt= 51601msec
      rnd-read : io=1,024MB, bw=15,404KB/s, iops=30,808, runt= 68070msec
      rnd-write: io=1,024MB, bw=14,776KB/s, iops=29,552, runt= 70963msec
    
    After:
      seq-read : io=1,024MB, bw=20,343KB/s, iops=40,685, runt= 51546msec
      seq-write: io=1,024MB, bw=20,803KB/s, iops=41,606, runt= 50404msec
      rnd-read : io=1,024MB, bw=16,221KB/s, iops=32,442, runt= 64642msec
      rnd-write: io=1,024MB, bw=15,199KB/s, iops=30,397, runt= 68991msec
    
    Signed-off-by: Asias He <asias@redhat.com>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Yijing Wang <wangyijing@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 76b87de061f61314d2db3926639102c0dcf39e0e
Author: Raphael Kubo da Costa <rakuco@FreeBSD.org>
Date:   Mon Sep 2 14:57:51 2013 +0300

    Bluetooth: Add support for BCM20702A0 [0b05, 17cb]
    
    commit 38a172bef8c93ecbfd69715fd88396988e4073fd upstream.
    
    Yet another vendor specific ID for this chipset; this one for the ASUS
    USB-BT400 Bluetooth 4.0 adapter.
    
    T:  Bus=03 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  6 Spd=12  MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0b05 ProdID=17cb Rev=01.12
    S:  Manufacturer=Broadcom Corp
    S:  Product=BCM20702A0
    S:  SerialNumber=000272C64400
    C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
    
    Signed-off-by: Raphael Kubo da Costa <rakuco@FreeBSD.org>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 140deab36402de1b4049bcc12a418e16039da041
Author: Peng Chen <pengchen@qti.qualcomm.com>
Date:   Fri Aug 30 17:41:40 2013 +0800

    Bluetooth: Add a new PID/VID 0cf3/e005 for AR3012.
    
    commit 0a3658cccdf5326ea508efeb1879b0e2508bb0c3 upstream.
    
    usb device info:
    
    T:  Bus=06 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 15 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0cf3 ProdID=e005 Rev= 0.02
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    
    Signed-off-by: Peng Chen <pengchen@qca.qualcomm.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ae1c727625e893f0c458de607ec3868b194e79c6
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Thu Jun 20 13:38:45 2013 +0800

    Bluetooth: Add support for Atheros [0cf3:e003]
    
    commit 1d5b569ef85d013a775560a90050dc630614c045 upstream.
    
    Add support for the AR9462 chip
    
    T:  Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#=  4 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0cf3 ProdID=e003 Rev=00.02
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d9b03b2af1118a8535db70185857b0fc70a2150e
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Wed Jul 17 11:27:40 2013 +0800

    Bluetooth: Add support for Atheros [0cf3:3121]
    
    commit 1ebd0b21ab14efb75950079840eac29afea2a26e upstream.
    
    Add support for the AR3012 chip.
    
    T:  Bus=03 Lev=01 Prnt=01 Port=06 Cnt=01 Dev#=  6 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0cf3 ProdID=3121 Rev=00.02
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fa6e6074eeeb7f5d70befc5f4503177e07cde572
Author: Sujith Manoharan <sujith@msujith.org>
Date:   Mon Jul 15 09:29:03 2013 +0530

    Bluetooth: ath3k: Add support for ID 0x13d3/0x3402
    
    commit 5b77a1f3d7b7360dc2b7c6d2188d39b9f8432907 upstream.
    
    T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  5 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=13d3 ProdID=3402 Rev= 0.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    Bug: https://bugzilla.kernel.org/show_bug.cgi?id=59701
    
    Signed-off-by: Sujith Manoharan <sujith@msujith.org>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 61286bc54e9d1e7c12953dc277a83d8ce49b6fb5
Author: Thomas Loo <tloo@saltstorm.net>
Date:   Wed Jul 3 02:53:54 2013 +0200

    Bluetooth: ath3k: Add support for Fujitsu Lifebook UH5x2 [04c5:1330]
    
    commit fb2e4631a7e23c37b9e2e7b2fd776231bbfc39d4 upstream.
    
    commit 84eb2ae1807dd1467bf6f500fc69ae61f1907b75 upstream.
    
    The Fujitsu Lifebook UH552/UH572 ships with a Qualcomm AR9462/AR3012
    WLAN/BT-Combo card.
    Add device ID to the ath3k driver to enable the bluetooth side of things.
    Patch against v3.10.
    
    T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04c5 ProdID=1330 Rev=00.02
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    Signed-off-by: Thomas Loo <tloo@saltstorm.net>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5ff17150132bc8afc4bfa63770b2feb8579067f1
Author: Cho, Yu-Chen <acho@suse.com>
Date:   Tue Jun 4 21:40:26 2013 +0800

    Bluetooth: Add support for Mediatek Bluetooth device [0e8d:763f]
    
    commit ff98736cbbbeb9087d4e5d7cb89e05c3e8bd01d6 upstream.
    
    commit 178c059e7640aa8e50213400c6f3dde00189d979 upstream.
    
    This patch adds support for Mediatek Bluetooth device
    
    T:  Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
    D:  Ver= 2.01 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0e8d ProdID=763f Rev= 1.00
    S:  Manufacturer=MediaTek
    S:  Product=BT
    S:  SerialNumber=1.0
    C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=450mA
    A:  FirstIf#= 0 IfCount= 2 Cls=ff(vend.) Sub=ff Prot=ff
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
    E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
    E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    I:  If#= 1 Alt= 6 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
    
    Signed-off-by: Cho, Yu-Chen <acho@suse.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 27370724e35ea2798b482ec014a08274de3139bd
Author: Noguchi Kazutosi <linux@scaltinof.net>
Date:   Sun Mar 24 23:41:10 2013 +0900

    Bluetooth: Add support for Foxconn/Hon Hai [0489:e04d]
    
    commit 0fc110f4e4f569e12c472f73f0af485e05631403 upstream.
    
    Add support for the AR3012 chip.
    
    T:  Bus=01 Lev=02 Prnt=02 Port=05 Cnt=03 Dev#= 21 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e04d Rev=00.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    Signed-off-by: Noguchi Kazutosi <linux@scaltinof.net>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1a182cc2740ad9f9831be4b8bdb8b0f5f946269f
Author: Sunguk Lee <d3m3vilurr@gmail.com>
Date:   Tue Mar 12 04:41:58 2013 +0900

    Bluetooth: Device 0cf3:3008 should map AR 3012
    
    commit 94a32d10f47b637ae24b78b1ddc7ef0e8396fda4 upstream.
    
    T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0cf3 ProdID=3008 Rev= 0.01
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    
    Signed-off-by: Sunguk Lee <d3m3vilurr@gmail.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d83ff8cd53e72348202f1a5f6110ee07404b7025
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Tue Feb 19 11:54:16 2013 -0500

    Bluetooth: Add support for atheros 04ca:3004 device to ath3k
    
    commit 3f63c340a72f2872a9362245cb2e03f3d2bb73a6 upstream.
    
    Yet another version of the atheros bluetooth chipset
    
    T:  Bus=01 Lev=02 Prnt=02 Port=03 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=3004 Rev=00.01
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    This resolves https://bugzilla.redhat.com/show_bug.cgi?id=844750
    
    Reported-by: niktr@mail.ru
    Signed-off-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e98f05ee934efd837fe98a7628affc4956b9471b
Author: Sergio Cambra <sergio@programatica.es>
Date:   Thu Jan 10 01:06:55 2013 +0100

    Bluetooth device 04ca:3008 should use ath3k
    
    commit f4d6f7dce71a5da93da50272ff1670bf2f1146b1 upstream.
    
    Output of /sys/kernel/debug/usb/devices
    T:  Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  6 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=3008 Rev= 0.02
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    
    Signed-off-by: Sergio Cambra <sergio@programatica.es>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7a344a224e918743ce58928faa6cfd9b4f8e87fe
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Thu Jan 3 12:25:00 2013 +0800

    Bluetooth: Add support for Foxconn / Hon Hai [0489:e056]
    
    commit 2582d529c44d12502a700f1c3db062b9f44679bc upstream.
    
    Add support for the AR9462 chip
    
    T: Bus=01 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
    D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
    P: Vendor=0489 ProdID=e056 Rev=00.01
    C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 340733cde963ab8582b5e306db5983942bf67b1a
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Thu Jan 3 12:24:59 2013 +0800

    Bluetooth: Add support for Foxconn / Hon Hai [0489:e04e]
    
    commit 3a61eda81ebcfc006ebb1496764299d53e5bf67f upstream.
    
    Add support for the AR9462 chip
    
    T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  5 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e04e Rev=00.02
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7a8c99e21fad826a45661da89cd86bd6df69c305
Author: Daniel Schaal <farbing@web.de>
Date:   Sat Dec 29 11:14:34 2012 +0100

    Bluetooth: Add support for GC-WB300D PCIe [04ca:3006] to ath3k.
    
    commit 2c262b2a5235b7f5b18d4d58394511f76371d7cb upstream.
    
    T:  Bus=02 Lev=02 Prnt=02 Port=06 Cnt=01 Dev#=  4 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=3006 Rev= 0.02
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    
    Signed-off-by: Daniel Schaal <farbing@web.de>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b36e95cac48b0f632e15e14de5a59163b62afa2
Author: AceLan Kao <acelan.kao@canonical.com>
Date:   Tue Dec 11 11:41:20 2012 +0800

    Bluetooth: Add support for IMC Networks [13d3:3393]
    
    commit eed307e290b96636def331375e065aca43f9069a upstream.
    
    Add support for the AR9462 chip
    
    T:  Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=13d3 ProdID=3393 Rev=00.01
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a990f68bde5fc6d8ea83f767575d70eaa0acc48
Author: Jeff Cook <jeff@deserettechnology.com>
Date:   Fri Nov 9 16:39:48 2012 -0700

    Bluetooth: Add support for BCM20702A0 [0b05, 17b5]
    
    commit 1ee3ff6110c16acfc915a79b1e3feb5013c41e75 upstream.
    
    Vendor-specific ID for BCM20702A0.
    Support for bluetooth over Asus Wi-Fi GO!, included with Asus P8Z77-V
    Deluxe.
    
    T:  Bus=07 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0b05 ProdID=17b5 Rev=01.12
    S:  Manufacturer=Broadcom Corp
    S:  Product=BCM20702A0
    S:  SerialNumber=94DBC98AC113
    C:  #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
    
    Signed-off-by: Jeff Cook <jeff@deserettechnology.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit adebaa7a1d6e8838edae80f1d0e4a53c49a1ce04
Author: Jaroslav Resler <resler@cs.cas.cz>
Date:   Tue Sep 11 17:25:32 2012 +0800

    Bluetooth: Add support for BCM20702A0 [04ca, 2003]
    
    commit 0c1abbd1aa0416258881c303a88e618cbca0759c upstream.
    
    Add another vendor specific ID for BCM20702A0.
    
    output of usb-devices:
    T:  Bus=01 Lev=02 Prnt=02 Port=03 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=2003 Rev= 1.12
    S:  Manufacturer=Broadcom Corp
    S:  Product=BCM20702A0
    S:  SerialNumber=446D57861623
    C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=  0mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=84(I) Atr=02(Bulk) MxPS=  32 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS=  32 Ivl=0ms
    I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
    
    Signed-off-by: Cho, Yu-Chen <acho@suse.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ec5bf54af7cf56eeb106c16a73d0f35d407370a2
Author: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Date:   Wed Aug 15 01:38:11 2012 -0300

    Bluetooth: Add USB_VENDOR_AND_INTERFACE_INFO() for Broadcom/Foxconn
    
    commit ee66401bb94b1f2ce51089c341dcdd25d26ae631 upstream.
    
    Foxconn devices has a vendor specific class of device, we will match them
    differently now.
    
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1403b36793c0787e82bed2c4d8123ef6593c1ad2
Author: Yevgeniy Melnichuk <yevgeniy.melnichuk@googlemail.com>
Date:   Tue Aug 7 19:48:10 2012 +0530

    Bluetooth: Add support for Sony Vaio T-Series
    
    commit bc21fde2d549d1cb1ebef04016eb7affa43bb5c1 upstream.
    
    Add Sony Vaio T-Series Bluetooth Module( 0x489:0xE036) to
    the blacklist of btusb module and add it to the ath3k module.
    
    output of cat /sys/kernel/debug/usb/devices
    
    T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  5 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e036 Rev= 0.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    
    Signed-off-by: Yevgeniy Melnichuk <yevgeniy.melnichuk@googlemail.com>
    Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
    Acked-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a1144cac91f26fd79db28fdd261ba435cb4059c7
Author: Michael Gruetzner <mgruetzn@gmx.de>
Date:   Wed May 2 22:33:40 2012 +0200

    Bluetooth: Add support for Foxconn/Hon Hai AR5BBU22 0489:E03C
    
    commit 85d59726c5c66016a507f1f4a60db8e374dd284d upstream.
    
    Add Foxconn/Hon Hai AR5BBU22 Bluetooth Module( 0x489:0xE03C) to
    the blacklist of btusb module and add it to the ath3k module to properly
    load the firmware in Kernel 3.3.4
    The device is integrated in  e.g. some  Acer Aspire 7750G.
    
    Output from /sys/kernel/debug/usb/devices:
    
    T:  Bus=01 Lev=02 Prnt=02 Port=05 Cnt=02 Dev#=  6 Spd=12   MxCh= 0
    D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e03c Rev= 0.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    
    Signed-off-by: Michael Gruetzner <mgruetzn@gmx.de>
    Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4126da551e92345e6e7da09870da10fba804e04f
Author: Peng Chen <pengchen@qca.qualcomm.com>
Date:   Wed Aug 1 10:11:59 2012 +0800

    Bluetooth: add support for atheros 0489:e057
    
    commit 2096ae6ca647302d50a68aa36cb66a00e7dfac70 upstream.
    
        Add support for the AR3012 chip found on Fioxconn.
    
        usb-devices shows:
    
        T:  Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 44 Spd=12   MxCh= 0
        D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
        P:  Vendor=0489 ProdID=e057 Rev= 0.02
        C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
        I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
        E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
        E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
        I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
        I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
        I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
        I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
        I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
        I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
        E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
        E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    
    Signed-off-by: Peng Chen <pengchen@qca.qualcomm.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c2f15c35b2e4152169edf7f1c37c38eb8ec45fe1
Author: Giancarlo Formicuccia <giancarlo.formicuccia@gmail.com>
Date:   Sun Jun 10 08:33:11 2012 +0200

    Bluetooth: add support for atheros 0930:0219
    
    commit 6c4ae5c2e7bfbb7d10d73611f69ac8a8609d84fd upstream.
    
    Add support for the AR3012 chip found on the Toshiba Sallite M840-1000-XQ.
    
    usb-devices shows:
    
    T:  Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#=  5 Spd=12  MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0930 ProdID=0219 Rev=00.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    
    Signed-off-by: Giancarlo Formicuccia <giancarlo.formicuccia@gmail.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7f801fcbd4bc022d58e39a1cd7f6e84933359d19
Author: Marek Vasut <marex@denx.de>
Date:   Fri Jun 8 14:32:50 2012 +0200

    Bluetooth: Support AR3011 in Acer Iconia Tab W500
    
    commit 6eda541d12116b4772baa09d3e8d7b0389df4289 upstream.
    
    Acer used this chip connected via USB:
    
    Bus 005 Device 005: ID 0cf3:3005 Atheros Communications, Inc. AR3011 Bluetooth
    Device Descriptor:
      bLength                18
      bDescriptorType         1
      bcdUSB               1.10
      bDeviceClass          224 Wireless
      bDeviceSubClass         1 Radio Frequency
      bDeviceProtocol         1 Bluetooth
      bMaxPacketSize0        64
      idVendor           0x0cf3 Atheros Communications, Inc.
      idProduct          0x3005 AR3011 Bluetooth
      bcdDevice            0.01
      iManufacturer           0
      iProduct                0
      iSerial                 0
      bNumConfigurations      1
    
    Signed-off-by: Marek Vasut <marex@denx.de>
    Cc: Gustavo Padovan <gustavo@padovan.org>
    Cc: Johan Hedberg <johan.hedberg@gmail.com>
    Cc: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ec88fcb4aa2c33fe2fe2a23c576a7e2581c5c3d
Author: Jaganath Kanakkassery <jaganath.k@samsung.com>
Date:   Fri Jun 21 19:55:11 2013 +0530

    Bluetooth: Fix invalid length check in l2cap_information_rsp()
    
    commit 3f6fa3d489e127ca5a5b298eabac3ff5dbe0e112 upstream.
    
    The length check is invalid since the length varies with type of
    info response.
    
    This was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888
    
    Because of this, l2cap info rsp is not handled and command reject is sent.
    
    > ACL data: handle 11 flags 0x02 dlen 16
            L2CAP(s): Info rsp: type 2 result 0
              Extended feature mask 0x00b8
                Enhanced Retransmission mode
                Streaming mode
                FCS Option
                Fixed Channels
    < ACL data: handle 11 flags 0x00 dlen 10
            L2CAP(s): Command rej: reason 0
              Command not understood
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
    Signed-off-by: Chan-Yeol Park <chanyeol.park@samsung.com>
    Acked-by: Johan Hedberg <johan.hedberg@intel.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Cc: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ade988a989901a1527c6809aeea0ca3b8639af46
Author: Johan Hedberg <johan.hedberg@intel.com>
Date:   Tue May 28 13:46:30 2013 +0300

    Bluetooth: Fix missing length checks for L2CAP signalling PDUs
    
    commit cb3b3152b2f5939d67005cff841a1ca748b19888 upstream.
    
    There has been code in place to check that the L2CAP length header
    matches the amount of data received, but many PDU handlers have not been
    checking that the data received actually matches that expected by the
    specific PDU. This patch adds passing the length header to the specific
    handler functions and ensures that those functions fail cleanly in the
    case of an incorrect amount of data.
    
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    [bwh: Backported to 3.2:
     - Adjust context
     - Move uses of *req below the new check in l2cap_connect_req]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    [wujg: Backported to 3.4:
     - Adjust context
     - Adjust l2cap_create_channel_rsp()'s parameters]
    Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 653b6fe704e344fe48162a23b60657db1ac84233
Author: Andrey Ryabinin <a.ryabinin@samsung.com>
Date:   Fri Jun 6 19:09:30 2014 +0400

    mm: rmap: fix use-after-free in __put_anon_vma
    
    commit 624483f3ea82598ab0f62f1bdb9177f531ab1892 upstream.
    
    While working address sanitizer for kernel I've discovered
    use-after-free bug in __put_anon_vma.
    
    For the last anon_vma, anon_vma->root freed before child anon_vma.
    Later in anon_vma_free(anon_vma) we are referencing to already freed
    anon_vma->root to check rwsem.
    
    This fixes it by freeing the child anon_vma before freeing
    anon_vma->root.
    
    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Acked-by: Peter Zijlstra <peterz@infradead.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7da536df5fb077e03b8882b586f274409c459861
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Fri May 23 10:45:54 2014 -0400

    USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume
    
    commit 8ef42ddd9a53b73e6fc3934278710c27f80f324f upstream.
    
    Not all host controller drivers have bus-suspend and bus-resume
    methods.  When one doesn't, it will cause problems if runtime PM is
    enabled in the kernel.  The PM core will attempt to suspend the
    controller's root hub, the suspend will fail because there is no
    bus-suspend routine, and a -EBUSY error code will be returned to the
    PM core.  This will cause the suspend attempt to be repeated shortly
    thereafter, in a never-ending loop.
    
    Part of the problem is that the original error code -ENOENT gets
    changed to -EBUSY in usb_runtime_suspend(), on the grounds that the PM
    core will interpret -ENOENT as meaning that the root hub has gotten
    into a runtime-PM error state.  While this change is appropriate for
    real USB devices, it's not such a good idea for a root hub.  In fact,
    considering the root hub to be in a runtime-PM error state would not
    be far from the truth.  Therefore this patch updates
    usb_runtime_suspend() so that it adjusts error codes only for
    non-root-hub devices.
    
    Furthermore, the patch attempts to prevent the problem from occurring
    in the first place by not enabling runtime PM by default for root hubs
    whose host controller driver doesn't have bus_suspend and bus_resume
    methods.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Will Deacon <will.deacon@arm.com>
    Tested-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 98e74212146e2191a9e6edb673b35389fd8f6aed
Author: Johan Hovold <jhovold@gmail.com>
Date:   Sat Apr 26 11:53:44 2014 +0200

    USB: io_ti: fix firmware download on big-endian machines (part 2)
    
    commit c03890ff5e24a4bf59059f2d179f427559b7330a upstream.
    
    A recent patch that purported to fix firmware download on big-endian
    machines failed to add the corresponding sparse annotation to the
    i2c-header. This was reported by the kbuild test robot.
    
    Adding the appropriate annotation revealed another endianess bug related
    to the i2c-header Size-field in a code path that is exercised when the
    firmware is actually being downloaded (and not just verified and left
    untouched unless older than the firmware at hand).
    
    This patch adds the required sparse annotation to the i2c-header and
    makes sure that the Size-field is sent in little-endian byte order
    during firmware download also on big-endian machines.
    
    Note that this patch is only compile-tested, but that there is no
    functional change for little-endian systems.
    
    Reported-by: kbuild test robot <fengguang.wu@intel.com>
    Cc: Ludovic Drolez <ldrolez@debian.org>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 96f169c406101ce9a90c3e534652610bfc46bf67
Author: Alexej Starschenko <starschenko@gmail.com>
Date:   Wed May 7 10:43:29 2014 +0200

    USB: serial: option: add support for Novatel E371 PCIe card
    
    commit 8a61ba3a47ac39f660702aa66a172185dd605a86 upstream.
    
    Adds product ID for the Novatel E371 PCI Express Mini Card.
    
    $ lsusb
    Bus 001 Device 024: ID 1410:9011 Novatel Wireless
    
    $ usb-devices
    T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 24 Spd=480 MxCh= 0
    D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=1410 ProdID=9011 Rev=00.03
    S:  Manufacturer=Novatel Wireless, Inc.
    S:  Product=Novatel Wireless HSPA
    S:  SerialNumber=012773002115811
    C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
    I:  If#= 6 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
    I:  If#= 7 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
    
    Tested with kernel 3.2.0.
    
    Signed-off-by: Alexej Starschenko <starschenko@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 939b9b9297bd427da92dd1b3d3c94a813db8eee0
Author: George McCollister <george.mccollister@gmail.com>
Date:   Sat Apr 26 12:04:47 2014 +0200

    USB: ftdi_sio: add NovaTech OrionLXm product ID
    
    commit d0839d757e6294921c31b1c4ca4f1dcc5df63bcd upstream.
    
    The NovaTech OrionLXm uses an onboard FTDI serial converter for JTAG and
    console access.
    
    Here is the lsusb output:
    Bus 004 Device 123: ID 0403:7c90 Future Technology Devices
    International, Ltd
    
    Signed-off-by: George McCollister <george.mccollister@gmail.com>
    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 810d7a3bef08c6ebe984a9e1dd12659ef3d37679
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Jun 2 15:16:07 2014 +0200

    ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup
    
    commit 192a98e280e560510a62aca8cfa83b4ae7c095bb upstream.
    
    The conversion to a fixup table for Replacer model with ALC260 in
    commit 20f7d928 took the wrong widget NID for COEF setups.  Namely,
    NID 0x1a should have been used instead of NID 0x20, which is the
    common node for all Realtek codecs but ALC260.
    
    Fixes: 20f7d928fa6e ('ALSA: hda/realtek - Replace ALC260 model=replacer with the auto-parser')
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit abd03db4242413c2abd6ed87139559e4d0cb8a19
Author: Ronan Marquet <ronan.marquet@orange.fr>
Date:   Sun Jun 1 18:38:53 2014 +0200

    ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop
    
    commit e30cf2d2bed3aed74a651c64de323ba26e4ff7d0 upstream.
    
    Correcion of wrong fixup entries add in commit ca8f0424 to replace
    static model quirk for PB V7900 laptop (will model).
    
    [note: the removal of ALC260_FIXUP_HP_PIN_0F chain is also needed as a
     part of the fix; otherwise the pin is set up wrongly as a headphone,
     and user-space (PulseAudio) may be wrongly trying to detect the jack
     state -- tiwai]
    
    Fixes: ca8f04247eaa ('ALSA: hda/realtek - Add the fixup codes for ALC260 model=will')
    Signed-off-by: Ronan Marquet <ronan.marquet@orange.fr>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 718c04d410c7a442b59e5e7e372dc011b0ca3dc5
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Mon May 19 00:56:22 2014 +0100

    Staging: speakup: Move pasting into a work item
    
    commit d7500135802ca55b3f4e01a16544e8b34082f8c3 upstream.
    
    Input is handled in softirq context, but when pasting we may
    need to sleep.  speakup_paste_selection() currently tries to
    bodge this by busy-waiting if in_atomic(), but that doesn't
    help because the ldisc may also sleep.
    
    For bonus breakage, speakup_paste_selection() changes the
    state of current, even though it's not running in process
    context.
    
    Move it into a work item and make sure to cancel it on exit.
    
    References: https://bugs.debian.org/735202
    References: https://bugs.debian.org/744015
    Reported-by: Paul Gevers <elbrus@debian.org>
    Reported-and-tested-by: Jarek Czekalski <jarekczek@poczta.onet.pl>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a0a3c6603ccd5840452c7d88d7df213f573867d9
Author: Mathias Nyman <mathias.nyman@linux.intel.com>
Date:   Wed May 28 23:51:13 2014 +0300

    xhci: delete endpoints from bandwidth list before freeing whole device
    
    commit 5dc2808c4729bf080487e61b80ee04e0fdb12a37 upstream.
    
    Lists of endpoints are stored for bandwidth calculation for roothub ports.
    Make sure we remove all endpoints from the list before the whole device,
    containing its endpoints list_head stuctures, is freed.
    
    This used to be done in the wrong order in xhci_mem_cleanup(),
    and triggered an oops in resume from S4 (hibernate).
    
    Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0b78a4287b8cc7c0817b7bc4894d8c9c177bb751
Author: NeilBrown <neilb@suse.de>
Date:   Wed May 28 13:39:23 2014 +1000

    md: always set MD_RECOVERY_INTR when aborting a reshape or other "resync".
    
    commit 3991b31ea072b070081ca3bfa860a077eda67de5 upstream.
    
    If mddev->ro is set, md_to_sync will (correctly) abort.
    However in that case MD_RECOVERY_INTR isn't set.
    
    If a RESHAPE had been requested, then ->finish_reshape() will be
    called and it will think the reshape was successful even though
    nothing happened.
    
    Normally a resync will not be requested if ->ro is set, but if an
    array is stopped while a reshape is on-going, then when the array is
    started, the reshape will be restarted.  If the array is also set
    read-only at this point, the reshape will instantly appear to success,
    resulting in data corruption.
    
    Consequently, this patch is suitable for any -stable kernel.
    
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6e81d4f7b4e8cea2817c7568e3756798cd29aae
Author: Lai Jiangshan <laijs@cn.fujitsu.com>
Date:   Fri May 16 11:50:42 2014 +0800

    sched: Fix hotplug vs. set_cpus_allowed_ptr()
    
    commit 6acbfb96976fc3350e30d964acb1dbbdf876d55e upstream.
    
    Lai found that:
    
      WARNING: CPU: 1 PID: 13 at arch/x86/kernel/smp.c:124 native_smp_send_reschedule+0x2d/0x4b()
      ...
      migration_cpu_stop+0x1d/0x22
    
    was caused by set_cpus_allowed_ptr() assuming that cpu_active_mask is
    always a sub-set of cpu_online_mask.
    
    This isn't true since 5fbd036b552f ("sched: Cleanup cpu_active madness").
    
    So set active and online at the same time to avoid this particular
    problem.
    
    Fixes: 5fbd036b552f ("sched: Cleanup cpu_active madness")
    Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Michael wang <wangyun@linux.vnet.ibm.com>
    Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
    Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Cc: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
    Cc: Toshi Kani <toshi.kani@hp.com>
    Link: http://lkml.kernel.org/r/53758B12.8060609@cn.fujitsu.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee40d72c3e6fc7e6cd5241eb84fa104b61dc8ec3
Author: Andrey Ryabinin <a.ryabinin@samsung.com>
Date:   Wed May 7 08:07:25 2014 +0100

    ARM: 8051/1: put_user: fix possible data corruption in put_user
    
    commit 537094b64b229bf3ad146042f83e74cf6abe59df upstream.
    
    According to arm procedure call standart r2 register is call-cloberred.
    So after the result of x expression was put into r2 any following
    function call in p may overwrite r2. To fix this, the result of p
    expression must be saved to the temporary variable before the
    assigment x expression to __r2.
    
    Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Reviewed-by: Nicolas Pitre <nico@linaro.org>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1b2a92d89ef65cba15994b3707a512ceede879b8
Author: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Date:   Thu May 22 11:54:21 2014 -0700

    mm/memory-failure.c: fix memory leak by race between poison and unpoison
    
    commit 3e030ecc0fc7de10fd0da10c1c19939872a31717 upstream.
    
    When a memory error happens on an in-use page or (free and in-use)
    hugepage, the victim page is isolated with its refcount set to one.
    
    When you try to unpoison it later, unpoison_memory() calls put_page()
    for it twice in order to bring the page back to free page pool (buddy or
    free hugepage list).  However, if another memory error occurs on the
    page which we are unpoisoning, memory_failure() returns without
    releasing the refcount which was incremented in the same call at first,
    which results in memory leak and unconsistent num_poisoned_pages
    statistics.  This patch fixes it.
    
    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4b2cfc9508d9e509708f85748548e03db696dbcd
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Fri May 2 16:56:01 2014 +0200

    perf: Fix race in removing an event
    
    commit 46ce0fe97a6be7532ce6126bb26ce89fed81528c upstream.
    
    When removing a (sibling) event we do:
    
    	raw_spin_lock_irq(&ctx->lock);
    	perf_group_detach(event);
    	raw_spin_unlock_irq(&ctx->lock);
    
    	<hole>
    
    	perf_remove_from_context(event);
    		raw_spin_lock_irq(&ctx->lock);
    		...
    		raw_spin_unlock_irq(&ctx->lock);
    
    Now, assuming the event is a sibling, it will be 'unreachable' for
    things like ctx_sched_out() because that iterates the
    groups->siblings, and we just unhooked the sibling.
    
    So, if during <hole> we get ctx_sched_out(), it will miss the event
    and not call event_sched_out() on it, leaving it programmed on the
    PMU.
    
    The subsequent perf_remove_from_context() call will find the ctx is
    inactive and only call list_del_event() to remove the event from all
    other lists.
    
    Hereafter we can proceed to free the event; while still programmed!
    
    Close this hole by moving perf_group_detach() inside the same
    ctx->lock region(s) perf_remove_from_context() has.
    
    The condition on inherited events only in __perf_event_exit_task() is
    likely complete crap because non-inherited events are part of groups
    too and we're tearing down just the same. But leave that for another
    patch.
    
    Most-likely-Fixes: e03a9a55b4e ("perf: Change close() semantics for group events")
    Reported-by: Vince Weaver <vincent.weaver@maine.edu>
    Tested-by: Vince Weaver <vincent.weaver@maine.edu>
    Much-staring-at-traces-by: Vince Weaver <vincent.weaver@maine.edu>
    Much-staring-at-traces-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/20140505093124.GN17778@laptop.programming.kicks-ass.net
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 183f99ecb6a484c142ae2fc99df3ef5cdadc3985
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Thu May 15 20:23:48 2014 +0200

    perf: Limit perf_event_attr::sample_period to 63 bits
    
    commit 0819b2e30ccb93edf04876237b6205eef84ec8d2 upstream.
    
    Vince reported that using a large sample_period (one with bit 63 set)
    results in wreckage since while the sample_period is fundamentally
    unsigned (negative periods don't make sense) the way we implement
    things very much rely on signed logic.
    
    So limit sample_period to 63 bits to avoid tripping over this.
    
    Reported-by: Vince Weaver <vincent.weaver@maine.edu>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/n/tip-p25fhunibl4y3qi0zuqmyf4b@git.kernel.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0d41f6026aa0c15d60e75f8f71f1408c32fe1ba4
Author: Jiri Olsa <jolsa@redhat.com>
Date:   Mon Apr 7 11:04:08 2014 +0200

    perf: Prevent false warning in perf_swevent_add
    
    commit 39af6b1678afa5880dda7e375cf3f9d395087f6d upstream.
    
    The perf cpu offline callback takes down all cpu context
    events and releases swhash->swevent_hlist.
    
    This could race with task context software event being just
    scheduled on this cpu via perf_swevent_add while cpu hotplug
    code already cleaned up event's data.
    
    The race happens in the gap between the cpu notifier code
    and the cpu being actually taken down. Note that only cpu
    ctx events are terminated in the perf cpu hotplug code.
    
    It's easily reproduced with:
      $ perf record -e faults perf bench sched pipe
    
    while putting one of the cpus offline:
      # echo 0 > /sys/devices/system/cpu/cpu1/online
    
    Console emits following warning:
      WARNING: CPU: 1 PID: 2845 at kernel/events/core.c:5672 perf_swevent_add+0x18d/0x1a0()
      Modules linked in:
      CPU: 1 PID: 2845 Comm: sched-pipe Tainted: G        W    3.14.0+ #256
      Hardware name: Intel Corporation Montevina platform/To be filled by O.E.M., BIOS AMVACRB1.86C.0066.B00.0805070703 05/07/2008
       0000000000000009 ffff880077233ab8 ffffffff81665a23 0000000000200005
       0000000000000000 ffff880077233af8 ffffffff8104732c 0000000000000046
       ffff88007467c800 0000000000000002 ffff88007a9cf2a0 0000000000000001
      Call Trace:
       [<ffffffff81665a23>] dump_stack+0x4f/0x7c
       [<ffffffff8104732c>] warn_slowpath_common+0x8c/0xc0
       [<ffffffff8104737a>] warn_slowpath_null+0x1a/0x20
       [<ffffffff8110fb3d>] perf_swevent_add+0x18d/0x1a0
       [<ffffffff811162ae>] event_sched_in.isra.75+0x9e/0x1f0
       [<ffffffff8111646a>] group_sched_in+0x6a/0x1f0
       [<ffffffff81083dd5>] ? sched_clock_local+0x25/0xa0
       [<ffffffff811167e6>] ctx_sched_in+0x1f6/0x450
       [<ffffffff8111757b>] perf_event_sched_in+0x6b/0xa0
       [<ffffffff81117a4b>] perf_event_context_sched_in+0x7b/0xc0
       [<ffffffff81117ece>] __perf_event_task_sched_in+0x43e/0x460
       [<ffffffff81096f1e>] ? put_lock_stats.isra.18+0xe/0x30
       [<ffffffff8107b3c8>] finish_task_switch+0xb8/0x100
       [<ffffffff8166a7de>] __schedule+0x30e/0xad0
       [<ffffffff81172dd2>] ? pipe_read+0x3e2/0x560
       [<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70
       [<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70
       [<ffffffff8166b464>] preempt_schedule_irq+0x44/0x70
       [<ffffffff816707f0>] retint_kernel+0x20/0x30
       [<ffffffff8109e60a>] ? lockdep_sys_exit+0x1a/0x90
       [<ffffffff812a4234>] lockdep_sys_exit_thunk+0x35/0x67
       [<ffffffff81679321>] ? sysret_check+0x5/0x56
    
    Fixing this by tracking the cpu hotplug state and displaying
    the WARN only if current cpu is initialized properly.
    
    Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
    Reported-by: Fengguang Wu <fengguang.wu@intel.com>
    Signed-off-by: Jiri Olsa <jolsa@redhat.com>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/1396861448-10097-1-git-send-email-jolsa@redhat.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4e0d105c09b8bec501ff5455b774bf3a845d017c
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Sun Apr 13 09:34:53 2014 -0400

    sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check
    
    commit 6227cb00cc120f9a43ce8313bb0475ddabcb7d01 upstream.
    
    The check at the beginning of cpupri_find() makes sure that the task_pri
    variable does not exceed the cp->pri_to_cpu array length. But that length
    is CPUPRI_NR_PRIORITIES not MAX_RT_PRIO, where it will miss the last two
    priorities in that array.
    
    As task_pri is computed from convert_prio() which should never be bigger
    than CPUPRI_NR_PRIORITIES, if the check should cause a panic if it is
    hit.
    
    Reported-by: Mike Galbraith <umgwanakikbuti@gmail.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/1397015410.5212.13.camel@marge.simpson.net
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>