--- /dev/null
+From d4eddd42f592a0cf06818fae694a3d271f842e4d Mon Sep 17 00:00:00 2001
+From: Kent Overstreet <kmo@daterainc.com>
+Date: Tue, 22 Oct 2013 15:35:50 -0700
+Subject: bcache: Fixed incorrect order of arguments to bio_alloc_bioset()
+
+From: Kent Overstreet <kmo@daterainc.com>
+
+commit d4eddd42f592a0cf06818fae694a3d271f842e4d upstream.
+
+Signed-off-by: Kent Overstreet <kmo@daterainc.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/request.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -1000,7 +1000,7 @@ static void request_write(struct cached_
+
+ if (bio->bi_rw & REQ_FLUSH) {
+ /* Also need to send a flush to the backing device */
+- struct bio *flush = bio_alloc_bioset(0, GFP_NOIO,
++ struct bio *flush = bio_alloc_bioset(GFP_NOIO, 0,
+ dc->disk.bio_split);
+
+ flush->bi_rw = WRITE_FLUSH;
--- /dev/null
+From ea84753c98a7ac6b74e530b64c444a912b3835ca Mon Sep 17 00:00:00 2001
+From: Anjana V Kumar <anjanavk12@gmail.com>
+Date: Sat, 12 Oct 2013 10:59:17 +0800
+Subject: cgroup: fix to break the while loop in cgroup_attach_task() correctly
+
+From: Anjana V Kumar <anjanavk12@gmail.com>
+
+commit ea84753c98a7ac6b74e530b64c444a912b3835ca upstream.
+
+Both Anjana and Eunki reported a stall in the while_each_thread loop
+in cgroup_attach_task().
+
+It's because, when we attach a single thread to a cgroup, if the cgroup
+is exiting or is already in that cgroup, we won't break the loop.
+
+If the task is already in the cgroup, the bug can lead to another thread
+being attached to the cgroup unexpectedly:
+
+ # echo 5207 > tasks
+ # cat tasks
+ 5207
+ # echo 5207 > tasks
+ # cat tasks
+ 5207
+ 5215
+
+What's worse, if the task to be attached isn't the leader of the thread
+group, we might never exit the loop, hence cpu stall. Thanks for Oleg's
+analysis.
+
+This bug was introduced by commit 081aa458c38ba576bdd4265fc807fa95b48b9e79
+("cgroup: consolidate cgroup_attach_task() and cgroup_attach_proc()")
+
+[ lizf: - fixed the first continue, pointed out by Oleg,
+ - rewrote changelog. ]
+
+Reported-by: Eunki Kim <eunki_kim@samsung.com>
+Reported-by: Anjana V Kumar <anjanavk12@gmail.com>
+Signed-off-by: Anjana V Kumar <anjanavk12@gmail.com>
+Signed-off-by: Li Zefan <lizefan@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/cgroup.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2054,7 +2054,7 @@ static int cgroup_attach_task(struct cgr
+
+ /* @tsk either already exited or can't exit until the end */
+ if (tsk->flags & PF_EXITING)
+- continue;
++ goto next;
+
+ /* as per above, nr_threads may decrease, but not increase. */
+ BUG_ON(i >= group_size);
+@@ -2062,7 +2062,7 @@ static int cgroup_attach_task(struct cgr
+ ent.cgrp = task_cgroup_from_root(tsk, root);
+ /* nothing to do if this task is already in the cgroup */
+ if (ent.cgrp == cgrp)
+- continue;
++ goto next;
+ /*
+ * saying GFP_ATOMIC has no effect here because we did prealloc
+ * earlier, but it's good form to communicate our expectations.
+@@ -2070,7 +2070,7 @@ static int cgroup_attach_task(struct cgr
+ retval = flex_array_put(group, i, &ent, GFP_ATOMIC);
+ BUG_ON(retval != 0);
+ i++;
+-
++ next:
+ if (!threadgroup)
+ break;
+ } while_each_thread(leader, tsk);
--- /dev/null
+From 2f6c9479633780ba4a3484bba7eba5a721a5cf20 Mon Sep 17 00:00:00 2001
+From: Jan Klos <honza.klos@gmail.com>
+Date: Sun, 6 Oct 2013 21:08:20 +0200
+Subject: cifs: Fix inability to write files >2GB to SMB2/3 shares
+
+From: Jan Klos <honza.klos@gmail.com>
+
+commit 2f6c9479633780ba4a3484bba7eba5a721a5cf20 upstream.
+
+When connecting to SMB2/3 shares, maximum file size is set to non-LFS maximum in superblock. This is due to cap_large_files bit being different for SMB1 and SMB2/3 (where it is just an internal flag that is not negotiated and the SMB1 one corresponds to multichannel capability, so maybe LFS works correctly if server sends 0x08 flag) while capabilities are checked always for the SMB1 bit in cifs_read_super().
+
+The patch fixes this by checking for the correct bit according to the protocol version.
+
+Signed-off-by: Jan Klos <honza.klos@gmail.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <smfrench@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/cifsfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -120,14 +120,16 @@ cifs_read_super(struct super_block *sb)
+ {
+ struct inode *inode;
+ struct cifs_sb_info *cifs_sb;
++ struct cifs_tcon *tcon;
+ int rc = 0;
+
+ cifs_sb = CIFS_SB(sb);
++ tcon = cifs_sb_master_tcon(cifs_sb);
+
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIXACL)
+ sb->s_flags |= MS_POSIXACL;
+
+- if (cifs_sb_master_tcon(cifs_sb)->ses->capabilities & CAP_LARGE_FILES)
++ if (tcon->ses->capabilities & tcon->ses->server->vals->cap_large_files)
+ sb->s_maxbytes = MAX_LFS_FILESIZE;
+ else
+ sb->s_maxbytes = MAX_NON_LFS;
+@@ -147,7 +149,7 @@ cifs_read_super(struct super_block *sb)
+ goto out_no_root;
+ }
+
+- if (cifs_sb_master_tcon(cifs_sb)->nocase)
++ if (tcon->nocase)
+ sb->s_d_op = &cifs_ci_dentry_ops;
+ else
+ sb->s_d_op = &cifs_dentry_ops;
--- /dev/null
+From 52e0a509e5d6f902ec26bc2a8bb02b137dc453be Mon Sep 17 00:00:00 2001
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Date: Tue, 15 Oct 2013 11:06:14 -0700
+Subject: cpufreq / intel_pstate: Fix max_perf_pct on resume
+
+From: Dirk Brandewie <dirk.j.brandewie@intel.com>
+
+commit 52e0a509e5d6f902ec26bc2a8bb02b137dc453be upstream.
+
+If the system is suspended while max_perf_pct is less than 100 percent
+or no_turbo set policy->{min,max} will be set incorrectly with scaled
+values which turn the scaled values into hard limits.
+
+References: https://bugzilla.kernel.org/show_bug.cgi?id=61241
+Reported-by: Patrick Bartels <petzicus@googlemail.com>
+Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -629,8 +629,8 @@ static int intel_pstate_cpu_exit(struct
+
+ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
+ {
+- int rc, min_pstate, max_pstate;
+ struct cpudata *cpu;
++ int rc;
+
+ rc = intel_pstate_init_cpu(policy->cpu);
+ if (rc)
+@@ -644,9 +644,8 @@ static int intel_pstate_cpu_init(struct
+ else
+ policy->policy = CPUFREQ_POLICY_POWERSAVE;
+
+- intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
+- policy->min = min_pstate * 100000;
+- policy->max = max_pstate * 100000;
++ policy->min = cpu->pstate.min_pstate * 100000;
++ policy->max = cpu->pstate.turbo_pstate * 100000;
+
+ /* cpuinfo and default policy values */
+ policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000;
--- /dev/null
+From 0e8244322b7fc45fd11a1c45f70b6bacddf4986f Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Mon, 14 Oct 2013 19:36:47 +0100
+Subject: cpufreq: s3c64xx: Rename index to driver_data
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit 0e8244322b7fc45fd11a1c45f70b6bacddf4986f upstream.
+
+The index field of cpufreq_frequency_table has been renamed to
+driver_data by commit 5070158 (cpufreq: rename index as driver_data
+in cpufreq_frequency_table).
+
+This patch updates the s3c64xx driver to match.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/s3c64xx-cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/s3c64xx-cpufreq.c
++++ b/drivers/cpufreq/s3c64xx-cpufreq.c
+@@ -166,7 +166,7 @@ static void __init s3c64xx_cpufreq_confi
+ if (freq->frequency == CPUFREQ_ENTRY_INVALID)
+ continue;
+
+- dvfs = &s3c64xx_dvfs_table[freq->index];
++ dvfs = &s3c64xx_dvfs_table[freq->driver_data];
+ found = 0;
+
+ for (i = 0; i < count; i++) {
--- /dev/null
+From 86b84167d4e67372376a57ea9955c5d53dae232f Mon Sep 17 00:00:00 2001
+From: David Herrmann <dh.herrmann@gmail.com>
+Date: Fri, 18 Oct 2013 16:26:22 +0200
+Subject: HID: wiimote: add LEGO-wiimote VID
+
+From: David Herrmann <dh.herrmann@gmail.com>
+
+commit 86b84167d4e67372376a57ea9955c5d53dae232f upstream.
+
+The LEGO-wiimote uses a different VID than the Nintendo ID. The device is
+technically the same so add the ID.
+
+Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-wiimote-core.c | 5 ++++-
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1827,6 +1827,7 @@ static const struct hid_device_id hid_ha
+
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
+ { }
+ };
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -633,6 +633,7 @@
+ #define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN 0x0003
+
+ #define USB_VENDOR_ID_NINTENDO 0x057e
++#define USB_VENDOR_ID_NINTENDO2 0x054c
+ #define USB_DEVICE_ID_NINTENDO_WIIMOTE 0x0306
+ #define USB_DEVICE_ID_NINTENDO_WIIMOTE2 0x0330
+
+--- a/drivers/hid/hid-wiimote-core.c
++++ b/drivers/hid/hid-wiimote-core.c
+@@ -838,7 +838,8 @@ static void wiimote_init_set_type(struct
+ goto done;
+ }
+
+- if (vendor == USB_VENDOR_ID_NINTENDO) {
++ if (vendor == USB_VENDOR_ID_NINTENDO ||
++ vendor == USB_VENDOR_ID_NINTENDO2) {
+ if (product == USB_DEVICE_ID_NINTENDO_WIIMOTE) {
+ devtype = WIIMOTE_DEV_GEN10;
+ goto done;
+@@ -1860,6 +1861,8 @@ static void wiimote_hid_remove(struct hi
+ static const struct hid_device_id wiimote_hid_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
+ USB_DEVICE_ID_NINTENDO_WIIMOTE) },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2,
++ USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
+ USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
+ { }
--- /dev/null
+From a754055a1296fcbe6f32de3a5eaca6efb2fd1865 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 16 Sep 2013 11:12:07 +0300
+Subject: mac80211: correctly close cancelled scans
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit a754055a1296fcbe6f32de3a5eaca6efb2fd1865 upstream.
+
+__ieee80211_scan_completed is called from a worker. This
+means that the following flow is possible.
+
+ * driver calls ieee80211_scan_completed
+ * mac80211 cancels the scan (that is already complete)
+ * __ieee80211_scan_completed runs
+
+When scan_work will finally run, it will see that the scan
+hasn't been aborted and might even trigger another scan on
+another band. This leads to a situation where cfg80211's
+scan is not done and no further scan can be issued.
+
+Fix this by setting a new flag when a HW scan is being
+cancelled so that no other scan will be triggered.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/ieee80211_i.h | 3 +++
+ net/mac80211/scan.c | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -858,6 +858,8 @@ struct tpt_led_trigger {
+ * that the scan completed.
+ * @SCAN_ABORTED: Set for our scan work function when the driver reported
+ * a scan complete for an aborted scan.
++ * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being
++ * cancelled.
+ */
+ enum {
+ SCAN_SW_SCANNING,
+@@ -865,6 +867,7 @@ enum {
+ SCAN_ONCHANNEL_SCANNING,
+ SCAN_COMPLETED,
+ SCAN_ABORTED,
++ SCAN_HW_CANCELLED,
+ };
+
+ /**
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -211,6 +211,9 @@ static bool ieee80211_prep_hw_scan(struc
+ enum ieee80211_band band;
+ int i, ielen, n_chans;
+
++ if (test_bit(SCAN_HW_CANCELLED, &local->scanning))
++ return false;
++
+ do {
+ if (local->hw_scan_band == IEEE80211_NUM_BANDS)
+ return false;
+@@ -887,7 +890,23 @@ void ieee80211_scan_cancel(struct ieee80
+ if (!local->scan_req)
+ goto out;
+
++ /*
++ * We have a scan running and the driver already reported completion,
++ * but the worker hasn't run yet or is stuck on the mutex - mark it as
++ * cancelled.
++ */
++ if (test_bit(SCAN_HW_SCANNING, &local->scanning) &&
++ test_bit(SCAN_COMPLETED, &local->scanning)) {
++ set_bit(SCAN_HW_CANCELLED, &local->scanning);
++ goto out;
++ }
++
+ if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
++ /*
++ * Make sure that __ieee80211_scan_completed doesn't trigger a
++ * scan on another band.
++ */
++ set_bit(SCAN_HW_CANCELLED, &local->scanning);
+ if (local->ops->cancel_hw_scan)
+ drv_cancel_hw_scan(local,
+ rcu_dereference_protected(local->scan_sdata,
--- /dev/null
+From 6329b8d917adc077caa60c2447385554130853a3 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 17 Sep 2013 11:15:43 +0200
+Subject: mac80211: drop spoofed packets in ad-hoc mode
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 6329b8d917adc077caa60c2447385554130853a3 upstream.
+
+If an Ad-Hoc node receives packets with the Cell ID or its own MAC
+address as source address, it hits a WARN_ON in sta_info_insert_check()
+With many packets, this can massively spam the logs. One way that this
+can easily happen is through having Cisco APs in the area with rouge AP
+detection and countermeasures enabled.
+Such Cisco APs will regularly send fake beacons, disassoc and deauth
+packets that trigger these warnings.
+
+To fix this issue, drop such spoofed packets early in the rx path.
+
+Reported-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3014,6 +3014,9 @@ static int prepare_for_handlers(struct i
+ case NL80211_IFTYPE_ADHOC:
+ if (!bssid)
+ return 0;
++ if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
++ ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
++ return 0;
+ if (ieee80211_is_beacon(hdr->frame_control)) {
+ return 1;
+ } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
--- /dev/null
+From d86aa4f8ca58898ec6a94c0635da20b948171ed7 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 11 Oct 2013 15:47:06 +0200
+Subject: mac80211: fix crash if bitrate calculation goes wrong
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit d86aa4f8ca58898ec6a94c0635da20b948171ed7 upstream.
+
+If a frame's timestamp is calculated, and the bitrate
+calculation goes wrong and returns zero, the system
+will attempt to divide by zero and crash. Catch this
+case and print the rate information that the driver
+reported when this happens.
+
+Reported-by: Thomas Lindroth <thomas.lindroth@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/util.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -2155,6 +2155,10 @@ u64 ieee80211_calculate_rx_timestamp(str
+ }
+
+ rate = cfg80211_calculate_bitrate(&ri);
++ if (WARN_ONCE(!rate,
++ "Invalid bitrate: flags=0x%x, idx=%d, vht_nss=%d\n",
++ status->flag, status->rate_idx, status->vht_nss))
++ return 0;
+
+ /* rewind from end of MPDU */
+ if (status->flag & RX_FLAG_MACTIME_END)
--- /dev/null
+From 0c5b93290b2f3c7a376567c03ae8d385b0e99851 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 29 Sep 2013 21:39:34 +0200
+Subject: mac80211: update sta->last_rx on acked tx frames
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 0c5b93290b2f3c7a376567c03ae8d385b0e99851 upstream.
+
+When clients are idle for too long, hostapd sends nullfunc frames for
+probing. When those are acked by the client, the idle time needs to be
+updated.
+
+To make this work (and to avoid unnecessary probing), update sta->last_rx
+whenever an ACK was received for a tx packet. Only do this if the flag
+IEEE80211_HW_REPORTS_TX_ACK_STATUS is set.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/status.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -180,6 +180,9 @@ static void ieee80211_frame_acked(struct
+ struct ieee80211_local *local = sta->local;
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+
++ if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
++ sta->last_rx = jiffies;
++
+ if (ieee80211_is_data_qos(mgmt->frame_control)) {
+ struct ieee80211_hdr *hdr = (void *) skb->data;
+ u8 *qc = ieee80211_get_qos_ctl(hdr);
--- /dev/null
+From 03bb7f42765ce596604f03d179f3137d7df05bba Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 29 Sep 2013 21:39:33 +0200
+Subject: mac80211: use sta_info_get_bss() for nl80211 tx and client probing
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 03bb7f42765ce596604f03d179f3137d7df05bba upstream.
+
+This allows calls for clients in AP_VLANs (e.g. for 4-addr) to succeed
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/cfg.c | 2 +-
+ net/mac80211/tx.c | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -3334,7 +3334,7 @@ static int ieee80211_probe_client(struct
+ return -EINVAL;
+ }
+ band = chanctx_conf->def.chan->band;
+- sta = sta_info_get(sdata, peer);
++ sta = sta_info_get_bss(sdata, peer);
+ if (sta) {
+ qos = test_sta_flag(sta, WLAN_STA_WME);
+ } else {
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1101,7 +1101,8 @@ ieee80211_tx_prepare(struct ieee80211_su
+ tx->sta = rcu_dereference(sdata->u.vlan.sta);
+ if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
+ return TX_DROP;
+- } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
++ } else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
++ IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
+ tx->sdata->control_port_protocol == tx->skb->protocol) {
+ tx->sta = sta_info_get_bss(sdata, hdr->addr1);
+ }
usb-quirks.c-add-one-device-that-cannot-deal-with-suspension.patch
usb-quirks-add-touchscreen-that-is-dazzeled-by-remote-wakeup.patch
usb-serial-ftdi_sio-add-id-for-z3x-box-device.patch
+xhci-don-t-enable-disable-rwe-on-bus-suspend-resume.patch
+cifs-fix-inability-to-write-files-2gb-to-smb2-3-shares.patch
+x86-update-uv3-hub-revision-id.patch
+cpufreq-s3c64xx-rename-index-to-driver_data.patch
+cpufreq-intel_pstate-fix-max_perf_pct-on-resume.patch
+bcache-fixed-incorrect-order-of-arguments-to-bio_alloc_bioset.patch
+hid-wiimote-add-lego-wiimote-vid.patch
+cgroup-fix-to-break-the-while-loop-in-cgroup_attach_task-correctly.patch
+mac80211-correctly-close-cancelled-scans.patch
+mac80211-drop-spoofed-packets-in-ad-hoc-mode.patch
+mac80211-use-sta_info_get_bss-for-nl80211-tx-and-client-probing.patch
+mac80211-update-sta-last_rx-on-acked-tx-frames.patch
+mac80211-fix-crash-if-bitrate-calculation-goes-wrong.patch
--- /dev/null
+From dd3c9c4b603c664fedc12facf180db0f1794aafe Mon Sep 17 00:00:00 2001
+From: Russ Anderson <rja@sgi.com>
+Date: Mon, 14 Oct 2013 11:17:34 -0500
+Subject: x86: Update UV3 hub revision ID
+
+From: Russ Anderson <rja@sgi.com>
+
+commit dd3c9c4b603c664fedc12facf180db0f1794aafe upstream.
+
+The UV3 hub revision ID is different than expected. The first
+revision was supposed to start at 1 but instead will start at 0.
+
+Signed-off-by: Russ Anderson <rja@sgi.com>
+Link: http://lkml.kernel.org/r/20131014161733.GA6274@sgi.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -113,7 +113,7 @@ static int __init early_get_pnodeid(void
+ break;
+ case UV3_HUB_PART_NUMBER:
+ case UV3_HUB_PART_NUMBER_X:
+- uv_min_hub_revision_id += UV3_HUB_REVISION_BASE - 1;
++ uv_min_hub_revision_id += UV3_HUB_REVISION_BASE;
+ break;
+ }
+
--- /dev/null
+From f217c980ca980e3a645b7485ea5eae9a747f4945 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Mon, 5 Aug 2013 13:36:00 -0700
+Subject: xhci: Don't enable/disable RWE on bus suspend/resume.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit f217c980ca980e3a645b7485ea5eae9a747f4945 upstream.
+
+The RWE bit of the USB 2.0 PORTPMSC register is supposed to enable
+remote wakeup for devices in the lower power link state L1. It has
+nothing to do with the device suspend remote wakeup from L2. The RWE
+bit is designed to be set once (when USB 2.0 LPM is enabled for the
+port) and cleared only when USB 2.0 LPM is disabled for the port.
+
+The xHCI bus suspend method was setting the RWE bit erroneously, and the
+bus resume method was clearing it. The xHCI 1.0 specification with
+errata up to Aug 12, 2012 says in section 4.23.5.1.1.1 "Hardware
+Controlled LPM":
+
+"While Hardware USB2 LPM is enabled, software shall not modify the
+HIRDBESL or RWE fields of the USB2 PORTPMSC register..."
+
+If we have previously enabled USB 2.0 LPM for a device, that means when
+the USB 2.0 bus is resumed, we violate the xHCI specification by
+clearing RWE. It also means that after a bus resume, the host would
+think remote wakeup is disabled from L1 for ports with USB 2.0 Link PM
+enabled, which is not what we want.
+
+This patch should be backported to kernels as old as 3.2, that
+contain the commit 65580b4321eb36f16ae8b5987bfa1bb948fc5112 "xHCI: set
+USB2 hardware LPM". That was the first kernel that supported USB 2.0
+Link PM.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 26 --------------------------
+ 1 file changed, 26 deletions(-)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1092,18 +1092,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd
+ t1 = xhci_port_state_to_neutral(t1);
+ if (t1 != t2)
+ xhci_writel(xhci, t2, port_array[port_index]);
+-
+- if (hcd->speed != HCD_USB3) {
+- /* enable remote wake up for USB 2.0 */
+- __le32 __iomem *addr;
+- u32 tmp;
+-
+- /* Get the port power control register address. */
+- addr = port_array[port_index] + PORTPMSC;
+- tmp = xhci_readl(xhci, addr);
+- tmp |= PORT_RWE;
+- xhci_writel(xhci, tmp, addr);
+- }
+ }
+ hcd->state = HC_STATE_SUSPENDED;
+ bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
+@@ -1182,20 +1170,6 @@ int xhci_bus_resume(struct usb_hcd *hcd)
+ xhci_ring_device(xhci, slot_id);
+ } else
+ xhci_writel(xhci, temp, port_array[port_index]);
+-
+- if (hcd->speed != HCD_USB3) {
+- /* disable remote wake up for USB 2.0 */
+- __le32 __iomem *addr;
+- u32 tmp;
+-
+- /* Add one to the port status register address to get
+- * the port power control register address.
+- */
+- addr = port_array[port_index] + PORTPMSC;
+- tmp = xhci_readl(xhci, addr);
+- tmp &= ~PORT_RWE;
+- xhci_writel(xhci, tmp, addr);
+- }
+ }
+
+ (void) xhci_readl(xhci, &xhci->op_regs->command);
projects / thirdparty / kernel / stable-queue.git / commitdiff
