--- /dev/null
+From 22d059a5c7c5de61e53c88e30b65e55fbfd91e91 Mon Sep 17 00:00:00 2001
+From: Eliad Peller <eliad@wizery.com>
+Date: Tue, 26 Aug 2014 11:23:11 +0300
+Subject: iwlwifi: increase DEFAULT_MAX_TX_POWER
+
+From: Eliad Peller <eliad@wizery.com>
+
+commit 22d059a5c7c5de61e53c88e30b65e55fbfd91e91 upstream.
+
+The chip is able to transmit up to 22dBm, so set
+the constant appropriately.
+
+Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-config.h | 2 ++
+ drivers/net/wireless/iwlwifi/iwl-nvm-parse.c | 4 +---
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/iwlwifi/iwl-config.h
+@@ -120,6 +120,8 @@ enum iwl_led_mode {
+ #define IWL_LONG_WD_TIMEOUT 10000
+ #define IWL_MAX_WD_TIMEOUT 120000
+
++#define IWL_DEFAULT_MAX_TX_POWER 22
++
+ /* Antenna presence definitions */
+ #define ANT_NONE 0x0
+ #define ANT_A BIT(0)
+--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+@@ -143,8 +143,6 @@ static const u8 iwl_nvm_channels_family_
+ #define LAST_2GHZ_HT_PLUS 9
+ #define LAST_5GHZ_HT 161
+
+-#define DEFAULT_MAX_TX_POWER 16
+-
+ /* rate data (static) */
+ static struct ieee80211_rate iwl_cfg80211_rates[] = {
+ { .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
+@@ -279,7 +277,7 @@ static int iwl_init_channel_map(struct d
+ * Default value - highest tx power value. max_power
+ * is not used in mvm, and is used for backwards compatibility
+ */
+- channel->max_power = DEFAULT_MAX_TX_POWER;
++ channel->max_power = IWL_DEFAULT_MAX_TX_POWER;
+ is_5ghz = channel->band == IEEE80211_BAND_5GHZ;
+ IWL_DEBUG_EEPROM(dev,
+ "Ch. %d [%sGHz] %s%s%s%s%s%s(0x%02x %ddBm): Ad-Hoc %ssupported\n",
--- /dev/null
+From 86974bff066dd8b98be46d7c7d3aba89034f0833 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 31 Jul 2014 14:32:37 +0300
+Subject: iwlwifi: mvm: fix endianity issues with Smart Fifo commands
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 86974bff066dd8b98be46d7c7d3aba89034f0833 upstream.
+
+This code was broken on big endian systems. Sparse didn't
+catch the bug since the firmware command was not tagged as
+little endian.
+Fix the bug for big endian systems and tag the field in the
+firmware command to prevent such issues in the future.
+
+Fixes: 1f3b0ff8ec ("iwlwifi: mvm: Add Smart FIFO support")
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/fw-api.h | 4 ++--
+ drivers/net/wireless/iwlwifi/mvm/sf.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
++++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+@@ -1487,14 +1487,14 @@ enum iwl_sf_scenario {
+
+ /**
+ * Smart Fifo configuration command.
+- * @state: smart fifo state, types listed in iwl_sf_sate.
++ * @state: smart fifo state, types listed in enum %iwl_sf_sate.
+ * @watermark: Minimum allowed availabe free space in RXF for transient state.
+ * @long_delay_timeouts: aging and idle timer values for each scenario
+ * in long delay state.
+ * @full_on_timeouts: timer values for each scenario in full on state.
+ */
+ struct iwl_sf_cfg_cmd {
+- enum iwl_sf_state state;
++ __le32 state;
+ __le32 watermark[SF_TRANSIENT_STATES_NUMBER];
+ __le32 long_delay_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES];
+ __le32 full_on_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES];
+--- a/drivers/net/wireless/iwlwifi/mvm/sf.c
++++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
+@@ -172,7 +172,7 @@ static int iwl_mvm_sf_config(struct iwl_
+ enum iwl_sf_state new_state)
+ {
+ struct iwl_sf_cfg_cmd sf_cmd = {
+- .state = new_state,
++ .state = cpu_to_le32(new_state),
+ };
+ struct ieee80211_sta *sta;
+ int ret = 0;
--- /dev/null
+From 7c8b3bc688bdcfd7789efbd17da4d85b104ad351 Mon Sep 17 00:00:00 2001
+From: Luciano Coelho <luciano.coelho@intel.com>
+Date: Wed, 30 Jul 2014 15:04:08 +0300
+Subject: iwlwifi: mvm: set MAC_FILTER_IN_BEACON correctly for STA/P2P client
+
+From: Luciano Coelho <luciano.coelho@intel.com>
+
+commit 7c8b3bc688bdcfd7789efbd17da4d85b104ad351 upstream.
+
+In commit cad3f08c (iwlwifi: mvm: enable MAC_FILTER_IN_BEACON when
+forced_assoc_off is set) the code to set the MAC_FILTER_IN_BEACON flag
+was accidentally moved to the main block of the if statement, while it
+should be in the else block instead. Move it to the right place.
+
+Fixes: cad3f08c23de ("iwlwifi: mvm: enable MAC_FILTER_IN_BEACON when forced_assoc_off is set")
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+@@ -720,11 +720,6 @@ static int iwl_mvm_mac_ctxt_cmd_sta(stru
+ !force_assoc_off) {
+ u32 dtim_offs;
+
+- /* Allow beacons to pass through as long as we are not
+- * associated, or we do not have dtim period information.
+- */
+- cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_BEACON);
+-
+ /*
+ * The DTIM count counts down, so when it is N that means N
+ * more beacon intervals happen until the DTIM TBTT. Therefore
+@@ -758,6 +753,11 @@ static int iwl_mvm_mac_ctxt_cmd_sta(stru
+ ctxt_sta->is_assoc = cpu_to_le32(1);
+ } else {
+ ctxt_sta->is_assoc = cpu_to_le32(0);
++
++ /* Allow beacons to pass through as long as we are not
++ * associated, or we do not have dtim period information.
++ */
++ cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_BEACON);
+ }
+
+ ctxt_sta->bi = cpu_to_le32(vif->bss_conf.beacon_int);
--- /dev/null
+From aa11bbf3df026d6b1c6b528bef634fd9de7c2619 Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Tue, 2 Sep 2014 18:39:21 +0300
+Subject: iwlwifi: mvm: treat EAPOLs like mgmt frames wrt rate
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit aa11bbf3df026d6b1c6b528bef634fd9de7c2619 upstream.
+
+Using the LQ table which is initially set according to
+the rssi could lead to EAPOLs being sent in high legacy
+rates like 54mbps.
+It's better to avoid sending EAPOLs in high rates as it reduces
+the chances of a successful 4-Way handshake.
+Avoid this and treat them like other mgmt frames which would
+initially get sent at the basic rate.
+
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/tx.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -169,10 +169,14 @@ static void iwl_mvm_set_tx_cmd_rate(stru
+
+ /*
+ * for data packets, rate info comes from the table inside the fw. This
+- * table is controlled by LINK_QUALITY commands
++ * table is controlled by LINK_QUALITY commands. Exclude ctrl port
++ * frames like EAPOLs which should be treated as mgmt frames. This
++ * avoids them being sent initially in high rates which increases the
++ * chances for completion of the 4-Way handshake.
+ */
+
+- if (ieee80211_is_data(fc) && sta) {
++ if (ieee80211_is_data(fc) && sta &&
++ !(info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO)) {
+ tx_cmd->initial_rate_index = 0;
+ tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE);
+ return;
--- /dev/null
+From f47f46d7b09cf1d09e4b44b6cc4dd7d68a08028c Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sun, 31 Aug 2014 22:11:11 +0300
+Subject: Revert "iwlwifi: dvm: don't enable CTS to self"
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit f47f46d7b09cf1d09e4b44b6cc4dd7d68a08028c upstream.
+
+This reverts commit 43d826ca5979927131685cc2092c7ce862cb91cd.
+
+This commit caused packet loss.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/dvm/rxon.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
++++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
+@@ -1068,6 +1068,13 @@ int iwlagn_commit_rxon(struct iwl_priv *
+ /* recalculate basic rates */
+ iwl_calc_basic_rates(priv, ctx);
+
++ /*
++ * force CTS-to-self frames protection if RTS-CTS is not preferred
++ * one aggregation protection method
++ */
++ if (!priv->hw_params.use_rts_for_aggregation)
++ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
++
+ if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
+ !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
+ ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
+@@ -1473,6 +1480,11 @@ void iwlagn_bss_info_changed(struct ieee
+ else
+ ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
+
++ if (bss_conf->use_cts_prot)
++ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
++ else
++ ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
++
+ memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN);
+
+ if (vif->type == NL80211_IFTYPE_AP ||
iscsi-target-fix-memory-corruption-in-iscsit_logout_post_handler_diffcid.patch
nfc-microread-potential-overflows-in-microread_target_discovered.patch
scsi-libiscsi-fix-potential-buffer-overrun-in-__iscsi_conn_send_pdu.patch
+revert-iwlwifi-dvm-don-t-enable-cts-to-self.patch
+iwlwifi-mvm-fix-endianity-issues-with-smart-fifo-commands.patch
+iwlwifi-increase-default_max_tx_power.patch
+iwlwifi-mvm-treat-eapols-like-mgmt-frames-wrt-rate.patch
+iwlwifi-mvm-set-mac_filter_in_beacon-correctly-for-sta-p2p-client.patch
+workqueue-apply-__wq_ordered-to-create_singlethread_workqueue.patch
--- /dev/null
+From e09c2c295468476a239d13324ce9042ec4de05eb Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Sat, 13 Sep 2014 04:14:30 +0900
+Subject: workqueue: apply __WQ_ORDERED to create_singlethread_workqueue()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit e09c2c295468476a239d13324ce9042ec4de05eb upstream.
+
+create_singlethread_workqueue() is a compat interface for single
+threaded workqueue which maps to ordered workqueue w/ rescuer in the
+current implementation. create_singlethread_workqueue() currently
+implemented by invoking alloc_workqueue() w/ appropriate parameters.
+
+8719dceae2f9 ("workqueue: reject adjusting max_active or applying
+attrs to ordered workqueues") introduced __WQ_ORDERED to protect
+ordered workqueues against dynamic attribute changes which can break
+ordering guarantees but forgot to apply it to
+create_singlethread_workqueue(). This in itself is okay as nobody
+currently uses dynamic attribute change on workqueues created with
+create_singlethread_workqueue().
+
+However, 4c16bd327c ("workqueue: implement NUMA affinity for unbound
+workqueues") broke singlethreaded guarantee for ordered workqueues
+through allocating a separate pool_workqueue on each NUMA node by
+default. A later change 8a2b75384444 ("workqueue: fix ordered
+workqueues in NUMA setups") fixed it by allocating only one global
+pool_workqueue if __WQ_ORDERED is set.
+
+Combined, the __WQ_ORDERED omission in create_singlethread_workqueue()
+became critical breaking its single threadedness and ordering
+guarantee.
+
+Let's make create_singlethread_workqueue() wrap
+alloc_ordered_workqueue() instead so that it inherits __WQ_ORDERED and
+can implicitly track future ordered_workqueue changes.
+
+v2: I missed that __WQ_ORDERED now protects against pwq splitting
+ across NUMA nodes and incorrectly described the patch as a
+ nice-to-have fix to protect against future dynamic attribute
+ usages. Oleg pointed out that this is actually a critical
+ breakage due to 8a2b75384444 ("workqueue: fix ordered workqueues
+ in NUMA setups").
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Mike Anderson <mike.anderson@us.ibm.com>
+Cc: Oleg Nesterov <onestero@redhat.com>
+Cc: Gustavo Luiz Duarte <gduarte@redhat.com>
+Cc: Tomas Henzl <thenzl@redhat.com>
+Fixes: 4c16bd327c ("workqueue: implement NUMA affinity for unbound workqueues")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/workqueue.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -419,7 +419,7 @@ __alloc_workqueue_key(const char *fmt, u
+ alloc_workqueue("%s", WQ_FREEZABLE | WQ_UNBOUND | WQ_MEM_RECLAIM, \
+ 1, (name))
+ #define create_singlethread_workqueue(name) \
+- alloc_workqueue("%s", WQ_UNBOUND | WQ_MEM_RECLAIM, 1, (name))
++ alloc_ordered_workqueue("%s", WQ_MEM_RECLAIM, name)
+
+ extern void destroy_workqueue(struct workqueue_struct *wq);
+