--- /dev/null
+From c0214f98943b1fe43f7be61b7782b0c8f0836f28 Mon Sep 17 00:00:00 2001
+From: Fabio Baltieri <fabio.baltieri@gmail.com>
+Date: Sun, 8 Jun 2014 22:06:24 +0100
+Subject: hwmon: (ina2xx) Cast to s16 on shunt and current regs
+
+From: Fabio Baltieri <fabio.baltieri@gmail.com>
+
+commit c0214f98943b1fe43f7be61b7782b0c8f0836f28 upstream.
+
+All devices supported by ina2xx are bidirectional and report the
+measured shunt voltage and power values as a signed 16 bit, but the
+current driver implementation caches all registers as u16, leading
+to an incorrect sign extension when reporting to userspace in
+ina2xx_get_value().
+
+This patch fixes the problem by casting the signed registers to s16.
+Tested on an INA219.
+
+Signed-off-by: Fabio Baltieri <fabio.baltieri@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/ina2xx.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/ina2xx.c
++++ b/drivers/hwmon/ina2xx.c
+@@ -148,7 +148,8 @@ static int ina2xx_get_value(struct ina2x
+
+ switch (reg) {
+ case INA2XX_SHUNT_VOLTAGE:
+- val = DIV_ROUND_CLOSEST(data->regs[reg],
++ /* signed register */
++ val = DIV_ROUND_CLOSEST((s16)data->regs[reg],
+ data->config->shunt_div);
+ break;
+ case INA2XX_BUS_VOLTAGE:
+@@ -160,8 +161,8 @@ static int ina2xx_get_value(struct ina2x
+ val = data->regs[reg] * data->config->power_lsb;
+ break;
+ case INA2XX_CURRENT:
+- /* LSB=1mA (selected). Is in mA */
+- val = data->regs[reg];
++ /* signed register, LSB=1mA (selected), in mA */
++ val = (s16)data->regs[reg];
+ break;
+ default:
+ /* programmer goofed */
--- /dev/null
+From 51d211e9c334b9eca3505f4052afa660c3e0606b Mon Sep 17 00:00:00 2001
+From: Doug Smythies <doug.smythies@gmail.com>
+Date: Tue, 17 Jun 2014 13:36:10 -0700
+Subject: intel_pstate: Correct rounding in busy calculation
+
+From: Doug Smythies <doug.smythies@gmail.com>
+
+commit 51d211e9c334b9eca3505f4052afa660c3e0606b upstream.
+
+There was a mistake in the actual rounding portion this previous patch:
+f0fe3cd7e12d (intel_pstate: Correct rounding in busy calculation) such that
+the rounding was asymetric and incorrect.
+
+Severity: Not very serious, but can increase target pstate by one extra value.
+For real world work flows the issue should self correct (but I have no proof).
+It is the equivalent of different PID gains for positive and negative numbers.
+
+Examples:
+ -3.000000 used to round to -4, rounds to -3 with this patch.
+ -3.503906 used to round to -5, rounds to -4 with this patch.
+
+Fixes: f0fe3cd7e12d (intel_pstate: Correct rounding in busy calculation)
+Signed-off-by: Doug Smythies <dsmythies@telus.net>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/intel_pstate.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -200,10 +200,7 @@ static signed int pid_calc(struct _pid *
+ pid->last_err = fp_error;
+
+ result = pterm + mul_fp(pid->integral, pid->i_gain) + dterm;
+- if (result >= 0)
+- result = result + (1 << (FRAC_BITS-1));
+- else
+- result = result - (1 << (FRAC_BITS-1));
++ result = result + (1 << (FRAC_BITS-1));
+ return (signed int)fp_toint(result);
+ }
+
--- /dev/null
+From 923eaf367206e01f22c97aee22300e332d071916 Mon Sep 17 00:00:00 2001
+From: Arik Nemtsov <arik@wizery.com>
+Date: Mon, 26 May 2014 14:40:51 +0300
+Subject: mac80211: don't check netdev state for debugfs read/write
+
+From: Arik Nemtsov <arik@wizery.com>
+
+commit 923eaf367206e01f22c97aee22300e332d071916 upstream.
+
+Doing so will lead to an oops for a p2p-dev interface, since it has
+no netdev.
+
+Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/debugfs_netdev.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -34,8 +34,7 @@ static ssize_t ieee80211_if_read(
+ ssize_t ret = -EINVAL;
+
+ read_lock(&dev_base_lock);
+- if (sdata->dev->reg_state == NETREG_REGISTERED)
+- ret = (*format)(sdata, buf, sizeof(buf));
++ ret = (*format)(sdata, buf, sizeof(buf));
+ read_unlock(&dev_base_lock);
+
+ if (ret >= 0)
+@@ -62,8 +61,7 @@ static ssize_t ieee80211_if_write(
+
+ ret = -ENODEV;
+ rtnl_lock();
+- if (sdata->dev->reg_state == NETREG_REGISTERED)
+- ret = (*write)(sdata, buf, count);
++ ret = (*write)(sdata, buf, count);
+ rtnl_unlock();
+
+ return ret;
--- /dev/null
+From 53d045258ee2e38b1e882617cb0799a04d05f5fa Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 27 May 2014 22:33:57 +0200
+Subject: mac80211: fix a memory leak on sta rate selection table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 53d045258ee2e38b1e882617cb0799a04d05f5fa upstream.
+
+If the rate control algorithm uses a selection table, it
+is leaked when the station is destroyed - fix that.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Reported-by: Christophe Prévotaux <cprevotaux@nltinc.com>
+Fixes: 0d528d85c519 ("mac80211: improve the rate control API")
+[add commit log entry, remove pointless NULL check]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/sta_info.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -240,6 +240,7 @@ void sta_info_free(struct ieee80211_loca
+
+ sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
+
++ kfree(rcu_dereference_raw(sta->sta.rates));
+ kfree(sta);
+ }
+
--- /dev/null
+From c7d37a66e345df2fdf1aa7b2c9a6d3d53846ca5b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Krzysztof=20Ha=C5=82asa?= <khalasa@piap.pl>
+Date: Mon, 26 May 2014 14:14:46 +0200
+Subject: mac80211: fix IBSS join by initializing last_scan_completed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Krzysztof=20Ha=C5=82asa?= <khalasa@piap.pl>
+
+commit c7d37a66e345df2fdf1aa7b2c9a6d3d53846ca5b upstream.
+
+Without this fix, freshly rebooted Linux creates a new IBSS
+instead of joining an existing one. Only when jiffies counter
+overflows after 5 minutes the IBSS can be successfully joined.
+
+Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
+[edit commit message slightly]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/ibss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1648,6 +1648,7 @@ int ieee80211_ibss_join(struct ieee80211
+ sdata->u.ibss.control_port = params->control_port;
+ sdata->u.ibss.userspace_handles_dfs = params->userspace_handles_dfs;
+ sdata->u.ibss.basic_rates = params->basic_rates;
++ sdata->u.ibss.last_scan_completed = jiffies;
+
+ /* fix basic_rates if channel does not support these rates */
+ rate_flags = ieee80211_chandef_rate_flags(¶ms->chandef);
dm-thin-update-discard_granularity-to-reflect-the-thin-pool-blocksize.patch
rbd-use-reference-counts-for-image-requests.patch
rbd-handle-parent_overlap-on-writes-correctly.patch
+hwmon-ina2xx-cast-to-s16-on-shunt-and-current-regs.patch
+intel_pstate-correct-rounding-in-busy-calculation.patch
+twl4030-madc-request-processed-values-in-twl4030_get_madc_conversion.patch
+mac80211-fix-ibss-join-by-initializing-last_scan_completed.patch
+mac80211-don-t-check-netdev-state-for-debugfs-read-write.patch
+mac80211-fix-a-memory-leak-on-sta-rate-selection-table.patch
--- /dev/null
+From e0326be0cded13dfc3a24cbeece1f1ae64348a0e Mon Sep 17 00:00:00 2001
+From: Paul Kocialkowski <contact@paulk.fr>
+Date: Sat, 24 May 2014 13:09:00 +0100
+Subject: twl4030-madc: Request processed values in twl4030_get_madc_conversion
+
+From: Paul Kocialkowski <contact@paulk.fr>
+
+commit e0326be0cded13dfc3a24cbeece1f1ae64348a0e upstream.
+
+Not setting the raw parameter in the request causes it to be randomly
+initialized to a value that might be different from zero or zero. This leads to
+values that are randomly either raw or processed, making it very difficult to
+make reliable use of the values.
+
+Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
+Acked-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/twl4030-madc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/adc/twl4030-madc.c
++++ b/drivers/iio/adc/twl4030-madc.c
+@@ -645,6 +645,7 @@ int twl4030_get_madc_conversion(int chan
+ req.channels = (1 << channel_no);
+ req.method = TWL4030_MADC_SW2;
+ req.active = 0;
++ req.raw = 0;
+ req.func_cb = NULL;
+ ret = twl4030_madc_conversion(&req);
+ if (ret < 0)