linux-libre-{pae,xen}-3.14-5: fix a futex bug and add some iwlwifi fixes

22 files changed, 662 insertions, 56 deletions

diff --git a/kernels/linux-libre-pae/0001-Bluetooth-allocate-static-minor-for-vhci.patch b/kernels/linux-libre-pae/0001-Bluetooth-allocate-static-minor-for-vhci.patch
index f63e5e79d..557da37ce 100644
--- a/kernels/linux-libre-pae/0001-Bluetooth-allocate-static-minor-for-vhci.patch
+++ b/kernels/linux-libre-pae/0001-Bluetooth-allocate-static-minor-for-vhci.patch
@@ -1,7 +1,7 @@
 From 5d77ba2d26110c678b40fd723866a17d4036de12 Mon Sep 17 00:00:00 2001
 From: Lucas De Marchi <lucas.demarchi@intel.com>
 Date: Tue, 18 Feb 2014 02:19:26 -0300
-Subject: [PATCH 1/7] Bluetooth: allocate static minor for vhci
+Subject: [PATCH 01/10] Bluetooth: allocate static minor for vhci
 
 Commit bfacbb9 (Bluetooth: Use devname:vhci module alias for virtual HCI
 driver) added the module alias to hci_vhci module so it's possible to
@@ -70,5 +70,5 @@ index 3737f72..7bb6148 100644
  #define DMAPI_MINOR		140	/* DMAPI */
  #define NVRAM_MINOR		144
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-pae/0002-module-allow-multiple-calls-to-MODULE_DEVICE_TABLE-p.patch b/kernels/linux-libre-pae/0002-module-allow-multiple-calls-to-MODULE_DEVICE_TABLE-p.patch
index 188110a8c..7db851cb9 100644
--- a/kernels/linux-libre-pae/0002-module-allow-multiple-calls-to-MODULE_DEVICE_TABLE-p.patch
+++ b/kernels/linux-libre-pae/0002-module-allow-multiple-calls-to-MODULE_DEVICE_TABLE-p.patch
@@ -1,8 +1,8 @@
 From 9bc5b710f5957763d6944f38143b627d127c15ff Mon Sep 17 00:00:00 2001
 From: Tom Gundersen <teg@jklm.no>
 Date: Mon, 3 Feb 2014 11:14:13 +1030
-Subject: [PATCH 2/7] module: allow multiple calls to MODULE_DEVICE_TABLE() per
- module
+Subject: [PATCH 02/10] module: allow multiple calls to MODULE_DEVICE_TABLE()
+ per module
 
 Commit 78551277e4df5: "Input: i8042 - add PNP modaliases" had a bug, where the
 second call to MODULE_DEVICE_TABLE() overrode the first resulting in not all
@@ -89,5 +89,5 @@ index 25e5cb0..ce16404 100644
  	/* Handle all-NULL symbols allocated into .bss */
  	if (info->sechdrs[get_secindex(info, sym)].sh_type & SHT_NOBITS) {
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-pae/0003-module-remove-MODULE_GENERIC_TABLE.patch b/kernels/linux-libre-pae/0003-module-remove-MODULE_GENERIC_TABLE.patch
index 43947a1d3..d7a022ce8 100644
--- a/kernels/linux-libre-pae/0003-module-remove-MODULE_GENERIC_TABLE.patch
+++ b/kernels/linux-libre-pae/0003-module-remove-MODULE_GENERIC_TABLE.patch
@@ -1,7 +1,7 @@
 From 06d2e746733a83469944481cb7f4fb1c7134a8ce Mon Sep 17 00:00:00 2001
 From: Rusty Russell <rusty@rustcorp.com.au>
 Date: Mon, 3 Feb 2014 11:15:13 +1030
-Subject: [PATCH 3/7] module: remove MODULE_GENERIC_TABLE
+Subject: [PATCH 03/10] module: remove MODULE_GENERIC_TABLE
 
 MODULE_DEVICE_TABLE() calles MODULE_GENERIC_TABLE(); make it do the
 work directly.  This also removes a wart introduced in the last patch,
@@ -71,5 +71,5 @@ index ad18f60..5686b37 100644
  /* Version of form [<epoch>:]<version>[-<extra-version>].
   * Or for CVS/RCS ID version, everything but the number is stripped.
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-pae/0004-fs-Don-t-return-0-from-get_anon_bdev.patch b/kernels/linux-libre-pae/0004-fs-Don-t-return-0-from-get_anon_bdev.patch
index 4c11b31f2..5e4a27f06 100644
--- a/kernels/linux-libre-pae/0004-fs-Don-t-return-0-from-get_anon_bdev.patch
+++ b/kernels/linux-libre-pae/0004-fs-Don-t-return-0-from-get_anon_bdev.patch
@@ -1,7 +1,7 @@
 From 835a463e190af87a36df681863db7c3ea7ba0d66 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Thomas=20B=C3=A4chler?= <thomas@archlinux.org>
 Date: Thu, 3 Apr 2014 21:55:37 +0200
-Subject: [PATCH 4/7] fs: Don't return 0 from get_anon_bdev
+Subject: [PATCH 04/10] fs: Don't return 0 from get_anon_bdev
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -40,5 +40,5 @@ index 80d5cf2..7624267 100644
  int get_anon_bdev(dev_t *p)
  {
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-pae/0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch b/kernels/linux-libre-pae/0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch
index c31441731..74283b57c 100644
--- a/kernels/linux-libre-pae/0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch
+++ b/kernels/linux-libre-pae/0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch
@@ -1,8 +1,8 @@
 From 71d4f3022d1f625d94187f7cda682d2233a692d8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Thomas=20B=C3=A4chler?= <thomas@archlinux.org>
 Date: Thu, 3 Apr 2014 23:59:49 +0200
-Subject: [PATCH 5/7] Revert "Bluetooth: Enable autosuspend for Intel Bluetooth
- device"
+Subject: [PATCH 05/10] Revert "Bluetooth: Enable autosuspend for Intel
+ Bluetooth device"
 
 This reverts commit d2bee8fb6e18f6116aada39851918473761f7ab1.
 
@@ -29,5 +29,5 @@ index baeaaed..6d6e09e 100644
  	/* Interface numbers are hardcoded in the specification */
  	data->isoc = usb_ifnum_to_if(data->udev, 1);
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-pae/0006-genksyms-fix-typeof-handling.patch b/kernels/linux-libre-pae/0006-genksyms-fix-typeof-handling.patch
index 08b467a4c..fdd4b6d03 100644
--- a/kernels/linux-libre-pae/0006-genksyms-fix-typeof-handling.patch
+++ b/kernels/linux-libre-pae/0006-genksyms-fix-typeof-handling.patch
@@ -1,7 +1,7 @@
 From 39a7f4024e3e7d54a3bb49dcb645b3d7af16354e Mon Sep 17 00:00:00 2001
 From: Jan Beulich <JBeulich@suse.com>
 Date: Thu, 3 Apr 2014 14:46:37 -0700
-Subject: [PATCH 6/7] genksyms: fix typeof() handling
+Subject: [PATCH 06/10] genksyms: fix typeof() handling
 
 Recent increased use of typeof() throughout the tree resulted in a
 number of symbols (25 in a typical distro config of ours) not getting a
@@ -1356,5 +1356,5 @@ index 23c3999..b9f4cf2 100644
  	/* References to s/u/e's defined elsewhere.  Rearrange things
  	   so that it is easier to expand the definition fully later.  */
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-pae/0007-Fix-the-use-of-code32_start-in-the-EFI-boot-stub.patch b/kernels/linux-libre-pae/0007-x86-efi-Correct-EFI-boot-stub-use-of-code32_start.patch
index 8cf776842..898ee1543 100644
--- a/kernels/linux-libre-pae/0007-Fix-the-use-of-code32_start-in-the-EFI-boot-stub.patch
+++ b/kernels/linux-libre-pae/0007-x86-efi-Correct-EFI-boot-stub-use-of-code32_start.patch
@@ -1,8 +1,22 @@
-From ec8ec8362c46fd86571204d0fcce11c03477e5c5 Mon Sep 17 00:00:00 2001
+From 720a9dbf61c88bd57d6f8198ed8ccb2bd4a6abd8 Mon Sep 17 00:00:00 2001
 From: Matt Fleming <matt@console-pimps.org>
 Date: Wed, 9 Apr 2014 10:33:49 +0200
-Subject: [PATCH 7/7] Fix the use of code32_start in the EFI boot stub
+Subject: [PATCH 07/10] x86/efi: Correct EFI boot stub use of code32_start
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
 
+code32_start should point at the start of the protected mode code, and
+*not* at the beginning of the bzImage. This is much easier to do in
+assembly so document that callers of make_boot_params() need to fill out
+code32_start.
+
+The fallout from this bug is that we would end up relocating the image
+but copying the image at some offset, resulting in what appeared to be
+memory corruption.
+
+Reported-by: Thomas Bächler <thomas@archlinux.org>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
 ---
  arch/x86/boot/compressed/eboot.c   |  5 +++--
  arch/x86/boot/compressed/head_32.S | 14 ++++++++------
@@ -92,5 +106,5 @@ index c5c1ae0..b10fa66 100644
  	jmp	*%rax
  
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-pae/0008-futex-avoid-race-between-requeue-and-wake.patch b/kernels/linux-libre-pae/0008-futex-avoid-race-between-requeue-and-wake.patch
new file mode 100644
index 000000000..8685e1168
--- /dev/null
+++ b/kernels/linux-libre-pae/0008-futex-avoid-race-between-requeue-and-wake.patch
@@ -0,0 +1,94 @@
+From aafcd8f8692fb9e389608c1efad2e57c0bbb9362 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Tue, 8 Apr 2014 15:30:07 -0700
+Subject: [PATCH 08/10] futex: avoid race between requeue and wake
+
+commit 69cd9eba38867a493a043bb13eb9b33cad5f1a9a upstream.
+
+Jan Stancek reported:
+ "pthread_cond_broadcast/4-1.c testcase from openposix testsuite (LTP)
+  occasionally fails, because some threads fail to wake up.
+
+  Testcase creates 5 threads, which are all waiting on same condition.
+  Main thread then calls pthread_cond_broadcast() without holding mutex,
+  which calls:
+
+      futex(uaddr1, FUTEX_CMP_REQUEUE_PRIVATE, 1, 2147483647, uaddr2, ..)
+
+  This immediately wakes up single thread A, which unlocks mutex and
+  tries to wake up another thread:
+
+      futex(uaddr2, FUTEX_WAKE_PRIVATE, 1)
+
+  If thread A manages to call futex_wake() before any waiters are
+  requeued for uaddr2, no other thread is woken up"
+
+The ordering constraints for the hash bucket waiter counting are that
+the waiter counts have to be incremented _before_ getting the spinlock
+(because the spinlock acts as part of the memory barrier), but the
+"requeue" operation didn't honor those rules, and nobody had even
+thought about that case.
+
+This fairly simple patch just increments the waiter count for the target
+hash bucket (hb2) when requeing a futex before taking the locks.  It
+then decrements them again after releasing the lock - the code that
+actually moves the futex(es) between hash buckets will do the additional
+required waiter count housekeeping.
+
+Reported-and-tested-by: Jan Stancek <jstancek@redhat.com>
+Acked-by: Davidlohr Bueso <davidlohr@hp.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/futex.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 08ec814..16b1f2c 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1450,6 +1450,7 @@ retry:
+ 	hb2 = hash_futex(&key2);
+ 
+ retry_private:
++	hb_waiters_inc(hb2);
+ 	double_lock_hb(hb1, hb2);
+ 
+ 	if (likely(cmpval != NULL)) {
+@@ -1459,6 +1460,7 @@ retry_private:
+ 
+ 		if (unlikely(ret)) {
+ 			double_unlock_hb(hb1, hb2);
++			hb_waiters_dec(hb2);
+ 
+ 			ret = get_user(curval, uaddr1);
+ 			if (ret)
+@@ -1508,6 +1510,7 @@ retry_private:
+ 			break;
+ 		case -EFAULT:
+ 			double_unlock_hb(hb1, hb2);
++			hb_waiters_dec(hb2);
+ 			put_futex_key(&key2);
+ 			put_futex_key(&key1);
+ 			ret = fault_in_user_writeable(uaddr2);
+@@ -1517,6 +1520,7 @@ retry_private:
+ 		case -EAGAIN:
+ 			/* The owner was exiting, try again. */
+ 			double_unlock_hb(hb1, hb2);
++			hb_waiters_dec(hb2);
+ 			put_futex_key(&key2);
+ 			put_futex_key(&key1);
+ 			cond_resched();
+@@ -1592,6 +1596,7 @@ retry_private:
+ 
+ out_unlock:
+ 	double_unlock_hb(hb1, hb2);
++	hb_waiters_dec(hb2);
+ 
+ 	/*
+ 	 * drop_futex_key_refs() must be called outside the spinlocks. During
+-- 
+1.9.2
+
diff --git a/kernels/linux-libre-pae/0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch b/kernels/linux-libre-pae/0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch
new file mode 100644
index 000000000..5acbf53dd
--- /dev/null
+++ b/kernels/linux-libre-pae/0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch
@@ -0,0 +1,125 @@
+From 06af061dd673d749d5516bea41e2becb034e00b8 Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Sun, 16 Mar 2014 05:23:21 +0200
+Subject: [PATCH 09/10] iwlwifi: mvm: rs: fix search cycle rules
+
+commit 8930b05090acd321b1fc7c642528c697cb105c42 upstream.
+
+We should explore all possible columns when searching to be
+as resilient as possible to changing conditions. This fixes
+for example a scenario where even after a sudden creation of
+rssi difference between the 2 antennas we would keep doing MIMO
+at a low rate instead of switching to SISO at a higher rate using
+the better antenna which was the optimal configuration.
+
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/iwlwifi/mvm/rs.c | 36 +++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
+index 6abf74e..5bc8715 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -211,9 +211,9 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 		.next_columns = {
+ 			RS_COLUMN_LEGACY_ANT_B,
+ 			RS_COLUMN_SISO_ANT_A,
++			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_MIMO2_SGI,
+ 		},
+ 	},
+ 	[RS_COLUMN_LEGACY_ANT_B] = {
+@@ -221,10 +221,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 		.ant = ANT_B,
+ 		.next_columns = {
+ 			RS_COLUMN_LEGACY_ANT_A,
++			RS_COLUMN_SISO_ANT_A,
+ 			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_MIMO2_SGI,
+ 		},
+ 	},
+ 	[RS_COLUMN_SISO_ANT_A] = {
+@@ -234,8 +234,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
+ 			RS_COLUMN_SISO_ANT_A_SGI,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_SISO_ANT_B_SGI,
++			RS_COLUMN_MIMO2_SGI,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -248,8 +248,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_A,
+ 			RS_COLUMN_MIMO2,
+ 			RS_COLUMN_SISO_ANT_B_SGI,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_SISO_ANT_A_SGI,
++			RS_COLUMN_MIMO2_SGI,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -263,8 +263,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_B_SGI,
+ 			RS_COLUMN_MIMO2_SGI,
+ 			RS_COLUMN_SISO_ANT_A,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_SISO_ANT_B,
++			RS_COLUMN_MIMO2,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -279,8 +279,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_A_SGI,
+ 			RS_COLUMN_MIMO2_SGI,
+ 			RS_COLUMN_SISO_ANT_B,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_SISO_ANT_A,
++			RS_COLUMN_MIMO2,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -292,10 +292,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 		.ant = ANT_AB,
+ 		.next_columns = {
+ 			RS_COLUMN_SISO_ANT_A,
++			RS_COLUMN_SISO_ANT_B,
++			RS_COLUMN_SISO_ANT_A_SGI,
++			RS_COLUMN_SISO_ANT_B_SGI,
+ 			RS_COLUMN_MIMO2_SGI,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
+ 		},
+ 		.checks = {
+ 			rs_mimo_allow,
+@@ -307,10 +307,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 		.sgi = true,
+ 		.next_columns = {
+ 			RS_COLUMN_SISO_ANT_A_SGI,
++			RS_COLUMN_SISO_ANT_B_SGI,
++			RS_COLUMN_SISO_ANT_A,
++			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
+ 		},
+ 		.checks = {
+ 			rs_mimo_allow,
+-- 
+1.9.2
+
diff --git a/kernels/linux-libre-pae/0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch b/kernels/linux-libre-pae/0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch
new file mode 100644
index 000000000..7f18091a4
--- /dev/null
+++ b/kernels/linux-libre-pae/0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch
@@ -0,0 +1,52 @@
+From 784c4f0b18f89922ddc0fe21e5ec64cc370bb3f2 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 19 Mar 2014 18:36:39 +0100
+Subject: [PATCH 10/10] iwlwifi: mvm: delay enabling smart FIFO until after
+ beacon RX
+
+If we have no beacon data before association, delay smart FIFO
+enablement until after we have this data.
+
+Not doing so can cause association failures in extremely silent
+environments (usually only a shielded box/room) as beacon RX is
+not sent to the host immediately, and then the association time
+event ends without the host receiving any beacon even though it
+was on the air - it's just stuck on the FIFO.
+
+Cc: <stable@vger.kernel.org> [3.14]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+---
+ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 1 +
+ drivers/net/wireless/iwlwifi/mvm/sf.c       | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index c35b866..45e861e 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -971,6 +971,7 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
+ 		 */
+ 		iwl_mvm_remove_time_event(mvm, mvmvif,
+ 					  &mvmvif->time_event_data);
++		iwl_mvm_sf_update(mvm, vif, false);
+ 	} else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS |
+ 			      BSS_CHANGED_QOS)) {
+ 		ret = iwl_mvm_power_update_mode(mvm, vif);
+diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c b/drivers/net/wireless/iwlwifi/mvm/sf.c
+index 8401627..88809b2 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/sf.c
++++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
+@@ -274,7 +274,8 @@ int iwl_mvm_sf_update(struct iwl_mvm *mvm, struct ieee80211_vif *changed_vif,
+ 				return -EINVAL;
+ 			if (changed_vif->type != NL80211_IFTYPE_STATION) {
+ 				new_state = SF_UNINIT;
+-			} else if (changed_vif->bss_conf.assoc) {
++			} else if (changed_vif->bss_conf.assoc &&
++				   changed_vif->bss_conf.dtim_period) {
+ 				mvmvif = iwl_mvm_vif_from_mac80211(changed_vif);
+ 				sta_id = mvmvif->ap_sta_id;
+ 				new_state = SF_FULL_ON;
+-- 
+1.9.2
+
diff --git a/kernels/linux-libre-pae/PKGBUILD b/kernels/linux-libre-pae/PKGBUILD
index 4a6cf6215..ae3f2e5e9 100644
--- a/kernels/linux-libre-pae/PKGBUILD
+++ b/kernels/linux-libre-pae/PKGBUILD
@@ -1,4 +1,4 @@
-# $Id: PKGBUILD 210090 2014-04-09 19:24:57Z thomas $
+# $Id: PKGBUILD 210209 2014-04-11 21:45:37Z thomas $
 # Contributor: Tobias Powalowski <tpowa@archlinux.org>
 # Contributor: Thomas Baechler <thomas@archlinux.org>
 # Maintainer (Parabola): André Silva <emulatorman@parabola.nu>
@@ -8,7 +8,7 @@ pkgbase=linux-libre-pae     # Build stock -LIBRE-PAE kernel
 _basekernel=3.14
 #pkgver=${_basekernel}.8
 pkgver=${_basekernel}
-pkgrel=4
+pkgrel=5
 arch=('i686')
 url="http://linux-libre.fsfla.org/"
 license=('GPL2')
@@ -28,19 +28,25 @@ source=("http://linux-libre.fsfla.org/pub/linux-libre/releases/${_basekernel}-gn
         '0004-fs-Don-t-return-0-from-get_anon_bdev.patch'
         '0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch'
         '0006-genksyms-fix-typeof-handling.patch'
-        '0007-Fix-the-use-of-code32_start-in-the-EFI-boot-stub.patch')
+        '0007-x86-efi-Correct-EFI-boot-stub-use-of-code32_start.patch'
+        '0008-futex-avoid-race-between-requeue-and-wake.patch'
+        '0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch'
+        '0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch')
 sha256sums=('477555c709b9407fe37dbd70d3331ff9dde1f9d874aba2741f138d07ae6f281b'
             'd1aa49780d3d76291dfe04d79b5b0bd9246ce101dcb7a0f6818a96c28d9d0e8e'
             '292d5c553f87246c8dc2d57cadfd2db92a3750173b4588d53c2919743171eca5'
             '8303b426b1a6dce456b2350003558ae312d21cab0ae6c1f0d7b9d21395f4e177'
             'faced4eb4c47c4eb1a9ee8a5bf8a7c4b49d6b4d78efbe426e410730e6267d182'
-            'aa17aa9a5c663552ea047b9d2a9a916207bed361bd387418c122f6611ee576a6'
-            '48c459a2a14e8f161b79943e9ea405c4e98cd5abdab62749c4e9d65e5735382a'
-            'f15a6831736e4c0b8b355fd7887445e770500d439cb851623ea300cc50ba4d97'
-            '4b9aed8d0b7c2389d9413caa2152e6591200630c19dda8224d43eae7d863a0d6'
-            'e0666f75eabc2bbfa668cb35ee72dfbad48e5963828a444fbb50388048a8cd3c'
-            'd2c449d346ae52724d36c3224bd06fcae7775b0698a9096eb89eeaa6dbc092e5'
-            '5a175c698cfdbf942f712afeda2a6af3f4e63a742ec6b6dc3a64bc6a7fb685bb')
+            '6d72e14552df59e6310f16c176806c408355951724cd5b48a47bf01591b8be02'
+            '52dec83a8805a8642d74d764494acda863e0aa23e3d249e80d4b457e20a3fd29'
+            '65d58f63215ee3c5f9c4fc6bce36fc5311a6c7dbdbe1ad29de40647b47ff9c0d'
+            '1e1ae0f31f722e80da083ecada1f1be57f9ddad133941820c4483b0240e494c1'
+            '3fffb01cf97a5a7ab9601cb277d2468c0fb1e1cceba4225915f3ffae3a5694ec'
+            'cf2e7a2d00787f754028e7459688c2755a406e632ce48b60952fa4ff7ed6f4b7'
+            'a98bc3836bcf85774a974a1585e6b64432ba8c42363ee484d14515ccd6a88e24'
+            'f8699fcf4242c0727c3c0af56928515cef9b6ce329968537ce2894b30d43eade'
+            '1d4c7b24312ed3781e5d139dfb52f0c22350bf5a2845fe747469dfa7b6ed861f'
+            'c0af4622f75c89fef62183e18b7d49998228d4eaa906c6accaf4aa4ff0134f85')
 
 _kernelname=${pkgbase#linux-libre}
 _localversionname=-LIBRE-PAE
@@ -85,7 +91,19 @@ prepare() {
 
   # Fix the use of code32_start in the EFI boot stub
   # http://permalink.gmane.org/gmane.linux.kernel/1679881
-  patch -p1 -i "${srcdir}/0007-Fix-the-use-of-code32_start-in-the-EFI-boot-stub.patch"
+  # https://git.kernel.org/cgit/linux/kernel/git/mfleming/efi.git/commit/?h=urgent&id=7e8213c1f3acc064aef37813a39f13cbfe7c3ce7
+  patch -p1 -i "${srcdir}/0007-x86-efi-Correct-EFI-boot-stub-use-of-code32_start.patch"
+
+  # https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/tree/queue-3.14/futex-avoid-race-between-requeue-and-wake.patch
+  # FS#39806
+  patch -p1 -i "${srcdir}/0008-futex-avoid-race-between-requeue-and-wake.patch"
+
+  # Fix some intel wifi issues
+  # https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/tree/queue-3.14/iwlwifi-mvm-rs-fix-search-cycle-rules.patch
+  patch -p1 -i "${srcdir}/0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch"
+  # https://git.kernel.org/cgit/linux/kernel/git/iwlwifi/iwlwifi-fixes.git/commit/?id=12f853a89e29f50b17698e17e73c328a35f1498d
+  # FS#39815
+  patch -p1 -i "${srcdir}/0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch"
 
   cat "${srcdir}/config" > ./.config # simpler
 
diff --git a/kernels/linux-libre-xen/0001-Bluetooth-allocate-static-minor-for-vhci.patch b/kernels/linux-libre-xen/0001-Bluetooth-allocate-static-minor-for-vhci.patch
index f63e5e79d..557da37ce 100644
--- a/kernels/linux-libre-xen/0001-Bluetooth-allocate-static-minor-for-vhci.patch
+++ b/kernels/linux-libre-xen/0001-Bluetooth-allocate-static-minor-for-vhci.patch
@@ -1,7 +1,7 @@
 From 5d77ba2d26110c678b40fd723866a17d4036de12 Mon Sep 17 00:00:00 2001
 From: Lucas De Marchi <lucas.demarchi@intel.com>
 Date: Tue, 18 Feb 2014 02:19:26 -0300
-Subject: [PATCH 1/7] Bluetooth: allocate static minor for vhci
+Subject: [PATCH 01/10] Bluetooth: allocate static minor for vhci
 
 Commit bfacbb9 (Bluetooth: Use devname:vhci module alias for virtual HCI
 driver) added the module alias to hci_vhci module so it's possible to
@@ -70,5 +70,5 @@ index 3737f72..7bb6148 100644
  #define DMAPI_MINOR		140	/* DMAPI */
  #define NVRAM_MINOR		144
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-xen/0002-module-allow-multiple-calls-to-MODULE_DEVICE_TABLE-p.patch b/kernels/linux-libre-xen/0002-module-allow-multiple-calls-to-MODULE_DEVICE_TABLE-p.patch
index 188110a8c..7db851cb9 100644
--- a/kernels/linux-libre-xen/0002-module-allow-multiple-calls-to-MODULE_DEVICE_TABLE-p.patch
+++ b/kernels/linux-libre-xen/0002-module-allow-multiple-calls-to-MODULE_DEVICE_TABLE-p.patch
@@ -1,8 +1,8 @@
 From 9bc5b710f5957763d6944f38143b627d127c15ff Mon Sep 17 00:00:00 2001
 From: Tom Gundersen <teg@jklm.no>
 Date: Mon, 3 Feb 2014 11:14:13 +1030
-Subject: [PATCH 2/7] module: allow multiple calls to MODULE_DEVICE_TABLE() per
- module
+Subject: [PATCH 02/10] module: allow multiple calls to MODULE_DEVICE_TABLE()
+ per module
 
 Commit 78551277e4df5: "Input: i8042 - add PNP modaliases" had a bug, where the
 second call to MODULE_DEVICE_TABLE() overrode the first resulting in not all
@@ -89,5 +89,5 @@ index 25e5cb0..ce16404 100644
  	/* Handle all-NULL symbols allocated into .bss */
  	if (info->sechdrs[get_secindex(info, sym)].sh_type & SHT_NOBITS) {
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-xen/0003-module-remove-MODULE_GENERIC_TABLE.patch b/kernels/linux-libre-xen/0003-module-remove-MODULE_GENERIC_TABLE.patch
index 43947a1d3..d7a022ce8 100644
--- a/kernels/linux-libre-xen/0003-module-remove-MODULE_GENERIC_TABLE.patch
+++ b/kernels/linux-libre-xen/0003-module-remove-MODULE_GENERIC_TABLE.patch
@@ -1,7 +1,7 @@
 From 06d2e746733a83469944481cb7f4fb1c7134a8ce Mon Sep 17 00:00:00 2001
 From: Rusty Russell <rusty@rustcorp.com.au>
 Date: Mon, 3 Feb 2014 11:15:13 +1030
-Subject: [PATCH 3/7] module: remove MODULE_GENERIC_TABLE
+Subject: [PATCH 03/10] module: remove MODULE_GENERIC_TABLE
 
 MODULE_DEVICE_TABLE() calles MODULE_GENERIC_TABLE(); make it do the
 work directly.  This also removes a wart introduced in the last patch,
@@ -71,5 +71,5 @@ index ad18f60..5686b37 100644
  /* Version of form [<epoch>:]<version>[-<extra-version>].
   * Or for CVS/RCS ID version, everything but the number is stripped.
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-xen/0004-fs-Don-t-return-0-from-get_anon_bdev.patch b/kernels/linux-libre-xen/0004-fs-Don-t-return-0-from-get_anon_bdev.patch
index 4c11b31f2..5e4a27f06 100644
--- a/kernels/linux-libre-xen/0004-fs-Don-t-return-0-from-get_anon_bdev.patch
+++ b/kernels/linux-libre-xen/0004-fs-Don-t-return-0-from-get_anon_bdev.patch
@@ -1,7 +1,7 @@
 From 835a463e190af87a36df681863db7c3ea7ba0d66 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Thomas=20B=C3=A4chler?= <thomas@archlinux.org>
 Date: Thu, 3 Apr 2014 21:55:37 +0200
-Subject: [PATCH 4/7] fs: Don't return 0 from get_anon_bdev
+Subject: [PATCH 04/10] fs: Don't return 0 from get_anon_bdev
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -40,5 +40,5 @@ index 80d5cf2..7624267 100644
  int get_anon_bdev(dev_t *p)
  {
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-xen/0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch b/kernels/linux-libre-xen/0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch
index c31441731..74283b57c 100644
--- a/kernels/linux-libre-xen/0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch
+++ b/kernels/linux-libre-xen/0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch
@@ -1,8 +1,8 @@
 From 71d4f3022d1f625d94187f7cda682d2233a692d8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Thomas=20B=C3=A4chler?= <thomas@archlinux.org>
 Date: Thu, 3 Apr 2014 23:59:49 +0200
-Subject: [PATCH 5/7] Revert "Bluetooth: Enable autosuspend for Intel Bluetooth
- device"
+Subject: [PATCH 05/10] Revert "Bluetooth: Enable autosuspend for Intel
+ Bluetooth device"
 
 This reverts commit d2bee8fb6e18f6116aada39851918473761f7ab1.
 
@@ -29,5 +29,5 @@ index baeaaed..6d6e09e 100644
  	/* Interface numbers are hardcoded in the specification */
  	data->isoc = usb_ifnum_to_if(data->udev, 1);
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-xen/0006-genksyms-fix-typeof-handling.patch b/kernels/linux-libre-xen/0006-genksyms-fix-typeof-handling.patch
index 08b467a4c..fdd4b6d03 100644
--- a/kernels/linux-libre-xen/0006-genksyms-fix-typeof-handling.patch
+++ b/kernels/linux-libre-xen/0006-genksyms-fix-typeof-handling.patch
@@ -1,7 +1,7 @@
 From 39a7f4024e3e7d54a3bb49dcb645b3d7af16354e Mon Sep 17 00:00:00 2001
 From: Jan Beulich <JBeulich@suse.com>
 Date: Thu, 3 Apr 2014 14:46:37 -0700
-Subject: [PATCH 6/7] genksyms: fix typeof() handling
+Subject: [PATCH 06/10] genksyms: fix typeof() handling
 
 Recent increased use of typeof() throughout the tree resulted in a
 number of symbols (25 in a typical distro config of ours) not getting a
@@ -1356,5 +1356,5 @@ index 23c3999..b9f4cf2 100644
  	/* References to s/u/e's defined elsewhere.  Rearrange things
  	   so that it is easier to expand the definition fully later.  */
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-xen/0007-Fix-the-use-of-code32_start-in-the-EFI-boot-stub.patch b/kernels/linux-libre-xen/0007-x86-efi-Correct-EFI-boot-stub-use-of-code32_start.patch
index 8cf776842..898ee1543 100644
--- a/kernels/linux-libre-xen/0007-Fix-the-use-of-code32_start-in-the-EFI-boot-stub.patch
+++ b/kernels/linux-libre-xen/0007-x86-efi-Correct-EFI-boot-stub-use-of-code32_start.patch
@@ -1,8 +1,22 @@
-From ec8ec8362c46fd86571204d0fcce11c03477e5c5 Mon Sep 17 00:00:00 2001
+From 720a9dbf61c88bd57d6f8198ed8ccb2bd4a6abd8 Mon Sep 17 00:00:00 2001
 From: Matt Fleming <matt@console-pimps.org>
 Date: Wed, 9 Apr 2014 10:33:49 +0200
-Subject: [PATCH 7/7] Fix the use of code32_start in the EFI boot stub
+Subject: [PATCH 07/10] x86/efi: Correct EFI boot stub use of code32_start
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
 
+code32_start should point at the start of the protected mode code, and
+*not* at the beginning of the bzImage. This is much easier to do in
+assembly so document that callers of make_boot_params() need to fill out
+code32_start.
+
+The fallout from this bug is that we would end up relocating the image
+but copying the image at some offset, resulting in what appeared to be
+memory corruption.
+
+Reported-by: Thomas Bächler <thomas@archlinux.org>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
 ---
  arch/x86/boot/compressed/eboot.c   |  5 +++--
  arch/x86/boot/compressed/head_32.S | 14 ++++++++------
@@ -92,5 +106,5 @@ index c5c1ae0..b10fa66 100644
  	jmp	*%rax
  
 -- 
-1.9.1
+1.9.2
 
diff --git a/kernels/linux-libre-xen/0008-futex-avoid-race-between-requeue-and-wake.patch b/kernels/linux-libre-xen/0008-futex-avoid-race-between-requeue-and-wake.patch
new file mode 100644
index 000000000..8685e1168
--- /dev/null
+++ b/kernels/linux-libre-xen/0008-futex-avoid-race-between-requeue-and-wake.patch
@@ -0,0 +1,94 @@
+From aafcd8f8692fb9e389608c1efad2e57c0bbb9362 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Tue, 8 Apr 2014 15:30:07 -0700
+Subject: [PATCH 08/10] futex: avoid race between requeue and wake
+
+commit 69cd9eba38867a493a043bb13eb9b33cad5f1a9a upstream.
+
+Jan Stancek reported:
+ "pthread_cond_broadcast/4-1.c testcase from openposix testsuite (LTP)
+  occasionally fails, because some threads fail to wake up.
+
+  Testcase creates 5 threads, which are all waiting on same condition.
+  Main thread then calls pthread_cond_broadcast() without holding mutex,
+  which calls:
+
+      futex(uaddr1, FUTEX_CMP_REQUEUE_PRIVATE, 1, 2147483647, uaddr2, ..)
+
+  This immediately wakes up single thread A, which unlocks mutex and
+  tries to wake up another thread:
+
+      futex(uaddr2, FUTEX_WAKE_PRIVATE, 1)
+
+  If thread A manages to call futex_wake() before any waiters are
+  requeued for uaddr2, no other thread is woken up"
+
+The ordering constraints for the hash bucket waiter counting are that
+the waiter counts have to be incremented _before_ getting the spinlock
+(because the spinlock acts as part of the memory barrier), but the
+"requeue" operation didn't honor those rules, and nobody had even
+thought about that case.
+
+This fairly simple patch just increments the waiter count for the target
+hash bucket (hb2) when requeing a futex before taking the locks.  It
+then decrements them again after releasing the lock - the code that
+actually moves the futex(es) between hash buckets will do the additional
+required waiter count housekeeping.
+
+Reported-and-tested-by: Jan Stancek <jstancek@redhat.com>
+Acked-by: Davidlohr Bueso <davidlohr@hp.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/futex.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 08ec814..16b1f2c 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1450,6 +1450,7 @@ retry:
+ 	hb2 = hash_futex(&key2);
+ 
+ retry_private:
++	hb_waiters_inc(hb2);
+ 	double_lock_hb(hb1, hb2);
+ 
+ 	if (likely(cmpval != NULL)) {
+@@ -1459,6 +1460,7 @@ retry_private:
+ 
+ 		if (unlikely(ret)) {
+ 			double_unlock_hb(hb1, hb2);
++			hb_waiters_dec(hb2);
+ 
+ 			ret = get_user(curval, uaddr1);
+ 			if (ret)
+@@ -1508,6 +1510,7 @@ retry_private:
+ 			break;
+ 		case -EFAULT:
+ 			double_unlock_hb(hb1, hb2);
++			hb_waiters_dec(hb2);
+ 			put_futex_key(&key2);
+ 			put_futex_key(&key1);
+ 			ret = fault_in_user_writeable(uaddr2);
+@@ -1517,6 +1520,7 @@ retry_private:
+ 		case -EAGAIN:
+ 			/* The owner was exiting, try again. */
+ 			double_unlock_hb(hb1, hb2);
++			hb_waiters_dec(hb2);
+ 			put_futex_key(&key2);
+ 			put_futex_key(&key1);
+ 			cond_resched();
+@@ -1592,6 +1596,7 @@ retry_private:
+ 
+ out_unlock:
+ 	double_unlock_hb(hb1, hb2);
++	hb_waiters_dec(hb2);
+ 
+ 	/*
+ 	 * drop_futex_key_refs() must be called outside the spinlocks. During
+-- 
+1.9.2
+
diff --git a/kernels/linux-libre-xen/0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch b/kernels/linux-libre-xen/0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch
new file mode 100644
index 000000000..5acbf53dd
--- /dev/null
+++ b/kernels/linux-libre-xen/0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch
@@ -0,0 +1,125 @@
+From 06af061dd673d749d5516bea41e2becb034e00b8 Mon Sep 17 00:00:00 2001
+From: Eyal Shapira <eyal@wizery.com>
+Date: Sun, 16 Mar 2014 05:23:21 +0200
+Subject: [PATCH 09/10] iwlwifi: mvm: rs: fix search cycle rules
+
+commit 8930b05090acd321b1fc7c642528c697cb105c42 upstream.
+
+We should explore all possible columns when searching to be
+as resilient as possible to changing conditions. This fixes
+for example a scenario where even after a sudden creation of
+rssi difference between the 2 antennas we would keep doing MIMO
+at a low rate instead of switching to SISO at a higher rate using
+the better antenna which was the optimal configuration.
+
+Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/iwlwifi/mvm/rs.c | 36 +++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
+index 6abf74e..5bc8715 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -211,9 +211,9 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 		.next_columns = {
+ 			RS_COLUMN_LEGACY_ANT_B,
+ 			RS_COLUMN_SISO_ANT_A,
++			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_MIMO2_SGI,
+ 		},
+ 	},
+ 	[RS_COLUMN_LEGACY_ANT_B] = {
+@@ -221,10 +221,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 		.ant = ANT_B,
+ 		.next_columns = {
+ 			RS_COLUMN_LEGACY_ANT_A,
++			RS_COLUMN_SISO_ANT_A,
+ 			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_MIMO2_SGI,
+ 		},
+ 	},
+ 	[RS_COLUMN_SISO_ANT_A] = {
+@@ -234,8 +234,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
+ 			RS_COLUMN_SISO_ANT_A_SGI,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_SISO_ANT_B_SGI,
++			RS_COLUMN_MIMO2_SGI,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -248,8 +248,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_A,
+ 			RS_COLUMN_MIMO2,
+ 			RS_COLUMN_SISO_ANT_B_SGI,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_SISO_ANT_A_SGI,
++			RS_COLUMN_MIMO2_SGI,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -263,8 +263,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_B_SGI,
+ 			RS_COLUMN_MIMO2_SGI,
+ 			RS_COLUMN_SISO_ANT_A,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_SISO_ANT_B,
++			RS_COLUMN_MIMO2,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -279,8 +279,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 			RS_COLUMN_SISO_ANT_A_SGI,
+ 			RS_COLUMN_MIMO2_SGI,
+ 			RS_COLUMN_SISO_ANT_B,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
++			RS_COLUMN_SISO_ANT_A,
++			RS_COLUMN_MIMO2,
+ 		},
+ 		.checks = {
+ 			rs_siso_allow,
+@@ -292,10 +292,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 		.ant = ANT_AB,
+ 		.next_columns = {
+ 			RS_COLUMN_SISO_ANT_A,
++			RS_COLUMN_SISO_ANT_B,
++			RS_COLUMN_SISO_ANT_A_SGI,
++			RS_COLUMN_SISO_ANT_B_SGI,
+ 			RS_COLUMN_MIMO2_SGI,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
+ 		},
+ 		.checks = {
+ 			rs_mimo_allow,
+@@ -307,10 +307,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
+ 		.sgi = true,
+ 		.next_columns = {
+ 			RS_COLUMN_SISO_ANT_A_SGI,
++			RS_COLUMN_SISO_ANT_B_SGI,
++			RS_COLUMN_SISO_ANT_A,
++			RS_COLUMN_SISO_ANT_B,
+ 			RS_COLUMN_MIMO2,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
+-			RS_COLUMN_INVALID,
+ 		},
+ 		.checks = {
+ 			rs_mimo_allow,
+-- 
+1.9.2
+
diff --git a/kernels/linux-libre-xen/0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch b/kernels/linux-libre-xen/0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch
new file mode 100644
index 000000000..7f18091a4
--- /dev/null
+++ b/kernels/linux-libre-xen/0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch
@@ -0,0 +1,52 @@
+From 784c4f0b18f89922ddc0fe21e5ec64cc370bb3f2 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 19 Mar 2014 18:36:39 +0100
+Subject: [PATCH 10/10] iwlwifi: mvm: delay enabling smart FIFO until after
+ beacon RX
+
+If we have no beacon data before association, delay smart FIFO
+enablement until after we have this data.
+
+Not doing so can cause association failures in extremely silent
+environments (usually only a shielded box/room) as beacon RX is
+not sent to the host immediately, and then the association time
+event ends without the host receiving any beacon even though it
+was on the air - it's just stuck on the FIFO.
+
+Cc: <stable@vger.kernel.org> [3.14]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+---
+ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 1 +
+ drivers/net/wireless/iwlwifi/mvm/sf.c       | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index c35b866..45e861e 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -971,6 +971,7 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
+ 		 */
+ 		iwl_mvm_remove_time_event(mvm, mvmvif,
+ 					  &mvmvif->time_event_data);
++		iwl_mvm_sf_update(mvm, vif, false);
+ 	} else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS |
+ 			      BSS_CHANGED_QOS)) {
+ 		ret = iwl_mvm_power_update_mode(mvm, vif);
+diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c b/drivers/net/wireless/iwlwifi/mvm/sf.c
+index 8401627..88809b2 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/sf.c
++++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
+@@ -274,7 +274,8 @@ int iwl_mvm_sf_update(struct iwl_mvm *mvm, struct ieee80211_vif *changed_vif,
+ 				return -EINVAL;
+ 			if (changed_vif->type != NL80211_IFTYPE_STATION) {
+ 				new_state = SF_UNINIT;
+-			} else if (changed_vif->bss_conf.assoc) {
++			} else if (changed_vif->bss_conf.assoc &&
++				   changed_vif->bss_conf.dtim_period) {
+ 				mvmvif = iwl_mvm_vif_from_mac80211(changed_vif);
+ 				sta_id = mvmvif->ap_sta_id;
+ 				new_state = SF_FULL_ON;
+-- 
+1.9.2
+
diff --git a/kernels/linux-libre-xen/PKGBUILD b/kernels/linux-libre-xen/PKGBUILD
index ffcaba679..b5bd2e74f 100644
--- a/kernels/linux-libre-xen/PKGBUILD
+++ b/kernels/linux-libre-xen/PKGBUILD
@@ -1,4 +1,4 @@
-# $Id: PKGBUILD 210090 2014-04-09 19:24:57Z thomas $
+# $Id: PKGBUILD 210209 2014-04-11 21:45:37Z thomas $
 # Contributor: Tobias Powalowski <tpowa@archlinux.org>
 # Contributor: Thomas Baechler <thomas@archlinux.org>
 # Maintainer (Parabola): André Silva <emulatorman@parabola.nu>
@@ -8,7 +8,7 @@ pkgbase=linux-libre-xen     # Build stock -LIBRE-XEN kernel
 _basekernel=3.14
 #pkgver=${_basekernel}.8
 pkgver=${_basekernel}
-pkgrel=4
+pkgrel=5
 arch=('i686')
 url="http://linux-libre.fsfla.org/"
 license=('GPL2')
@@ -28,19 +28,25 @@ source=("http://linux-libre.fsfla.org/pub/linux-libre/releases/${_basekernel}-gn
         '0004-fs-Don-t-return-0-from-get_anon_bdev.patch'
         '0005-Revert-Bluetooth-Enable-autosuspend-for-Intel-Blueto.patch'
         '0006-genksyms-fix-typeof-handling.patch'
-        '0007-Fix-the-use-of-code32_start-in-the-EFI-boot-stub.patch')
+        '0007-x86-efi-Correct-EFI-boot-stub-use-of-code32_start.patch'
+        '0008-futex-avoid-race-between-requeue-and-wake.patch'
+        '0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch'
+        '0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch')
 sha256sums=('477555c709b9407fe37dbd70d3331ff9dde1f9d874aba2741f138d07ae6f281b'
             '2bd49bb28000063f6886816ae521b224e4c254c9523cdd70d041d913611fafbe'
             '7a475ada892857397cf80d2de777825ae94758dc2d9dfa3754ae3d670f4a2f02'
             '8303b426b1a6dce456b2350003558ae312d21cab0ae6c1f0d7b9d21395f4e177'
             'faced4eb4c47c4eb1a9ee8a5bf8a7c4b49d6b4d78efbe426e410730e6267d182'
-            'aa17aa9a5c663552ea047b9d2a9a916207bed361bd387418c122f6611ee576a6'
-            '48c459a2a14e8f161b79943e9ea405c4e98cd5abdab62749c4e9d65e5735382a'
-            'f15a6831736e4c0b8b355fd7887445e770500d439cb851623ea300cc50ba4d97'
-            '4b9aed8d0b7c2389d9413caa2152e6591200630c19dda8224d43eae7d863a0d6'
-            'e0666f75eabc2bbfa668cb35ee72dfbad48e5963828a444fbb50388048a8cd3c'
-            'd2c449d346ae52724d36c3224bd06fcae7775b0698a9096eb89eeaa6dbc092e5'
-            '5a175c698cfdbf942f712afeda2a6af3f4e63a742ec6b6dc3a64bc6a7fb685bb')
+            '6d72e14552df59e6310f16c176806c408355951724cd5b48a47bf01591b8be02'
+            '52dec83a8805a8642d74d764494acda863e0aa23e3d249e80d4b457e20a3fd29'
+            '65d58f63215ee3c5f9c4fc6bce36fc5311a6c7dbdbe1ad29de40647b47ff9c0d'
+            '1e1ae0f31f722e80da083ecada1f1be57f9ddad133941820c4483b0240e494c1'
+            '3fffb01cf97a5a7ab9601cb277d2468c0fb1e1cceba4225915f3ffae3a5694ec'
+            'cf2e7a2d00787f754028e7459688c2755a406e632ce48b60952fa4ff7ed6f4b7'
+            'a98bc3836bcf85774a974a1585e6b64432ba8c42363ee484d14515ccd6a88e24'
+            'f8699fcf4242c0727c3c0af56928515cef9b6ce329968537ce2894b30d43eade'
+            '1d4c7b24312ed3781e5d139dfb52f0c22350bf5a2845fe747469dfa7b6ed861f'
+            'c0af4622f75c89fef62183e18b7d49998228d4eaa906c6accaf4aa4ff0134f85')
 
 _kernelname=${pkgbase#linux-libre}
 _localversionname=-LIBRE-XEN
@@ -85,7 +91,19 @@ prepare() {
 
   # Fix the use of code32_start in the EFI boot stub
   # http://permalink.gmane.org/gmane.linux.kernel/1679881
-  patch -p1 -i "${srcdir}/0007-Fix-the-use-of-code32_start-in-the-EFI-boot-stub.patch"
+  # https://git.kernel.org/cgit/linux/kernel/git/mfleming/efi.git/commit/?h=urgent&id=7e8213c1f3acc064aef37813a39f13cbfe7c3ce7
+  patch -p1 -i "${srcdir}/0007-x86-efi-Correct-EFI-boot-stub-use-of-code32_start.patch"
+
+  # https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/tree/queue-3.14/futex-avoid-race-between-requeue-and-wake.patch
+  # FS#39806
+  patch -p1 -i "${srcdir}/0008-futex-avoid-race-between-requeue-and-wake.patch"
+
+  # Fix some intel wifi issues
+  # https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/tree/queue-3.14/iwlwifi-mvm-rs-fix-search-cycle-rules.patch
+  patch -p1 -i "${srcdir}/0009-iwlwifi-mvm-rs-fix-search-cycle-rules.patch"
+  # https://git.kernel.org/cgit/linux/kernel/git/iwlwifi/iwlwifi-fixes.git/commit/?id=12f853a89e29f50b17698e17e73c328a35f1498d
+  # FS#39815
+  patch -p1 -i "${srcdir}/0010-iwlwifi-mvm-delay-enabling-smart-FIFO-until-after-be.patch"
 
   cat "${srcdir}/config" > ./.config # simpler