--- /dev/null
+From ec30326ea773900da210c495e14cfeb532550ba2 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sat, 5 Oct 2013 14:09:30 +0200
+Subject: ath9k: fix tx queue scheduling after channel changes
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit ec30326ea773900da210c495e14cfeb532550ba2 upstream.
+
+Otherwise, if queues are full during a scan, tx scheduling does not
+resume after switching back to the home channel.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/main.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -208,6 +208,7 @@ static bool ath_complete_reset(struct at
+ struct ath_hw *ah = sc->sc_ah;
+ struct ath_common *common = ath9k_hw_common(ah);
+ unsigned long flags;
++ int i;
+
+ if (ath_startrecv(sc) != 0) {
+ ath_err(common, "Unable to restart recv logic\n");
+@@ -235,6 +236,15 @@ static bool ath_complete_reset(struct at
+ }
+ work:
+ ath_restart_work(sc);
++
++ for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
++ if (!ATH_TXQ_SETUP(sc, i))
++ continue;
++
++ spin_lock_bh(&sc->tx.txq[i].axq_lock);
++ ath_txq_schedule(sc, &sc->tx.txq[i]);
++ spin_unlock_bh(&sc->tx.txq[i].axq_lock);
++ }
+ }
+
+ if ((ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) && sc->ant_rx != 3)
+@@ -542,21 +552,10 @@ chip_reset:
+
+ static int ath_reset(struct ath_softc *sc)
+ {
+- int i, r;
++ int r;
+
+ ath9k_ps_wakeup(sc);
+-
+ r = ath_reset_internal(sc, NULL);
+-
+- for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+- if (!ATH_TXQ_SETUP(sc, i))
+- continue;
+-
+- spin_lock_bh(&sc->tx.txq[i].axq_lock);
+- ath_txq_schedule(sc, &sc->tx.txq[i]);
+- spin_unlock_bh(&sc->tx.txq[i].axq_lock);
+- }
+-
+ ath9k_ps_restore(sc);
+
+ return r;
--- /dev/null
+From 5abbeea553c8260ed4e2ac4aae962aff800b6c6d Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Wed, 9 Oct 2013 12:19:19 +0200
+Subject: can: at91-can: fix device to driver data mapping for platform devices
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 5abbeea553c8260ed4e2ac4aae962aff800b6c6d upstream.
+
+In commit:
+
+ 3078cde7 can: at91_can: add dt support
+
+device tree support was added to the at91_can driver. In this commit the
+mapping of device to driver data was mixed up. This results in the sam9x5
+parameters being used for the sam9263 and the workaround for the broken mailbox
+0 on the sam9263 not being activated.
+
+This patch fixes the broken platform_device_id table.
+
+Cc: Ludovic Desroches <ludovic.desroches@atmel.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/at91_can.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/at91_can.c
++++ b/drivers/net/can/at91_can.c
+@@ -1405,10 +1405,10 @@ static int at91_can_remove(struct platfo
+
+ static const struct platform_device_id at91_can_id_table[] = {
+ {
+- .name = "at91_can",
++ .name = "at91sam9x5_can",
+ .driver_data = (kernel_ulong_t)&at91_at91sam9x5_data,
+ }, {
+- .name = "at91sam9x5_can",
++ .name = "at91_can",
+ .driver_data = (kernel_ulong_t)&at91_at91sam9263_data,
+ }, {
+ /* sentinel */
--- /dev/null
+From e358784297992b012e8071764d996191dd2b1a54 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Thu, 3 Oct 2013 23:51:55 +0200
+Subject: can: flexcan: fix mx28 detection by rearanging OF match table
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit e358784297992b012e8071764d996191dd2b1a54 upstream.
+
+The current implemetation of of_match_device() relies that the of_device_id
+table in the driver is sorted from most specific to least specific compatible.
+
+Without this patch the mx28 is detected as the less specific p1010. This leads
+to a p1010 specific workaround is activated on the mx28, which is not needed.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/flexcan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -979,9 +979,9 @@ static void unregister_flexcandev(struct
+ }
+
+ static const struct of_device_id flexcan_of_match[] = {
+- { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
+- { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
+ { .compatible = "fsl,imx6q-flexcan", .data = &fsl_imx6q_devtype_data, },
++ { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
++ { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
+ { /* sentinel */ },
+ };
+ MODULE_DEVICE_TABLE(of, flexcan_of_match);
--- /dev/null
+From d5a7b406c529e4595ce03dc8f6dcf7fa36f106fa Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Fri, 4 Oct 2013 10:52:36 +0200
+Subject: can: flexcan: flexcan_chip_start: fix regression, mark one MB for TX and abort pending TX
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit d5a7b406c529e4595ce03dc8f6dcf7fa36f106fa upstream.
+
+In patch
+
+ 0d1862e can: flexcan: fix flexcan_chip_start() on imx6
+
+the loop in flexcan_chip_start() that iterates over all mailboxes after the
+soft reset of the CAN core was removed. This loop put all mailboxes (even the
+ones marked as reserved 1...7) into EMPTY/INACTIVE mode. On mailboxes 8...63,
+this aborts any pending TX messages.
+
+After a cold boot there is random garbage in the mailboxes, which leads to
+spontaneous transmit of CAN frames during first activation. Further if the
+interface was disabled with a pending message (usually due to an error
+condition on the CAN bus), this message is retransmitted after enabling the
+interface again.
+
+This patch fixes the regression by:
+1) Limiting the maximum number of used mailboxes to 8, 0...7 are used by the RX
+FIFO, 8 is used by TX.
+2) Marking the TX mailbox as EMPTY/INACTIVE, so that any pending TX of that
+mailbox is aborted.
+
+Cc: Lothar Waßmann <LW@KARO-electronics.de>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/flexcan.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -62,7 +62,7 @@
+ #define FLEXCAN_MCR_BCC BIT(16)
+ #define FLEXCAN_MCR_LPRIO_EN BIT(13)
+ #define FLEXCAN_MCR_AEN BIT(12)
+-#define FLEXCAN_MCR_MAXMB(x) ((x) & 0xf)
++#define FLEXCAN_MCR_MAXMB(x) ((x) & 0x1f)
+ #define FLEXCAN_MCR_IDAM_A (0 << 8)
+ #define FLEXCAN_MCR_IDAM_B (1 << 8)
+ #define FLEXCAN_MCR_IDAM_C (2 << 8)
+@@ -736,9 +736,11 @@ static int flexcan_chip_start(struct net
+ *
+ */
+ reg_mcr = flexcan_read(®s->mcr);
++ reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
+ reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_FEN | FLEXCAN_MCR_HALT |
+ FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN |
+- FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS;
++ FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS |
++ FLEXCAN_MCR_MAXMB(FLEXCAN_TX_BUF_ID);
+ netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
+ flexcan_write(reg_mcr, ®s->mcr);
+
+@@ -783,6 +785,10 @@ static int flexcan_chip_start(struct net
+ ®s->cantxfg[i].can_ctrl);
+ }
+
++ /* Abort any pending TX, mark Mailbox as INACTIVE */
++ flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
++ ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
++
+ /* acceptance mask/acceptance code (accept everything) */
+ flexcan_write(0x0, ®s->rxgmask);
+ flexcan_write(0x0, ®s->rx14mask);
--- /dev/null
+From f478f33a93f9353dcd1fe55445343d76b1c3f84a Mon Sep 17 00:00:00 2001
+From: Bruno Randolf <br1@einfach.org>
+Date: Thu, 26 Sep 2013 16:55:28 +0100
+Subject: cfg80211: fix warning when using WEXT for IBSS
+
+From: Bruno Randolf <br1@einfach.org>
+
+commit f478f33a93f9353dcd1fe55445343d76b1c3f84a upstream.
+
+Fix kernel warning when using WEXT for configuring ad-hoc mode,
+e.g. "iwconfig wlan0 essid test channel 1"
+
+WARNING: at net/wireless/chan.c:373 cfg80211_chandef_usable+0x50/0x21c [cfg80211]()
+
+The warning is caused by an uninitialized variable center_freq1.
+
+Signed-off-by: Bruno Randolf <br1@einfach.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/ibss.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/wireless/ibss.c
++++ b/net/wireless/ibss.c
+@@ -263,6 +263,8 @@ int cfg80211_ibss_wext_join(struct cfg80
+ if (chan->flags & IEEE80211_CHAN_DISABLED)
+ continue;
+ wdev->wext.ibss.chandef.chan = chan;
++ wdev->wext.ibss.chandef.center_freq1 =
++ chan->center_freq;
+ break;
+ }
+
+@@ -347,6 +349,7 @@ int cfg80211_ibss_wext_siwfreq(struct ne
+ if (chan) {
+ wdev->wext.ibss.chandef.chan = chan;
+ wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
++ wdev->wext.ibss.chandef.center_freq1 = freq;
+ wdev->wext.ibss.channel_fixed = true;
+ } else {
+ /* cfg80211_ibss_wext_join will pick one if needed */
--- /dev/null
+From 180032973ee97daddf5c9d733e5b425b108f8679 Mon Sep 17 00:00:00 2001
+From: Luciano Coelho <luciano.coelho@intel.com>
+Date: Thu, 29 Aug 2013 13:26:57 +0300
+Subject: cfg80211: use the correct macro to check for active monitor support
+
+From: Luciano Coelho <luciano.coelho@intel.com>
+
+commit 180032973ee97daddf5c9d733e5b425b108f8679 upstream.
+
+Use MONITOR_FLAG_ACTIVE, which is a flag mask, instead of
+NL80211_MNTR_FLAG_ACTIVE, which is a flag index, when checking if the
+hardware supports active monitoring.
+
+Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/nl80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -2379,7 +2379,7 @@ static int nl80211_set_interface(struct
+ change = true;
+ }
+
+- if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
++ if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
+ !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
+ return -EOPNOTSUPP;
+
+@@ -2441,7 +2441,7 @@ static int nl80211_new_interface(struct
+ info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
+ &flags);
+
+- if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
++ if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
+ !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
+ return -EOPNOTSUPP;
+
--- /dev/null
+From 5a3e9f7f8c8768b5f7df81100c684e4cd00a6eb5 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sun, 15 Sep 2013 14:39:02 +0300
+Subject: iwlwifi: mvm: call ieee80211_scan_completed when needed
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 5a3e9f7f8c8768b5f7df81100c684e4cd00a6eb5 upstream.
+
+When RFKill cuts short a scan, mac80211 cancels the scan.
+This is done by sending a host command to the firmware, but
+this command was dropped because of RFKill. Flag this
+command as "SEND_IN_RFKILL" to make sure it is sent to the
+firmware. The firmware will send SCAN_COMPLETE_NOTIFICATION
+which will trigger a call to ieee80211_scan_completed.
+
+If the scan cannot be aborted, it is because the firmware
+already finished the scan but we hadn't notified mac80211
+at the time mac80211 decided to cancel the scan. By the time
+we see the scan could not be aborted, mac80211 has been
+notified already.
+
+This patch fixes situations in which we didn't notify
+mac80211 upon completion of the scan that was cut short
+by RFkill.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/scan.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
+@@ -392,6 +392,11 @@ static bool iwl_mvm_scan_abort_notif(str
+ return false;
+ }
+
++ /*
++ * If scan cannot be aborted, it means that we had a
++ * SCAN_COMPLETE_NOTIFICATION in the pipe and it called
++ * ieee80211_scan_completed already.
++ */
+ IWL_DEBUG_SCAN(mvm, "Scan cannot be aborted, exit now: %d\n",
+ *resp);
+ return true;
+@@ -415,14 +420,19 @@ void iwl_mvm_cancel_scan(struct iwl_mvm
+ SCAN_COMPLETE_NOTIFICATION };
+ int ret;
+
++ if (mvm->scan_status == IWL_MVM_SCAN_NONE)
++ return;
++
+ iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
+ scan_abort_notif,
+ ARRAY_SIZE(scan_abort_notif),
+ iwl_mvm_scan_abort_notif, NULL);
+
+- ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, CMD_SYNC, 0, NULL);
++ ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD,
++ CMD_SYNC | CMD_SEND_IN_RFKILL, 0, NULL);
+ if (ret) {
+ IWL_ERR(mvm, "Couldn't send SCAN_ABORT_CMD: %d\n", ret);
++ /* mac80211's state will be cleaned in the fw_restart flow */
+ goto out_remove_notif;
+ }
+
--- /dev/null
+From 08a5dd3842f2ac61c6d69661d2d96022df8ae359 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 24 Sep 2013 19:34:26 +0300
+Subject: iwlwifi: pcie: add SKUs for 6000, 6005 and 6235 series
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 08a5dd3842f2ac61c6d69661d2d96022df8ae359 upstream.
+
+Add some new PCI IDs to the table for 6000, 6005 and 6235 series.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-6000.c | 6 ++++++
+ drivers/net/wireless/iwlwifi/iwl-config.h | 1 +
+ drivers/net/wireless/iwlwifi/pcie/drv.c | 10 ++++++++++
+ 3 files changed, 17 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
+@@ -240,6 +240,12 @@ const struct iwl_cfg iwl6035_2agn_cfg =
+ .ht_params = &iwl6000_ht_params,
+ };
+
++const struct iwl_cfg iwl6035_2agn_sff_cfg = {
++ .name = "Intel(R) Centrino(R) Ultimate-N 6235 AGN",
++ IWL_DEVICE_6035,
++ .ht_params = &iwl6000_ht_params,
++};
++
+ const struct iwl_cfg iwl1030_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 1030 BGN",
+ IWL_DEVICE_6030,
+--- a/drivers/net/wireless/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/iwlwifi/iwl-config.h
+@@ -277,6 +277,7 @@ extern const struct iwl_cfg iwl2000_2bgn
+ extern const struct iwl_cfg iwl2000_2bgn_d_cfg;
+ extern const struct iwl_cfg iwl2030_2bgn_cfg;
+ extern const struct iwl_cfg iwl6035_2agn_cfg;
++extern const struct iwl_cfg iwl6035_2agn_sff_cfg;
+ extern const struct iwl_cfg iwl105_bgn_cfg;
+ extern const struct iwl_cfg iwl105_bgn_d_cfg;
+ extern const struct iwl_cfg iwl135_bgn_cfg;
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -139,13 +139,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_ca
+
+ /* 6x00 Series */
+ {IWL_PCI_DEVICE(0x422B, 0x1101, iwl6000_3agn_cfg)},
++ {IWL_PCI_DEVICE(0x422B, 0x1108, iwl6000_3agn_cfg)},
+ {IWL_PCI_DEVICE(0x422B, 0x1121, iwl6000_3agn_cfg)},
++ {IWL_PCI_DEVICE(0x422B, 0x1128, iwl6000_3agn_cfg)},
+ {IWL_PCI_DEVICE(0x422C, 0x1301, iwl6000i_2agn_cfg)},
+ {IWL_PCI_DEVICE(0x422C, 0x1306, iwl6000i_2abg_cfg)},
+ {IWL_PCI_DEVICE(0x422C, 0x1307, iwl6000i_2bg_cfg)},
+ {IWL_PCI_DEVICE(0x422C, 0x1321, iwl6000i_2agn_cfg)},
+ {IWL_PCI_DEVICE(0x422C, 0x1326, iwl6000i_2abg_cfg)},
+ {IWL_PCI_DEVICE(0x4238, 0x1111, iwl6000_3agn_cfg)},
++ {IWL_PCI_DEVICE(0x4238, 0x1118, iwl6000_3agn_cfg)},
+ {IWL_PCI_DEVICE(0x4239, 0x1311, iwl6000i_2agn_cfg)},
+ {IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
+
+@@ -153,12 +156,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_ca
+ {IWL_PCI_DEVICE(0x0082, 0x1301, iwl6005_2agn_cfg)},
+ {IWL_PCI_DEVICE(0x0082, 0x1306, iwl6005_2abg_cfg)},
+ {IWL_PCI_DEVICE(0x0082, 0x1307, iwl6005_2bg_cfg)},
++ {IWL_PCI_DEVICE(0x0082, 0x1308, iwl6005_2agn_cfg)},
+ {IWL_PCI_DEVICE(0x0082, 0x1321, iwl6005_2agn_cfg)},
+ {IWL_PCI_DEVICE(0x0082, 0x1326, iwl6005_2abg_cfg)},
++ {IWL_PCI_DEVICE(0x0082, 0x1328, iwl6005_2agn_cfg)},
+ {IWL_PCI_DEVICE(0x0085, 0x1311, iwl6005_2agn_cfg)},
++ {IWL_PCI_DEVICE(0x0085, 0x1318, iwl6005_2agn_cfg)},
+ {IWL_PCI_DEVICE(0x0085, 0x1316, iwl6005_2abg_cfg)},
+ {IWL_PCI_DEVICE(0x0082, 0xC020, iwl6005_2agn_sff_cfg)},
+ {IWL_PCI_DEVICE(0x0085, 0xC220, iwl6005_2agn_sff_cfg)},
++ {IWL_PCI_DEVICE(0x0085, 0xC228, iwl6005_2agn_sff_cfg)},
+ {IWL_PCI_DEVICE(0x0082, 0x4820, iwl6005_2agn_d_cfg)},
+ {IWL_PCI_DEVICE(0x0082, 0x1304, iwl6005_2agn_mow1_cfg)},/* low 5GHz active */
+ {IWL_PCI_DEVICE(0x0082, 0x1305, iwl6005_2agn_mow2_cfg)},/* high 5GHz active */
+@@ -240,8 +247,11 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_ca
+
+ /* 6x35 Series */
+ {IWL_PCI_DEVICE(0x088E, 0x4060, iwl6035_2agn_cfg)},
++ {IWL_PCI_DEVICE(0x088E, 0x406A, iwl6035_2agn_sff_cfg)},
+ {IWL_PCI_DEVICE(0x088F, 0x4260, iwl6035_2agn_cfg)},
++ {IWL_PCI_DEVICE(0x088F, 0x426A, iwl6035_2agn_sff_cfg)},
+ {IWL_PCI_DEVICE(0x088E, 0x4460, iwl6035_2agn_cfg)},
++ {IWL_PCI_DEVICE(0x088E, 0x446A, iwl6035_2agn_sff_cfg)},
+ {IWL_PCI_DEVICE(0x088E, 0x4860, iwl6035_2agn_cfg)},
+ {IWL_PCI_DEVICE(0x088F, 0x5260, iwl6035_2agn_cfg)},
+
--- /dev/null
+From 8660998608cfa1077e560034db81885af8e1e885 Mon Sep 17 00:00:00 2001
+From: Dave Kleikamp <dave.kleikamp@oracle.com>
+Date: Fri, 6 Sep 2013 21:49:56 -0500
+Subject: jfs: fix error path in ialloc
+
+From: Dave Kleikamp <dave.kleikamp@oracle.com>
+
+commit 8660998608cfa1077e560034db81885af8e1e885 upstream.
+
+If insert_inode_locked() fails, we shouldn't be calling
+unlock_new_inode().
+
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Tested-by: Michael L. Semon <mlsemon35@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jfs/jfs_inode.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/jfs/jfs_inode.c
++++ b/fs/jfs/jfs_inode.c
+@@ -95,7 +95,7 @@ struct inode *ialloc(struct inode *paren
+
+ if (insert_inode_locked(inode) < 0) {
+ rc = -EINVAL;
+- goto fail_unlock;
++ goto fail_put;
+ }
+
+ inode_init_owner(inode, parent, mode);
+@@ -156,7 +156,6 @@ struct inode *ialloc(struct inode *paren
+ fail_drop:
+ dquot_drop(inode);
+ inode->i_flags |= S_NOQUOTA;
+-fail_unlock:
+ clear_nlink(inode);
+ unlock_new_inode(inode);
+ fail_put:
--- /dev/null
+From 453b0c3f6910672f79da354077af728d92f95c5b Mon Sep 17 00:00:00 2001
+From: Amitkumar Karwar <akarwar@marvell.com>
+Date: Fri, 27 Sep 2013 10:55:38 -0700
+Subject: mwifiex: fix SDIO interrupt lost issue
+
+From: Amitkumar Karwar <akarwar@marvell.com>
+
+commit 453b0c3f6910672f79da354077af728d92f95c5b upstream.
+
+601216e "mwifiex: process RX packets in SDIO IRQ thread directly"
+introduced a command timeout issue which can be reproduced easily on
+an AM33xx platform using a test application written by Daniel Mack:
+
+https://gist.github.com/zonque/6579314
+
+mwifiex_main_process() is called from both the SDIO handler and
+the workqueue. In case an interrupt occurs right after the
+int_status check, but before updating the mwifiex_processing flag,
+this interrupt gets lost, resulting in a command timeout and
+consequently a card reset.
+
+Let main_proc_lock protect both int_status and mwifiex_processing
+flag. This fixes the interrupt lost issue.
+
+Reported-by: Sven Neumann <s.neumann@raumfeld.com>
+Reported-by: Andreas Fenkart <andreas.fenkart@streamunlimited.com>
+Tested-by: Daniel Mack <zonque@gmail.com>
+Reviewed-by: Dylan Reid <dgreid@chromium.org>
+Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: Paul Stewart <pstew@chromium.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/mwifiex/main.c
++++ b/drivers/net/wireless/mwifiex/main.c
+@@ -354,10 +354,12 @@ process_start:
+ }
+ } while (true);
+
+- if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter))
++ spin_lock_irqsave(&adapter->main_proc_lock, flags);
++ if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter)) {
++ spin_unlock_irqrestore(&adapter->main_proc_lock, flags);
+ goto process_start;
++ }
+
+- spin_lock_irqsave(&adapter->main_proc_lock, flags);
+ adapter->mwifiex_processing = false;
+ spin_unlock_irqrestore(&adapter->main_proc_lock, flags);
+
--- /dev/null
+From 9473ca6e920a3b9ca902753ce52833657f9221cc Mon Sep 17 00:00:00 2001
+From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
+Date: Tue, 8 Oct 2013 10:18:20 -0500
+Subject: rtlwifi: rtl8192cu: Fix error in pointer arithmetic
+
+From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
+
+commit 9473ca6e920a3b9ca902753ce52833657f9221cc upstream.
+
+An error in calculating the offset in an skb causes the driver to read
+essential device info from the wrong locations. The main effect is that
+automatic gain calculations are nonsense.
+
+Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/trx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+@@ -343,7 +343,8 @@ bool rtl92cu_rx_query_desc(struct ieee80
+ (bool)GET_RX_DESC_PAGGR(pdesc));
+ rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
+ if (phystatus) {
+- p_drvinfo = (struct rx_fwinfo_92c *)(pdesc + RTL_RX_DESC_SIZE);
++ p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
++ stats->rx_bufshift);
+ rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
+ p_drvinfo);
+ }
--- /dev/null
+From 6541932ea2f7de0b0c5203decf666b143ad5fa33 Mon Sep 17 00:00:00 2001
+From: Khalid Aziz <khalid.aziz@oracle.com>
+Date: Wed, 25 Sep 2013 11:45:11 -0600
+Subject: SCSI: BusLogic: Fix an oops when intializing multimaster adapter
+
+From: Khalid Aziz <khalid.aziz@oracle.com>
+
+commit 6541932ea2f7de0b0c5203decf666b143ad5fa33 upstream.
+
+This fixes an oops caused by buslogic driver when initializing a BusLogic
+MultiMaster adapter. Initialization code used scope of a variable
+incorrectly which created a NULL pointer. Oops message is below:
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000c
+IP: [<c150c137>] blogic_init_mm_probeinfo.isra.17+0x20a/0x583
+*pde = 00000000
+Oops: 002 [#1] PREEMPT SMP
+Modules linked in:
+CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.11.1.puz1 #1
+Hardware name: /Canterwood, BIOS 6.00 PG 05/16/2003
+task: f7050000 ti: f7054000 task.ti: f7054000
+EIP: 0060:[<c150c137>] EFLAGS: 00010246 CPU:1
+EIP is at blogic_init_mm_probeinfo.isra.17+0x20a/0x583
+EAX: 00000013 EBX: 00000000 ECX: 00000000 EDX: f8001000
+ESI: f71cb800 EDI: f7388000 EBP: 00007800 ESP: f7055c84
+ DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
+CR0: 8005003b CR2: 0000000c CR3: 0154f000 CR4: 000007d0
+Stack:
+ 0000001c 00000000 c11a59f6 f7055c98 00008130 ffffffff ffffffff 00000000
+ 00000003 00000000 00000000 00000000 00000013 f8001000 00000001 000003d0
+ 00000000 00000000 00000000 c14e3f84 f78803c8 00000000 f738c000 000000e9
+Call Trace:
+ [<c11a59f6>] ? pci_get_subsys+0x33/0x38
+ [<c150c4fb>] ? blogic_init_probeinfo_list+0x4b/0x19e
+ [<c108d593>] ? __alloc_pages_nodemask+0xe3/0x623
+ [<c108d593>] ? __alloc_pages_nodemask+0xe3/0x623
+ [<c10fb99e>] ? sysfs_link_sibling+0x61/0x8d
+ [<c10b0519>] ? kmem_cache_alloc+0x8b/0xb5
+ [<c150cce5>] ? blogic_init+0xa1/0x10e8
+ [<c10fc0a8>] ? sysfs_add_one+0x10/0x9d
+ [<c10fc18a>] ? sysfs_addrm_finish+0x12/0x85
+ [<c10fca37>] ? sysfs_do_create_link_sd+0x9d/0x1b4
+ [<c117c272>] ? blk_register_queue+0x69/0xb3
+ [<c10fcb68>] ? sysfs_create_link+0x1a/0x2c
+ [<c1181a07>] ? add_disk+0x1a1/0x3c7
+ [<c138737b>] ? klist_next+0x60/0xc3
+ [<c122cc3a>] ? scsi_dh_detach+0x68/0x68
+ [<c1213e36>] ? bus_for_each_dev+0x51/0x61
+ [<c1000356>] ? do_one_initcall+0x22/0x12c
+ [<c10f3688>] ? __proc_create+0x8c/0xba
+ [<c150cc44>] ? blogic_setup+0x5f6/0x5f6
+ [<c14e94aa>] ? repair_env_string+0xf/0x4d
+ [<c14e949b>] ? do_early_param+0x71/0x71
+ [<c103efaa>] ? parse_args+0x21f/0x33d
+ [<c14e9a54>] ? kernel_init_freeable+0xdf/0x17d
+ [<c14e949b>] ? do_early_param+0x71/0x71
+ [<c1388b64>] ? kernel_init+0x8/0xc0
+ [<c1392222>] ? ret_from_kernel_thread+0x6/0x28
+ [<c1392227>] ? ret_from_kernel_thread+0x1b/0x28
+ [<c1388b5c>] ? rest_init+0x6c/0x6c
+Code: 89 44 24 10 0f b6 44 24 3d 89 44 24 0c c7 44 24 08 00 00 00 00 c7 44 24 04 38 62 46 c1 c7 04 24 02 00 00 00 e8 78 13 d2 ff 31 db <89> 6b 0c b0 20 89 ea ee
+ c7 44 24 08 04 00 00 00 8d 44 24 4c 89
+EIP: [<c150c137>] blogic_init_mm_probeinfo.isra.17+0x20a/0x583 SS:ESP 0068:f7055c84
+CR2: 000000000000000c
+---[ end trace 17f45f5196d40487 ]---
+Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
+
+Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com>
+Reported-by: Pierre Uszynski <pierre@rahul.net>
+Tested-by: Pierre Uszynski <pierre@rahul.net>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/BusLogic.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -696,7 +696,7 @@ static int __init blogic_init_mm_probein
+ while ((pci_device = pci_get_device(PCI_VENDOR_ID_BUSLOGIC,
+ PCI_DEVICE_ID_BUSLOGIC_MULTIMASTER,
+ pci_device)) != NULL) {
+- struct blogic_adapter *adapter = adapter;
++ struct blogic_adapter *host_adapter = adapter;
+ struct blogic_adapter_info adapter_info;
+ enum blogic_isa_ioport mod_ioaddr_req;
+ unsigned char bus;
+@@ -744,9 +744,9 @@ static int __init blogic_init_mm_probein
+ known and enabled, note that the particular Standard ISA I/O
+ Address should not be probed.
+ */
+- adapter->io_addr = io_addr;
+- blogic_intreset(adapter);
+- if (blogic_cmd(adapter, BLOGIC_INQ_PCI_INFO, NULL, 0,
++ host_adapter->io_addr = io_addr;
++ blogic_intreset(host_adapter);
++ if (blogic_cmd(host_adapter, BLOGIC_INQ_PCI_INFO, NULL, 0,
+ &adapter_info, sizeof(adapter_info)) ==
+ sizeof(adapter_info)) {
+ if (adapter_info.isa_port < 6)
+@@ -762,7 +762,7 @@ static int __init blogic_init_mm_probein
+ I/O Address assigned at system initialization.
+ */
+ mod_ioaddr_req = BLOGIC_IO_DISABLE;
+- blogic_cmd(adapter, BLOGIC_MOD_IOADDR, &mod_ioaddr_req,
++ blogic_cmd(host_adapter, BLOGIC_MOD_IOADDR, &mod_ioaddr_req,
+ sizeof(mod_ioaddr_req), NULL, 0);
+ /*
+ For the first MultiMaster Host Adapter enumerated,
+@@ -779,12 +779,12 @@ static int __init blogic_init_mm_probein
+
+ fetch_localram.offset = BLOGIC_AUTOSCSI_BASE + 45;
+ fetch_localram.count = sizeof(autoscsi_byte45);
+- blogic_cmd(adapter, BLOGIC_FETCH_LOCALRAM,
++ blogic_cmd(host_adapter, BLOGIC_FETCH_LOCALRAM,
+ &fetch_localram, sizeof(fetch_localram),
+ &autoscsi_byte45,
+ sizeof(autoscsi_byte45));
+- blogic_cmd(adapter, BLOGIC_GET_BOARD_ID, NULL, 0, &id,
+- sizeof(id));
++ blogic_cmd(host_adapter, BLOGIC_GET_BOARD_ID, NULL, 0,
++ &id, sizeof(id));
+ if (id.fw_ver_digit1 == '5')
+ force_scan_order =
+ autoscsi_byte45.force_scan_order;
--- /dev/null
+From 10c580e4239df5c3344ca00322eca86ab2de880b Mon Sep 17 00:00:00 2001
+From: Aaron Lu <aaron.lu@intel.com>
+Date: Thu, 10 Oct 2013 13:22:36 +0800
+Subject: SCSI: sd: call blk_pm_runtime_init before add_disk
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+commit 10c580e4239df5c3344ca00322eca86ab2de880b upstream.
+
+Sujit has found a race condition that would make q->nr_pending
+unbalanced, it occurs as Sujit explained:
+
+"
+sd_probe_async() ->
+ add_disk() ->
+ disk_add_event() ->
+ schedule(disk_events_workfn)
+ sd_revalidate_disk()
+ blk_pm_runtime_init()
+return;
+
+Let's say the disk_events_workfn() calls sd_check_events() which tries
+to send test_unit_ready() and because of sd_revalidate_disk() trying to
+send another commands the test_unit_ready() might be re-queued as the
+tagged command queuing is disabled.
+
+So the race condition is -
+
+Thread 1 | Thread 2
+sd_revalidate_disk() | sd_check_events()
+...nr_pending = 0 as q->dev = NULL| scsi_queue_insert()
+blk_runtime_pm_init() | blk_pm_requeue_request() ->
+ | nr_pending = -1 since
+ | q->dev != NULL
+"
+
+The problem is, the test_unit_ready request doesn't get counted the
+first time it is queued, so the later decrement of q->nr_pending in
+blk_pm_requeue_request makes it unbalanced.
+
+Fix this by calling blk_pm_runtime_init before add_disk so that all
+requests initiated there will all be counted.
+
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Reported-and-tested-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2853,6 +2853,7 @@ static void sd_probe_async(void *data, a
+ gd->events |= DISK_EVENT_MEDIA_CHANGE;
+ }
+
++ blk_pm_runtime_init(sdp->request_queue, dev);
+ add_disk(gd);
+ if (sdkp->capacity)
+ sd_dif_config_host(sdkp);
+@@ -2861,7 +2862,6 @@ static void sd_probe_async(void *data, a
+
+ sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
+ sdp->removable ? "removable " : "");
+- blk_pm_runtime_init(sdp->request_queue, dev);
+ scsi_autopm_put_device(sdp);
+ put_device(&sdkp->dev);
+ }
mac80211-use-sta_info_get_bss-for-nl80211-tx-and-client-probing.patch
mac80211-update-sta-last_rx-on-acked-tx-frames.patch
mac80211-fix-crash-if-bitrate-calculation-goes-wrong.patch
+ath9k-fix-tx-queue-scheduling-after-channel-changes.patch
+cfg80211-use-the-correct-macro-to-check-for-active-monitor-support.patch
+cfg80211-fix-warning-when-using-wext-for-ibss.patch
+mwifiex-fix-sdio-interrupt-lost-issue.patch
+rtlwifi-rtl8192cu-fix-error-in-pointer-arithmetic.patch
+iwlwifi-mvm-call-ieee80211_scan_completed-when-needed.patch
+iwlwifi-pcie-add-skus-for-6000-6005-and-6235-series.patch
+jfs-fix-error-path-in-ialloc.patch
+can-at91-can-fix-device-to-driver-data-mapping-for-platform-devices.patch
+can-flexcan-fix-mx28-detection-by-rearanging-of-match-table.patch
+can-flexcan-flexcan_chip_start-fix-regression-mark-one-mb-for-tx-and-abort-pending-tx.patch
+scsi-buslogic-fix-an-oops-when-intializing-multimaster-adapter.patch
+scsi-sd-call-blk_pm_runtime_init-before-add_disk.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
