--- /dev/null
+From 6ab982e8cf8e5760da407ccdc4abc815bea23179 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 17 Jun 2013 10:19:49 +0200
+Subject: ALSA: hda - Fix pin configurations for MacBook Air 4,2
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 6ab982e8cf8e5760da407ccdc4abc815bea23179 upstream.
+
+MacBook Air 4,2 requires the whole default pin configuration table to
+be overridden by the driver, as usual, as Apple's machines don't set
+up properly after boot. Otherwise mic won't work, and other ill
+effect may happen.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=59381
+Reported-and-tested-by: Peter John Hartman <peterjohnhartman@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_cirrus.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -58,6 +58,7 @@ enum {
+ CS420X_GPIO_23,
+ CS420X_MBP101,
+ CS420X_MBP81,
++ CS420X_MBA42,
+ CS420X_AUTO,
+ /* aliases */
+ CS420X_IMAC27_122 = CS420X_GPIO_23,
+@@ -345,6 +346,7 @@ static const struct hda_model_fixup cs42
+ { .id = CS420X_APPLE, .name = "apple" },
+ { .id = CS420X_MBP101, .name = "mbp101" },
+ { .id = CS420X_MBP81, .name = "mbp81" },
++ { .id = CS420X_MBA42, .name = "mba42" },
+ {}
+ };
+
+@@ -360,6 +362,7 @@ static const struct snd_pci_quirk cs420x
+ SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
+ SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
+ SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
++ SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
+ SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
+ {} /* terminator */
+ };
+@@ -413,6 +416,20 @@ static const struct hda_pintbl mbp101_pi
+ {} /* terminator */
+ };
+
++static const struct hda_pintbl mba42_pincfgs[] = {
++ { 0x09, 0x012b4030 }, /* HP */
++ { 0x0a, 0x400000f0 },
++ { 0x0b, 0x90100120 }, /* speaker */
++ { 0x0c, 0x400000f0 },
++ { 0x0d, 0x90a00110 }, /* mic */
++ { 0x0e, 0x400000f0 },
++ { 0x0f, 0x400000f0 },
++ { 0x10, 0x400000f0 },
++ { 0x12, 0x400000f0 },
++ { 0x15, 0x400000f0 },
++ {} /* terminator */
++};
++
+ static void cs420x_fixup_gpio_13(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -481,6 +498,12 @@ static const struct hda_fixup cs420x_fix
+ .chained = true,
+ .chain_id = CS420X_GPIO_13,
+ },
++ [CS420X_MBA42] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = mba42_pincfgs,
++ .chained = true,
++ .chain_id = CS420X_GPIO_13,
++ },
+ };
+
+ static struct cs_spec *cs_alloc_spec(struct hda_codec *codec, int vendor_nid)
--- /dev/null
+From 36691e1be6ec551eef4a5225f126a281f8c051c2 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 17 Jun 2013 10:25:02 +0200
+Subject: ALSA: usb-audio: Fix invalid volume resolution for Logitech HD Webcam c310
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 36691e1be6ec551eef4a5225f126a281f8c051c2 upstream.
+
+Just like the previous fix for LogitechHD Webcam c270 in commit
+11e7064f35bb87da8f427d1aa4bbd8b7473a3993, c310 model also requires the
+same workaround for avoiding the kernel warning.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=59741
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -885,6 +885,7 @@ static void volume_control_quirks(struct
+
+ case USB_ID(0x046d, 0x0808):
+ case USB_ID(0x046d, 0x0809):
++ case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+ case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
+ case USB_ID(0x046d, 0x0991):
--- /dev/null
+From 342cda29343a6272c630f94ed56810a76740251b Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Sat, 15 Jun 2013 11:21:09 +0200
+Subject: ALSA: usb-audio: work around Android accessory firmware bug
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 342cda29343a6272c630f94ed56810a76740251b upstream.
+
+When the Android firmware enables the audio interfaces in accessory
+mode, it always declares in the control interface's baInterfaceNr array
+that interfaces 0 and 1 belong to the audio function. However, the
+accessory interface itself, if also enabled, already is at index 0 and
+shifts the actual audio interface numbers to 1 and 2, which prevents the
+PCM streaming interface from being seen by the host driver.
+
+To get the PCM interface interface to work, detect when the descriptors
+point to the (for this driver useless) accessory interface, and redirect
+to the correct one.
+
+Reported-by: Jeremy Rosen <jeremy.rosen@openwide.fr>
+Tested-by: Jeremy Rosen <jeremy.rosen@openwide.fr>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/card.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -144,14 +144,32 @@ static int snd_usb_create_stream(struct
+ return -EINVAL;
+ }
+
++ alts = &iface->altsetting[0];
++ altsd = get_iface_desc(alts);
++
++ /*
++ * Android with both accessory and audio interfaces enabled gets the
++ * interface numbers wrong.
++ */
++ if ((chip->usb_id == USB_ID(0x18d1, 0x2d04) ||
++ chip->usb_id == USB_ID(0x18d1, 0x2d05)) &&
++ interface == 0 &&
++ altsd->bInterfaceClass == USB_CLASS_VENDOR_SPEC &&
++ altsd->bInterfaceSubClass == USB_SUBCLASS_VENDOR_SPEC) {
++ interface = 2;
++ iface = usb_ifnum_to_if(dev, interface);
++ if (!iface)
++ return -EINVAL;
++ alts = &iface->altsetting[0];
++ altsd = get_iface_desc(alts);
++ }
++
+ if (usb_interface_claimed(iface)) {
+ snd_printdd(KERN_INFO "%d:%d:%d: skipping, already claimed\n",
+ dev->devnum, ctrlif, interface);
+ return -EINVAL;
+ }
+
+- alts = &iface->altsetting[0];
+- altsd = get_iface_desc(alts);
+ if ((altsd->bInterfaceClass == USB_CLASS_AUDIO ||
+ altsd->bInterfaceClass == USB_CLASS_VENDOR_SPEC) &&
+ altsd->bInterfaceSubClass == USB_SUBCLASS_MIDISTREAMING) {
--- /dev/null
+From 691557941af4c12bd307ad81a4d9fa9c7743ac28 Mon Sep 17 00:00:00 2001
+From: Jon Medhurst <tixy@linaro.org>
+Date: Fri, 7 Jun 2013 10:35:35 +0100
+Subject: ARM: 7752/1: errata: LoUIS bit field in CLIDR register is incorrect
+
+From: Jon Medhurst <tixy@linaro.org>
+
+commit 691557941af4c12bd307ad81a4d9fa9c7743ac28 upstream.
+
+On Cortex-A9 before version r1p0, the LoUIS bit field of the CLIDR
+register returns zero when it should return one. This leads to cache
+maintenance operations which rely on this value to not function as
+intended, causing data corruption.
+
+The workaround for this errata is to detect affected CPUs and correct
+the LoUIS value read.
+
+Acked-by: Will Deacon <will.deacon@arm.com>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Jon Medhurst <tixy@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/Kconfig | 10 ++++++++++
+ arch/arm/mm/cache-v7.S | 8 ++++++++
+ 2 files changed, 18 insertions(+)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1306,6 +1306,16 @@ config PL310_ERRATA_588369
+ is not correctly implemented in PL310 as clean lines are not
+ invalidated as a result of these operations.
+
++config ARM_ERRATA_643719
++ bool "ARM errata: LoUIS bit field in CLIDR register is incorrect"
++ depends on CPU_V7 && SMP
++ help
++ This option enables the workaround for the 643719 Cortex-A9 (prior to
++ r1p0) erratum. On affected cores the LoUIS bit field of the CLIDR
++ register returns zero when it should return one. The workaround
++ corrects this value, ensuring cache maintenance operations which use
++ it behave as intended and avoiding data corruption.
++
+ config ARM_ERRATA_720789
+ bool "ARM errata: TLBIASIDIS and TLBIMVAIS operations can broadcast a faulty ASID"
+ depends on CPU_V7
+--- a/arch/arm/mm/cache-v7.S
++++ b/arch/arm/mm/cache-v7.S
+@@ -92,6 +92,14 @@ ENTRY(v7_flush_dcache_louis)
+ mrc p15, 1, r0, c0, c0, 1 @ read clidr, r0 = clidr
+ ALT_SMP(ands r3, r0, #(7 << 21)) @ extract LoUIS from clidr
+ ALT_UP(ands r3, r0, #(7 << 27)) @ extract LoUU from clidr
++#ifdef CONFIG_ARM_ERRATA_643719
++ ALT_SMP(mrceq p15, 0, r2, c0, c0, 0) @ read main ID register
++ ALT_UP(moveq pc, lr) @ LoUU is zero, so nothing to do
++ ldreq r1, =0x410fc090 @ ID of ARM Cortex A9 r0p?
++ biceq r2, r2, #0x0000000f @ clear minor revision number
++ teqeq r2, r1 @ test for errata affected core and if so...
++ orreqs r3, #(1 << 21) @ fix LoUIS value (and set flags state to 'ne')
++#endif
+ ALT_SMP(mov r3, r3, lsr #20) @ r3 = LoUIS * 2
+ ALT_UP(mov r3, r3, lsr #26) @ r3 = LoUU * 2
+ moveq pc, lr @ return if level == 0
--- /dev/null
+From 049be07053ebbf0ee8543caea23ae7bdf0765bb2 Mon Sep 17 00:00:00 2001
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Date: Mon, 10 Jun 2013 18:05:51 +0100
+Subject: ARM: 7754/1: Fix the CPU ID and the mask associated to the PJ4B
+
+From: Gregory CLEMENT <gregory.clement@free-electrons.com>
+
+commit 049be07053ebbf0ee8543caea23ae7bdf0765bb2 upstream.
+
+This commit fixes the ID and mask for the PJ4B which was too
+restrictive and didn't match the CPU of the Armada 370 SoC.
+
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Reviewed-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/proc-v7.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -407,8 +407,8 @@ __v7_ca9mp_proc_info:
+ */
+ .type __v7_pj4b_proc_info, #object
+ __v7_pj4b_proc_info:
+- .long 0x562f5840
+- .long 0xfffffff0
++ .long 0x560f5800
++ .long 0xff0fff00
+ __v7_proc __v7_pj4b_setup
+ .size __v7_pj4b_proc_info, . - __v7_pj4b_proc_info
+ #endif /* CONFIG_ARM_LPAE */
--- /dev/null
+From 1bc39742aab09248169ef9d3727c9def3528b3f3 Mon Sep 17 00:00:00 2001
+From: Simon Baatz <gmbnomis@gmail.com>
+Date: Mon, 10 Jun 2013 21:10:12 +0100
+Subject: ARM: 7755/1: handle user space mapped pages in flush_kernel_dcache_page
+
+From: Simon Baatz <gmbnomis@gmail.com>
+
+commit 1bc39742aab09248169ef9d3727c9def3528b3f3 upstream.
+
+Commit f8b63c1 made flush_kernel_dcache_page a no-op assuming that
+the pages it needs to handle are kernel mapped only. However, for
+example when doing direct I/O, pages with user space mappings may
+occur.
+
+Thus, continue to do lazy flushing if there are no user space
+mappings. Otherwise, flush the kernel cache lines directly.
+
+Signed-off-by: Simon Baatz <gmbnomis@gmail.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/cacheflush.h | 4 +---
+ arch/arm/mm/flush.c | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 34 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/include/asm/cacheflush.h
++++ b/arch/arm/include/asm/cacheflush.h
+@@ -320,9 +320,7 @@ static inline void flush_anon_page(struc
+ }
+
+ #define ARCH_HAS_FLUSH_KERNEL_DCACHE_PAGE
+-static inline void flush_kernel_dcache_page(struct page *page)
+-{
+-}
++extern void flush_kernel_dcache_page(struct page *);
+
+ #define flush_dcache_mmap_lock(mapping) \
+ spin_lock_irq(&(mapping)->tree_lock)
+--- a/arch/arm/mm/flush.c
++++ b/arch/arm/mm/flush.c
+@@ -298,6 +298,39 @@ void flush_dcache_page(struct page *page
+ EXPORT_SYMBOL(flush_dcache_page);
+
+ /*
++ * Ensure cache coherency for the kernel mapping of this page. We can
++ * assume that the page is pinned via kmap.
++ *
++ * If the page only exists in the page cache and there are no user
++ * space mappings, this is a no-op since the page was already marked
++ * dirty at creation. Otherwise, we need to flush the dirty kernel
++ * cache lines directly.
++ */
++void flush_kernel_dcache_page(struct page *page)
++{
++ if (cache_is_vivt() || cache_is_vipt_aliasing()) {
++ struct address_space *mapping;
++
++ mapping = page_mapping(page);
++
++ if (!mapping || mapping_mapped(mapping)) {
++ void *addr;
++
++ addr = page_address(page);
++ /*
++ * kmap_atomic() doesn't set the page virtual
++ * address for highmem pages, and
++ * kunmap_atomic() takes care of cache
++ * flushing already.
++ */
++ if (!IS_ENABLED(CONFIG_HIGHMEM) || addr)
++ __cpuc_flush_dcache_area(addr, PAGE_SIZE);
++ }
++ }
++}
++EXPORT_SYMBOL(flush_kernel_dcache_page);
++
++/*
+ * Flush an anonymous page so that users of get_user_pages()
+ * can safely access the data. The expected sequence is:
+ *
--- /dev/null
+From b3657453f16a7b84eab9b93bb9a9a2901ffc70af Mon Sep 17 00:00:00 2001
+From: Hante Meuleman <meuleman@broadcom.com>
+Date: Mon, 27 May 2013 21:09:53 +0200
+Subject: brcmfmac: Turn off ARP offloading when configured for AP.
+
+From: Hante Meuleman <meuleman@broadcom.com>
+
+commit b3657453f16a7b84eab9b93bb9a9a2901ffc70af upstream.
+
+ARP offloading should only be used in STA or P2P client mode. It
+is currently configured once at init. When being configured for AP
+ARP offloading should be turned off and when AP mode is left it can
+be turned back on.
+
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c | 18 --------
+ drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h | 6 ++
+ drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 40 +++++++++++++++++-
+ 3 files changed, 45 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+@@ -26,7 +26,6 @@
+ #include "fwil.h"
+
+ #define PKTFILTER_BUF_SIZE 128
+-#define BRCMF_ARPOL_MODE 0xb /* agent|snoop|peer_autoreply */
+ #define BRCMF_DEFAULT_BCN_TIMEOUT 3
+ #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40
+ #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
+@@ -337,23 +336,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ goto done;
+ }
+
+- /* Try to set and enable ARP offload feature, this may fail */
+- err = brcmf_fil_iovar_int_set(ifp, "arp_ol", BRCMF_ARPOL_MODE);
+- if (err) {
+- brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
+- BRCMF_ARPOL_MODE, err);
+- err = 0;
+- } else {
+- err = brcmf_fil_iovar_int_set(ifp, "arpoe", 1);
+- if (err) {
+- brcmf_dbg(TRACE, "failed to enable ARP offload err = %d\n",
+- err);
+- err = 0;
+- } else
+- brcmf_dbg(TRACE, "successfully enabled ARP offload to 0x%x\n",
+- BRCMF_ARPOL_MODE);
+- }
+-
+ /* Setup packet filter */
+ brcmf_c_pktfilter_offload_set(ifp, BRCMF_DEFAULT_PACKET_FILTER);
+ brcmf_c_pktfilter_offload_enable(ifp, BRCMF_DEFAULT_PACKET_FILTER,
+--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+@@ -23,6 +23,12 @@
+
+ #define BRCMF_FIL_ACTION_FRAME_SIZE 1800
+
++/* ARP Offload feature flags for arp_ol iovar */
++#define BRCMF_ARP_OL_AGENT 0x00000001
++#define BRCMF_ARP_OL_SNOOP 0x00000002
++#define BRCMF_ARP_OL_HOST_AUTO_REPLY 0x00000004
++#define BRCMF_ARP_OL_PEER_AUTO_REPLY 0x00000008
++
+
+ enum brcmf_fil_p2p_if_types {
+ BRCMF_FIL_P2P_IF_CLIENT,
+--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+@@ -505,6 +505,38 @@ send_key_to_dongle(struct net_device *nd
+ return err;
+ }
+
++static s32
++brcmf_configure_arp_offload(struct brcmf_if *ifp, bool enable)
++{
++ s32 err;
++ u32 mode;
++
++ if (enable)
++ mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
++ else
++ mode = 0;
++
++ /* Try to set and enable ARP offload feature, this may fail, then it */
++ /* is simply not supported and err 0 will be returned */
++ err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
++ if (err) {
++ brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
++ mode, err);
++ err = 0;
++ } else {
++ err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
++ if (err) {
++ brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
++ enable, err);
++ err = 0;
++ } else
++ brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
++ enable, mode);
++ }
++
++ return err;
++}
++
+ static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
+ const char *name,
+ enum nl80211_iftype type,
+@@ -3709,6 +3741,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ }
+
+ brcmf_set_mpc(ndev, 0);
++ brcmf_configure_arp_offload(ifp, false);
+
+ /* find the RSN_IE */
+ rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
+@@ -3815,8 +3848,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wi
+ set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
+
+ exit:
+- if (err)
++ if (err) {
+ brcmf_set_mpc(ndev, 1);
++ brcmf_configure_arp_offload(ifp, true);
++ }
+ return err;
+ }
+
+@@ -3857,6 +3892,7 @@ static int brcmf_cfg80211_stop_ap(struct
+ brcmf_err("bss_enable config failed %d\n", err);
+ }
+ brcmf_set_mpc(ndev, 1);
++ brcmf_configure_arp_offload(ifp, true);
+ set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
+ clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
+
+@@ -4995,6 +5031,8 @@ static s32 brcmf_config_dongle(struct br
+ if (err)
+ goto default_conf_out;
+
++ brcmf_configure_arp_offload(ifp, true);
++
+ cfg->dongle_up = true;
+ default_conf_out:
+
--- /dev/null
+From 72b5322f11ff0abf6a52b3007486656578d2c982 Mon Sep 17 00:00:00 2001
+From: Lai Jiangshan <laijs@cn.fujitsu.com>
+Date: Mon, 3 Jun 2013 17:17:15 +0800
+Subject: clk: remove notifier from list before freeing it
+
+From: Lai Jiangshan <laijs@cn.fujitsu.com>
+
+commit 72b5322f11ff0abf6a52b3007486656578d2c982 upstream.
+
+The @cn is stay in @clk_notifier_list after it is freed, it cause
+memory corruption.
+
+Example, if @clk is registered(first), unregistered(first),
+registered(second), unregistered(second).
+
+The freed @cn will be used when @clk is registered(second),
+and the bug will be happened when @clk is unregistered(second):
+
+[ 517.040000] clk_notif_dbg clk_notif_dbg.1: clk_notifier_unregister()
+[ 517.040000] Unable to handle kernel paging request at virtual address 00df3008
+[ 517.050000] pgd = ed858000
+[ 517.050000] [00df3008] *pgd=00000000
+[ 517.060000] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+[ 517.060000] Modules linked in: clk_notif_dbg(O-) [last unloaded: clk_notif_dbg]
+[ 517.060000] CPU: 1 PID: 499 Comm: modprobe Tainted: G O 3.10.0-rc3-00119-ga93cb29-dirty #85
+[ 517.060000] task: ee1e0180 ti: ee3e6000 task.ti: ee3e6000
+[ 517.060000] PC is at srcu_readers_seq_idx+0x48/0x84
+[ 517.060000] LR is at srcu_readers_seq_idx+0x60/0x84
+[ 517.060000] pc : [<c0052720>] lr : [<c0052738>] psr: 80070013
+[ 517.060000] sp : ee3e7d48 ip : 00000000 fp : ee3e7d6c
+[ 517.060000] r10: 00000000 r9 : ee3e6000 r8 : 00000000
+[ 517.060000] r7 : ed84fe4c r6 : c068ec90 r5 : c068e430 r4 : 00000000
+[ 517.060000] r3 : 00df3000 r2 : 00000000 r1 : 00000002 r0 : 00000000
+[ 517.060000] Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 517.060000] Control: 18c5387d Table: 2d85804a DAC: 00000015
+[ 517.060000] Process modprobe (pid: 499, stack limit = 0xee3e6238)
+[ 517.060000] Stack: (0xee3e7d48 to 0xee3e8000)
+....
+[ 517.060000] [<c0052720>] (srcu_readers_seq_idx+0x48/0x84) from [<c0052790>] (try_check_zero+0x34/0xfc)
+[ 517.060000] [<c0052790>] (try_check_zero+0x34/0xfc) from [<c00528b0>] (srcu_advance_batches+0x58/0x114)
+[ 517.060000] [<c00528b0>] (srcu_advance_batches+0x58/0x114) from [<c0052c30>] (__synchronize_srcu+0x114/0x1ac)
+[ 517.060000] [<c0052c30>] (__synchronize_srcu+0x114/0x1ac) from [<c0052d14>] (synchronize_srcu+0x2c/0x34)
+[ 517.060000] [<c0052d14>] (synchronize_srcu+0x2c/0x34) from [<c0053a08>] (srcu_notifier_chain_unregister+0x68/0x74)
+[ 517.060000] [<c0053a08>] (srcu_notifier_chain_unregister+0x68/0x74) from [<c0375a78>] (clk_notifier_unregister+0x7c/0xc0)
+[ 517.060000] [<c0375a78>] (clk_notifier_unregister+0x7c/0xc0) from [<bf008034>] (clk_notif_dbg_remove+0x34/0x9c [clk_notif_dbg])
+[ 517.060000] [<bf008034>] (clk_notif_dbg_remove+0x34/0x9c [clk_notif_dbg]) from [<c02bb974>] (platform_drv_remove+0x24/0x28)
+[ 517.060000] [<c02bb974>] (platform_drv_remove+0x24/0x28) from [<c02b9bf8>] (__device_release_driver+0x8c/0xd4)
+[ 517.060000] [<c02b9bf8>] (__device_release_driver+0x8c/0xd4) from [<c02ba680>] (driver_detach+0x9c/0xc4)
+[ 517.060000] [<c02ba680>] (driver_detach+0x9c/0xc4) from [<c02b99c4>] (bus_remove_driver+0xcc/0xfc)
+[ 517.060000] [<c02b99c4>] (bus_remove_driver+0xcc/0xfc) from [<c02bace4>] (driver_unregister+0x54/0x78)
+[ 517.060000] [<c02bace4>] (driver_unregister+0x54/0x78) from [<c02bbb44>] (platform_driver_unregister+0x1c/0x20)
+[ 517.060000] [<c02bbb44>] (platform_driver_unregister+0x1c/0x20) from [<bf0081f8>] (clk_notif_dbg_driver_exit+0x14/0x1c [clk_notif_dbg])
+[ 517.060000] [<bf0081f8>] (clk_notif_dbg_driver_exit+0x14/0x1c [clk_notif_dbg]) from [<c00835e4>] (SyS_delete_module+0x200/0x28c)
+[ 517.060000] [<c00835e4>] (SyS_delete_module+0x200/0x28c) from [<c000edc0>] (ret_fast_syscall+0x0/0x48)
+[ 517.060000] Code: e5973004 e7911102 e0833001 e2881002 (e7933101)
+
+Reported-by: Sören Brinkmann <soren.brinkmann@xilinx.com>
+Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
+Tested-by: Sören Brinkmann <soren.brinkmann@xilinx.com>
+Signed-off-by: Mike Turquette <mturquette@linaro.org>
+[mturquette@linaro.org: shortened $SUBJECT]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -1759,6 +1759,7 @@ int clk_notifier_unregister(struct clk *
+ /* XXX the notifier code should handle this better */
+ if (!cn->notifier_head.head) {
+ srcu_cleanup_notifier_head(&cn->notifier_head);
++ list_del(&cn->node);
+ kfree(cn);
+ }
+
--- /dev/null
+From abc41254181e901ef5eda2c884ca6cd88a186b6d Mon Sep 17 00:00:00 2001
+From: Jed Davis <jld@mozilla.com>
+Date: Thu, 20 Jun 2013 04:07:14 +0100
+Subject: perf: arm64: Record the user-mode PC in the call chain.
+
+From: Jed Davis <jld@mozilla.com>
+
+commit abc41254181e901ef5eda2c884ca6cd88a186b6d upstream.
+
+With this change, we no longer lose the innermost entry in the user-mode
+part of the call chain. See also the x86 port, which includes the ip,
+and the corresponding change in arch/arm.
+
+Signed-off-by: Jed Davis <jld@mozilla.com>
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/perf_event.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -1336,6 +1336,7 @@ void perf_callchain_user(struct perf_cal
+ return;
+ }
+
++ perf_callchain_store(entry, regs->pc);
+ tail = (struct frame_tail __user *)regs->regs[29];
+
+ while (entry->nr < PERF_MAX_STACK_DEPTH &&
--- /dev/null
+From 5b8df24e22e0b00b599cb9ae63dbb96e1959be30 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Thu, 30 May 2013 18:05:55 -0500
+Subject: rtlwifi: rtl8192cu: Fix problem in connecting to WEP or WPA(1) networks
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 5b8df24e22e0b00b599cb9ae63dbb96e1959be30 upstream.
+
+Driver rtl8192cu can connect to WPA2 networks, but fails for any other
+encryption method. The cause is a failure to set the rate control data
+blocks. These changes fix https://bugzilla.redhat.com/show_bug.cgi?id=952793
+and https://bugzilla.redhat.com/show_bug.cgi?id=761525.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/hw.c | 132 ++++++++++++++++++++-------
+ drivers/net/wireless/rtlwifi/rtl8192cu/hw.h | 4
+ drivers/net/wireless/rtlwifi/rtl8192cu/mac.c | 18 +++
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 4
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.h | 3
+ drivers/net/wireless/rtlwifi/usb.c | 13 ++
+ drivers/net/wireless/rtlwifi/wifi.h | 4
+ 7 files changed, 138 insertions(+), 40 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+@@ -1973,26 +1973,35 @@ void rtl92cu_set_hw_reg(struct ieee80211
+ }
+ }
+
+-void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
+- struct ieee80211_sta *sta,
+- u8 rssi_level)
++static void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
++ struct ieee80211_sta *sta)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_phy *rtlphy = &(rtlpriv->phy);
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+- u32 ratr_value = (u32) mac->basic_rates;
+- u8 *mcsrate = mac->mcs;
++ struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
++ u32 ratr_value;
+ u8 ratr_index = 0;
+ u8 nmode = mac->ht_enable;
+- u8 mimo_ps = 1;
+- u16 shortgi_rate = 0;
+- u32 tmp_ratr_value = 0;
++ u8 mimo_ps = IEEE80211_SMPS_OFF;
++ u16 shortgi_rate;
++ u32 tmp_ratr_value;
+ u8 curtxbw_40mhz = mac->bw_40;
+- u8 curshortgi_40mhz = mac->sgi_40;
+- u8 curshortgi_20mhz = mac->sgi_20;
++ u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
++ 1 : 0;
++ u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
++ 1 : 0;
+ enum wireless_mode wirelessmode = mac->mode;
+
+- ratr_value |= ((*(u16 *) (mcsrate))) << 12;
++ if (rtlhal->current_bandtype == BAND_ON_5G)
++ ratr_value = sta->supp_rates[1] << 4;
++ else
++ ratr_value = sta->supp_rates[0];
++ if (mac->opmode == NL80211_IFTYPE_ADHOC)
++ ratr_value = 0xfff;
++
++ ratr_value |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
++ sta->ht_cap.mcs.rx_mask[0] << 12);
+ switch (wirelessmode) {
+ case WIRELESS_MODE_B:
+ if (ratr_value & 0x0000000c)
+@@ -2006,7 +2015,7 @@ void rtl92cu_update_hal_rate_table(struc
+ case WIRELESS_MODE_N_24G:
+ case WIRELESS_MODE_N_5G:
+ nmode = 1;
+- if (mimo_ps == 0) {
++ if (mimo_ps == IEEE80211_SMPS_STATIC) {
+ ratr_value &= 0x0007F005;
+ } else {
+ u32 ratr_mask;
+@@ -2016,8 +2025,7 @@ void rtl92cu_update_hal_rate_table(struc
+ ratr_mask = 0x000ff005;
+ else
+ ratr_mask = 0x0f0ff005;
+- if (curtxbw_40mhz)
+- ratr_mask |= 0x00000010;
++
+ ratr_value &= ratr_mask;
+ }
+ break;
+@@ -2026,41 +2034,74 @@ void rtl92cu_update_hal_rate_table(struc
+ ratr_value &= 0x000ff0ff;
+ else
+ ratr_value &= 0x0f0ff0ff;
++
+ break;
+ }
++
+ ratr_value &= 0x0FFFFFFF;
+- if (nmode && ((curtxbw_40mhz && curshortgi_40mhz) ||
+- (!curtxbw_40mhz && curshortgi_20mhz))) {
++
++ if (nmode && ((curtxbw_40mhz &&
++ curshortgi_40mhz) || (!curtxbw_40mhz &&
++ curshortgi_20mhz))) {
++
+ ratr_value |= 0x10000000;
+ tmp_ratr_value = (ratr_value >> 12);
++
+ for (shortgi_rate = 15; shortgi_rate > 0; shortgi_rate--) {
+ if ((1 << shortgi_rate) & tmp_ratr_value)
+ break;
+ }
++
+ shortgi_rate = (shortgi_rate << 12) | (shortgi_rate << 8) |
+- (shortgi_rate << 4) | (shortgi_rate);
++ (shortgi_rate << 4) | (shortgi_rate);
+ }
++
+ rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
++
++ RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
++ rtl_read_dword(rtlpriv, REG_ARFR0));
+ }
+
+-void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
++static void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw,
++ struct ieee80211_sta *sta,
++ u8 rssi_level)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_phy *rtlphy = &(rtlpriv->phy);
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+- u32 ratr_bitmap = (u32) mac->basic_rates;
+- u8 *p_mcsrate = mac->mcs;
+- u8 ratr_index = 0;
+- u8 curtxbw_40mhz = mac->bw_40;
+- u8 curshortgi_40mhz = mac->sgi_40;
+- u8 curshortgi_20mhz = mac->sgi_20;
+- enum wireless_mode wirelessmode = mac->mode;
++ struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
++ struct rtl_sta_info *sta_entry = NULL;
++ u32 ratr_bitmap;
++ u8 ratr_index;
++ u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
++ u8 curshortgi_40mhz = curtxbw_40mhz &&
++ (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
++ 1 : 0;
++ u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
++ 1 : 0;
++ enum wireless_mode wirelessmode = 0;
+ bool shortgi = false;
+ u8 rate_mask[5];
+ u8 macid = 0;
+- u8 mimops = 1;
++ u8 mimo_ps = IEEE80211_SMPS_OFF;
+
+- ratr_bitmap |= (p_mcsrate[1] << 20) | (p_mcsrate[0] << 12);
++ sta_entry = (struct rtl_sta_info *) sta->drv_priv;
++ wirelessmode = sta_entry->wireless_mode;
++ if (mac->opmode == NL80211_IFTYPE_STATION ||
++ mac->opmode == NL80211_IFTYPE_MESH_POINT)
++ curtxbw_40mhz = mac->bw_40;
++ else if (mac->opmode == NL80211_IFTYPE_AP ||
++ mac->opmode == NL80211_IFTYPE_ADHOC)
++ macid = sta->aid + 1;
++
++ if (rtlhal->current_bandtype == BAND_ON_5G)
++ ratr_bitmap = sta->supp_rates[1] << 4;
++ else
++ ratr_bitmap = sta->supp_rates[0];
++ if (mac->opmode == NL80211_IFTYPE_ADHOC)
++ ratr_bitmap = 0xfff;
++ ratr_bitmap |= (sta->ht_cap.mcs.rx_mask[1] << 20 |
++ sta->ht_cap.mcs.rx_mask[0] << 12);
+ switch (wirelessmode) {
+ case WIRELESS_MODE_B:
+ ratr_index = RATR_INX_WIRELESS_B;
+@@ -2071,6 +2112,7 @@ void rtl92cu_update_hal_rate_mask(struct
+ break;
+ case WIRELESS_MODE_G:
+ ratr_index = RATR_INX_WIRELESS_GB;
++
+ if (rssi_level == 1)
+ ratr_bitmap &= 0x00000f00;
+ else if (rssi_level == 2)
+@@ -2085,7 +2127,8 @@ void rtl92cu_update_hal_rate_mask(struct
+ case WIRELESS_MODE_N_24G:
+ case WIRELESS_MODE_N_5G:
+ ratr_index = RATR_INX_WIRELESS_NGB;
+- if (mimops == 0) {
++
++ if (mimo_ps == IEEE80211_SMPS_STATIC) {
+ if (rssi_level == 1)
+ ratr_bitmap &= 0x00070000;
+ else if (rssi_level == 2)
+@@ -2128,8 +2171,10 @@ void rtl92cu_update_hal_rate_mask(struct
+ }
+ }
+ }
++
+ if ((curtxbw_40mhz && curshortgi_40mhz) ||
+ (!curtxbw_40mhz && curshortgi_20mhz)) {
++
+ if (macid == 0)
+ shortgi = true;
+ else if (macid == 1)
+@@ -2138,21 +2183,42 @@ void rtl92cu_update_hal_rate_mask(struct
+ break;
+ default:
+ ratr_index = RATR_INX_WIRELESS_NGB;
++
+ if (rtlphy->rf_type == RF_1T2R)
+ ratr_bitmap &= 0x000ff0ff;
+ else
+ ratr_bitmap &= 0x0f0ff0ff;
+ break;
+ }
+- RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "ratr_bitmap :%x\n",
+- ratr_bitmap);
+- *(u32 *)&rate_mask = ((ratr_bitmap & 0x0fffffff) |
+- ratr_index << 28);
++ sta_entry->ratr_index = ratr_index;
++
++ RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG,
++ "ratr_bitmap :%x\n", ratr_bitmap);
++ *(u32 *)&rate_mask = (ratr_bitmap & 0x0fffffff) |
++ (ratr_index << 28);
+ rate_mask[4] = macid | (shortgi ? 0x20 : 0x00) | 0x80;
+ RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG,
+ "Rate_index:%x, ratr_val:%x, %5phC\n",
+ ratr_index, ratr_bitmap, rate_mask);
+- rtl92c_fill_h2c_cmd(hw, H2C_RA_MASK, 5, rate_mask);
++ memcpy(rtlpriv->rate_mask, rate_mask, 5);
++ /* rtl92c_fill_h2c_cmd() does USB I/O and will result in a
++ * "scheduled while atomic" if called directly */
++ schedule_work(&rtlpriv->works.fill_h2c_cmd);
++
++ if (macid != 0)
++ sta_entry->ratr_index = ratr_index;
++}
++
++void rtl92cu_update_hal_rate_tbl(struct ieee80211_hw *hw,
++ struct ieee80211_sta *sta,
++ u8 rssi_level)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++
++ if (rtlpriv->dm.useramask)
++ rtl92cu_update_hal_rate_mask(hw, sta, rssi_level);
++ else
++ rtl92cu_update_hal_rate_table(hw, sta);
+ }
+
+ void rtl92cu_update_channel_access_setting(struct ieee80211_hw *hw)
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
+@@ -98,10 +98,6 @@ void rtl92cu_update_interrupt_mask(struc
+ u32 add_msr, u32 rm_msr);
+ void rtl92cu_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val);
+ void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val);
+-void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
+- struct ieee80211_sta *sta,
+- u8 rssi_level);
+-void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level);
+
+ void rtl92cu_update_channel_access_setting(struct ieee80211_hw *hw);
+ bool rtl92cu_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 * valid);
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+@@ -289,14 +289,30 @@ void rtl92c_set_key(struct ieee80211_hw
+ macaddr = cam_const_broad;
+ entry_id = key_index;
+ } else {
++ if (mac->opmode == NL80211_IFTYPE_AP ||
++ mac->opmode == NL80211_IFTYPE_MESH_POINT) {
++ entry_id = rtl_cam_get_free_entry(hw,
++ p_macaddr);
++ if (entry_id >= TOTAL_CAM_ENTRY) {
++ RT_TRACE(rtlpriv, COMP_SEC,
++ DBG_EMERG,
++ "Can not find free hw security cam entry\n");
++ return;
++ }
++ } else {
++ entry_id = CAM_PAIRWISE_KEY_POSITION;
++ }
++
+ key_index = PAIRWISE_KEYIDX;
+- entry_id = CAM_PAIRWISE_KEY_POSITION;
+ is_pairwise = true;
+ }
+ }
+ if (rtlpriv->sec.key_len[key_index] == 0) {
+ RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+ "delete one entry\n");
++ if (mac->opmode == NL80211_IFTYPE_AP ||
++ mac->opmode == NL80211_IFTYPE_MESH_POINT)
++ rtl_cam_del_entry(hw, p_macaddr);
+ rtl_cam_delete_one_entry(hw, p_macaddr, entry_id);
+ } else {
+ RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -106,8 +106,7 @@ static struct rtl_hal_ops rtl8192cu_hal_
+ .update_interrupt_mask = rtl92cu_update_interrupt_mask,
+ .get_hw_reg = rtl92cu_get_hw_reg,
+ .set_hw_reg = rtl92cu_set_hw_reg,
+- .update_rate_tbl = rtl92cu_update_hal_rate_table,
+- .update_rate_mask = rtl92cu_update_hal_rate_mask,
++ .update_rate_tbl = rtl92cu_update_hal_rate_tbl,
+ .fill_tx_desc = rtl92cu_tx_fill_desc,
+ .fill_fake_txdesc = rtl92cu_fill_fake_txdesc,
+ .fill_tx_cmddesc = rtl92cu_tx_fill_cmddesc,
+@@ -137,6 +136,7 @@ static struct rtl_hal_ops rtl8192cu_hal_
+ .phy_lc_calibrate = _rtl92cu_phy_lc_calibrate,
+ .phy_set_bw_mode_callback = rtl92cu_phy_set_bw_mode_callback,
+ .dm_dynamic_txpower = rtl92cu_dm_dynamic_txpower,
++ .fill_h2c_cmd = rtl92c_fill_h2c_cmd,
+ };
+
+ static struct rtl_mod_params rtl92cu_mod_params = {
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.h
+@@ -49,5 +49,8 @@ bool rtl92cu_phy_set_rf_power_state(stru
+ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw,
+ enum radio_path rfpath, u32 regaddr, u32 bitmask);
+ void rtl92cu_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
++void rtl92cu_update_hal_rate_tbl(struct ieee80211_hw *hw,
++ struct ieee80211_sta *sta,
++ u8 rssi_level);
+
+ #endif
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -740,6 +740,7 @@ static void rtl_usb_stop(struct ieee8021
+
+ /* should after adapter start and interrupt enable. */
+ set_hal_stop(rtlhal);
++ cancel_work_sync(&rtlpriv->works.fill_h2c_cmd);
+ /* Enable software */
+ SET_USB_STOP(rtlusb);
+ rtl_usb_deinit(hw);
+@@ -942,6 +943,16 @@ static bool rtl_usb_tx_chk_waitq_insert(
+ return false;
+ }
+
++static void rtl_fill_h2c_cmd_work_callback(struct work_struct *work)
++{
++ struct rtl_works *rtlworks =
++ container_of(work, struct rtl_works, fill_h2c_cmd);
++ struct ieee80211_hw *hw = rtlworks->hw;
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++
++ rtlpriv->cfg->ops->fill_h2c_cmd(hw, H2C_RA_MASK, 5, rtlpriv->rate_mask);
++}
++
+ static struct rtl_intf_ops rtl_usb_ops = {
+ .adapter_start = rtl_usb_start,
+ .adapter_stop = rtl_usb_stop,
+@@ -973,6 +984,8 @@ int rtl_usb_probe(struct usb_interface *
+
+ /* this spin lock must be initialized early */
+ spin_lock_init(&rtlpriv->locks.usb_lock);
++ INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
++ rtl_fill_h2c_cmd_work_callback);
+
+ rtlpriv->usb_data_index = 0;
+ init_completion(&rtlpriv->firmware_loading_complete);
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -1572,6 +1572,8 @@ struct rtl_hal_ops {
+ void (*bt_wifi_media_status_notify) (struct ieee80211_hw *hw,
+ bool mstate);
+ void (*bt_coex_off_before_lps) (struct ieee80211_hw *hw);
++ void (*fill_h2c_cmd) (struct ieee80211_hw *hw, u8 element_id,
++ u32 cmd_len, u8 *p_cmdbuffer);
+ };
+
+ struct rtl_intf_ops {
+@@ -1698,6 +1700,7 @@ struct rtl_works {
+ struct delayed_work ps_rfon_wq;
+
+ struct work_struct lps_leave_work;
++ struct work_struct fill_h2c_cmd;
+ };
+
+ struct rtl_debug {
+@@ -1866,6 +1869,7 @@ struct rtl_priv {
+ bool bt_operation_on;
+ };
+ };
++ u8 rate_mask[5];
+
+ /*This must be the last item so
+ that it points to the data allocated
--- /dev/null
+arm-7752-1-errata-louis-bit-field-in-clidr-register-is-incorrect.patch
+arm-7754-1-fix-the-cpu-id-and-the-mask-associated-to-the-pj4b.patch
+arm-7755-1-handle-user-space-mapped-pages-in-flush_kernel_dcache_page.patch
+perf-arm64-record-the-user-mode-pc-in-the-call-chain.patch
+alsa-usb-audio-fix-invalid-volume-resolution-for-logitech-hd-webcam-c310.patch
+alsa-hda-fix-pin-configurations-for-macbook-air-4-2.patch
+alsa-usb-audio-work-around-android-accessory-firmware-bug.patch
+clk-remove-notifier-from-list-before-freeing-it.patch
+tilepro-work-around-module-link-error-with-gcc-4.7.patch
+rtlwifi-rtl8192cu-fix-problem-in-connecting-to-wep-or-wpa-1-networks.patch
+brcmfmac-turn-off-arp-offloading-when-configured-for-ap.patch
--- /dev/null
+From 3cb3f839d306443f3d1e79b0bde1a2ad2c12b555 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Sat, 15 Jun 2013 16:47:47 -0400
+Subject: tilepro: work around module link error with gcc 4.7
+
+From: Chris Metcalf <cmetcalf@tilera.com>
+
+commit 3cb3f839d306443f3d1e79b0bde1a2ad2c12b555 upstream.
+
+gcc 4.7.x is emitting calls to __ffsdi2 where previously
+it used to inline the appropriate ctz instructions.
+While this needs to be fixed in gcc, it's also easy to avoid
+having it cause build failures when building with those
+compilers by exporting __ffsdi2 to modules.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/tile/lib/exports.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/tile/lib/exports.c
++++ b/arch/tile/lib/exports.c
+@@ -84,4 +84,6 @@ uint64_t __ashrdi3(uint64_t, unsigned in
+ EXPORT_SYMBOL(__ashrdi3);
+ uint64_t __ashldi3(uint64_t, unsigned int);
+ EXPORT_SYMBOL(__ashldi3);
++int __ffsdi2(uint64_t);
++EXPORT_SYMBOL(__ffsdi2);
+ #endif
projects / thirdparty / kernel / stable-queue.git / commitdiff
