--- /dev/null
+From 3d9a0183dd3423353e9e363bcc261c1220d05f9f Mon Sep 17 00:00:00 2001
+From: Ivan Shugov <ivan.shugov@gmail.com>
+Date: Wed, 24 Oct 2012 11:02:44 +0200
+Subject: ARM: at91: at91sam9g10: fix SOC type detection
+
+From: Ivan Shugov <ivan.shugov@gmail.com>
+
+commit 3d9a0183dd3423353e9e363bcc261c1220d05f9f upstream.
+
+Newer at91sam9g10 SoC revision can't be detected, so the kernel can't boot with
+this kind of kernel panic:
+"AT91: Impossible to detect the SOC type"
+
+CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
+CPU: VIVT data cache, VIVT instruction cache
+Machine: Atmel AT91SAM9G10-EK
+Ignoring tag cmdline (using the default kernel command line)
+bootconsole [earlycon0] enabled
+Memory policy: ECC disabled, Data cache writeback
+Kernel panic - not syncing: AT91: Impossible to detect the SOC type
+[<c00133d4>] (unwind_backtrace+0x0/0xe0) from [<c02366dc>] (panic+0x78/0x1cc)
+[<c02366dc>] (panic+0x78/0x1cc) from [<c02fa35c>] (at91_map_io+0x90/0xc8)
+[<c02fa35c>] (at91_map_io+0x90/0xc8) from [<c02f9860>] (paging_init+0x564/0x6d0)
+[<c02f9860>] (paging_init+0x564/0x6d0) from [<c02f7914>] (setup_arch+0x464/0x704)
+[<c02f7914>] (setup_arch+0x464/0x704) from [<c02f44f8>] (start_kernel+0x6c/0x2d4)
+[<c02f44f8>] (start_kernel+0x6c/0x2d4) from [<20008040>] (0x20008040)
+
+The reason for this is that the Debug Unit Chip ID Register has changed between
+Engineering Sample and definitive revision of the SoC. Changing the check of
+cidr to socid will address the problem. We do not integrate this check to the
+list just above because we also have to make sure that the extended id is
+disregarded.
+
+Signed-off-by: Ivan Shugov <ivan.shugov@gmail.com>
+[nicolas.ferre@atmel.com: change commit message]
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-at91/setup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-at91/setup.c
++++ b/arch/arm/mach-at91/setup.c
+@@ -151,7 +151,7 @@ static void __init soc_detect(u32 dbgu_b
+ }
+
+ /* at91sam9g10 */
+- if ((cidr & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) {
++ if ((socid & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) {
+ at91_soc_initdata.type = AT91_SOC_SAM9G10;
+ at91_boot_soc = at91sam9261_soc;
+ }
--- /dev/null
+From 69e7ea04c9365626c0963ff09bbaa3a1b49e293a Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Wed, 24 Oct 2012 16:19:47 +0200
+Subject: ARM: at91: fix external interrupt specification in board code
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit 69e7ea04c9365626c0963ff09bbaa3a1b49e293a upstream.
+
+Since the switch to sparse irq, we have to add the NR_IRQS_LEGACY
+offset to static irq numbers. It has been forgotten on these
+SPI irq definitions in board code.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-at91/board-neocore926.c | 2 +-
+ arch/arm/mach-at91/board-sam9261ek.c | 2 +-
+ arch/arm/mach-at91/board-sam9263ek.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/mach-at91/board-neocore926.c
++++ b/arch/arm/mach-at91/board-neocore926.c
+@@ -129,7 +129,7 @@ static struct spi_board_info neocore926_
+ .max_speed_hz = 125000 * 16,
+ .bus_num = 0,
+ .platform_data = &ads_info,
+- .irq = AT91SAM9263_ID_IRQ1,
++ .irq = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1,
+ },
+ #endif
+ };
+--- a/arch/arm/mach-at91/board-sam9261ek.c
++++ b/arch/arm/mach-at91/board-sam9261ek.c
+@@ -309,7 +309,7 @@ static struct spi_board_info ek_spi_devi
+ .max_speed_hz = 125000 * 26, /* (max sample rate @ 3V) * (cmd + data + overhead) */
+ .bus_num = 0,
+ .platform_data = &ads_info,
+- .irq = AT91SAM9261_ID_IRQ0,
++ .irq = NR_IRQS_LEGACY + AT91SAM9261_ID_IRQ0,
+ .controller_data = (void *) AT91_PIN_PA28, /* CS pin */
+ },
+ #endif
+--- a/arch/arm/mach-at91/board-sam9263ek.c
++++ b/arch/arm/mach-at91/board-sam9263ek.c
+@@ -132,7 +132,7 @@ static struct spi_board_info ek_spi_devi
+ .max_speed_hz = 125000 * 26, /* (max sample rate @ 3V) * (cmd + data + overhead) */
+ .bus_num = 0,
+ .platform_data = &ads_info,
+- .irq = AT91SAM9263_ID_IRQ1,
++ .irq = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1,
+ },
+ #endif
+ };
--- /dev/null
+From 738a0fd752dc60e20beeda6f2f0f62e58dc0e344 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Wed, 24 Oct 2012 16:09:57 +0200
+Subject: ARM: at91: fix external interrupts in non-DT case
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit 738a0fd752dc60e20beeda6f2f0f62e58dc0e344 upstream.
+
+Management of external interrupts has changed but the
+non-DT code has not integrated these changes.
+Add a mask to pass external irq specification from SoC
+specific code to the at91_aic_init() function.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-at91/generic.h | 3 ++-
+ arch/arm/mach-at91/irq.c | 9 +++++++--
+ arch/arm/mach-at91/setup.c | 2 +-
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-at91/generic.h
++++ b/arch/arm/mach-at91/generic.h
+@@ -26,7 +26,8 @@ extern void __init at91_dt_initialize(vo
+ extern void __init at91_init_irq_default(void);
+ extern void __init at91_init_interrupts(unsigned int priority[]);
+ extern void __init at91x40_init_interrupts(unsigned int priority[]);
+-extern void __init at91_aic_init(unsigned int priority[]);
++extern void __init at91_aic_init(unsigned int priority[],
++ unsigned int ext_irq_mask);
+ extern int __init at91_aic_of_init(struct device_node *node,
+ struct device_node *parent);
+ extern int __init at91_aic5_of_init(struct device_node *node,
+--- a/arch/arm/mach-at91/irq.c
++++ b/arch/arm/mach-at91/irq.c
+@@ -502,14 +502,19 @@ int __init at91_aic5_of_init(struct devi
+ /*
+ * Initialize the AIC interrupt controller.
+ */
+-void __init at91_aic_init(unsigned int *priority)
++void __init at91_aic_init(unsigned int *priority, unsigned int ext_irq_mask)
+ {
+ unsigned int i;
+ int irq_base;
+
+- if (at91_aic_pm_init())
++ at91_extern_irq = kzalloc(BITS_TO_LONGS(n_irqs)
++ * sizeof(*at91_extern_irq), GFP_KERNEL);
++
++ if (at91_aic_pm_init() || at91_extern_irq == NULL)
+ panic("Unable to allocate bit maps\n");
+
++ *at91_extern_irq = ext_irq_mask;
++
+ at91_aic_base = ioremap(AT91_AIC, 512);
+ if (!at91_aic_base)
+ panic("Unable to ioremap AIC registers\n");
+--- a/arch/arm/mach-at91/setup.c
++++ b/arch/arm/mach-at91/setup.c
+@@ -47,7 +47,7 @@ void __init at91_init_irq_default(void)
+ void __init at91_init_interrupts(unsigned int *priority)
+ {
+ /* Initialize the AIC interrupt controller */
+- at91_aic_init(priority);
++ at91_aic_init(priority, at91_extern_irq);
+
+ /* Enable GPIO interrupts */
+ at91_gpio_irq_setup();
--- /dev/null
+From 7840487cd6298f9f931103b558290d8d98d41c49 Mon Sep 17 00:00:00 2001
+From: Bo Shen <voice.shen@atmel.com>
+Date: Mon, 15 Oct 2012 17:30:27 +0800
+Subject: ARM: at91/i2c: change id to let i2c-gpio work
+
+From: Bo Shen <voice.shen@atmel.com>
+
+commit 7840487cd6298f9f931103b558290d8d98d41c49 upstream.
+
+The i2c core driver will turn the platform device ID to busnum
+When using platfrom device ID as -1, it means dynamically assigned
+the busnum. When writing code, we need to make sure the busnum,
+and call i2c_register_board_info(int busnum, ...) to register device
+if using -1, we do not know the value of busnum
+
+In order to solve this issue, set the platform device ID as a fix number
+Here using 0 to match the busnum used in i2c_regsiter_board_info()
+
+Signed-off-by: Bo Shen <voice.shen@atmel.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-at91/at91rm9200_devices.c | 2 +-
+ arch/arm/mach-at91/at91sam9260_devices.c | 2 +-
+ arch/arm/mach-at91/at91sam9261_devices.c | 2 +-
+ arch/arm/mach-at91/at91sam9263_devices.c | 2 +-
+ arch/arm/mach-at91/at91sam9rl_devices.c | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/mach-at91/at91rm9200_devices.c
++++ b/arch/arm/mach-at91/at91rm9200_devices.c
+@@ -463,7 +463,7 @@ static struct i2c_gpio_platform_data pda
+
+ static struct platform_device at91rm9200_twi_device = {
+ .name = "i2c-gpio",
+- .id = -1,
++ .id = 0,
+ .dev.platform_data = &pdata,
+ };
+
+--- a/arch/arm/mach-at91/at91sam9260_devices.c
++++ b/arch/arm/mach-at91/at91sam9260_devices.c
+@@ -471,7 +471,7 @@ static struct i2c_gpio_platform_data pda
+
+ static struct platform_device at91sam9260_twi_device = {
+ .name = "i2c-gpio",
+- .id = -1,
++ .id = 0,
+ .dev.platform_data = &pdata,
+ };
+
+--- a/arch/arm/mach-at91/at91sam9261_devices.c
++++ b/arch/arm/mach-at91/at91sam9261_devices.c
+@@ -285,7 +285,7 @@ static struct i2c_gpio_platform_data pda
+
+ static struct platform_device at91sam9261_twi_device = {
+ .name = "i2c-gpio",
+- .id = -1,
++ .id = 0,
+ .dev.platform_data = &pdata,
+ };
+
+--- a/arch/arm/mach-at91/at91sam9263_devices.c
++++ b/arch/arm/mach-at91/at91sam9263_devices.c
+@@ -542,7 +542,7 @@ static struct i2c_gpio_platform_data pda
+
+ static struct platform_device at91sam9263_twi_device = {
+ .name = "i2c-gpio",
+- .id = -1,
++ .id = 0,
+ .dev.platform_data = &pdata,
+ };
+
+--- a/arch/arm/mach-at91/at91sam9rl_devices.c
++++ b/arch/arm/mach-at91/at91sam9rl_devices.c
+@@ -314,7 +314,7 @@ static struct i2c_gpio_platform_data pda
+
+ static struct platform_device at91sam9rl_twi_device = {
+ .name = "i2c-gpio",
+- .id = -1,
++ .id = 0,
+ .dev.platform_data = &pdata,
+ };
+
--- /dev/null
+From 11930c530f3edf81160e4962e363d579f5cdce7e Mon Sep 17 00:00:00 2001
+From: Josh Wu <josh.wu@atmel.com>
+Date: Fri, 14 Sep 2012 17:01:29 +0800
+Subject: ARM: at91/tc: fix typo in the DT document
+
+From: Josh Wu <josh.wu@atmel.com>
+
+commit 11930c530f3edf81160e4962e363d579f5cdce7e upstream.
+
+Signed-off-by: Josh Wu <josh.wu@atmel.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/arm/atmel-at91.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/arm/atmel-at91.txt
++++ b/Documentation/devicetree/bindings/arm/atmel-at91.txt
+@@ -8,7 +8,7 @@ PIT Timer required properties:
+ shared across all System Controller members.
+
+ TC/TCLIB Timer required properties:
+-- compatible: Should be "atmel,<chip>-pit".
++- compatible: Should be "atmel,<chip>-tcb".
+ <chip> can be "at91rm9200" or "at91sam9x5"
+ - reg: Should contain registers location and length
+ - interrupts: Should contain all interrupts for the TC block
--- /dev/null
+From 308b3afb97dc342e9c4f958d8b4c459ae0e22bd7 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Wed, 17 Oct 2012 16:47:11 +0900
+Subject: ARM: SAMSUNG: Add naming of s3c64xx-spi devices
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+commit 308b3afb97dc342e9c4f958d8b4c459ae0e22bd7 upstream.
+
+Commit a5238e360b71 (spi: s3c64xx: move controller information into driver
+data) introduced separate device names for the different subtypes of the
+spi controller but forgot to set these in the relevant machines.
+
+To fix this introduce a s3c64xx_spi_setname function and populate all
+Samsung arches with the correct names. The function resides in a new
+header, as the s3c64xx-spi.h contains driver platform data and should
+therefore at some later point move out of the Samsung include dir.
+
+Tested on a s3c2416-based machine.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+[s.nawrocki@samsung.com: tested on mach-exynos]
+Tested-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-exynos/common.c | 5 ++++
+ arch/arm/mach-s3c24xx/s3c2416.c | 2 +
+ arch/arm/mach-s3c24xx/s3c2443.c | 4 +++
+ arch/arm/mach-s5p64x0/common.c | 3 ++
+ arch/arm/mach-s5pc100/common.c | 3 ++
+ arch/arm/mach-s5pv210/common.c | 3 ++
+ arch/arm/plat-samsung/include/plat/spi-core.h | 30 ++++++++++++++++++++++++++
+ 7 files changed, 50 insertions(+)
+
+--- a/arch/arm/mach-exynos/common.c
++++ b/arch/arm/mach-exynos/common.c
+@@ -47,6 +47,7 @@
+ #include <plat/fimc-core.h>
+ #include <plat/iic-core.h>
+ #include <plat/tv-core.h>
++#include <plat/spi-core.h>
+ #include <plat/regs-serial.h>
+
+ #include "common.h"
+@@ -346,6 +347,8 @@ static void __init exynos4_map_io(void)
+
+ s5p_fb_setname(0, "exynos4-fb");
+ s5p_hdmi_setname("exynos4-hdmi");
++
++ s3c64xx_spi_setname("exynos4210-spi");
+ }
+
+ static void __init exynos5_map_io(void)
+@@ -366,6 +369,8 @@ static void __init exynos5_map_io(void)
+ s3c_i2c0_setname("s3c2440-i2c");
+ s3c_i2c1_setname("s3c2440-i2c");
+ s3c_i2c2_setname("s3c2440-i2c");
++
++ s3c64xx_spi_setname("exynos4210-spi");
+ }
+
+ static void __init exynos4_init_clocks(int xtal)
+--- a/arch/arm/mach-s3c24xx/s3c2416.c
++++ b/arch/arm/mach-s3c24xx/s3c2416.c
+@@ -61,6 +61,7 @@
+ #include <plat/nand-core.h>
+ #include <plat/adc-core.h>
+ #include <plat/rtc-core.h>
++#include <plat/spi-core.h>
+
+ static struct map_desc s3c2416_iodesc[] __initdata = {
+ IODESC_ENT(WATCHDOG),
+@@ -132,6 +133,7 @@ void __init s3c2416_map_io(void)
+ /* initialize device information early */
+ s3c2416_default_sdhci0();
+ s3c2416_default_sdhci1();
++ s3c64xx_spi_setname("s3c2443-spi");
+
+ iotable_init(s3c2416_iodesc, ARRAY_SIZE(s3c2416_iodesc));
+ }
+--- a/arch/arm/mach-s3c24xx/s3c2443.c
++++ b/arch/arm/mach-s3c24xx/s3c2443.c
+@@ -43,6 +43,7 @@
+ #include <plat/nand-core.h>
+ #include <plat/adc-core.h>
+ #include <plat/rtc-core.h>
++#include <plat/spi-core.h>
+
+ static struct map_desc s3c2443_iodesc[] __initdata = {
+ IODESC_ENT(WATCHDOG),
+@@ -100,6 +101,9 @@ void __init s3c2443_map_io(void)
+ s3c24xx_gpiocfg_default.set_pull = s3c2443_gpio_setpull;
+ s3c24xx_gpiocfg_default.get_pull = s3c2443_gpio_getpull;
+
++ /* initialize device information early */
++ s3c64xx_spi_setname("s3c2443-spi");
++
+ iotable_init(s3c2443_iodesc, ARRAY_SIZE(s3c2443_iodesc));
+ }
+
+--- a/arch/arm/mach-s5p64x0/common.c
++++ b/arch/arm/mach-s5p64x0/common.c
+@@ -44,6 +44,7 @@
+ #include <plat/sdhci.h>
+ #include <plat/adc-core.h>
+ #include <plat/fb-core.h>
++#include <plat/spi-core.h>
+ #include <plat/gpio-cfg.h>
+ #include <plat/regs-irqtype.h>
+ #include <plat/regs-serial.h>
+@@ -179,6 +180,7 @@ void __init s5p6440_map_io(void)
+ /* initialize any device information early */
+ s3c_adc_setname("s3c64xx-adc");
+ s3c_fb_setname("s5p64x0-fb");
++ s3c64xx_spi_setname("s5p64x0-spi");
+
+ s5p64x0_default_sdhci0();
+ s5p64x0_default_sdhci1();
+@@ -193,6 +195,7 @@ void __init s5p6450_map_io(void)
+ /* initialize any device information early */
+ s3c_adc_setname("s3c64xx-adc");
+ s3c_fb_setname("s5p64x0-fb");
++ s3c64xx_spi_setname("s5p64x0-spi");
+
+ s5p64x0_default_sdhci0();
+ s5p64x0_default_sdhci1();
+--- a/arch/arm/mach-s5pc100/common.c
++++ b/arch/arm/mach-s5pc100/common.c
+@@ -45,6 +45,7 @@
+ #include <plat/fb-core.h>
+ #include <plat/iic-core.h>
+ #include <plat/onenand-core.h>
++#include <plat/spi-core.h>
+ #include <plat/regs-serial.h>
+ #include <plat/watchdog-reset.h>
+
+@@ -165,6 +166,8 @@ void __init s5pc100_map_io(void)
+ s3c_onenand_setname("s5pc100-onenand");
+ s3c_fb_setname("s5pc100-fb");
+ s3c_cfcon_setname("s5pc100-pata");
++
++ s3c64xx_spi_setname("s5pc100-spi");
+ }
+
+ void __init s5pc100_init_clocks(int xtal)
+--- a/arch/arm/mach-s5pv210/common.c
++++ b/arch/arm/mach-s5pv210/common.c
+@@ -43,6 +43,7 @@
+ #include <plat/iic-core.h>
+ #include <plat/keypad-core.h>
+ #include <plat/tv-core.h>
++#include <plat/spi-core.h>
+ #include <plat/regs-serial.h>
+
+ #include "common.h"
+@@ -196,6 +197,8 @@ void __init s5pv210_map_io(void)
+
+ /* setup TV devices */
+ s5p_hdmi_setname("s5pv210-hdmi");
++
++ s3c64xx_spi_setname("s5pv210-spi");
+ }
+
+ void __init s5pv210_init_clocks(int xtal)
+--- /dev/null
++++ b/arch/arm/plat-samsung/include/plat/spi-core.h
+@@ -0,0 +1,30 @@
++/*
++ * Copyright (C) 2012 Heiko Stuebner <heiko@sntech.de>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#ifndef __PLAT_S3C_SPI_CORE_H
++#define __PLAT_S3C_SPI_CORE_H
++
++/* These functions are only for use with the core support code, such as
++ * the cpu specific initialisation code
++ */
++
++/* re-define device name depending on support. */
++static inline void s3c64xx_spi_setname(char *name)
++{
++#ifdef CONFIG_S3C64XX_DEV_SPI0
++ s3c64xx_device_spi0.name = name;
++#endif
++#ifdef CONFIG_S3C64XX_DEV_SPI1
++ s3c64xx_device_spi1.name = name;
++#endif
++#ifdef CONFIG_S3C64XX_DEV_SPI2
++ s3c64xx_device_spi2.name = name;
++#endif
++}
++
++#endif /* __PLAT_S3C_SPI_CORE_H */
--- /dev/null
+From f89ff6441df06abc2d95f3ef67525923032d6283 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Wed, 24 Oct 2012 08:57:16 -0500
+Subject: b43: Fix oops on unload when firmware not found
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit f89ff6441df06abc2d95f3ef67525923032d6283 upstream.
+
+When b43 fails to find firmware when loaded, a subsequent unload will
+oops due to calling ieee80211_unregister_hw() when the corresponding
+register call was never made.
+
+Commit 2d838bb608e2d1f6cb4280e76748cb812dc822e7 fixed the same problem
+for b43legacy.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Tested-by: Markus Kanet <dvmailing@gmx.eu>
+Cc: Markus Kanet <dvmailing@gmx.eu>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/b43/main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -5374,6 +5374,8 @@ static void b43_bcma_remove(struct bcma_
+ cancel_work_sync(&wldev->restart_work);
+
+ B43_WARN_ON(!wl);
++ if (!wldev->fw.ucode.data)
++ return; /* NULL if firmware never loaded */
+ if (wl->current_dev == wldev && wl->hw_registred) {
+ b43_leds_stop(wldev);
+ ieee80211_unregister_hw(wl->hw);
+@@ -5448,6 +5450,8 @@ static void b43_ssb_remove(struct ssb_de
+ cancel_work_sync(&wldev->restart_work);
+
+ B43_WARN_ON(!wl);
++ if (!wldev->fw.ucode.data)
++ return; /* NULL if firmware never loaded */
+ if (wl->current_dev == wldev && wl->hw_registred) {
+ b43_leds_stop(wldev);
+ ieee80211_unregister_hw(wl->hw);
--- /dev/null
+From 1fffa905adffbf0d3767fc978ef09afb830275eb Mon Sep 17 00:00:00 2001
+From: Piotr Haber <phaber@broadcom.com>
+Date: Thu, 11 Oct 2012 14:05:15 +0200
+Subject: bcma: fix unregistration of cores
+
+From: Piotr Haber <phaber@broadcom.com>
+
+commit 1fffa905adffbf0d3767fc978ef09afb830275eb upstream.
+
+When cores are unregistered, entries
+need to be removed from cores list in a safe manner.
+
+Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Signed-off-by: Piotr Haber <phaber@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bcma/main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -141,9 +141,10 @@ static int bcma_register_cores(struct bc
+
+ static void bcma_unregister_cores(struct bcma_bus *bus)
+ {
+- struct bcma_device *core;
++ struct bcma_device *core, *tmp;
+
+- list_for_each_entry(core, &bus->cores, list) {
++ list_for_each_entry_safe(core, tmp, &bus->cores, list) {
++ list_del(&core->list);
+ if (core->dev_registered)
+ device_unregister(&core->dev);
+ }
--- /dev/null
+From 065a13e2cc665f6547dc7e8a9d6b6565badf940a Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Thu, 11 Oct 2012 16:26:06 +0200
+Subject: Bluetooth: SMP: Fix setting unknown auth_req bits
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit 065a13e2cc665f6547dc7e8a9d6b6565badf940a upstream.
+
+When sending a pairing request or response we should not just blindly
+copy the value that the remote device sent. Instead we should at least
+make sure to mask out any unknown bits. This is particularly critical
+from the upcoming LE Secure Connections feature perspective as
+incorrectly indicating support for it (by copying the remote value)
+would cause a failure to pair with devices that support it.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/smp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -32,6 +32,8 @@
+
+ #define SMP_TIMEOUT msecs_to_jiffies(30000)
+
++#define AUTH_REQ_MASK 0x07
++
+ static inline void swap128(u8 src[16], u8 dst[16])
+ {
+ int i;
+@@ -230,7 +232,7 @@ static void build_pairing_cmd(struct l2c
+ req->max_key_size = SMP_MAX_ENC_KEY_SIZE;
+ req->init_key_dist = 0;
+ req->resp_key_dist = dist_keys;
+- req->auth_req = authreq;
++ req->auth_req = (authreq & AUTH_REQ_MASK);
+ return;
+ }
+
+@@ -239,7 +241,7 @@ static void build_pairing_cmd(struct l2c
+ rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
+ rsp->init_key_dist = 0;
+ rsp->resp_key_dist = req->resp_key_dist & dist_keys;
+- rsp->auth_req = authreq;
++ rsp->auth_req = (authreq & AUTH_REQ_MASK);
+ }
+
+ static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
--- /dev/null
+From e4df1cbcc1f329e53a1fff7450b2229e0addff20 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Tue, 23 Oct 2012 00:55:10 +0200
+Subject: cpufreq / powernow-k8: Remove usage of smp_processor_id() in preemptible code
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit e4df1cbcc1f329e53a1fff7450b2229e0addff20 upstream.
+
+Commit 6889125b8b4e09c5e53e6ecab3433bed1ce198c9
+(cpufreq/powernow-k8: workqueue user shouldn't migrate the kworker to another CPU)
+causes powernow-k8 to trigger a preempt warning, e.g.:
+
+ BUG: using smp_processor_id() in preemptible [00000000] code: cpufreq/3776
+ caller is powernowk8_target+0x20/0x49
+ Pid: 3776, comm: cpufreq Not tainted 3.6.0 #9
+ Call Trace:
+ [<ffffffff8125b447>] debug_smp_processor_id+0xc7/0xe0
+ [<ffffffff814877e7>] powernowk8_target+0x20/0x49
+ [<ffffffff81482b02>] __cpufreq_driver_target+0x82/0x8a
+ [<ffffffff81484fc6>] cpufreq_governor_performance+0x4e/0x54
+ [<ffffffff81482c50>] __cpufreq_governor+0x8c/0xc9
+ [<ffffffff81482e6f>] __cpufreq_set_policy+0x1a9/0x21e
+ [<ffffffff814839af>] store_scaling_governor+0x16f/0x19b
+ [<ffffffff81484f16>] ? cpufreq_update_policy+0x124/0x124
+ [<ffffffff8162b4a5>] ? _raw_spin_unlock_irqrestore+0x2c/0x49
+ [<ffffffff81483640>] store+0x60/0x88
+ [<ffffffff811708c0>] sysfs_write_file+0xf4/0x130
+ [<ffffffff8111243b>] vfs_write+0xb5/0x151
+ [<ffffffff811126e0>] sys_write+0x4a/0x71
+ [<ffffffff816319a9>] system_call_fastpath+0x16/0x1b
+
+Fix this by by always using work_on_cpu().
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/powernow-k8.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -1223,14 +1223,7 @@ static int powernowk8_target(struct cpuf
+ struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
+ .relation = relation };
+
+- /*
+- * Must run on @pol->cpu. cpufreq core is responsible for ensuring
+- * that we're bound to the current CPU and pol->cpu stays online.
+- */
+- if (smp_processor_id() == pol->cpu)
+- return powernowk8_target_fn(&pta);
+- else
+- return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
++ return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
+ }
+
+ /* Driver entry point to verify the policy and range of frequencies */
--- /dev/null
+From 720dfd250e48a8c7fd1b2b8645955413989c4ee0 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Date: Sun, 21 Oct 2012 19:58:30 +0800
+Subject: dmaengine: imx-dma: fix missing unlock on error in imxdma_xfer_desc()
+
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+
+commit 720dfd250e48a8c7fd1b2b8645955413989c4ee0 upstream.
+
+Add the missing unlock on the error handling path in function
+imxdma_xfer_desc().
+
+Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/imx-dma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/imx-dma.c
++++ b/drivers/dma/imx-dma.c
+@@ -474,8 +474,10 @@ static int imxdma_xfer_desc(struct imxdm
+ slot = i;
+ break;
+ }
+- if (slot < 0)
++ if (slot < 0) {
++ spin_unlock_irqrestore(&imxdma->lock, flags);
+ return -EBUSY;
++ }
+
+ imxdma->slots_2d[slot].xsr = d->x;
+ imxdma->slots_2d[slot].ysr = d->y;
--- /dev/null
+From 5997e089e4c3a7f0958a8fb0a54ec2b5a6f06168 Mon Sep 17 00:00:00 2001
+From: Barry Song <Baohua.Song@csr.com>
+Date: Thu, 27 Sep 2012 16:35:38 +0800
+Subject: dmaengine: sirf: fix a typo in dma_prep_interleaved
+
+From: Barry Song <Baohua.Song@csr.com>
+
+commit 5997e089e4c3a7f0958a8fb0a54ec2b5a6f06168 upstream.
+
+either DEV_TO_MEM or MEM_TO_DEV is supported, so change
+OR to AND.
+
+Signed-off-by: Barry Song <Baohua.Song@csr.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/sirf-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/sirf-dma.c
++++ b/drivers/dma/sirf-dma.c
+@@ -428,7 +428,7 @@ static struct dma_async_tx_descriptor *s
+ unsigned long iflags;
+ int ret;
+
+- if ((xt->dir != DMA_MEM_TO_DEV) || (xt->dir != DMA_DEV_TO_MEM)) {
++ if ((xt->dir != DMA_MEM_TO_DEV) && (xt->dir != DMA_DEV_TO_MEM)) {
+ ret = -EINVAL;
+ goto err_dir;
+ }
--- /dev/null
+From 26fd12209c08fe947be1828896ef4ffc5bd0e6df Mon Sep 17 00:00:00 2001
+From: Barry Song <Baohua.Song@csr.com>
+Date: Thu, 27 Sep 2012 16:36:10 +0800
+Subject: dmaengine: sirf: fix a typo in moving running dma_desc to active queue
+
+From: Barry Song <Baohua.Song@csr.com>
+
+commit 26fd12209c08fe947be1828896ef4ffc5bd0e6df upstream.
+
+list_move_tail(&schan->queued, &schan->active) makes the list_empty(schan->queued)
+undefined, we either should change it to:
+list_move_tail(schan->queued.next, &schan->active)
+or
+list_move_tail(&sdesc->node, &schan->active)
+
+Signed-off-by: Barry Song <Baohua.Song@csr.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/sirf-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/sirf-dma.c
++++ b/drivers/dma/sirf-dma.c
+@@ -109,7 +109,7 @@ static void sirfsoc_dma_execute(struct s
+ sdesc = list_first_entry(&schan->queued, struct sirfsoc_dma_desc,
+ node);
+ /* Move the first queued descriptor to active list */
+- list_move_tail(&schan->queued, &schan->active);
++ list_move_tail(&sdesc->node, &schan->active);
+
+ /* Start the DMA transfer */
+ writel_relaxed(sdesc->width, sdma->base + SIRFSOC_DMA_WIDTH_0 +
--- /dev/null
+From b40a79591ca918e7b91b0d9b6abd5d00f2e88c19 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 25 Oct 2012 22:28:12 +0200
+Subject: freezer: exec should clear PF_NOFREEZE along with PF_KTHREAD
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit b40a79591ca918e7b91b0d9b6abd5d00f2e88c19 upstream.
+
+flush_old_exec() clears PF_KTHREAD but forgets about PF_NOFREEZE.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/exec.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1110,7 +1110,8 @@ int flush_old_exec(struct linux_binprm *
+ bprm->mm = NULL; /* We're using it now */
+
+ set_fs(USER_DS);
+- current->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD);
++ current->flags &=
++ ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD | PF_NOFREEZE);
+ flush_thread();
+ current->personality &= ~bprm->per_clear;
+
--- /dev/null
+From 8f7b8db6e0557c8437adf9371e020cd89a7e85dc Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 25 Sep 2012 16:40:12 +0200
+Subject: iwlwifi: fix 6000 series channel switch command
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 8f7b8db6e0557c8437adf9371e020cd89a7e85dc upstream.
+
+The channel switch command for 6000 series devices
+is larger than the maximum inline command size of
+320 bytes. The command is therefore refused with a
+warning. Fix this by allocating the command and
+using the NOCOPY mechanism.
+
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/dvm/devices.c | 39 +++++++++++++++++------------
+ 1 file changed, 24 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
++++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
+@@ -518,7 +518,7 @@ static int iwl6000_hw_channel_switch(str
+ * See iwlagn_mac_channel_switch.
+ */
+ struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+- struct iwl6000_channel_switch_cmd cmd;
++ struct iwl6000_channel_switch_cmd *cmd;
+ u32 switch_time_in_usec, ucode_switch_time;
+ u16 ch;
+ u32 tsf_low;
+@@ -527,18 +527,25 @@ static int iwl6000_hw_channel_switch(str
+ struct ieee80211_vif *vif = ctx->vif;
+ struct iwl_host_cmd hcmd = {
+ .id = REPLY_CHANNEL_SWITCH,
+- .len = { sizeof(cmd), },
++ .len = { sizeof(*cmd), },
+ .flags = CMD_SYNC,
+- .data = { &cmd, },
++ .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+ };
++ int err;
+
+- cmd.band = priv->band == IEEE80211_BAND_2GHZ;
++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
++ if (!cmd)
++ return -ENOMEM;
++
++ hcmd.data[0] = cmd;
++
++ cmd->band = priv->band == IEEE80211_BAND_2GHZ;
+ ch = ch_switch->channel->hw_value;
+ IWL_DEBUG_11H(priv, "channel switch from %u to %u\n",
+ ctx->active.channel, ch);
+- cmd.channel = cpu_to_le16(ch);
+- cmd.rxon_flags = ctx->staging.flags;
+- cmd.rxon_filter_flags = ctx->staging.filter_flags;
++ cmd->channel = cpu_to_le16(ch);
++ cmd->rxon_flags = ctx->staging.flags;
++ cmd->rxon_filter_flags = ctx->staging.filter_flags;
+ switch_count = ch_switch->count;
+ tsf_low = ch_switch->timestamp & 0x0ffffffff;
+ /*
+@@ -554,23 +561,25 @@ static int iwl6000_hw_channel_switch(str
+ switch_count = 0;
+ }
+ if (switch_count <= 1)
+- cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
++ cmd->switch_time = cpu_to_le32(priv->ucode_beacon_time);
+ else {
+ switch_time_in_usec =
+ vif->bss_conf.beacon_int * switch_count * TIME_UNIT;
+ ucode_switch_time = iwl_usecs_to_beacons(priv,
+ switch_time_in_usec,
+ beacon_interval);
+- cmd.switch_time = iwl_add_beacon_time(priv,
+- priv->ucode_beacon_time,
+- ucode_switch_time,
+- beacon_interval);
++ cmd->switch_time = iwl_add_beacon_time(priv,
++ priv->ucode_beacon_time,
++ ucode_switch_time,
++ beacon_interval);
+ }
+ IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
+- cmd.switch_time);
+- cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
++ cmd->switch_time);
++ cmd->expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
+
+- return iwl_dvm_send_cmd(priv, &hcmd);
++ err = iwl_dvm_send_cmd(priv, &hcmd);
++ kfree(cmd);
++ return err;
+ }
+
+ struct iwl_lib_ops iwl6000_lib = {
--- /dev/null
+From 4045f72bcf3c293c7c5932ef001742d8bb5ded76 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 2 Oct 2012 21:34:23 +0200
+Subject: mac80211: check if key has TKIP type before updating IV
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 4045f72bcf3c293c7c5932ef001742d8bb5ded76 upstream.
+
+This patch fix corruption which can manifest itself by following crash
+when switching on rfkill switch with rt2x00 driver:
+https://bugzilla.redhat.com/attachment.cgi?id=615362
+
+Pointer key->u.ccmp.tfm of group key get corrupted in:
+
+ieee80211_rx_h_michael_mic_verify():
+
+ /* update IV in key information to be able to detect replays */
+ rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
+ rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;
+
+because rt2x00 always set RX_FLAG_MMIC_STRIPPED, even if key is not TKIP.
+
+We already check type of the key in different path in
+ieee80211_rx_h_michael_mic_verify() function, so adding additional
+check here is reasonable.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/wpa.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -106,7 +106,8 @@ ieee80211_rx_h_michael_mic_verify(struct
+ if (status->flag & RX_FLAG_MMIC_ERROR)
+ goto mic_fail;
+
+- if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
++ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
+ goto update_iv;
+
+ return RX_CONTINUE;
--- /dev/null
+From 3a40414f826a8f1096d9b94c4a53ef91b25ba28d Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 1 Oct 2012 15:52:00 +0200
+Subject: mac80211: connect with HT20 if HT40 is not permitted
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 3a40414f826a8f1096d9b94c4a53ef91b25ba28d upstream.
+
+Some changes to fix issues with HT40 APs in Korea
+and follow-up changes to allow using HT40 even if
+the local regulatory database disallows it caused
+issues with iwlwifi (and could cause issues with
+other devices); iwlwifi firmware would assert if
+you tried to connect to an AP that has an invalid
+configuration (e.g. using HT40- on channel 140.)
+
+Fix this, while avoiding the "Korean AP" issue by
+disabling HT40 and advertising HT20 to the AP
+when connecting.
+
+Reported-by: Florian Reitmeir <florian@reitmeir.org>
+Tested-by: Florian Reitmeir <florian@reitmeir.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/mlme.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3065,22 +3065,32 @@ static int ieee80211_prep_connection(str
+ ht_cfreq, ht_oper->primary_chan,
+ cbss->channel->band);
+ ht_oper = NULL;
++ } else {
++ channel_type = NL80211_CHAN_HT20;
+ }
+ }
+
+- if (ht_oper) {
+- channel_type = NL80211_CHAN_HT20;
++ if (ht_oper && sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
++ /*
++ * cfg80211 already verified that the channel itself can
++ * be used, but it didn't check that we can do the right
++ * HT type, so do that here as well. If HT40 isn't allowed
++ * on this channel, disable 40 MHz operation.
++ */
+
+- if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+- switch (ht_oper->ht_param &
+- IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+- case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
++ switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
++ case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
++ if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
++ ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
++ else
+ channel_type = NL80211_CHAN_HT40PLUS;
+- break;
+- case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
++ break;
++ case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
++ if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
++ ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
++ else
+ channel_type = NL80211_CHAN_HT40MINUS;
+- break;
+- }
++ break;
+ }
+ }
+
--- /dev/null
+From d4fa14cd62bd078c8e3ef39283b9f237e5b2ff0f Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 10 Oct 2012 22:40:23 +0200
+Subject: mac80211: use ieee80211_free_txskb in a few more places
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit d4fa14cd62bd078c8e3ef39283b9f237e5b2ff0f upstream.
+
+Free tx status skbs when draining power save buffers, pending frames, or
+when tearing down a vif.
+Fixes remaining conditions that can lead to hostapd/wpa_supplicant hangs when
+running out of socket write memory.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/iface.c | 2 +-
+ net/mac80211/sta_info.c | 4 ++--
+ net/mac80211/util.c | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -822,7 +822,7 @@ static void ieee80211_do_stop(struct iee
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ if (info->control.vif == &sdata->vif) {
+ __skb_unlink(skb, &local->pending[i]);
+- dev_kfree_skb_irq(skb);
++ ieee80211_free_txskb(&local->hw, skb);
+ }
+ }
+ }
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -585,7 +585,7 @@ static bool sta_info_cleanup_expire_buff
+ */
+ if (!skb)
+ break;
+- dev_kfree_skb(skb);
++ ieee80211_free_txskb(&local->hw, skb);
+ }
+
+ /*
+@@ -614,7 +614,7 @@ static bool sta_info_cleanup_expire_buff
+ local->total_ps_buffered--;
+ ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n",
+ sta->sta.addr);
+- dev_kfree_skb(skb);
++ ieee80211_free_txskb(&local->hw, skb);
+ }
+
+ /*
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -400,7 +400,7 @@ void ieee80211_add_pending_skb(struct ie
+ int queue = info->hw_queue;
+
+ if (WARN_ON(!info->control.vif)) {
+- kfree_skb(skb);
++ ieee80211_free_txskb(&local->hw, skb);
+ return;
+ }
+
+@@ -425,7 +425,7 @@ void ieee80211_add_pending_skbs_fn(struc
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+ if (WARN_ON(!info->control.vif)) {
+- kfree_skb(skb);
++ ieee80211_free_txskb(&local->hw, skb);
+ continue;
+ }
+
--- /dev/null
+From bf11315eeda510ea4fc1a2bf972d8155d31d89b4 Mon Sep 17 00:00:00 2001
+From: Stanislav Yakovlev <stas.yakovlev@gmail.com>
+Date: Mon, 15 Oct 2012 14:14:32 +0000
+Subject: net/wireless: ipw2200: Fix panic occurring in ipw_handle_promiscuous_tx()
+
+From: Stanislav Yakovlev <stas.yakovlev@gmail.com>
+
+commit bf11315eeda510ea4fc1a2bf972d8155d31d89b4 upstream.
+
+The driver does not count space of radiotap fields when allocating skb for
+radiotap packet. This leads to kernel panic with the following call trace:
+
+...
+[67607.676067] [<c152f90f>] error_code+0x67/0x6c
+[67607.676067] [<c142f831>] ? skb_put+0x91/0xa0
+[67607.676067] [<f8cf5e5b>] ? ipw_handle_promiscuous_tx+0x16b/0x2d0 [ipw2200]
+[67607.676067] [<f8cf5e5b>] ipw_handle_promiscuous_tx+0x16b/0x2d0 [ipw2200]
+[67607.676067] [<f8cf899b>] ipw_net_hard_start_xmit+0x8b/0x90 [ipw2200]
+[67607.676067] [<f8741c5a>] libipw_xmit+0x55a/0x980 [libipw]
+[67607.676067] [<c143d3e8>] dev_hard_start_xmit+0x218/0x4d0
+...
+
+This bug was found by VittGam.
+https://bugzilla.kernel.org/show_bug.cgi?id=43255
+
+Signed-off-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+--- a/drivers/net/wireless/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/ipw2x00/ipw2200.c
+@@ -10472,7 +10472,7 @@ static void ipw_handle_promiscuous_tx(struct ipw_priv *priv,
+ } else
+ len = src->len;
+
+- dst = alloc_skb(len + sizeof(*rt_hdr), GFP_ATOMIC);
++ dst = alloc_skb(len + sizeof(*rt_hdr) + sizeof(u16)*2, GFP_ATOMIC);
+ if (!dst)
+ continue;
+
--- /dev/null
+From f8295ec22cb0f1ee6849b862addbfa3ea9320755 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Wed, 24 Oct 2012 12:10:34 +0000
+Subject: qmi_wwan/cdc_ether: move Novatel 551 and E362 to qmi_wwan
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit f8295ec22cb0f1ee6849b862addbfa3ea9320755 upstream.
+
+These devices provide QMI and ethernet functionality via a standard CDC
+ethernet descriptor. But when driven by cdc_ether, the QMI
+functionality is unavailable because only cdc_ether can claim the USB
+interface. Thus blacklist the devices in cdc_ether and add their IDs to
+qmi_wwan, which enables both QMI and ethernet simultaneously.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/cdc_ether.c | 41 ++++++++++++++++++++++++++---------------
+ drivers/net/usb/qmi_wwan.c | 14 ++++++++++++++
+ 2 files changed, 40 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -592,6 +592,32 @@ static const struct usb_device_id produc
+ .driver_info = 0,
+ },
+
++/* Novatel USB551L and MC551 - handled by qmi_wwan */
++{
++ .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++ | USB_DEVICE_ID_MATCH_PRODUCT
++ | USB_DEVICE_ID_MATCH_INT_INFO,
++ .idVendor = NOVATEL_VENDOR_ID,
++ .idProduct = 0xB001,
++ .bInterfaceClass = USB_CLASS_COMM,
++ .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
++ .bInterfaceProtocol = USB_CDC_PROTO_NONE,
++ .driver_info = 0,
++},
++
++/* Novatel E362 - handled by qmi_wwan */
++{
++ .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++ | USB_DEVICE_ID_MATCH_PRODUCT
++ | USB_DEVICE_ID_MATCH_INT_INFO,
++ .idVendor = NOVATEL_VENDOR_ID,
++ .idProduct = 0x9010,
++ .bInterfaceClass = USB_CLASS_COMM,
++ .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
++ .bInterfaceProtocol = USB_CDC_PROTO_NONE,
++ .driver_info = 0,
++},
++
+ /*
+ * WHITELIST!!!
+ *
+@@ -604,21 +630,6 @@ static const struct usb_device_id produc
+ * because of bugs/quirks in a given product (like Zaurus, above).
+ */
+ {
+- /* Novatel USB551L */
+- /* This match must come *before* the generic CDC-ETHER match so that
+- * we get FLAG_WWAN set on the device, since it's descriptors are
+- * generic CDC-ETHER.
+- */
+- .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+- | USB_DEVICE_ID_MATCH_PRODUCT
+- | USB_DEVICE_ID_MATCH_INT_INFO,
+- .idVendor = NOVATEL_VENDOR_ID,
+- .idProduct = 0xB001,
+- .bInterfaceClass = USB_CLASS_COMM,
+- .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
+- .bInterfaceProtocol = USB_CDC_PROTO_NONE,
+- .driver_info = (unsigned long)&wwan_info,
+-}, {
+ /* ZTE (Vodafone) K3805-Z */
+ .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+ | USB_DEVICE_ID_MATCH_PRODUCT
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -364,6 +364,20 @@ static const struct usb_device_id produc
+ USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57),
+ .driver_info = (unsigned long)&qmi_wwan_info,
+ },
++ { /* Novatel USB551L and MC551 */
++ USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0xb001,
++ USB_CLASS_COMM,
++ USB_CDC_SUBCLASS_ETHERNET,
++ USB_CDC_PROTO_NONE),
++ .driver_info = (unsigned long)&qmi_wwan_info,
++ },
++ { /* Novatel E362 */
++ USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0x9010,
++ USB_CLASS_COMM,
++ USB_CDC_SUBCLASS_ETHERNET,
++ USB_CDC_PROTO_NONE),
++ .driver_info = (unsigned long)&qmi_wwan_info,
++ },
+
+ /* 2. Combined interface devices matching on class+protocol */
+ { /* Huawei E367 and possibly others in "Windows mode" */
--- /dev/null
+From 73b26df5fa1a6245d6fc982362518b620bc7c2fe Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Wed, 17 Oct 2012 13:50:43 +0200
+Subject: Revert "ath9k_hw: Updated AR9003 tx gain table for 5GHz"
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 73b26df5fa1a6245d6fc982362518b620bc7c2fe upstream.
+
+This reverts commit a240dc7b3c7463bd60cf0a9b2a90f52f78aae0fd.
+
+This commit is reducing tx power by at least 10 db on some devices,
+e.g. the Buffalo WZR-HP-G450H.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Cc: rmanohar@qca.qualcomm.com
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h | 164 +++++++++----------
+ 1 file changed, 82 insertions(+), 82 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
++++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+@@ -534,107 +534,107 @@ static const u32 ar9300_2p2_baseband_cor
+
+ static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
+ /* Addr 5G_HT20 5G_HT40 2G_HT40 2G_HT20 */
+- {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+- {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+- {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
++ {0x0000a2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
++ {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
++ {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+ {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+ {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+ {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+ {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+ {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+ {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+- {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202},
+- {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400},
+- {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402},
+- {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404},
+- {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603},
+- {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02},
+- {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04},
+- {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20},
+- {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20},
+- {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22},
+- {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24},
+- {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640},
+- {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660},
+- {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861},
+- {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81},
+- {0x0000a54c, 0x5a08442e, 0x5a08442e, 0x47001a83, 0x47001a83},
+- {0x0000a550, 0x5e0a4431, 0x5e0a4431, 0x4a001c84, 0x4a001c84},
+- {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3},
+- {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5},
+- {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9},
+- {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb},
+- {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+- {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+- {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+- {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+- {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+- {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+- {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
++ {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
++ {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
++ {0x0000a518, 0x21002220, 0x21002220, 0x16000402, 0x16000402},
++ {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404},
++ {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
++ {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
++ {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
++ {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
++ {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
++ {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
++ {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
++ {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
++ {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
++ {0x0000a544, 0x52022470, 0x52022470, 0x3f001861, 0x3f001861},
++ {0x0000a548, 0x55022490, 0x55022490, 0x43001a81, 0x43001a81},
++ {0x0000a54c, 0x59022492, 0x59022492, 0x47001a83, 0x47001a83},
++ {0x0000a550, 0x5d022692, 0x5d022692, 0x4a001c84, 0x4a001c84},
++ {0x0000a554, 0x61022892, 0x61022892, 0x4e001ce3, 0x4e001ce3},
++ {0x0000a558, 0x65024890, 0x65024890, 0x52001ce5, 0x52001ce5},
++ {0x0000a55c, 0x69024892, 0x69024892, 0x56001ce9, 0x56001ce9},
++ {0x0000a560, 0x6e024c92, 0x6e024c92, 0x5a001ceb, 0x5a001ceb},
++ {0x0000a564, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
++ {0x0000a568, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
++ {0x0000a56c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
++ {0x0000a570, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
++ {0x0000a574, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
++ {0x0000a578, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
++ {0x0000a57c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+ {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+ {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
+ {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
+ {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
+- {0x0000a590, 0x15800028, 0x15800028, 0x0f800202, 0x0f800202},
+- {0x0000a594, 0x1b80002b, 0x1b80002b, 0x12800400, 0x12800400},
+- {0x0000a598, 0x1f820028, 0x1f820028, 0x16800402, 0x16800402},
+- {0x0000a59c, 0x2582002b, 0x2582002b, 0x19800404, 0x19800404},
+- {0x0000a5a0, 0x2a84002a, 0x2a84002a, 0x1c800603, 0x1c800603},
+- {0x0000a5a4, 0x2e86002a, 0x2e86002a, 0x21800a02, 0x21800a02},
+- {0x0000a5a8, 0x3382202d, 0x3382202d, 0x25800a04, 0x25800a04},
+- {0x0000a5ac, 0x3884202c, 0x3884202c, 0x28800a20, 0x28800a20},
+- {0x0000a5b0, 0x3c86202c, 0x3c86202c, 0x2c800e20, 0x2c800e20},
+- {0x0000a5b4, 0x4188202d, 0x4188202d, 0x30800e22, 0x30800e22},
+- {0x0000a5b8, 0x4586402d, 0x4586402d, 0x34800e24, 0x34800e24},
+- {0x0000a5bc, 0x4986222d, 0x4986222d, 0x38801640, 0x38801640},
+- {0x0000a5c0, 0x4d862231, 0x4d862231, 0x3c801660, 0x3c801660},
+- {0x0000a5c4, 0x50882231, 0x50882231, 0x3f801861, 0x3f801861},
+- {0x0000a5c8, 0x5688422e, 0x5688422e, 0x43801a81, 0x43801a81},
+- {0x0000a5cc, 0x5a88442e, 0x5a88442e, 0x47801a83, 0x47801a83},
+- {0x0000a5d0, 0x5e8a4431, 0x5e8a4431, 0x4a801c84, 0x4a801c84},
+- {0x0000a5d4, 0x648a4432, 0x648a4432, 0x4e801ce3, 0x4e801ce3},
+- {0x0000a5d8, 0x688a4434, 0x688a4434, 0x52801ce5, 0x52801ce5},
+- {0x0000a5dc, 0x6c8a6434, 0x6c8a6434, 0x56801ce9, 0x56801ce9},
+- {0x0000a5e0, 0x6f8a6633, 0x6f8a6633, 0x5a801ceb, 0x5a801ceb},
+- {0x0000a5e4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+- {0x0000a5e8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+- {0x0000a5ec, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+- {0x0000a5f0, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+- {0x0000a5f4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+- {0x0000a5f8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+- {0x0000a5fc, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
++ {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
++ {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
++ {0x0000a598, 0x21802220, 0x21802220, 0x16800402, 0x16800402},
++ {0x0000a59c, 0x27802223, 0x27802223, 0x19800404, 0x19800404},
++ {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
++ {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
++ {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
++ {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
++ {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
++ {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
++ {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
++ {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
++ {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
++ {0x0000a5c4, 0x52822470, 0x52822470, 0x3f801861, 0x3f801861},
++ {0x0000a5c8, 0x55822490, 0x55822490, 0x43801a81, 0x43801a81},
++ {0x0000a5cc, 0x59822492, 0x59822492, 0x47801a83, 0x47801a83},
++ {0x0000a5d0, 0x5d822692, 0x5d822692, 0x4a801c84, 0x4a801c84},
++ {0x0000a5d4, 0x61822892, 0x61822892, 0x4e801ce3, 0x4e801ce3},
++ {0x0000a5d8, 0x65824890, 0x65824890, 0x52801ce5, 0x52801ce5},
++ {0x0000a5dc, 0x69824892, 0x69824892, 0x56801ce9, 0x56801ce9},
++ {0x0000a5e0, 0x6e824c92, 0x6e824c92, 0x5a801ceb, 0x5a801ceb},
++ {0x0000a5e4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
++ {0x0000a5e8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
++ {0x0000a5ec, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
++ {0x0000a5f0, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
++ {0x0000a5f4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
++ {0x0000a5f8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
++ {0x0000a5fc, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+ {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+ {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+- {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+- {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+- {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+- {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000},
+- {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501},
+- {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501},
+- {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03},
+- {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+- {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04},
+- {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+- {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+- {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+- {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+- {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+- {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+- {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+- {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
++ {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
++ {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
++ {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
++ {0x0000a614, 0x02004000, 0x02004000, 0x01404000, 0x01404000},
++ {0x0000a618, 0x02004801, 0x02004801, 0x01404501, 0x01404501},
++ {0x0000a61c, 0x02808a02, 0x02808a02, 0x02008501, 0x02008501},
++ {0x0000a620, 0x0380ce03, 0x0380ce03, 0x0280ca03, 0x0280ca03},
++ {0x0000a624, 0x04411104, 0x04411104, 0x03010c04, 0x03010c04},
++ {0x0000a628, 0x04411104, 0x04411104, 0x04014c04, 0x04014c04},
++ {0x0000a62c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
++ {0x0000a630, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
++ {0x0000a634, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
++ {0x0000a638, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
++ {0x0000a63c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
++ {0x0000b2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
++ {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
++ {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+ {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+- {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+- {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+- {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
++ {0x0000c2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
++ {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
++ {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+ {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+ {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+- {0x00016048, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
++ {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+ {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+ {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+- {0x00016448, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
++ {0x00016448, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+ {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+ {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+- {0x00016848, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
++ {0x00016848, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+ {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+ };
+
--- /dev/null
+From 761ce8c41ed20ee3af77f2df527edc3f92e6f3bf Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 16 Oct 2012 14:34:12 +0200
+Subject: rt2x00: usb: fix reset resume
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 761ce8c41ed20ee3af77f2df527edc3f92e6f3bf upstream.
+
+Patch fixes warnings like below happened on resume:
+
+WARNING: at net/mac80211/driver-ops.h:12 check_sdata_in_driver+0x32/0x34()
+
+Problem is that in __ieee80211_susped() we remove sdata (i.e wlan0
+interface) and then during resume we call usb_unbind_interface() ->
+ieee80211_unregister_hw() with sdata removed.
+
+Patch fixes problem by adding .reset_resume calback, hence we do not
+unbind usb device on resume. This callback can be the same as normal
+.resume callback, sice we do all needed initalization during interface
+start, which is performed on resume [ ieee80211_resume() ->
+ieee80211_reconfig() -> rt2x00mac_start() -> rt2x00lib_start ].
+
+Resolves:
+https://bugzilla.kernel.org/show_bug.cgi?id=48041
+
+Reported-by: David Herrmann <dh.herrmann@googlemail.com>
+Reported-and-tested-by: Stephen Boyd <bebarino@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2500usb.c | 1 +
+ drivers/net/wireless/rt2x00/rt2800usb.c | 1 +
+ drivers/net/wireless/rt2x00/rt73usb.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/rt2x00/rt2500usb.c
++++ b/drivers/net/wireless/rt2x00/rt2500usb.c
+@@ -1989,6 +1989,7 @@ static struct usb_driver rt2500usb_drive
+ .disconnect = rt2x00usb_disconnect,
+ .suspend = rt2x00usb_suspend,
+ .resume = rt2x00usb_resume,
++ .reset_resume = rt2x00usb_resume,
+ .disable_hub_initiated_lpm = 1,
+ };
+
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -1322,6 +1322,7 @@ static struct usb_driver rt2800usb_drive
+ .disconnect = rt2x00usb_disconnect,
+ .suspend = rt2x00usb_suspend,
+ .resume = rt2x00usb_resume,
++ .reset_resume = rt2x00usb_resume,
+ .disable_hub_initiated_lpm = 1,
+ };
+
+--- a/drivers/net/wireless/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/rt2x00/rt73usb.c
+@@ -2536,6 +2536,7 @@ static struct usb_driver rt73usb_driver
+ .disconnect = rt2x00usb_disconnect,
+ .suspend = rt2x00usb_suspend,
+ .resume = rt2x00usb_resume,
++ .reset_resume = rt2x00usb_resume,
+ .disable_hub_initiated_lpm = 1,
+ };
+
usb-mos7840-remove-null-urb-submission.patch
usb-mos7840-remove-invalid-disconnect-handling.patch
vhost-fix-mergeable-bufs-on-be-hosts.patch
+arm-samsung-add-naming-of-s3c64xx-spi-devices.patch
+arm-at91-tc-fix-typo-in-the-dt-document.patch
+arm-at91-i2c-change-id-to-let-i2c-gpio-work.patch
+arm-at91-at91sam9g10-fix-soc-type-detection.patch
+arm-at91-fix-external-interrupts-in-non-dt-case.patch
+arm-at91-fix-external-interrupt-specification-in-board-code.patch
+mac80211-connect-with-ht20-if-ht40-is-not-permitted.patch
+mac80211-check-if-key-has-tkip-type-before-updating-iv.patch
+mac80211-use-ieee80211_free_txskb-in-a-few-more-places.patch
+b43-fix-oops-on-unload-when-firmware-not-found.patch
+tilegx-fix-some-issues-in-the-sw-tso-support.patch
+bluetooth-smp-fix-setting-unknown-auth_req-bits.patch
+qmi_wwan-cdc_ether-move-novatel-551-and-e362-to-qmi_wwan.patch
+rt2x00-usb-fix-reset-resume.patch
+freezer-exec-should-clear-pf_nofreeze-along-with-pf_kthread.patch
+dmaengine-sirf-fix-a-typo-in-dma_prep_interleaved.patch
+dmaengine-sirf-fix-a-typo-in-moving-running-dma_desc-to-active-queue.patch
+dmaengine-imx-dma-fix-missing-unlock-on-error-in-imxdma_xfer_desc.patch
+iwlwifi-fix-6000-series-channel-switch-command.patch
+bcma-fix-unregistration-of-cores.patch
+net-wireless-ipw2200-fix-panic-occurring-in-ipw_handle_promiscuous_tx.patch
+cpufreq-powernow-k8-remove-usage-of-smp_processor_id-in-preemptible-code.patch
+revert-ath9k_hw-updated-ar9003-tx-gain-table-for-5ghz.patch
--- /dev/null
+From 3da3fff8006c608f19a51859d44ba47ca8b41461 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Thu, 25 Oct 2012 07:25:20 +0000
+Subject: tilegx: fix some issues in the SW TSO support
+
+From: Chris Metcalf <cmetcalf@tilera.com>
+
+commit 3da3fff8006c608f19a51859d44ba47ca8b41461 upstream.
+
+This change correctly computes the header length and data length in
+the fragments to avoid a bug where we would end up with extremely
+slow performance. Also adopt use of skb_frag_size() accessor.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/tile/tilegx.c | 35 +++++++++++++++++++----------------
+ 1 file changed, 19 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/ethernet/tile/tilegx.c
++++ b/drivers/net/ethernet/tile/tilegx.c
+@@ -1334,11 +1334,11 @@ static int tso_count_edescs(struct sk_bu
+ {
+ struct skb_shared_info *sh = skb_shinfo(skb);
+ unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+- unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
++ unsigned int data_len = skb->len - sh_len;
+ unsigned int p_len = sh->gso_size;
+ long f_id = -1; /* id of the current fragment */
+- long f_size = skb->hdr_len; /* size of the current fragment */
+- long f_used = sh_len; /* bytes used from the current fragment */
++ long f_size = skb_headlen(skb) - sh_len; /* current fragment size */
++ long f_used = 0; /* bytes used from the current fragment */
+ long n; /* size of the current piece of payload */
+ int num_edescs = 0;
+ int segment;
+@@ -1353,7 +1353,7 @@ static int tso_count_edescs(struct sk_bu
+ /* Advance as needed. */
+ while (f_used >= f_size) {
+ f_id++;
+- f_size = sh->frags[f_id].size;
++ f_size = skb_frag_size(&sh->frags[f_id]);
+ f_used = 0;
+ }
+
+@@ -1384,13 +1384,13 @@ static void tso_headers_prepare(struct s
+ struct iphdr *ih;
+ struct tcphdr *th;
+ unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+- unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
++ unsigned int data_len = skb->len - sh_len;
+ unsigned char *data = skb->data;
+ unsigned int ih_off, th_off, p_len;
+ unsigned int isum_seed, tsum_seed, id, seq;
+ long f_id = -1; /* id of the current fragment */
+- long f_size = skb->hdr_len; /* size of the current fragment */
+- long f_used = sh_len; /* bytes used from the current fragment */
++ long f_size = skb_headlen(skb) - sh_len; /* current fragment size */
++ long f_used = 0; /* bytes used from the current fragment */
+ long n; /* size of the current piece of payload */
+ int segment;
+
+@@ -1405,7 +1405,7 @@ static void tso_headers_prepare(struct s
+ isum_seed = ((0xFFFF - ih->check) +
+ (0xFFFF - ih->tot_len) +
+ (0xFFFF - ih->id));
+- tsum_seed = th->check + (0xFFFF ^ htons(sh_len + data_len));
++ tsum_seed = th->check + (0xFFFF ^ htons(skb->len));
+ id = ntohs(ih->id);
+ seq = ntohl(th->seq);
+
+@@ -1444,7 +1444,7 @@ static void tso_headers_prepare(struct s
+ /* Advance as needed. */
+ while (f_used >= f_size) {
+ f_id++;
+- f_size = sh->frags[f_id].size;
++ f_size = skb_frag_size(&sh->frags[f_id]);
+ f_used = 0;
+ }
+
+@@ -1478,14 +1478,14 @@ static void tso_egress(struct net_device
+ struct tile_net_priv *priv = netdev_priv(dev);
+ struct skb_shared_info *sh = skb_shinfo(skb);
+ unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+- unsigned int data_len = skb->data_len + skb->hdr_len - sh_len;
++ unsigned int data_len = skb->len - sh_len;
+ unsigned int p_len = sh->gso_size;
+ gxio_mpipe_edesc_t edesc_head = { { 0 } };
+ gxio_mpipe_edesc_t edesc_body = { { 0 } };
+ long f_id = -1; /* id of the current fragment */
+- long f_size = skb->hdr_len; /* size of the current fragment */
+- long f_used = sh_len; /* bytes used from the current fragment */
+- void *f_data = skb->data;
++ long f_size = skb_headlen(skb) - sh_len; /* current fragment size */
++ long f_used = 0; /* bytes used from the current fragment */
++ void *f_data = skb->data + sh_len;
+ long n; /* size of the current piece of payload */
+ unsigned long tx_packets = 0, tx_bytes = 0;
+ unsigned int csum_start;
+@@ -1516,15 +1516,18 @@ static void tso_egress(struct net_device
+
+ /* Egress the payload. */
+ while (p_used < p_len) {
++ void *va;
+
+ /* Advance as needed. */
+ while (f_used >= f_size) {
+ f_id++;
+- f_size = sh->frags[f_id].size;
+- f_used = 0;
++ f_size = skb_frag_size(&sh->frags[f_id]);
+ f_data = tile_net_frag_buf(&sh->frags[f_id]);
++ f_used = 0;
+ }
+
++ va = f_data + f_used;
++
+ /* Use bytes from the current fragment. */
+ n = p_len - p_used;
+ if (n > f_size - f_used)
+@@ -1533,7 +1536,7 @@ static void tso_egress(struct net_device
+ p_used += n;
+
+ /* Egress a piece of the payload. */
+- edesc_body.va = va_to_tile_io_addr(f_data) + f_used;
++ edesc_body.va = va_to_tile_io_addr(va);
+ edesc_body.xfer_size = n;
+ edesc_body.bound = !(p_used < p_len);
+ gxio_mpipe_equeue_put_at(equeue, edesc_body, slot);
projects / thirdparty / kernel / stable-queue.git / commitdiff
