--- /dev/null
+From b08c9c317e3f7764a91d522cd031639ba42b98cc Mon Sep 17 00:00:00 2001
+From: Loic Poulain <loic.poulain@intel.com>
+Date: Thu, 24 Apr 2014 11:38:56 +0200
+Subject: 8250_core: Fix unwanted TX chars write
+
+From: Loic Poulain <loic.poulain@intel.com>
+
+commit b08c9c317e3f7764a91d522cd031639ba42b98cc upstream.
+
+On transmit-hold-register empty, serial8250_tx_chars
+should be called only if we don't use DMA.
+DMA has its own tx cycle.
+
+Signed-off-by: Loic Poulain <loic.poulain@intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -1520,7 +1520,7 @@ int serial8250_handle_irq(struct uart_po
+ status = serial8250_rx_chars(up, status);
+ }
+ serial8250_modem_status(up);
+- if (status & UART_LSR_THRE)
++ if (!up->dma && (status & UART_LSR_THRE))
+ serial8250_tx_chars(up);
+
+ spin_unlock_irqrestore(&port->lock, flags);
--- /dev/null
+From 8db6e5104b77de5d0b7002b95069da0992a34be9 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Wed, 16 Apr 2014 14:36:45 +0000
+Subject: clocksource: Exynos_mct: Register clock event after request_irq()
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 8db6e5104b77de5d0b7002b95069da0992a34be9 upstream.
+
+After hotplugging CPU1 the first call of interrupt handler for CPU1
+oneshot timer was called on CPU0 because it fired before setting IRQ
+affinity. Affected are SoCs where Multi Core Timer interrupts are
+shared (SPI), e.g. Exynos 4210.
+
+During setup of the MCT timers the clock event device should be
+registered after setting the affinity for interrupt. This will prevent
+starting the timer too early.
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Kyungmin Park <kyungmin.park@samsung.com>
+Cc: Marek Szyprowski <m.szyprowski@samsung.com>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Cc: Tomasz Figa <t.figa@samsung.com>,
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>,
+Cc: Kukjin Kim <kgene.kim@samsung.com>
+Cc: linux-arm-kernel@lists.infradead.org,
+Link: http://lkml.kernel.org/r/20140416143316.299247848@linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clocksource/exynos_mct.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -418,8 +418,6 @@ static int exynos4_local_timer_setup(str
+ evt->set_mode = exynos4_tick_set_mode;
+ evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
+ evt->rating = 450;
+- clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
+- 0xf, 0x7fffffff);
+
+ exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
+
+@@ -436,6 +434,8 @@ static int exynos4_local_timer_setup(str
+ } else {
+ enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
+ }
++ clockevents_config_and_register(evt, clk_rate / (TICK_BASE_CNT + 1),
++ 0xf, 0x7fffffff);
+
+ return 0;
+ }
--- /dev/null
+From 30ccf03b4a6a2102a2219058bdc6d779dc637dd7 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 16 Apr 2014 14:36:45 +0000
+Subject: clocksource: Exynos_mct: Use irq_force_affinity() in cpu bringup
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 30ccf03b4a6a2102a2219058bdc6d779dc637dd7 upstream.
+
+The starting cpu is not yet in the online mask so irq_set_affinity()
+fails which results in per cpu timers for this cpu ending up on some
+other online cpu, ususally cpu 0.
+
+Use irq_force_affinity() which disables the online mask check and
+makes things work.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Cc: Kyungmin Park <kyungmin.park@samsung.com>
+Cc: Marek Szyprowski <m.szyprowski@samsung.com>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Cc: Tomasz Figa <t.figa@samsung.com>,
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>,
+Cc: Kukjin Kim <kgene.kim@samsung.com>
+Cc: linux-arm-kernel@lists.infradead.org,
+Link: http://lkml.kernel.org/r/20140416143316.106665251@linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clocksource/exynos_mct.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -432,6 +432,7 @@ static int exynos4_local_timer_setup(str
+ evt->irq);
+ return -EIO;
+ }
++ irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
+ } else {
+ enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
+ }
+@@ -452,7 +453,6 @@ static int exynos4_mct_cpu_notify(struct
+ unsigned long action, void *hcpu)
+ {
+ struct mct_clock_event_device *mevt;
+- unsigned int cpu;
+
+ /*
+ * Grab cpu pointer in each case to avoid spurious
+@@ -463,12 +463,6 @@ static int exynos4_mct_cpu_notify(struct
+ mevt = this_cpu_ptr(&percpu_mct_tick);
+ exynos4_local_timer_setup(&mevt->evt);
+ break;
+- case CPU_ONLINE:
+- cpu = (unsigned long)hcpu;
+- if (mct_int_type == MCT_INT_SPI)
+- irq_set_affinity(mct_irqs[MCT_L0_IRQ + cpu],
+- cpumask_of(cpu));
+- break;
+ case CPU_DYING:
+ mevt = this_cpu_ptr(&percpu_mct_tick);
+ exynos4_local_timer_stop(&mevt->evt);
--- /dev/null
+From 404ca80eb5c2727d78cd517d12108b040c522e12 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 19 Apr 2014 10:15:07 -0700
+Subject: coredump: fix va_list corruption
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 404ca80eb5c2727d78cd517d12108b040c522e12 upstream.
+
+A va_list needs to be copied in case it needs to be used twice.
+
+Thanks to Hugh for debugging this issue, leading to various panics.
+
+Tested:
+
+ lpq84:~# echo "|/foobar12345 %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h" >/proc/sys/kernel/core_pattern
+
+'produce_core' is simply : main() { *(int *)0 = 1;}
+
+ lpq84:~# ./produce_core
+ Segmentation fault (core dumped)
+ lpq84:~# dmesg | tail -1
+ [ 614.352947] Core dump to |/foobar12345 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 lpq84 (null) pipe failed
+
+Notice the last argument was replaced by a NULL (we were lucky enough to
+not crash, but do not try this on your production machine !)
+
+After fix :
+
+ lpq83:~# echo "|/foobar12345 %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h %h" >/proc/sys/kernel/core_pattern
+ lpq83:~# ./produce_core
+ Segmentation fault
+ lpq83:~# dmesg | tail -1
+ [ 740.800441] Core dump to |/foobar12345 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 lpq83 pipe failed
+
+Fixes: 5fe9d8ca21cc ("coredump: cn_vprintf() has no reason to call vsnprintf() twice")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Diagnosed-by: Hugh Dickins <hughd@google.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Cc: Neil Horman <nhorman@tuxdriver.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/coredump.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -73,10 +73,15 @@ static int expand_corename(struct core_n
+ static int cn_vprintf(struct core_name *cn, const char *fmt, va_list arg)
+ {
+ int free, need;
++ va_list arg_copy;
+
+ again:
+ free = cn->size - cn->used;
+- need = vsnprintf(cn->corename + cn->used, free, fmt, arg);
++
++ va_copy(arg_copy, arg);
++ need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy);
++ va_end(arg_copy);
++
+ if (need < free) {
+ cn->used += need;
+ return 0;
--- /dev/null
+From 01f8fa4f01d8362358eb90e412bd7ae18a3ec1ad Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 16 Apr 2014 14:36:44 +0000
+Subject: genirq: Allow forcing cpu affinity of interrupts
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 01f8fa4f01d8362358eb90e412bd7ae18a3ec1ad upstream.
+
+The current implementation of irq_set_affinity() refuses rightfully to
+route an interrupt to an offline cpu.
+
+But there is a special case, where this is actually desired. Some of
+the ARM SoCs have per cpu timers which require setting the affinity
+during cpu startup where the cpu is not yet in the online mask.
+
+If we can't do that, then the local timer interrupt for the about to
+become online cpu is routed to some random online cpu.
+
+The developers of the affected machines tried to work around that
+issue, but that results in a massive mess in that timer code.
+
+We have a yet unused argument in the set_affinity callbacks of the irq
+chips, which I added back then for a similar reason. It was never
+required so it got not used. But I'm happy that I never removed it.
+
+That allows us to implement a sane handling of the above scenario. So
+the affected SoC drivers can add the required force handling to their
+interrupt chip, switch the timer code to irq_force_affinity() and
+things just work.
+
+This does not affect any existing user of irq_set_affinity().
+
+Tagged for stable to allow a simple fix of the affected SoC clock
+event drivers.
+
+Reported-and-tested-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Kyungmin Park <kyungmin.park@samsung.com>
+Cc: Marek Szyprowski <m.szyprowski@samsung.com>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Cc: Tomasz Figa <t.figa@samsung.com>,
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>,
+Cc: Kukjin Kim <kgene.kim@samsung.com>
+Cc: linux-arm-kernel@lists.infradead.org,
+Link: http://lkml.kernel.org/r/20140416143315.717251504@linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/cavium-octeon/octeon-irq.c | 2 +-
+ include/linux/interrupt.h | 35 ++++++++++++++++++++++++++++++++++-
+ include/linux/irq.h | 3 ++-
+ kernel/irq/manage.c | 17 ++++++-----------
+ 4 files changed, 43 insertions(+), 14 deletions(-)
+
+--- a/arch/mips/cavium-octeon/octeon-irq.c
++++ b/arch/mips/cavium-octeon/octeon-irq.c
+@@ -635,7 +635,7 @@ static void octeon_irq_cpu_offline_ciu(s
+ cpumask_clear(&new_affinity);
+ cpumask_set_cpu(cpumask_first(cpu_online_mask), &new_affinity);
+ }
+- __irq_set_affinity_locked(data, &new_affinity);
++ irq_set_affinity_locked(data, &new_affinity, false);
+ }
+
+ static int octeon_irq_ciu_set_affinity(struct irq_data *data,
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -202,7 +202,40 @@ static inline int check_wakeup_irqs(void
+
+ extern cpumask_var_t irq_default_affinity;
+
+-extern int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask);
++/* Internal implementation. Use the helpers below */
++extern int __irq_set_affinity(unsigned int irq, const struct cpumask *cpumask,
++ bool force);
++
++/**
++ * irq_set_affinity - Set the irq affinity of a given irq
++ * @irq: Interrupt to set affinity
++ * @mask: cpumask
++ *
++ * Fails if cpumask does not contain an online CPU
++ */
++static inline int
++irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
++{
++ return __irq_set_affinity(irq, cpumask, false);
++}
++
++/**
++ * irq_force_affinity - Force the irq affinity of a given irq
++ * @irq: Interrupt to set affinity
++ * @mask: cpumask
++ *
++ * Same as irq_set_affinity, but without checking the mask against
++ * online cpus.
++ *
++ * Solely for low level cpu hotplug code, where we need to make per
++ * cpu interrupts affine before the cpu becomes online.
++ */
++static inline int
++irq_force_affinity(unsigned int irq, const struct cpumask *cpumask)
++{
++ return __irq_set_affinity(irq, cpumask, true);
++}
++
+ extern int irq_can_set_affinity(unsigned int irq);
+ extern int irq_select_affinity(unsigned int irq);
+
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -385,7 +385,8 @@ extern void remove_percpu_irq(unsigned i
+
+ extern void irq_cpu_online(void);
+ extern void irq_cpu_offline(void);
+-extern int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *cpumask);
++extern int irq_set_affinity_locked(struct irq_data *data,
++ const struct cpumask *cpumask, bool force);
+
+ #if defined(CONFIG_SMP) && defined(CONFIG_GENERIC_PENDING_IRQ)
+ void irq_move_irq(struct irq_data *data);
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -150,7 +150,7 @@ int irq_do_set_affinity(struct irq_data
+ struct irq_chip *chip = irq_data_get_irq_chip(data);
+ int ret;
+
+- ret = chip->irq_set_affinity(data, mask, false);
++ ret = chip->irq_set_affinity(data, mask, force);
+ switch (ret) {
+ case IRQ_SET_MASK_OK:
+ cpumask_copy(data->affinity, mask);
+@@ -162,7 +162,8 @@ int irq_do_set_affinity(struct irq_data
+ return ret;
+ }
+
+-int __irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask)
++int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
++ bool force)
+ {
+ struct irq_chip *chip = irq_data_get_irq_chip(data);
+ struct irq_desc *desc = irq_data_to_desc(data);
+@@ -172,7 +173,7 @@ int __irq_set_affinity_locked(struct irq
+ return -EINVAL;
+
+ if (irq_can_move_pcntxt(data)) {
+- ret = irq_do_set_affinity(data, mask, false);
++ ret = irq_do_set_affinity(data, mask, force);
+ } else {
+ irqd_set_move_pending(data);
+ irq_copy_pending(desc, mask);
+@@ -187,13 +188,7 @@ int __irq_set_affinity_locked(struct irq
+ return ret;
+ }
+
+-/**
+- * irq_set_affinity - Set the irq affinity of a given irq
+- * @irq: Interrupt to set affinity
+- * @mask: cpumask
+- *
+- */
+-int irq_set_affinity(unsigned int irq, const struct cpumask *mask)
++int __irq_set_affinity(unsigned int irq, const struct cpumask *mask, bool force)
+ {
+ struct irq_desc *desc = irq_to_desc(irq);
+ unsigned long flags;
+@@ -203,7 +198,7 @@ int irq_set_affinity(unsigned int irq, c
+ return -EINVAL;
+
+ raw_spin_lock_irqsave(&desc->lock, flags);
+- ret = __irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask);
++ ret = irq_set_affinity_locked(irq_desc_get_irq_data(desc), mask, force);
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
+ return ret;
+ }
--- /dev/null
+From 431031851ea72a25abb9ad4df56a0f3b997e3026 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Wed, 9 Apr 2014 19:27:25 +0300
+Subject: iwlwifi: 7000: bump API to 9
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 431031851ea72a25abb9ad4df56a0f3b997e3026 upstream.
+
+This will allow to load the new firmware.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-7000.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -67,8 +67,8 @@
+ #include "iwl-agn-hw.h"
+
+ /* Highest firmware API version supported */
+-#define IWL7260_UCODE_API_MAX 8
+-#define IWL3160_UCODE_API_MAX 8
++#define IWL7260_UCODE_API_MAX 9
++#define IWL3160_UCODE_API_MAX 9
+
+ /* Oldest version we won't warn about */
+ #define IWL7260_UCODE_API_OK 7
--- /dev/null
+From 08a732f4e4a842f0101e5ea03d79e9d613ffadbe Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 24 Mar 2014 22:17:15 +0200
+Subject: iwlwifi: add MODULE_FIRMWARE for 7265
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 08a732f4e4a842f0101e5ea03d79e9d613ffadbe upstream.
+
+It was missing.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-7000.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -223,3 +223,4 @@ const struct iwl_cfg iwl7265_n_cfg = {
+
+ MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+ MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
++MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
--- /dev/null
+From 80f2679e589503bd6cbaaa1f9c1cd9dd7dfae032 Mon Sep 17 00:00:00 2001
+From: Oren Givon <oren.givon@intel.com>
+Date: Wed, 2 Apr 2014 14:04:20 +0300
+Subject: iwlwifi: add new 7265 HW IDs
+
+From: Oren Givon <oren.givon@intel.com>
+
+commit 80f2679e589503bd6cbaaa1f9c1cd9dd7dfae032 upstream.
+
+Add 2 new HW IDs for the 7265 series.
+
+Signed-off-by: Oren Givon <oren.givon@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/pcie/drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -372,12 +372,14 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_ca
+ {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2n_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
++ {IWL_PCI_DEVICE(0x095A, 0x5102, iwl7265_n_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9012, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x095A, 0x9200, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
--- /dev/null
+From d8fff919ecd7820084675c2814913445e95640ac Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Sun, 6 Apr 2014 05:27:36 +0300
+Subject: iwlwifi: mvm: avoid searching unnecessary columns
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit d8fff919ecd7820084675c2814913445e95640ac upstream.
+
+Don't search columns which are unlikely to succeed as previous
+columns searched with less aggressive modulation failed.
+
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/rs.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -212,8 +212,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_LEGACY_ANT_B,
+ RS_COLUMN_SISO_ANT_A,
+ RS_COLUMN_SISO_ANT_B,
+- RS_COLUMN_MIMO2,
+- RS_COLUMN_MIMO2_SGI,
++ RS_COLUMN_INVALID,
++ RS_COLUMN_INVALID,
+ RS_COLUMN_INVALID,
+ RS_COLUMN_INVALID,
+ },
+@@ -225,8 +225,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_LEGACY_ANT_A,
+ RS_COLUMN_SISO_ANT_A,
+ RS_COLUMN_SISO_ANT_B,
+- RS_COLUMN_MIMO2,
+- RS_COLUMN_MIMO2_SGI,
++ RS_COLUMN_INVALID,
++ RS_COLUMN_INVALID,
+ RS_COLUMN_INVALID,
+ RS_COLUMN_INVALID,
+ },
+@@ -239,9 +239,9 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_MIMO2,
+ RS_COLUMN_SISO_ANT_A_SGI,
+ RS_COLUMN_SISO_ANT_B_SGI,
+- RS_COLUMN_MIMO2_SGI,
+ RS_COLUMN_LEGACY_ANT_A,
+ RS_COLUMN_LEGACY_ANT_B,
++ RS_COLUMN_INVALID,
+ },
+ .checks = {
+ rs_siso_allow,
+@@ -255,9 +255,9 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_MIMO2,
+ RS_COLUMN_SISO_ANT_B_SGI,
+ RS_COLUMN_SISO_ANT_A_SGI,
+- RS_COLUMN_MIMO2_SGI,
+ RS_COLUMN_LEGACY_ANT_A,
+ RS_COLUMN_LEGACY_ANT_B,
++ RS_COLUMN_INVALID,
+ },
+ .checks = {
+ rs_siso_allow,
--- /dev/null
+From c63722cfd441bd3a99c65fa4c40bc65d7776e772 Mon Sep 17 00:00:00 2001
+From: Alexander Bondar <alexander.bondar@intel.com>
+Date: Mon, 10 Mar 2014 22:02:26 +0200
+Subject: iwlwifi: mvm: Change beacon filter enablement condition
+
+From: Alexander Bondar <alexander.bondar@intel.com>
+
+commit c63722cfd441bd3a99c65fa4c40bc65d7776e772 upstream.
+
+Enable beacon filter only if at least one beacon from candidate
+AP is received before or after association. Check this condition before
+enabling BF upon secured association completion. Add BF enablement to
+mac80211 event that indicates beacon is received after association.
+Too early beacon filtering enablement can lead to disconnection due to
+missing AP's beacon after association.
+
+Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -971,6 +971,7 @@ static void iwl_mvm_bss_info_changed_sta
+ */
+ iwl_mvm_remove_time_event(mvm, mvmvif,
+ &mvmvif->time_event_data);
++ WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, CMD_SYNC));
+ } else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS |
+ BSS_CHANGED_QOS)) {
+ ret = iwl_mvm_power_update_mode(mvm, vif);
+@@ -1304,7 +1305,9 @@ static int iwl_mvm_mac_sta_state(struct
+ } else if (old_state == IEEE80211_STA_ASSOC &&
+ new_state == IEEE80211_STA_AUTHORIZED) {
+ /* enable beacon filtering */
+- WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif));
++ if (vif->bss_conf.dtim_period)
++ WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif,
++ CMD_SYNC));
+ ret = 0;
+ } else if (old_state == IEEE80211_STA_AUTHORIZED &&
+ new_state == IEEE80211_STA_ASSOC) {
--- /dev/null
+From fd7dbee51b3d98402edb11fec0c93d96476e0ae1 Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Sun, 6 Apr 2014 04:39:23 +0300
+Subject: iwlwifi: mvm: rs: fallback to legacy Tx columns
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit fd7dbee51b3d98402edb11fec0c93d96476e0ae1 upstream.
+
+Allow switching back to legacy Tx columns so we'll stop doing
+HT/VHT in case we're far from the AP. Stop active aggregation when
+making a deciding to stay in a legacy column.
+Despite having low legacy rates in the LQ table lower entries
+it doesn't help much in case we're doing aggregations as the
+aggregation was being transmitted in the initial rate of the table.
+
+This should help traffic stalls when far from the AP.
+
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/rs.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -142,7 +142,7 @@ enum rs_column_mode {
+ RS_MIMO2,
+ };
+
+-#define MAX_NEXT_COLUMNS 5
++#define MAX_NEXT_COLUMNS 7
+ #define MAX_COLUMN_CHECKS 3
+
+ typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
+@@ -214,6 +214,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_SISO_ANT_B,
+ RS_COLUMN_MIMO2,
+ RS_COLUMN_MIMO2_SGI,
++ RS_COLUMN_INVALID,
++ RS_COLUMN_INVALID,
+ },
+ },
+ [RS_COLUMN_LEGACY_ANT_B] = {
+@@ -225,6 +227,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_SISO_ANT_B,
+ RS_COLUMN_MIMO2,
+ RS_COLUMN_MIMO2_SGI,
++ RS_COLUMN_INVALID,
++ RS_COLUMN_INVALID,
+ },
+ },
+ [RS_COLUMN_SISO_ANT_A] = {
+@@ -236,6 +240,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_SISO_ANT_A_SGI,
+ RS_COLUMN_SISO_ANT_B_SGI,
+ RS_COLUMN_MIMO2_SGI,
++ RS_COLUMN_LEGACY_ANT_A,
++ RS_COLUMN_LEGACY_ANT_B,
+ },
+ .checks = {
+ rs_siso_allow,
+@@ -250,6 +256,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_SISO_ANT_B_SGI,
+ RS_COLUMN_SISO_ANT_A_SGI,
+ RS_COLUMN_MIMO2_SGI,
++ RS_COLUMN_LEGACY_ANT_A,
++ RS_COLUMN_LEGACY_ANT_B,
+ },
+ .checks = {
+ rs_siso_allow,
+@@ -265,6 +273,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_SISO_ANT_A,
+ RS_COLUMN_SISO_ANT_B,
+ RS_COLUMN_MIMO2,
++ RS_COLUMN_LEGACY_ANT_A,
++ RS_COLUMN_LEGACY_ANT_B,
+ },
+ .checks = {
+ rs_siso_allow,
+@@ -281,6 +291,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_SISO_ANT_B,
+ RS_COLUMN_SISO_ANT_A,
+ RS_COLUMN_MIMO2,
++ RS_COLUMN_LEGACY_ANT_A,
++ RS_COLUMN_LEGACY_ANT_B,
+ },
+ .checks = {
+ rs_siso_allow,
+@@ -296,6 +308,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_SISO_ANT_A_SGI,
+ RS_COLUMN_SISO_ANT_B_SGI,
+ RS_COLUMN_MIMO2_SGI,
++ RS_COLUMN_LEGACY_ANT_A,
++ RS_COLUMN_LEGACY_ANT_B,
+ },
+ .checks = {
+ rs_mimo_allow,
+@@ -311,6 +325,8 @@ static const struct rs_tx_column rs_tx_c
+ RS_COLUMN_SISO_ANT_A,
+ RS_COLUMN_SISO_ANT_B,
+ RS_COLUMN_MIMO2,
++ RS_COLUMN_LEGACY_ANT_A,
++ RS_COLUMN_LEGACY_ANT_B,
+ },
+ .checks = {
+ rs_mimo_allow,
+@@ -2032,8 +2048,18 @@ lq_update:
+ * stay with best antenna legacy modulation for a while
+ * before next round of mode comparisons. */
+ tbl1 = &(lq_sta->lq_info[lq_sta->active_tbl]);
+- if (is_legacy(&tbl1->rate) && !sta->ht_cap.ht_supported) {
++ if (is_legacy(&tbl1->rate)) {
+ IWL_DEBUG_RATE(mvm, "LQ: STAY in legacy table\n");
++
++ if (tid != IWL_MAX_TID_COUNT) {
++ tid_data = &sta_priv->tid_data[tid];
++ if (tid_data->state != IWL_AGG_OFF) {
++ IWL_DEBUG_RATE(mvm,
++ "Stop aggregation on tid %d\n",
++ tid);
++ ieee80211_stop_tx_ba_session(sta, tid);
++ }
++ }
+ rs_set_stay_in_table(mvm, 1, lq_sta);
+ } else {
+ /* If we're in an HT mode, and all 3 mode switch actions
--- /dev/null
+From e53839eb9882c99d3781eab0fe1b2d4369a6a2cc Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Sun, 6 Apr 2014 02:42:18 +0300
+Subject: iwlwifi: mvm: rs: fix and cleanup rs_get_rate_action
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit e53839eb9882c99d3781eab0fe1b2d4369a6a2cc upstream.
+
+Change the down/upscale decision logic a bit to be based
+on different success ratio thresholds. This fixes the implementation
+compared to the rate scale algorithm which was planned to yield
+optimal results. Also fix a case where a lower rate wasn't explored
+despite being a potential for better throughput.
+While at it rewrite rs_get_rate_action to be more clear and clean.
+
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/rs.c | 135 +++++++++++++++-------------------
+ drivers/net/wireless/iwlwifi/mvm/rs.h | 1
+ 2 files changed, 64 insertions(+), 72 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -1644,85 +1644,76 @@ static enum rs_action rs_get_rate_action
+ {
+ enum rs_action action = RS_ACTION_STAY;
+
+- /* Too many failures, decrease rate */
+ if ((sr <= RS_SR_FORCE_DECREASE) || (current_tpt == 0)) {
+ IWL_DEBUG_RATE(mvm,
+- "decrease rate because of low SR\n");
+- action = RS_ACTION_DOWNSCALE;
+- /* No throughput measured yet for adjacent rates; try increase. */
+- } else if ((low_tpt == IWL_INVALID_VALUE) &&
+- (high_tpt == IWL_INVALID_VALUE)) {
+- if (high != IWL_RATE_INVALID && sr >= IWL_RATE_INCREASE_TH) {
+- IWL_DEBUG_RATE(mvm,
+- "Good SR and no high rate measurement. "
+- "Increase rate\n");
+- action = RS_ACTION_UPSCALE;
+- } else if (low != IWL_RATE_INVALID) {
+- IWL_DEBUG_RATE(mvm,
+- "Remain in current rate\n");
+- action = RS_ACTION_STAY;
+- }
++ "Decrease rate because of low SR\n");
++ return RS_ACTION_DOWNSCALE;
+ }
+
+- /* Both adjacent throughputs are measured, but neither one has better
+- * throughput; we're using the best rate, don't change it!
+- */
+- else if ((low_tpt != IWL_INVALID_VALUE) &&
+- (high_tpt != IWL_INVALID_VALUE) &&
+- (low_tpt < current_tpt) &&
+- (high_tpt < current_tpt)) {
+- IWL_DEBUG_RATE(mvm,
+- "Both high and low are worse. "
+- "Maintain rate\n");
+- action = RS_ACTION_STAY;
+- }
+-
+- /* At least one adjacent rate's throughput is measured,
+- * and may have better performance.
+- */
+- else {
+- /* Higher adjacent rate's throughput is measured */
+- if (high_tpt != IWL_INVALID_VALUE) {
+- /* Higher rate has better throughput */
+- if (high_tpt > current_tpt &&
+- sr >= IWL_RATE_INCREASE_TH) {
+- IWL_DEBUG_RATE(mvm,
+- "Higher rate is better and good "
+- "SR. Increate rate\n");
+- action = RS_ACTION_UPSCALE;
+- } else {
+- IWL_DEBUG_RATE(mvm,
+- "Higher rate isn't better OR "
+- "no good SR. Maintain rate\n");
+- action = RS_ACTION_STAY;
+- }
+-
+- /* Lower adjacent rate's throughput is measured */
+- } else if (low_tpt != IWL_INVALID_VALUE) {
+- /* Lower rate has better throughput */
+- if (low_tpt > current_tpt) {
+- IWL_DEBUG_RATE(mvm,
+- "Lower rate is better. "
+- "Decrease rate\n");
+- action = RS_ACTION_DOWNSCALE;
+- } else if (sr >= IWL_RATE_INCREASE_TH) {
+- IWL_DEBUG_RATE(mvm,
+- "Lower rate isn't better and "
+- "good SR. Increase rate\n");
+- action = RS_ACTION_UPSCALE;
+- }
+- }
++ if ((low_tpt == IWL_INVALID_VALUE) &&
++ (high_tpt == IWL_INVALID_VALUE) &&
++ (high != IWL_RATE_INVALID)) {
++ IWL_DEBUG_RATE(mvm,
++ "No data about high/low rates. Increase rate\n");
++ return RS_ACTION_UPSCALE;
+ }
+
+- /* Sanity check; asked for decrease, but success rate or throughput
+- * has been good at old rate. Don't change it.
+- */
+- if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID) &&
+- ((sr > IWL_RATE_HIGH_TH) ||
+- (current_tpt > (100 * tbl->expected_tpt[low])))) {
++ if ((high_tpt == IWL_INVALID_VALUE) &&
++ (high != IWL_RATE_INVALID) &&
++ (low_tpt != IWL_INVALID_VALUE) &&
++ (low_tpt < current_tpt)) {
+ IWL_DEBUG_RATE(mvm,
+- "Sanity check failed. Maintain rate\n");
+- action = RS_ACTION_STAY;
++ "No data about high rate and low rate is worse. Increase rate\n");
++ return RS_ACTION_UPSCALE;
++ }
++
++ if ((high_tpt != IWL_INVALID_VALUE) &&
++ (high_tpt > current_tpt)) {
++ IWL_DEBUG_RATE(mvm,
++ "Higher rate is better. Increate rate\n");
++ return RS_ACTION_UPSCALE;
++ }
++
++ if ((low_tpt != IWL_INVALID_VALUE) &&
++ (high_tpt != IWL_INVALID_VALUE) &&
++ (low_tpt < current_tpt) &&
++ (high_tpt < current_tpt)) {
++ IWL_DEBUG_RATE(mvm,
++ "Both high and low are worse. Maintain rate\n");
++ return RS_ACTION_STAY;
++ }
++
++ if ((low_tpt != IWL_INVALID_VALUE) &&
++ (low_tpt > current_tpt)) {
++ IWL_DEBUG_RATE(mvm,
++ "Lower rate is better\n");
++ action = RS_ACTION_DOWNSCALE;
++ goto out;
++ }
++
++ if ((low_tpt == IWL_INVALID_VALUE) &&
++ (low != IWL_RATE_INVALID)) {
++ IWL_DEBUG_RATE(mvm,
++ "No data about lower rate\n");
++ action = RS_ACTION_DOWNSCALE;
++ goto out;
++ }
++
++ IWL_DEBUG_RATE(mvm, "Maintain rate\n");
++
++out:
++ if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID)) {
++ if (sr >= RS_SR_NO_DECREASE) {
++ IWL_DEBUG_RATE(mvm,
++ "SR is above NO DECREASE. Avoid downscale\n");
++ action = RS_ACTION_STAY;
++ } else if (current_tpt > (100 * tbl->expected_tpt[low])) {
++ IWL_DEBUG_RATE(mvm,
++ "Current TPT is higher than max expected in low rate. Avoid downscale\n");
++ action = RS_ACTION_STAY;
++ } else {
++ IWL_DEBUG_RATE(mvm, "Decrease rate\n");
++ }
+ }
+
+ return action;
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
+@@ -156,6 +156,7 @@ enum {
+ #define IWL_RATE_HIGH_TH 10880 /* 85% */
+ #define IWL_RATE_INCREASE_TH 6400 /* 50% */
+ #define RS_SR_FORCE_DECREASE 1920 /* 15% */
++#define RS_SR_NO_DECREASE 10880 /* 85% */
+
+ #define LINK_QUAL_AGG_TIME_LIMIT_DEF (4000) /* 4 milliseconds */
+ #define LINK_QUAL_AGG_TIME_LIMIT_MAX (8000)
--- /dev/null
+From d9088f60425e0acd8a8f05fdfcfdd288d3258641 Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Tue, 25 Mar 2014 10:25:44 +0200
+Subject: iwlwifi: mvm: rs: fix mimo delimiter in LQ cmd
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit d9088f60425e0acd8a8f05fdfcfdd288d3258641 upstream.
+
+mimo_delim was always set to 0 instead of pointing to
+the first SISO entry after MIMO rates.
+This can cause keep transmitting in MIMO even when we shouldn't.
+For example when the peer is requesting static SMPS.
+
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/rs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -2469,6 +2469,7 @@ static void rs_build_rates_table(struct
+ if (is_siso(&rate)) {
+ num_rates = RS_SECONDARY_SISO_NUM_RATES;
+ num_retries = RS_SECONDARY_SISO_RETRIES;
++ lq_cmd->mimo_delim = index;
+ } else if (is_legacy(&rate)) {
+ num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
+ num_retries = RS_LEGACY_RETRIES_PER_RATE;
--- /dev/null
+From 87d5e4155c0088e6766b4f0193b63fa0eab71220 Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Sun, 6 Apr 2014 18:13:22 +0300
+Subject: iwlwifi: mvm: rs: reinit rs if no tx for a long time
+
+From: Eyal Shapira <eyal@wizery.com>
+
+commit 87d5e4155c0088e6766b4f0193b63fa0eab71220 upstream.
+
+After being idle for a long time (>5sec) the rs statistics
+will be stale so we prefer to reset rs and start from legacy
+rates again. This gives better results when the attenuation
+increased signficantly (e.g. we got further from the AP) and
+after a while we start Tx
+Note that the first Tx after the idle period will still go out
+in the old modulation and rate but this seemed a simpler approach
+compared to adding a timer or modifying mac80211 for this.
+The negative impact is negligble as we'll recover quickly.
+
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/rs.c | 22 +++++++++++++++++++++-
+ drivers/net/wireless/iwlwifi/mvm/rs.h | 1 +
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -59,7 +59,7 @@
+ /* max allowed rate miss before sync LQ cmd */
+ #define IWL_MISSED_RATE_MAX 15
+ #define RS_STAY_IN_COLUMN_TIMEOUT (5*HZ)
+-
++#define RS_IDLE_TIMEOUT (5*HZ)
+
+ static u8 rs_ht_to_legacy[] = {
+ [IWL_RATE_MCS_0_INDEX] = IWL_RATE_6M_INDEX,
+@@ -991,6 +991,13 @@ static void rs_tx_status(void *mvm_r, st
+ return;
+ }
+
++#ifdef CPTCFG_MAC80211_DEBUGFS
++ /* Disable last tx check if we are debugging with fixed rate */
++ if (lq_sta->dbg_fixed_rate) {
++ IWL_DEBUG_RATE(mvm, "Fixed rate. avoid rate scaling\n");
++ return;
++ }
++#endif
+ if (!ieee80211_is_data(hdr->frame_control) ||
+ info->flags & IEEE80211_TX_CTL_NO_ACK)
+ return;
+@@ -1033,6 +1040,18 @@ static void rs_tx_status(void *mvm_r, st
+ mac_index++;
+ }
+
++ if (time_after(jiffies,
++ (unsigned long)(lq_sta->last_tx + RS_IDLE_TIMEOUT))) {
++ int tid;
++ IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
++ for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
++ ieee80211_stop_tx_ba_session(sta, tid);
++
++ iwl_mvm_rs_rate_init(mvm, sta, sband->band, false);
++ return;
++ }
++ lq_sta->last_tx = jiffies;
++
+ /* Here we actually compare this rate to the latest LQ command */
+ if ((mac_index < 0) ||
+ (rate.sgi != !!(mac_flags & IEEE80211_TX_RC_SHORT_GI)) ||
+@@ -2286,6 +2305,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm
+ rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
+
+ lq_sta->flush_timer = 0;
++ lq_sta->last_tx = jiffies;
+
+ IWL_DEBUG_RATE(mvm,
+ "LQ: *** rate scale station global init for station %d ***\n",
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
+@@ -311,6 +311,7 @@ struct iwl_lq_sta {
+ u32 visited_columns; /* Bitmask marking which Tx columns were
+ * explored during a search cycle
+ */
++ u64 last_tx;
+ bool is_vht;
+ enum ieee80211_band band;
+
--- /dev/null
+From b44b2140265ddfde03acbe809336111d31adb0d1 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Sun, 20 Apr 2014 08:29:21 -0400
+Subject: kernfs: add back missing error check in kernfs_fop_mmap()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit b44b2140265ddfde03acbe809336111d31adb0d1 upstream.
+
+While updating how mmap enabled kernfs files are handled by lockdep,
+9b2db6e18945 ("sysfs: bail early from kernfs_file_mmap() to avoid
+spurious lockdep warning") inadvertently dropped error return check
+from kernfs_file_mmap(). The intention was just dropping "if
+(ops->mmap)" check as the control won't reach the point if the mmap
+callback isn't implemented, but I mistakenly removed the error return
+check together with it.
+
+This led to Xorg crash on i810 which was reported and bisected to the
+commit and then to the specific change by Tobias.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-and-bisected-by: Tobias Powalowski <tobias.powalowski@googlemail.com>
+Tested-by: Tobias Powalowski <tobias.powalowski@googlemail.com>
+References: http://lkml.kernel.org/g/533D01BD.1010200@googlemail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/kernfs/file.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/kernfs/file.c
++++ b/fs/kernfs/file.c
+@@ -476,6 +476,8 @@ static int kernfs_fop_mmap(struct file *
+
+ ops = kernfs_ops(of->kn);
+ rc = ops->mmap(of, vma);
++ if (rc)
++ goto out_put;
+
+ /*
+ * PowerPC's pci_mmap of legacy_mem uses shmem_zero_setup()
--- /dev/null
+From 1b17844b29ae042576bea588164f2f1e9590a8bc Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Tue, 22 Apr 2014 13:49:40 -0700
+Subject: mm: make fixup_user_fault() check the vma access rights too
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 1b17844b29ae042576bea588164f2f1e9590a8bc upstream.
+
+fixup_user_fault() is used by the futex code when the direct user access
+fails, and the futex code wants it to either map in the page in a usable
+form or return an error. It relied on handle_mm_fault() to map the
+page, and correctly checked the error return from that, but while that
+does map the page, it doesn't actually guarantee that the page will be
+mapped with sufficient permissions to be then accessed.
+
+So do the appropriate tests of the vma access rights by hand.
+
+[ Side note: arguably handle_mm_fault() could just do that itself, but
+ we have traditionally done it in the caller, because some callers -
+ notably get_user_pages() - have been able to access pages even when
+ they are mapped with PROT_NONE. Maybe we should re-visit that design
+ decision, but in the meantime this is the minimal patch. ]
+
+Found by Dave Jones running his trinity tool.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memory.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1929,12 +1929,17 @@ int fixup_user_fault(struct task_struct
+ unsigned long address, unsigned int fault_flags)
+ {
+ struct vm_area_struct *vma;
++ vm_flags_t vm_flags;
+ int ret;
+
+ vma = find_extend_vma(mm, address);
+ if (!vma || address < vma->vm_start)
+ return -EFAULT;
+
++ vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
++ if (!(vm_flags & vma->vm_flags))
++ return -EFAULT;
++
+ ret = handle_mm_fault(mm, vma, address, fault_flags);
+ if (ret & VM_FAULT_ERROR) {
+ if (ret & VM_FAULT_OOM)
--- /dev/null
+From 27aa64b9d1bd0d23fd692c91763a48309b694311 Mon Sep 17 00:00:00 2001
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Date: Mon, 31 Mar 2014 19:51:14 +0200
+Subject: pata_at91: fix ata_host_activate() failure handling
+
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+
+commit 27aa64b9d1bd0d23fd692c91763a48309b694311 upstream.
+
+Add missing clk_put() call to ata_host_activate() failure path.
+
+Sergei says,
+
+ "Hm, I have once fixed that (see that *if* (!ret)) but looks like a
+ later commit 477c87e90853d136b188c50c0e4a93d01cad872e (ARM:
+ at91/pata: use gpio_is_valid to check the gpio) broke it again. :-(
+ Would be good if the changelog did mention that..."
+
+Cc: Andrew Victor <linux@maxim.org.za>
+Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
+Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com>
+Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/pata_at91.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/ata/pata_at91.c
++++ b/drivers/ata/pata_at91.c
+@@ -408,12 +408,13 @@ static int pata_at91_probe(struct platfo
+
+ host->private_data = info;
+
+- return ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
+- gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
+- irq_flags, &pata_at91_sht);
++ ret = ata_host_activate(host, gpio_is_valid(irq) ? gpio_to_irq(irq) : 0,
++ gpio_is_valid(irq) ? ata_sff_interrupt : NULL,
++ irq_flags, &pata_at91_sht);
++ if (ret)
++ goto err_put;
+
+- if (!ret)
+- return 0;
++ return 0;
+
+ err_put:
+ clk_put(info->mck);
--- /dev/null
+From f8fd1b0350d3a4581125f5eda6528f5a2c5f9183 Mon Sep 17 00:00:00 2001
+From: Loic Poulain <loic.poulain@intel.com>
+Date: Thu, 24 Apr 2014 11:34:48 +0200
+Subject: serial: 8250: Fix thread unsafe __dma_tx_complete function
+
+From: Loic Poulain <loic.poulain@intel.com>
+
+commit f8fd1b0350d3a4581125f5eda6528f5a2c5f9183 upstream.
+
+__dma_tx_complete is not protected against concurrent
+call of serial8250_tx_dma. it can lead to circular tail
+index corruption or parallel call of serial_tx_dma on the
+same data portion.
+
+This patch fixes this issue by holding the port lock.
+
+Signed-off-by: Loic Poulain <loic.poulain@intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_dma.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_dma.c
++++ b/drivers/tty/serial/8250/8250_dma.c
+@@ -20,12 +20,15 @@ static void __dma_tx_complete(void *para
+ struct uart_8250_port *p = param;
+ struct uart_8250_dma *dma = p->dma;
+ struct circ_buf *xmit = &p->port.state->xmit;
+-
+- dma->tx_running = 0;
++ unsigned long flags;
+
+ dma_sync_single_for_cpu(dma->txchan->device->dev, dma->tx_addr,
+ UART_XMIT_SIZE, DMA_TO_DEVICE);
+
++ spin_lock_irqsave(&p->port.lock, flags);
++
++ dma->tx_running = 0;
++
+ xmit->tail += dma->tx_size;
+ xmit->tail &= UART_XMIT_SIZE - 1;
+ p->port.icount.tx += dma->tx_size;
+@@ -35,6 +38,8 @@ static void __dma_tx_complete(void *para
+
+ if (!uart_circ_empty(xmit) && !uart_tx_stopped(&p->port))
+ serial8250_tx_dma(p);
++
++ spin_unlock_irqrestore(&p->port.lock, flags);
+ }
+
+ static void __dma_rx_complete(void *param)
ftrace-module-hardcode-ftrace_module_init-call-into-load_module.patch
of-irq-do-irq-resolution-in-platform_get_irq.patch
irqchip-gic-support-forced-affinity-setting.patch
+genirq-allow-forcing-cpu-affinity-of-interrupts.patch
+clocksource-exynos_mct-use-irq_force_affinity-in-cpu-bringup.patch
+clocksource-exynos_mct-register-clock-event-after-request_irq.patch
+kernfs-add-back-missing-error-check-in-kernfs_fop_mmap.patch
+pata_at91-fix-ata_host_activate-failure-handling.patch
+coredump-fix-va_list-corruption.patch
+topology-fix-compilation-warning-when-not-in-smp.patch
+mm-make-fixup_user_fault-check-the-vma-access-rights-too.patch
+serial-8250-fix-thread-unsafe-__dma_tx_complete-function.patch
+8250_core-fix-unwanted-tx-chars-write.patch
+iwlwifi-add-module_firmware-for-7265.patch
+iwlwifi-mvm-rs-fix-mimo-delimiter-in-lq-cmd.patch
+iwlwifi-add-new-7265-hw-ids.patch
+iwlwifi-mvm-rs-fallback-to-legacy-tx-columns.patch
+iwlwifi-mvm-avoid-searching-unnecessary-columns.patch
+iwlwifi-mvm-rs-fix-and-cleanup-rs_get_rate_action.patch
+iwlwifi-mvm-rs-reinit-rs-if-no-tx-for-a-long-time.patch
+iwlwifi-7000-bump-api-to-9.patch
+iwlwifi-mvm-change-beacon-filter-enablement-condition.patch
--- /dev/null
+From 53974e06603977f348ed978d75c426b0532daa67 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Vincent=20Stehl=C3=A9?= <vincent.stehle@laposte.net>
+Date: Fri, 4 Apr 2014 08:43:18 +0200
+Subject: topology: Fix compilation warning when not in SMP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Vincent=20Stehl=C3=A9?= <vincent.stehle@laposte.net>
+
+commit 53974e06603977f348ed978d75c426b0532daa67 upstream.
+
+The topology_##name() macro does not use its argument when CONFIG_SMP is not
+set, as it ultimately calls the cpu_data() macro.
+
+So we avoid maintaining a possibly unused `cpu' variable, to avoid the
+following compilation warning:
+
+ drivers/base/topology.c: In function ‘show_physical_package_id’:
+ drivers/base/topology.c:103:118: warning: unused variable ‘cpu’ [-Wunused-variable]
+ define_id_show_func(physical_package_id);
+
+ drivers/base/topology.c: In function ‘show_core_id’:
+ drivers/base/topology.c:106:106: warning: unused variable ‘cpu’ [-Wunused-variable]
+ define_id_show_func(core_id);
+
+This can be seen with e.g. x86 defconfig and CONFIG_SMP not set.
+
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/topology.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/base/topology.c
++++ b/drivers/base/topology.c
+@@ -40,8 +40,7 @@
+ static ssize_t show_##name(struct device *dev, \
+ struct device_attribute *attr, char *buf) \
+ { \
+- unsigned int cpu = dev->id; \
+- return sprintf(buf, "%d\n", topology_##name(cpu)); \
++ return sprintf(buf, "%d\n", topology_##name(dev->id)); \
+ }
+
+ #if defined(topology_thread_cpumask) || defined(topology_core_cpumask) || \
projects / thirdparty / kernel / stable-queue.git / commitdiff
