--- /dev/null
+From 1eec0c569523782392b5e6245effddb626213b8c Mon Sep 17 00:00:00 2001
+From: Shawn Guo <shawn.guo@linaro.org>
+Date: Thu, 2 Aug 2012 22:48:39 +0800
+Subject: ARM: dts: imx53-ard: add regulators for lan9220
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+commit 1eec0c569523782392b5e6245effddb626213b8c upstream.
+
+Since commit c7e963f (net/smsc911x: Add regulator support), the lan9220
+device tree probe fails on imx53-ard board, because the commit makes
+VDD33A and VDDVARIO supplies mandatory for the driver.
+
+Add a fixed dummy 3V3 supplying lan9220 to fix the regression.
+
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx53-ard.dts | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/arch/arm/boot/dts/imx53-ard.dts
++++ b/arch/arm/boot/dts/imx53-ard.dts
+@@ -70,10 +70,30 @@
+ interrupt-parent = <&gpio2>;
+ interrupts = <31>;
+ reg-io-width = <4>;
++ /*
++ * VDD33A and VDDVARIO of LAN9220 are supplied by
++ * SW4_3V3 of LTC3589. Before the regulator driver
++ * for this PMIC is available, we use a fixed dummy
++ * 3V3 regulator to get LAN9220 driver probing work.
++ */
++ vdd33a-supply = <®_3p3v>;
++ vddvario-supply = <®_3p3v>;
+ smsc,irq-push-pull;
+ };
+ };
+
++ regulators {
++ compatible = "simple-bus";
++
++ reg_3p3v: 3p3v {
++ compatible = "regulator-fixed";
++ regulator-name = "3P3V";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ regulator-always-on;
++ };
++ };
++
+ gpio-keys {
+ compatible = "gpio-keys";
+
--- /dev/null
+From 3bed491c8d28329e34f8a31e3fe64d03f3a350f1 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Fri, 3 Aug 2012 20:54:48 +0200
+Subject: ARM: mxs: Remove MMAP_MIN_ADDR setting from mxs_defconfig
+
+From: Marek Vasut <marex@denx.de>
+
+commit 3bed491c8d28329e34f8a31e3fe64d03f3a350f1 upstream.
+
+The CONFIG_DEFAULT_MMAP_MIN_ADDR was set to 65536 in mxs_defconfig,
+this caused severe breakage of userland applications since the upper
+limit for ARM is 32768. By default CONFIG_DEFAULT_MMAP_MIN_ADDR is
+set to 4096 and can also be changed via /proc/sys/vm/mmap_min_addr
+if needed.
+
+Quoting Russell King [1]:
+
+"4096 is also fine for ARM too. There's not much point in having
+defconfigs change it - that would just be pure noise in the config
+files."
+
+the CONFIG_DEFAULT_MMAP_MIN_ADDR can be removed from the defconfig
+altogether.
+
+This problem was introduced by commit cde7c41 (ARM: configs: add
+defconfig for mach-mxs).
+
+[1] http://marc.info/?l=linux-arm-kernel&m=134401593807820&w=2
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Russell King <linux@arm.linux.org.uk>
+Cc: Wolfgang Denk <wd@denx.de>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/configs/mxs_defconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/configs/mxs_defconfig
++++ b/arch/arm/configs/mxs_defconfig
+@@ -32,7 +32,6 @@ CONFIG_NO_HZ=y
+ CONFIG_HIGH_RES_TIMERS=y
+ CONFIG_PREEMPT_VOLUNTARY=y
+ CONFIG_AEABI=y
+-CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
+ CONFIG_AUTO_ZRELADDR=y
+ CONFIG_FPE_NWFPE=y
+ CONFIG_NET=y
--- /dev/null
+From 59ee93a528b94ef4e81a08db252b0326feff171f Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Sun, 5 Aug 2012 14:58:37 +0000
+Subject: ARM: pxa: remove irq_to_gpio from ezx-pcap driver
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 59ee93a528b94ef4e81a08db252b0326feff171f upstream.
+
+The irq_to_gpio function was removed from the pxa platform
+in linux-3.2, and this driver has been broken since.
+
+There is actually no in-tree user of this driver that adds
+this platform device, but the driver can and does get enabled
+on some platforms.
+
+Without this patch, building ezx_defconfig results in:
+
+drivers/mfd/ezx-pcap.c: In function 'pcap_isr_work':
+drivers/mfd/ezx-pcap.c:205:2: error: implicit declaration of function 'irq_to_gpio' [-Werror=implicit-function-declaration]
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com>
+Cc: Samuel Ortiz <sameo@linux.intel.com>
+Cc: Daniel Ribeiro <drwyrm@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/ezx-pcap.c | 2 +-
+ include/linux/mfd/ezx-pcap.h | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mfd/ezx-pcap.c
++++ b/drivers/mfd/ezx-pcap.c
+@@ -202,7 +202,7 @@ static void pcap_isr_work(struct work_st
+ }
+ local_irq_enable();
+ ezx_pcap_write(pcap, PCAP_REG_MSR, pcap->msr);
+- } while (gpio_get_value(irq_to_gpio(pcap->spi->irq)));
++ } while (gpio_get_value(pdata->gpio));
+ }
+
+ static void pcap_irq_handler(unsigned int irq, struct irq_desc *desc)
+--- a/include/linux/mfd/ezx-pcap.h
++++ b/include/linux/mfd/ezx-pcap.h
+@@ -16,6 +16,7 @@ struct pcap_subdev {
+ struct pcap_platform_data {
+ unsigned int irq_base;
+ unsigned int config;
++ int gpio;
+ void (*init) (void *); /* board specific init */
+ int num_subdevs;
+ struct pcap_subdev *subdevs;
--- /dev/null
+From paul.gortmaker@windriver.com Mon Aug 13 11:39:55 2012
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Thu, 2 Aug 2012 18:55:41 -0400
+Subject: cfg80211: fix interface combinations check for ADHOC(IBSS)
+To: Johannes Berg <johannes@sipsolutions.net>
+Cc: <linux-wireless@vger.kernel.org>, <linville@tuxdriver.com>, Liang Li <liang.li@windriver.com>, <stable@vger.kernel.org>, Paul Gortmaker <paul.gortmaker@windriver.com>
+Message-ID: <1343948141-25005-1-git-send-email-paul.gortmaker@windriver.com>
+
+
+From: Liang Li <liang.li@windriver.com>
+
+partial of commit 8e8b41f9d8c8e63fc92f899ace8da91a490ac573 upstream.
+
+As part of commit 463454b5dbd8 ("cfg80211: fix interface
+combinations check"), this extra check was introduced:
+
+ if ((all_iftypes & used_iftypes) != used_iftypes)
+ goto cont;
+
+However, most wireless NIC drivers did not advertise ADHOC in
+wiphy.iface_combinations[i].limits[] and hence we'll get -EBUSY
+when we bring up a ADHOC wlan with commands similar to:
+
+ # iwconfig wlan0 mode ad-hoc && ifconfig wlan0 up
+
+In commit 8e8b41f9d8c8e ("cfg80211: enforce lack of interface
+combinations"), the change below fixes the issue:
+
+ if (total == 1)
+ return 0;
+
+But it also introduces other dependencies for stable. For example,
+a full cherry pick of 8e8b41f9d8c8e would introduce additional
+regressions unless we also start cherry picking driver specific
+fixes like the following:
+
+ 9b4760e ath5k: add possible wiphy interface combinations
+ 1ae2fc2 mac80211_hwsim: advertise interface combinations
+ 20c8e8d ath9k: add possible wiphy interface combinations
+
+And the purpose of the 'if (total == 1)' is to cover the specific
+use case (IBSS, adhoc) that was mentioned above. So we just pick
+the specific part out from 8e8b41f9d8c8e here.
+
+Doing so gives stable kernels a way to fix the change introduced
+by 463454b5dbd8, without having to make cherry picks specific to
+various NIC drivers.
+
+Signed-off-by: Liang Li <liang.li@windriver.com>
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/util.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -974,6 +974,9 @@ int cfg80211_can_change_interface(struct
+ }
+ mutex_unlock(&rdev->devlist_mtx);
+
++ if (total == 1)
++ return 0;
++
+ for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
+ const struct ieee80211_iface_combination *c;
+ struct ieee80211_iface_limit *limits;
--- /dev/null
+From 1f6fc43e621167492ed4b7f3b4269c584c3d6ccc Mon Sep 17 00:00:00 2001
+From: Daniel Drake <dsd@laptop.org>
+Date: Thu, 2 Aug 2012 18:41:48 +0100
+Subject: cfg80211: process pending events when unregistering net device
+
+From: Daniel Drake <dsd@laptop.org>
+
+commit 1f6fc43e621167492ed4b7f3b4269c584c3d6ccc upstream.
+
+libertas currently calls cfg80211_disconnected() when it is being
+brought down. This causes an event to be allocated, but since the
+wdev is already removed from the rdev by the time that the event
+processing work executes, the event is never processed or freed.
+http://article.gmane.org/gmane.linux.kernel.wireless.general/95666
+
+Fix this leak, and other possible situations, by processing the event
+queue when a device is being unregistered. Thanks to Johannes Berg for
+the suggestion.
+
+Signed-off-by: Daniel Drake <dsd@laptop.org>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/core.c | 5 +++++
+ net/wireless/core.h | 1 +
+ net/wireless/util.c | 2 +-
+ 3 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -975,6 +975,11 @@ static int cfg80211_netdev_notifier_call
+ */
+ synchronize_rcu();
+ INIT_LIST_HEAD(&wdev->list);
++ /*
++ * Ensure that all events have been processed and
++ * freed.
++ */
++ cfg80211_process_wdev_events(wdev);
+ break;
+ case NETDEV_PRE_UP:
+ if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -426,6 +426,7 @@ int cfg80211_change_iface(struct cfg8021
+ struct net_device *dev, enum nl80211_iftype ntype,
+ u32 *flags, struct vif_params *params);
+ void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
++void cfg80211_process_wdev_events(struct wireless_dev *wdev);
+
+ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+ struct wireless_dev *wdev,
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -717,7 +717,7 @@ void cfg80211_upload_connect_keys(struct
+ wdev->connect_keys = NULL;
+ }
+
+-static void cfg80211_process_wdev_events(struct wireless_dev *wdev)
++void cfg80211_process_wdev_events(struct wireless_dev *wdev)
+ {
+ struct cfg80211_event *ev;
+ unsigned long flags;
--- /dev/null
+From b7ec70be01a87f2c85df3ae11046e74f9b67e323 Mon Sep 17 00:00:00 2001
+From: Tushar Dave <tushar.n.dave@intel.com>
+Date: Tue, 31 Jul 2012 02:02:43 +0000
+Subject: e1000e: NIC goes up and immediately goes down
+
+From: Tushar Dave <tushar.n.dave@intel.com>
+
+commit b7ec70be01a87f2c85df3ae11046e74f9b67e323 upstream.
+
+Found that commit d478eb44 was a bad commit.
+If the link partner is transmitting codeword (even if NULL codeword),
+then the RXCW.C bit will be set so check for RXCW.CW is unnecessary.
+Ref: RH BZ 840642
+
+Reported-by: Fabio Futigami <ffutigam@redhat.com>
+Signed-off-by: Tushar Dave <tushar.n.dave@intel.com>
+CC: Marcelo Ricardo Leitner <mleitner@redhat.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/e1000e/82571.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000e/82571.c
++++ b/drivers/net/ethernet/intel/e1000e/82571.c
+@@ -1582,10 +1582,8 @@ static s32 e1000_check_for_serdes_link_8
+ * auto-negotiation in the TXCW register and disable
+ * forced link in the Device Control register in an
+ * attempt to auto-negotiate with our link partner.
+- * If the partner code word is null, stop forcing
+- * and restart auto negotiation.
+ */
+- if ((rxcw & E1000_RXCW_C) || !(rxcw & E1000_RXCW_CW)) {
++ if (rxcw & E1000_RXCW_C) {
+ /* Enable autoneg, and unforce link up */
+ ew32(TXCW, mac->txcw);
+ ew32(CTRL, (ctrl & ~E1000_CTRL_SLU));
--- /dev/null
+From 4eef6cbfcc03b294d9d334368a851b35b496ce53 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 30 Apr 2012 16:21:37 +0000
+Subject: Input: eeti_ts: pass gpio value instead of IRQ
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 4eef6cbfcc03b294d9d334368a851b35b496ce53 upstream.
+
+The EETI touchscreen asserts its IRQ line as soon as it has data in its
+internal buffers. The line is automatically deasserted once all data has
+been read via I2C. Hence, the driver has to monitor the GPIO line and
+cannot simply rely on the interrupt handler reception.
+
+In the current implementation of the driver, irq_to_gpio() is used to
+determine the GPIO number from the i2c_client's IRQ value.
+
+As irq_to_gpio() is not available on all platforms, this patch changes
+this and makes the driver ignore the passed in IRQ. Instead, a GPIO is
+added to the platform_data struct and gpio_to_irq is used to derive the
+IRQ from that GPIO. If this fails, bail out. The driver is only able to
+work in environments where the touchscreen GPIO can be mapped to an
+IRQ.
+
+Without this patch, building raumfeld_defconfig results in:
+
+drivers/input/touchscreen/eeti_ts.c: In function 'eeti_ts_irq_active':
+drivers/input/touchscreen/eeti_ts.c:65:2: error: implicit declaration of function 'irq_to_gpio' [-Werror=implicit-function-declaration]
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Cc: Sven Neumann <s.neumann@raumfeld.com>
+Cc: linux-input@vger.kernel.org
+Cc: Haojian Zhuang <haojian.zhuang@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-pxa/raumfeld.c | 2 +-
+ drivers/input/touchscreen/eeti_ts.c | 21 +++++++++++++--------
+ include/linux/input/eeti_ts.h | 1 +
+ 3 files changed, 15 insertions(+), 9 deletions(-)
+
+--- a/arch/arm/mach-pxa/raumfeld.c
++++ b/arch/arm/mach-pxa/raumfeld.c
+@@ -953,12 +953,12 @@ static struct i2c_board_info raumfeld_co
+
+ static struct eeti_ts_platform_data eeti_ts_pdata = {
+ .irq_active_high = 1,
++ .irq_gpio = GPIO_TOUCH_IRQ,
+ };
+
+ static struct i2c_board_info raumfeld_controller_i2c_board_info __initdata = {
+ .type = "eeti_ts",
+ .addr = 0x0a,
+- .irq = PXA_GPIO_TO_IRQ(GPIO_TOUCH_IRQ),
+ .platform_data = &eeti_ts_pdata,
+ };
+
+--- a/drivers/input/touchscreen/eeti_ts.c
++++ b/drivers/input/touchscreen/eeti_ts.c
+@@ -48,7 +48,7 @@ struct eeti_ts_priv {
+ struct input_dev *input;
+ struct work_struct work;
+ struct mutex mutex;
+- int irq, irq_active_high;
++ int irq_gpio, irq, irq_active_high;
+ };
+
+ #define EETI_TS_BITDEPTH (11)
+@@ -62,7 +62,7 @@ struct eeti_ts_priv {
+
+ static inline int eeti_ts_irq_active(struct eeti_ts_priv *priv)
+ {
+- return gpio_get_value(irq_to_gpio(priv->irq)) == priv->irq_active_high;
++ return gpio_get_value(priv->irq_gpio) == priv->irq_active_high;
+ }
+
+ static void eeti_ts_read(struct work_struct *work)
+@@ -157,7 +157,7 @@ static void eeti_ts_close(struct input_d
+ static int __devinit eeti_ts_probe(struct i2c_client *client,
+ const struct i2c_device_id *idp)
+ {
+- struct eeti_ts_platform_data *pdata;
++ struct eeti_ts_platform_data *pdata = client->dev.platform_data;
+ struct eeti_ts_priv *priv;
+ struct input_dev *input;
+ unsigned int irq_flags;
+@@ -199,9 +199,12 @@ static int __devinit eeti_ts_probe(struc
+
+ priv->client = client;
+ priv->input = input;
+- priv->irq = client->irq;
++ priv->irq_gpio = pdata->irq_gpio;
++ priv->irq = gpio_to_irq(pdata->irq_gpio);
+
+- pdata = client->dev.platform_data;
++ err = gpio_request_one(pdata->irq_gpio, GPIOF_IN, client->name);
++ if (err < 0)
++ goto err1;
+
+ if (pdata)
+ priv->irq_active_high = pdata->irq_active_high;
+@@ -215,13 +218,13 @@ static int __devinit eeti_ts_probe(struc
+
+ err = input_register_device(input);
+ if (err)
+- goto err1;
++ goto err2;
+
+ err = request_irq(priv->irq, eeti_ts_isr, irq_flags,
+ client->name, priv);
+ if (err) {
+ dev_err(&client->dev, "Unable to request touchscreen IRQ.\n");
+- goto err2;
++ goto err3;
+ }
+
+ /*
+@@ -233,9 +236,11 @@ static int __devinit eeti_ts_probe(struc
+ device_init_wakeup(&client->dev, 0);
+ return 0;
+
+-err2:
++err3:
+ input_unregister_device(input);
+ input = NULL; /* so we dont try to free it below */
++err2:
++ gpio_free(pdata->irq_gpio);
+ err1:
+ input_free_device(input);
+ kfree(priv);
+--- a/include/linux/input/eeti_ts.h
++++ b/include/linux/input/eeti_ts.h
+@@ -2,6 +2,7 @@
+ #define LINUX_INPUT_EETI_TS_H
+
+ struct eeti_ts_platform_data {
++ int irq_gpio;
+ unsigned int irq_active_high;
+ };
+
--- /dev/null
+From 6dc463511d4a690f01a9248df3b384db717e0b1c Mon Sep 17 00:00:00 2001
+From: Chris Bagwell <chris@cnpbagwell.com>
+Date: Tue, 12 Jun 2012 00:25:48 -0700
+Subject: Input: wacom - Bamboo One 1024 pressure fix
+
+From: Chris Bagwell <chris@cnpbagwell.com>
+
+commit 6dc463511d4a690f01a9248df3b384db717e0b1c upstream.
+
+Bamboo One's with ID of 0x6a and 0x6b were added with correct
+indication of 1024 pressure levels but the Graphire packet routine
+was only looking at 9 bits. Increased to 10 bits.
+
+This bug caused these devices to roll over to zero pressure at half
+way mark.
+
+The other devices using this routine only support 256 or 512 range
+and look to fix unused bits at zero.
+
+Signed-off-by: Chris Bagwell <chris@cnpbagwell.com>
+Reported-by: Tushant Mirchandani <tushantin@gmail.com>
+Reviewed-by: Ping Cheng <pingc@wacom.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/tablet/wacom_wac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/tablet/wacom_wac.c
++++ b/drivers/input/tablet/wacom_wac.c
+@@ -243,7 +243,7 @@ static int wacom_graphire_irq(struct wac
+ input_report_abs(input, ABS_X, le16_to_cpup((__le16 *)&data[2]));
+ input_report_abs(input, ABS_Y, le16_to_cpup((__le16 *)&data[4]));
+ if (wacom->tool[0] != BTN_TOOL_MOUSE) {
+- input_report_abs(input, ABS_PRESSURE, data[6] | ((data[7] & 0x01) << 8));
++ input_report_abs(input, ABS_PRESSURE, data[6] | ((data[7] & 0x03) << 8));
+ input_report_key(input, BTN_TOUCH, data[1] & 0x01);
+ input_report_key(input, BTN_STYLUS, data[1] & 0x02);
+ input_report_key(input, BTN_STYLUS2, data[1] & 0x04);
--- /dev/null
+From 50e2a30cf6fcaeb2d27360ba614dd169a10041c5 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Sun, 5 Aug 2012 18:31:46 +0200
+Subject: iwlwifi: disable greenfield transmissions as a workaround
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 50e2a30cf6fcaeb2d27360ba614dd169a10041c5 upstream.
+
+There's a bug that causes the rate scaling to get stuck
+when it has to use single-stream rates with a peer that
+can do GF and SGI; the two are incompatible so we can't
+use them together, but that causes the algorithm to not
+work at all, it always rejects updates.
+
+Disable greenfield for now to prevent that problem.
+
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Tested-by: Cesar Eduardo Barros <cesarb@cesarb.net>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+@@ -709,11 +709,14 @@ static int rs_toggle_antenna(u32 valid_a
+ */
+ static bool rs_use_green(struct ieee80211_sta *sta)
+ {
+- struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+- struct iwl_rxon_context *ctx = sta_priv->ctx;
+-
+- return (sta->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD) &&
+- !(ctx->ht.non_gf_sta_present);
++ /*
++ * There's a bug somewhere in this code that causes the
++ * scaling to get stuck because GF+SGI can't be combined
++ * in SISO rates. Until we find that bug, disable GF, it
++ * has only limited benefit and we still interoperate with
++ * GF APs since we can always receive GF transmissions.
++ */
++ return false;
+ }
+
+ /**
--- /dev/null
+From deee0214def5d8a32b8112f11d9c2b1696e9c0cb Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 3 Aug 2012 12:49:14 +0200
+Subject: rt61pci: fix NULL pointer dereference in config_lna_gain
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit deee0214def5d8a32b8112f11d9c2b1696e9c0cb upstream.
+
+We can not pass NULL libconf->conf->channel to rt61pci_config() as it
+is dereferenced unconditionally in rt61pci_config_lna_gain() subroutine.
+
+Resolves:
+https://bugzilla.kernel.org/show_bug.cgi?id=44361
+
+Reported-and-tested-by: <dolohow@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt61pci.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/rt2x00/rt61pci.c
+@@ -2243,8 +2243,7 @@ static void rt61pci_txdone(struct rt2x00
+
+ static void rt61pci_wakeup(struct rt2x00_dev *rt2x00dev)
+ {
+- struct ieee80211_conf conf = { .flags = 0 };
+- struct rt2x00lib_conf libconf = { .conf = &conf };
++ struct rt2x00lib_conf libconf = { .conf = &rt2x00dev->hw->conf };
+
+ rt61pci_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
+ }
target-fix-reading-of-data-length-fields-for-unmap-commands.patch
target-fix-possible-integer-underflow-in-unmap-emulation.patch
target-check-number-of-unmap-descriptors-against-our-limit.patch
+arm-mxs-remove-mmap_min_addr-setting-from-mxs_defconfig.patch
+arm-dts-imx53-ard-add-regulators-for-lan9220.patch
+arm-pxa-remove-irq_to_gpio-from-ezx-pcap-driver.patch
+cfg80211-process-pending-events-when-unregistering-net-device.patch
+cfg80211-fix-interface-combinations-check-for-adhoc-ibss.patch
+tun-don-t-zeroize-sock-file-on-detach.patch
+iwlwifi-disable-greenfield-transmissions-as-a-workaround.patch
+e1000e-nic-goes-up-and-immediately-goes-down.patch
+input-eeti_ts-pass-gpio-value-instead-of-irq.patch
+input-wacom-bamboo-one-1024-pressure-fix.patch
+rt61pci-fix-null-pointer-dereference-in-config_lna_gain.patch
--- /dev/null
+From 66d1b9263a371abd15806c53f486f0645ef31a8f Mon Sep 17 00:00:00 2001
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+Date: Thu, 9 Aug 2012 02:50:40 +0000
+Subject: tun: don't zeroize sock->file on detach
+
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+
+commit 66d1b9263a371abd15806c53f486f0645ef31a8f upstream.
+
+This is a fix for bug, introduced in 3.4 kernel by commit
+1ab5ecb90cb6a3df1476e052f76a6e8f6511cb3d ("tun: don't hold network
+namespace by tun sockets"), which, among other things, replaced simple
+sock_put() by sk_release_kernel(). Below is sequence, which leads to
+oops for non-persistent devices:
+
+tun_chr_close()
+tun_detach() <== tun->socket.file = NULL
+tun_free_netdev()
+sk_release_sock()
+sock_release(sock->file == NULL)
+iput(SOCK_INODE(sock)) <== dereference on NULL pointer
+
+This patch just removes zeroing of socket's file from __tun_detach().
+sock_release() will do this.
+
+Reported-by: Ruan Zhijie <ruanzhijie@hotmail.com>
+Tested-by: Ruan Zhijie <ruanzhijie@hotmail.com>
+Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/tun.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -185,7 +185,6 @@ static void __tun_detach(struct tun_stru
+ netif_tx_lock_bh(tun->dev);
+ netif_carrier_off(tun->dev);
+ tun->tfile = NULL;
+- tun->socket.file = NULL;
+ netif_tx_unlock_bh(tun->dev);
+
+ /* Drop read queue */
projects / thirdparty / kernel / stable-queue.git / commitdiff
