--- /dev/null
+From 075163bbb0f51174359947e1bce84f5edb23f21e Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date: Thu, 20 Jun 2013 13:57:07 +0530
+Subject: ath9k_htc: Handle IDLE state transition properly
+
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+
+commit 075163bbb0f51174359947e1bce84f5edb23f21e upstream.
+
+Make sure that a chip reset is done when IDLE is turned
+off - this fixes authentication timeouts.
+
+Reported-by: Ignacy Gawedzki <i@lri.fr>
+Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/htc_drv_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -1174,7 +1174,7 @@ static int ath9k_htc_config(struct ieee8
+ mutex_lock(&priv->htc_pm_lock);
+
+ priv->ps_idle = !!(conf->flags & IEEE80211_CONF_IDLE);
+- if (priv->ps_idle)
++ if (!priv->ps_idle)
+ chip_reset = true;
+
+ mutex_unlock(&priv->htc_pm_lock);
--- /dev/null
+From 300b962e5244a1ea010df7e88595faa0085b461d Mon Sep 17 00:00:00 2001
+From: Anderson Lizardo <anderson.lizardo@openbossa.org>
+Date: Sun, 2 Jun 2013 16:30:40 -0400
+Subject: Bluetooth: Fix crash in l2cap_build_cmd() with small MTU
+
+From: Anderson Lizardo <anderson.lizardo@openbossa.org>
+
+commit 300b962e5244a1ea010df7e88595faa0085b461d upstream.
+
+If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus
+controller, memory corruption happens due to a memcpy() call with
+negative length.
+
+Fix this crash on either incoming or outgoing connections with a MTU
+smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE:
+
+[ 46.885433] BUG: unable to handle kernel paging request at f56ad000
+[ 46.888037] IP: [<c03d94cd>] memcpy+0x1d/0x40
+[ 46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060
+[ 46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
+[ 46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common
+[ 46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12
+[ 46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
+[ 46.888037] Workqueue: hci0 hci_rx_work [bluetooth]
+[ 46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000
+[ 46.888037] EIP: 0060:[<c03d94cd>] EFLAGS: 00010212 CPU: 0
+[ 46.888037] EIP is at memcpy+0x1d/0x40
+[ 46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2
+[ 46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c
+[ 46.888037] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+[ 46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0
+[ 46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
+[ 46.888037] DR6: ffff0ff0 DR7: 00000400
+[ 46.888037] Stack:
+[ 46.888037] fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000
+[ 46.888037] f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560
+[ 46.888037] f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2
+[ 46.888037] Call Trace:
+[ 46.888037] [<f8c6a54c>] l2cap_send_cmd+0x1cc/0x230 [bluetooth]
+[ 46.888037] [<f8c69eb2>] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth]
+[ 46.888037] [<f8c6f4c7>] l2cap_connect+0x3f7/0x540 [bluetooth]
+[ 46.888037] [<c019b37b>] ? trace_hardirqs_off+0xb/0x10
+[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
+[ 46.888037] [<c064ad20>] ? mutex_lock_nested+0x280/0x360
+[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
+[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
+[ 46.888037] [<c064ad08>] ? mutex_lock_nested+0x268/0x360
+[ 46.888037] [<c01a125b>] ? trace_hardirqs_on+0xb/0x10
+[ 46.888037] [<f8c72f8d>] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth]
+[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
+[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
+[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
+[ 46.888037] [<f8c754f1>] l2cap_recv_acldata+0x2a1/0x320 [bluetooth]
+[ 46.888037] [<f8c491d8>] hci_rx_work+0x518/0x810 [bluetooth]
+[ 46.888037] [<f8c48df2>] ? hci_rx_work+0x132/0x810 [bluetooth]
+[ 46.888037] [<c0158979>] process_one_work+0x1a9/0x600
+[ 46.888037] [<c01588fb>] ? process_one_work+0x12b/0x600
+[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
+[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
+[ 46.888037] [<c0159187>] worker_thread+0xf7/0x320
+[ 46.888037] [<c0159090>] ? rescuer_thread+0x290/0x290
+[ 46.888037] [<c01602f8>] kthread+0xa8/0xb0
+[ 46.888037] [<c0656777>] ret_from_kernel_thread+0x1b/0x28
+[ 46.888037] [<c0160250>] ? flush_kthread_worker+0x120/0x120
+[ 46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6 <f3> a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89
+[ 46.888037] EIP: [<c03d94cd>] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c
+[ 46.888037] CR2: 00000000f56ad000
+[ 46.888037] ---[ end trace 0217c1f4d78714a9 ]---
+
+Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/l2cap_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -2743,6 +2743,9 @@ static struct sk_buff *l2cap_build_cmd(s
+ BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
+ conn, code, ident, dlen);
+
++ if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
++ return NULL;
++
+ len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
+ count = min_t(unsigned int, conn->mtu, len);
+
--- /dev/null
+From 3f6fa3d489e127ca5a5b298eabac3ff5dbe0e112 Mon Sep 17 00:00:00 2001
+From: Jaganath Kanakkassery <jaganath.k@samsung.com>
+Date: Fri, 21 Jun 2013 19:55:11 +0530
+Subject: Bluetooth: Fix invalid length check in l2cap_information_rsp()
+
+From: Jaganath Kanakkassery <jaganath.k@samsung.com>
+
+commit 3f6fa3d489e127ca5a5b298eabac3ff5dbe0e112 upstream.
+
+The length check is invalid since the length varies with type of
+info response.
+
+This was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888
+
+Because of this, l2cap info rsp is not handled and command reject is sent.
+
+> ACL data: handle 11 flags 0x02 dlen 16
+ L2CAP(s): Info rsp: type 2 result 0
+ Extended feature mask 0x00b8
+ Enhanced Retransmission mode
+ Streaming mode
+ FCS Option
+ Fixed Channels
+< ACL data: handle 11 flags 0x00 dlen 10
+ L2CAP(s): Command rej: reason 0
+ Command not understood
+
+Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
+Signed-off-by: Chan-Yeol Park <chanyeol.park@samsung.com>
+Acked-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/l2cap_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4224,7 +4224,7 @@ static inline int l2cap_information_rsp(
+ struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
+ u16 type, result;
+
+- if (cmd_len != sizeof(*rsp))
++ if (cmd_len < sizeof(*rsp))
+ return -EPROTO;
+
+ type = __le16_to_cpu(rsp->type);
--- /dev/null
+From 11eb2645cbf38a08ae491bf6c602eea900ec0bb5 Mon Sep 17 00:00:00 2001
+From: Zefan Li <lizefan@huawei.com>
+Date: Wed, 26 Jun 2013 15:29:54 +0800
+Subject: dlci: acquire rtnl_lock before calling __dev_get_by_name()
+
+From: Zefan Li <lizefan@huawei.com>
+
+commit 11eb2645cbf38a08ae491bf6c602eea900ec0bb5 upstream.
+
+Otherwise the net device returned can be freed at anytime.
+
+Signed-off-by: Li Zefan <lizefan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wan/dlci.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wan/dlci.c
++++ b/drivers/net/wan/dlci.c
+@@ -385,20 +385,24 @@ static int dlci_del(struct dlci_add *dlc
+ struct net_device *master, *slave;
+ int err;
+
++ rtnl_lock();
++
+ /* validate slave device */
+ master = __dev_get_by_name(&init_net, dlci->devname);
+- if (!master)
+- return -ENODEV;
++ if (!master) {
++ err = -ENODEV;
++ goto out;
++ }
+
+ if (netif_running(master)) {
+- return -EBUSY;
++ err = -EBUSY;
++ goto out;
+ }
+
+ dlp = netdev_priv(master);
+ slave = dlp->slave;
+ flp = netdev_priv(slave);
+
+- rtnl_lock();
+ err = (*flp->deassoc)(slave, master);
+ if (!err) {
+ list_del(&dlp->list);
+@@ -407,8 +411,8 @@ static int dlci_del(struct dlci_add *dlc
+
+ dev_put(slave);
+ }
++out:
+ rtnl_unlock();
+-
+ return err;
+ }
+
--- /dev/null
+From 578a1310f2592ba90c5674bca21c1dbd1adf3f0a Mon Sep 17 00:00:00 2001
+From: Zefan Li <lizefan@huawei.com>
+Date: Wed, 26 Jun 2013 15:31:58 +0800
+Subject: dlci: validate the net device in dlci_del()
+
+From: Zefan Li <lizefan@huawei.com>
+
+commit 578a1310f2592ba90c5674bca21c1dbd1adf3f0a upstream.
+
+We triggered an oops while running trinity with 3.4 kernel:
+
+BUG: unable to handle kernel paging request at 0000000100000d07
+IP: [<ffffffffa0109738>] dlci_ioctl+0xd8/0x2d4 [dlci]
+PGD 640c0d067 PUD 0
+Oops: 0000 [#1] PREEMPT SMP
+CPU 3
+...
+Pid: 7302, comm: trinity-child3 Not tainted 3.4.24.09+ 40 Huawei Technologies Co., Ltd. Tecal RH2285 /BC11BTSA
+RIP: 0010:[<ffffffffa0109738>] [<ffffffffa0109738>] dlci_ioctl+0xd8/0x2d4 [dlci]
+...
+Call Trace:
+ [<ffffffff8137c5c3>] sock_ioctl+0x153/0x280
+ [<ffffffff81195494>] do_vfs_ioctl+0xa4/0x5e0
+ [<ffffffff8118354a>] ? fget_light+0x3ea/0x490
+ [<ffffffff81195a1f>] sys_ioctl+0x4f/0x80
+ [<ffffffff81478b69>] system_call_fastpath+0x16/0x1b
+...
+
+It's because the net device is not a dlci device.
+
+Reported-by: Li Jinyue <lijinyue@huawei.com>
+Signed-off-by: Li Zefan <lizefan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wan/dlci.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/wan/dlci.c
++++ b/drivers/net/wan/dlci.c
+@@ -384,6 +384,7 @@ static int dlci_del(struct dlci_add *dlc
+ struct frad_local *flp;
+ struct net_device *master, *slave;
+ int err;
++ bool found = false;
+
+ rtnl_lock();
+
+@@ -393,6 +394,17 @@ static int dlci_del(struct dlci_add *dlc
+ err = -ENODEV;
+ goto out;
+ }
++
++ list_for_each_entry(dlp, &dlci_devs, list) {
++ if (dlp->master == master) {
++ found = true;
++ break;
++ }
++ }
++ if (!found) {
++ err = -ENODEV;
++ goto out;
++ }
+
+ if (netif_running(master)) {
+ err = -EBUSY;
--- /dev/null
+From 8b4d801b2b123b6c09742f861fe44a8527b84d47 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 20 Jun 2013 17:50:06 +0200
+Subject: hw_breakpoint: Fix cpu check in task_bp_pinned(cpu)
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit 8b4d801b2b123b6c09742f861fe44a8527b84d47 upstream.
+
+trinity fuzzer triggered WARN_ONCE("Can't find any breakpoint
+slot") in arch_install_hw_breakpoint() but the problem is not
+arch-specific.
+
+The problem is, task_bp_pinned(cpu) checks "cpu == iter->cpu"
+but this doesn't account the "all cpus" events with iter->cpu <
+0.
+
+This means that, say, register_user_hw_breakpoint(tsk) can
+happily create the arbitrary number > HBP_NUM of breakpoints
+which can not be activated. toggle_bp_task_slot() is equally
+wrong by the same reason and nr_task_bp_pinned[] can have
+negative entries.
+
+Simple test:
+
+ # perl -e 'sleep 1 while 1' &
+ # perf record -e mem:0x10,mem:0x10,mem:0x10,mem:0x10,mem:0x10 -p `pidof perl`
+
+Before this patch this triggers the same problem/WARN_ON(),
+after the patch it correctly fails with -ENOSPC.
+
+Reported-by: Vince Weaver <vincent.weaver@maine.edu>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Frederic Weisbecker <fweisbec@gmail.com>
+Link: http://lkml.kernel.org/r/20130620155006.GA6324@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/hw_breakpoint.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/events/hw_breakpoint.c
++++ b/kernel/events/hw_breakpoint.c
+@@ -120,7 +120,7 @@ static int task_bp_pinned(int cpu, struc
+ list_for_each_entry(iter, &bp_task_head, hw.bp_list) {
+ if (iter->hw.bp_target == tsk &&
+ find_slot_idx(iter) == type &&
+- cpu == iter->cpu)
++ (iter->cpu < 0 || cpu == iter->cpu))
+ count += hw_breakpoint_weight(iter);
+ }
+
--- /dev/null
+From c790b0ad23f427c7522ffed264706238c57c007e Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 20 Jun 2013 17:50:09 +0200
+Subject: hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit c790b0ad23f427c7522ffed264706238c57c007e upstream.
+
+fetch_bp_busy_slots() and toggle_bp_slot() use
+for_each_online_cpu(), this is obviously wrong wrt cpu_up() or
+cpu_down(), we can over/under account the per-cpu numbers.
+
+For example:
+
+ # echo 0 >> /sys/devices/system/cpu/cpu1/online
+ # perf record -e mem:0x10 -p 1 &
+ # echo 1 >> /sys/devices/system/cpu/cpu1/online
+ # perf record -e mem:0x10,mem:0x10,mem:0x10,mem:0x10 -C1 -a &
+ # taskset -p 0x2 1
+
+triggers the same WARN_ONCE("Can't find any breakpoint slot") in
+arch_install_hw_breakpoint().
+
+Reported-by: Vince Weaver <vincent.weaver@maine.edu>
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Frederic Weisbecker <fweisbec@gmail.com>
+Link: http://lkml.kernel.org/r/20130620155009.GA6327@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/hw_breakpoint.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/events/hw_breakpoint.c
++++ b/kernel/events/hw_breakpoint.c
+@@ -149,7 +149,7 @@ fetch_bp_busy_slots(struct bp_busy_slots
+ return;
+ }
+
+- for_each_online_cpu(cpu) {
++ for_each_possible_cpu(cpu) {
+ unsigned int nr;
+
+ nr = per_cpu(nr_cpu_bp_pinned[type], cpu);
+@@ -235,7 +235,7 @@ toggle_bp_slot(struct perf_event *bp, bo
+ if (cpu >= 0) {
+ toggle_bp_task_slot(bp, cpu, enable, type, weight);
+ } else {
+- for_each_online_cpu(cpu)
++ for_each_possible_cpu(cpu)
+ toggle_bp_task_slot(bp, cpu, enable, type, weight);
+ }
+
--- /dev/null
+From b28b6dfe580ab1ab8bf08b908fd69e299b877103 Mon Sep 17 00:00:00 2001
+From: Nikolay Martynov <mar.kolya@gmail.com>
+Date: Fri, 31 May 2013 01:29:12 -0400
+Subject: iwlwifi: dvm: fix chain noise calibration
+
+From: Nikolay Martynov <mar.kolya@gmail.com>
+
+commit b28b6dfe580ab1ab8bf08b908fd69e299b877103 upstream.
+
+First step of chain noise calibration process had disable flag
+check inverted. Chain noise calibration never started because
+of this.
+
+Tested on intel 5300 with two antennas attached. The driver
+correctly disabled one chain.
+
+Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/dvm/rxon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
++++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
+@@ -1377,7 +1377,7 @@ static void iwlagn_chain_noise_reset(str
+ struct iwl_chain_noise_data *data = &priv->chain_noise_data;
+ int ret;
+
+- if (!(priv->calib_disabled & IWL_CHAIN_NOISE_CALIB_DISABLED))
++ if (priv->calib_disabled & IWL_CHAIN_NOISE_CALIB_DISABLED)
+ return;
+
+ if ((data->state == IWL_CHAIN_NOISE_ALIVE) &&
--- /dev/null
+From 6d446ec32f169c6a5d9bc90684a8082a6cbe90f6 Mon Sep 17 00:00:00 2001
+From: Gavin Shan <shangw@linux.vnet.ibm.com>
+Date: Tue, 25 Jun 2013 15:24:32 +0800
+Subject: net/tg3: Avoid delay during MMIO access
+
+From: Gavin Shan <shangw@linux.vnet.ibm.com>
+
+commit 6d446ec32f169c6a5d9bc90684a8082a6cbe90f6 upstream.
+
+When the EEH error is the result of a fenced host bridge, MMIO accesses
+can be very slow (milliseconds) to timeout and return all 1's,
+thus causing the driver various timeout loops to take way too long and
+trigger soft-lockup warnings (in addition to taking minutes to recover).
+
+It might be worthwhile to check if for any of these cases, ffffffff is
+a valid possible value, and if not, bail early since that means the HW
+is either gone or isolated. In the meantime, checking that the PCI channel
+is offline would be workaround of the problem.
+
+Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/tg3.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -743,6 +743,9 @@ static int tg3_ape_lock(struct tg3 *tp,
+ status = tg3_ape_read32(tp, gnt + off);
+ if (status == bit)
+ break;
++ if (pci_channel_offline(tp->pdev))
++ break;
++
+ udelay(10);
+ }
+
+@@ -1634,6 +1637,9 @@ static void tg3_wait_for_event_ack(struc
+ for (i = 0; i < delay_cnt; i++) {
+ if (!(tr32(GRC_RX_CPU_EVENT) & GRC_RX_CPU_DRIVER_EVENT))
+ break;
++ if (pci_channel_offline(tp->pdev))
++ break;
++
+ udelay(8);
+ }
+ }
+@@ -1812,6 +1818,9 @@ static int tg3_poll_fw(struct tg3 *tp)
+ for (i = 0; i < 200; i++) {
+ if (tr32(VCPU_STATUS) & VCPU_STATUS_INIT_DONE)
+ return 0;
++ if (pci_channel_offline(tp->pdev))
++ return -ENODEV;
++
+ udelay(100);
+ }
+ return -ENODEV;
+@@ -1822,6 +1831,15 @@ static int tg3_poll_fw(struct tg3 *tp)
+ tg3_read_mem(tp, NIC_SRAM_FIRMWARE_MBOX, &val);
+ if (val == ~NIC_SRAM_FIRMWARE_MBOX_MAGIC1)
+ break;
++ if (pci_channel_offline(tp->pdev)) {
++ if (!tg3_flag(tp, NO_FWARE_REPORTED)) {
++ tg3_flag_set(tp, NO_FWARE_REPORTED);
++ netdev_info(tp->dev, "No firmware running\n");
++ }
++
++ break;
++ }
++
+ udelay(10);
+ }
+
+@@ -3411,6 +3429,8 @@ static int tg3_nvram_write_block_buffere
+ ret = tg3_nvram_exec_cmd(tp, nvram_cmd);
+ if (ret)
+ break;
++ if (pci_channel_offline(tp->pdev))
++ return -EBUSY;
+ }
+ return ret;
+ }
+@@ -8224,6 +8244,14 @@ static int tg3_stop_block(struct tg3 *tp
+ tw32_f(ofs, val);
+
+ for (i = 0; i < MAX_WAIT_CNT; i++) {
++ if (pci_channel_offline(tp->pdev)) {
++ dev_err(&tp->pdev->dev,
++ "tg3_stop_block device offline, "
++ "ofs=%lx enable_bit=%x\n",
++ ofs, enable_bit);
++ return -ENODEV;
++ }
++
+ udelay(100);
+ val = tr32(ofs);
+ if ((val & enable_bit) == 0)
+@@ -8247,6 +8275,13 @@ static int tg3_abort_hw(struct tg3 *tp,
+
+ tg3_disable_ints(tp);
+
++ if (pci_channel_offline(tp->pdev)) {
++ tp->rx_mode &= ~(RX_MODE_ENABLE | TX_MODE_ENABLE);
++ tp->mac_mode &= ~MAC_MODE_TDE_ENABLE;
++ err = -ENODEV;
++ goto err_no_dev;
++ }
++
+ tp->rx_mode &= ~RX_MODE_ENABLE;
+ tw32_f(MAC_RX_MODE, tp->rx_mode);
+ udelay(10);
+@@ -8295,6 +8330,7 @@ static int tg3_abort_hw(struct tg3 *tp,
+ err |= tg3_stop_block(tp, BUFMGR_MODE, BUFMGR_MODE_ENABLE, silent);
+ err |= tg3_stop_block(tp, MEMARB_MODE, MEMARB_MODE_ENABLE, silent);
+
++err_no_dev:
+ for (i = 0; i < tp->irq_cnt; i++) {
+ struct tg3_napi *tnapi = &tp->napi[i];
+ if (tnapi->hw_status)
--- /dev/null
+From 8c8d2017ba25c510ddf093419048460db1109bc4 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 11 Jun 2013 18:48:53 +0200
+Subject: rt2800: fix RT5390 & RT3290 TX power settings regression
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 8c8d2017ba25c510ddf093419048460db1109bc4 upstream.
+
+My change:
+
+commit cee2c7315f60beeff6137ee59e99acc77d636eeb
+Author: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri Oct 5 13:44:09 2012 +0200
+
+ rt2800: use BBP_R1 for setting tx power
+
+unfortunately does not work well with RT5390 and RT3290 chips as they
+require different temperature compensation TX power settings (TSSI
+tuning). Since that commit make wireless connection very unstable on
+those chips, restore previous behavior to fix regression. Once we
+implement proper TSSI tuning on 5390/3290 we can restore back setting
+TX power by BBP_R1 register for those chips.
+
+Reported-and-tested-by: Mike Romberg <mike-romberg@comcast.net>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2800lib.c | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -2634,19 +2634,26 @@ static void rt2800_config_txpower(struct
+ * TODO: we do not use +6 dBm option to do not increase power beyond
+ * regulatory limit, however this could be utilized for devices with
+ * CAPABILITY_POWER_LIMIT.
++ *
++ * TODO: add different temperature compensation code for RT3290 & RT5390
++ * to allow to use BBP_R1 for those chips.
+ */
+- rt2800_bbp_read(rt2x00dev, 1, &r1);
+- if (delta <= -12) {
+- power_ctrl = 2;
+- delta += 12;
+- } else if (delta <= -6) {
+- power_ctrl = 1;
+- delta += 6;
+- } else {
+- power_ctrl = 0;
++ if (!rt2x00_rt(rt2x00dev, RT3290) &&
++ !rt2x00_rt(rt2x00dev, RT5390)) {
++ rt2800_bbp_read(rt2x00dev, 1, &r1);
++ if (delta <= -12) {
++ power_ctrl = 2;
++ delta += 12;
++ } else if (delta <= -6) {
++ power_ctrl = 1;
++ delta += 6;
++ } else {
++ power_ctrl = 0;
++ }
++ rt2x00_set_field8(&r1, BBP1_TX_POWER_CTRL, power_ctrl);
++ rt2800_bbp_write(rt2x00dev, 1, r1);
+ }
+- rt2x00_set_field8(&r1, BBP1_TX_POWER_CTRL, power_ctrl);
+- rt2800_bbp_write(rt2x00dev, 1, r1);
++
+ offset = TX_PWR_CFG_0;
+
+ for (i = 0; i < EEPROM_TXPOWER_BYRATE_SIZE; i += 2) {
--- /dev/null
+From 690cec8e70c211d1f5f6e520b21a68d0306173b6 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Fri, 14 Jun 2013 01:18:44 +0100
+Subject: s390/irq: Only define synchronize_irq() on SMP
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 690cec8e70c211d1f5f6e520b21a68d0306173b6 upstream.
+
+In uniprocessor configurations, synchronize_irq() is defined in
+<linux/hardirq.h> as a macro, and this function definition fails to
+compile.
+
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/irq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/s390/kernel/irq.c
++++ b/arch/s390/kernel/irq.c
+@@ -314,6 +314,7 @@ void measurement_alert_subclass_unregist
+ }
+ EXPORT_SYMBOL(measurement_alert_subclass_unregister);
+
++#ifdef CONFIG_SMP
+ void synchronize_irq(unsigned int irq)
+ {
+ /*
+@@ -322,6 +323,7 @@ void synchronize_irq(unsigned int irq)
+ */
+ }
+ EXPORT_SYMBOL_GPL(synchronize_irq);
++#endif
+
+ #ifndef CONFIG_PCI
+
--- /dev/null
+From c46b54f7406780ec4cf9c9124d1cfb777674dc70 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 10 Jun 2013 15:34:04 +0200
+Subject: s390/pci: Implement IRQ functions if !PCI
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit c46b54f7406780ec4cf9c9124d1cfb777674dc70 upstream.
+
+All architectures must implement IRQ functions. Since various
+dependencies on !S390 were removed, there are various drivers that can
+be selected but will fail to link. Provide a dummy implementation of
+these functions for the !PCI case.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/irq.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++
+ arch/s390/pci/pci.c | 33 -------------------------
+ 2 files changed, 64 insertions(+), 33 deletions(-)
+
+--- a/arch/s390/kernel/irq.c
++++ b/arch/s390/kernel/irq.c
+@@ -313,3 +313,67 @@ void measurement_alert_subclass_unregist
+ spin_unlock(&ma_subclass_lock);
+ }
+ EXPORT_SYMBOL(measurement_alert_subclass_unregister);
++
++void synchronize_irq(unsigned int irq)
++{
++ /*
++ * Not needed, the handler is protected by a lock and IRQs that occur
++ * after the handler is deleted are just NOPs.
++ */
++}
++EXPORT_SYMBOL_GPL(synchronize_irq);
++
++#ifndef CONFIG_PCI
++
++/* Only PCI devices have dynamically-defined IRQ handlers */
++
++int request_irq(unsigned int irq, irq_handler_t handler,
++ unsigned long irqflags, const char *devname, void *dev_id)
++{
++ return -EINVAL;
++}
++EXPORT_SYMBOL_GPL(request_irq);
++
++void free_irq(unsigned int irq, void *dev_id)
++{
++ WARN_ON(1);
++}
++EXPORT_SYMBOL_GPL(free_irq);
++
++void enable_irq(unsigned int irq)
++{
++ WARN_ON(1);
++}
++EXPORT_SYMBOL_GPL(enable_irq);
++
++void disable_irq(unsigned int irq)
++{
++ WARN_ON(1);
++}
++EXPORT_SYMBOL_GPL(disable_irq);
++
++#endif /* !CONFIG_PCI */
++
++void disable_irq_nosync(unsigned int irq)
++{
++ disable_irq(irq);
++}
++EXPORT_SYMBOL_GPL(disable_irq_nosync);
++
++unsigned long probe_irq_on(void)
++{
++ return 0;
++}
++EXPORT_SYMBOL_GPL(probe_irq_on);
++
++int probe_irq_off(unsigned long val)
++{
++ return 0;
++}
++EXPORT_SYMBOL_GPL(probe_irq_off);
++
++unsigned int probe_irq_mask(unsigned long val)
++{
++ return val;
++}
++EXPORT_SYMBOL_GPL(probe_irq_mask);
+--- a/arch/s390/pci/pci.c
++++ b/arch/s390/pci/pci.c
+@@ -306,15 +306,6 @@ static int zpci_cfg_store(struct zpci_de
+ return rc;
+ }
+
+-void synchronize_irq(unsigned int irq)
+-{
+- /*
+- * Not needed, the handler is protected by a lock and IRQs that occur
+- * after the handler is deleted are just NOPs.
+- */
+-}
+-EXPORT_SYMBOL_GPL(synchronize_irq);
+-
+ void enable_irq(unsigned int irq)
+ {
+ struct msi_desc *msi = irq_get_msi_desc(irq);
+@@ -331,30 +322,6 @@ void disable_irq(unsigned int irq)
+ }
+ EXPORT_SYMBOL_GPL(disable_irq);
+
+-void disable_irq_nosync(unsigned int irq)
+-{
+- disable_irq(irq);
+-}
+-EXPORT_SYMBOL_GPL(disable_irq_nosync);
+-
+-unsigned long probe_irq_on(void)
+-{
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(probe_irq_on);
+-
+-int probe_irq_off(unsigned long val)
+-{
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(probe_irq_off);
+-
+-unsigned int probe_irq_mask(unsigned long val)
+-{
+- return val;
+-}
+-EXPORT_SYMBOL_GPL(probe_irq_mask);
+-
+ void pcibios_fixup_bus(struct pci_bus *bus)
+ {
+ }
arm-7762-1-kernel-fix-arm_dt_init_cpu_maps-to-skip-non-cpu-nodes.patch
arm-7755-1-handle-user-space-mapped-pages-in-flush_kernel_dcache_page.patch
arm-7772-1-fix-missing-flush_kernel_dcache_page-for-nommu.patch
+bluetooth-fix-crash-in-l2cap_build_cmd-with-small-mtu.patch
+bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch
+hw_breakpoint-fix-cpu-check-in-task_bp_pinned-cpu.patch
+hw_breakpoint-use-cpu_possible_mask-in-reserve-release-_bp_slot.patch
+ath9k_htc-handle-idle-state-transition-properly.patch
+iwlwifi-dvm-fix-chain-noise-calibration.patch
+s390-pci-implement-irq-functions-if-pci.patch
+s390-irq-only-define-synchronize_irq-on-smp.patch
+dlci-acquire-rtnl_lock-before-calling-__dev_get_by_name.patch
+dlci-validate-the-net-device-in-dlci_del.patch
+net-tg3-avoid-delay-during-mmio-access.patch
+rt2800-fix-rt5390-rt3290-tx-power-settings-regression.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
