Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 352063c8 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 



John W. Linville says:

====================
Regarding the mac80211 bits, Johannes says:

"This time, I have a fix from Arik for scheduled scan recovery (something
that only recently went into the tree), a memory leak fix from Eytan and
a small regulatory bugfix from Inbal. The EAPOL change from Felix makes
rekeying more stable while lots of traffic is flowing, and there's
Emmanuel's and my fixes for a race in the code handling powersaving
clients."

Regarding the NFC bits, Samuel says:

"We only have one candidate for 3.14 fixes, and this is a NCI NULL
pointer dereference introduced during the 3.14 merge window."

Regarding the iwlwifi bits, Emmanuel says:

"This should fix an issue raised in iwldvm when we have lots of
association failures.  There is a bugzilla for this bug - it hasn't
been validated by the user, but I hope it will do the trick."

Beyond that...

Amitkumar Karwar brings two mwifiex fixes, one to avoid a NULL pointer
dereference and another to address an improperly timed interrupt.

Arend van Spriel gives us a brcmfmac fix to avoid a crash during
scatter-gather packet transfers.

Avinash Patila offers an mwifiex to avoid an invalid memory access
when a device is removed.

Bing Zhao delivers a simple fix to avoid a naming conflict between
libertas and mwifiex.

Felix Fietkau provides a trio of ath9k fixes that properly account
for sequence numbering in ps-poll frames, reduce the rate for false
positives during baseband hang detection, and fix a regression related
to rx descriptor handling.

James Cameron shows us a libertas fix to ignore zero-length IEs when
processing scan results.

Kirill Tkhai brings a hostap fix to avoid prematurely freeing a timer.

Stanislaw Gruszka fixes an ath9k locking problem.

Sujith Manoharan addresses ETSI compliance for a device handled by
ath9k by adjusting the minimum CCA power threshold values.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents babe723d 8e2a89c5

drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h

+2 −2
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = { 
	{0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},

	{0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},

	{0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},

	{0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},

	{0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},

	{0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},

	{0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},

	{0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
@@ -96,7 +96,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = { 
	{0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},

	{0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},

	{0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},

	{0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},

	{0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},

	{0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},

};

drivers/net/wireless/ath/ath9k/hw.c

+7 −1
Original line number Diff line number Diff line
@@ -1534,7 +1534,7 @@ EXPORT_SYMBOL(ath9k_hw_check_nav); 
bool ath9k_hw_check_alive(struct ath_hw *ah)

{

	int count = 50;

	u32 reg;

	u32 reg, last_val;



	if (AR_SREV_9300(ah))

		return !ath9k_hw_detect_mac_hang(ah);
@@ -1542,9 +1542,13 @@ bool ath9k_hw_check_alive(struct ath_hw *ah) 
	if (AR_SREV_9285_12_OR_LATER(ah))

		return true;



	last_val = REG_READ(ah, AR_OBS_BUS_1);

	do {

		reg = REG_READ(ah, AR_OBS_BUS_1);

		if (reg != last_val)

			return true;



		last_val = reg;

		if ((reg & 0x7E7FFFEF) == 0x00702400)

			continue;
@@ -1556,6 +1560,8 @@ bool ath9k_hw_check_alive(struct ath_hw *ah) 
		default:

			return true;

		}



		udelay(1);

	} while (count-- > 0);



	return false;

drivers/net/wireless/ath/ath9k/recv.c

+35 −35
Original line number Diff line number Diff line
@@ -731,6 +731,12 @@ static struct ath_rxbuf *ath_get_next_rx_buf(struct ath_softc *sc, 
		if (ret == -EINPROGRESS)

			return NULL;



		/*

		 * Re-check previous descriptor, in case it has been filled

		 * in the mean time.

		 */

		ret = ath9k_hw_rxprocdesc(ah, ds, rs);

		if (ret == -EINPROGRESS) {

			/*

			 * mark descriptor as zero-length and set the 'more'

			 * flag to ensure that both buffers get discarded
@@ -738,6 +744,7 @@ static struct ath_rxbuf *ath_get_next_rx_buf(struct ath_softc *sc, 
			rs->rs_datalen = 0;

			rs->rs_more = true;

		}

	}



	list_del(&bf->list);

	if (!bf->bf_mpdu)
@@ -985,22 +992,22 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc, 
	struct ath_common *common = ath9k_hw_common(ah);

	struct ieee80211_hdr *hdr;

	bool discard_current = sc->rx.discard_next;

	int ret = 0;



	/*

	 * Discard corrupt descriptors which are marked in

	 * ath_get_next_rx_buf().

	 */

	sc->rx.discard_next = rx_stats->rs_more;

	if (discard_current)

		return -EINVAL;

		goto corrupt;



	sc->rx.discard_next = false;



	/*

	 * Discard zero-length packets.

	 */

	if (!rx_stats->rs_datalen) {

		RX_STAT_INC(rx_len_err);

		return -EINVAL;

		goto corrupt;

	}



	/*
@@ -1010,7 +1017,7 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc, 
	 */

	if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {

		RX_STAT_INC(rx_len_err);

		return -EINVAL;

		goto corrupt;

	}



	/* Only use status info from the last fragment */
@@ -1024,10 +1031,8 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc, 
	 * This is different from the other corrupt descriptor

	 * condition handled above.

	 */

	if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC) {

		ret = -EINVAL;

		goto exit;

	}

	if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC)

		goto corrupt;



	hdr = (struct ieee80211_hdr *) (skb->data + ah->caps.rx_status_len);
@@ -1043,18 +1048,15 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc, 
		if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))

			RX_STAT_INC(rx_spectral);



		ret = -EINVAL;

		goto exit;

		return -EINVAL;

	}



	/*

	 * everything but the rate is checked here, the rate check is done

	 * separately to avoid doing two lookups for a rate for each frame.

	 */

	if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error)) {

		ret = -EINVAL;

		goto exit;

	}

	if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))

		return -EINVAL;



	if (ath_is_mybeacon(common, hdr)) {

		RX_STAT_INC(rx_beacons);
@@ -1064,15 +1066,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc, 
	/*

	 * This shouldn't happen, but have a safety check anyway.

	 */

	if (WARN_ON(!ah->curchan)) {

		ret = -EINVAL;

		goto exit;

	}

	if (WARN_ON(!ah->curchan))

		return -EINVAL;



	if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {

		ret =-EINVAL;

		goto exit;

	}

	if (ath9k_process_rate(common, hw, rx_stats, rx_status))

		return -EINVAL;



	ath9k_process_rssi(common, hw, rx_stats, rx_status);
@@ -1087,9 +1085,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc, 
		sc->rx.num_pkts++;

#endif



exit:

	sc->rx.discard_next = false;

	return ret;

	return 0;



corrupt:

	sc->rx.discard_next = rx_stats->rs_more;

	return -EINVAL;

}



static void ath9k_rx_skb_postprocess(struct ath_common *common,

drivers/net/wireless/ath/ath9k/xmit.c

+8 −5
Original line number Diff line number Diff line
@@ -1444,14 +1444,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc, 
	for (tidno = 0, tid = &an->tid[tidno];

	     tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {



		if (!tid->sched)

			continue;



		ac = tid->ac;

		txq = ac->txq;



		ath_txq_lock(sc, txq);



		if (!tid->sched) {

			ath_txq_unlock(sc, txq);

			continue;

		}



		buffered = ath_tid_has_buffered(tid);



		tid->sched = false;
@@ -2184,14 +2186,15 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb, 
		txq->stopped = true;

	}



	if (txctl->an)

		tid = ath_get_skb_tid(sc, txctl->an, skb);



	if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {

		ath_txq_unlock(sc, txq);

		txq = sc->tx.uapsdq;

		ath_txq_lock(sc, txq);

	} else if (txctl->an &&

		   ieee80211_is_data_present(hdr->frame_control)) {

		tid = ath_get_skb_tid(sc, txctl->an, skb);



		WARN_ON(tid->ac->txq != txctl->txq);



		if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)

drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c

+4 −10
Original line number Diff line number Diff line
@@ -457,7 +457,6 @@ struct brcmf_sdio { 


	u8 tx_hdrlen;		/* sdio bus header length for tx packet */

	bool txglom;		/* host tx glomming enable flag */

	struct sk_buff *txglom_sgpad;	/* scatter-gather padding buffer */

	u16 head_align;		/* buffer pointer alignment */

	u16 sgentry_align;	/* scatter-gather buffer alignment */

};
@@ -1944,9 +1943,8 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus, 
	if (lastfrm && chain_pad)

		tail_pad += blksize - chain_pad;

	if (skb_tailroom(pkt) < tail_pad && pkt->len > blksize) {

		pkt_pad = bus->txglom_sgpad;

		if (pkt_pad == NULL)

			  brcmu_pkt_buf_get_skb(tail_pad + tail_chop);

		pkt_pad = brcmu_pkt_buf_get_skb(tail_pad + tail_chop +

						bus->head_align);

		if (pkt_pad == NULL)

			return -ENOMEM;

		ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
@@ -1957,6 +1955,7 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus, 
		       tail_chop);

		*(u32 *)(pkt_pad->cb) = ALIGN_SKB_FLAG + tail_chop;

		skb_trim(pkt, pkt->len - tail_chop);

		skb_trim(pkt_pad, tail_pad + tail_chop);

		__skb_queue_after(pktq, pkt, pkt_pad);

	} else {

		ntail = pkt->data_len + tail_pad -
@@ -2011,7 +2010,7 @@ brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq, 
			return ret;

		head_pad = (u16)ret;

		if (head_pad)

			memset(pkt_next->data, 0, head_pad + bus->tx_hdrlen);

			memset(pkt_next->data + bus->tx_hdrlen, 0, head_pad);



		total_len += pkt_next->len;
@@ -3486,10 +3485,6 @@ static int brcmf_sdio_bus_preinit(struct device *dev) 
		bus->txglom = false;

		value = 1;

		pad_size = bus->sdiodev->func[2]->cur_blksize << 1;

		bus->txglom_sgpad = brcmu_pkt_buf_get_skb(pad_size);

		if (!bus->txglom_sgpad)

			brcmf_err("allocating txglom padding skb failed, reduced performance\n");



		err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",

					   &value, sizeof(u32));

		if (err < 0) {
@@ -4053,7 +4048,6 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus) 
			brcmf_sdio_chip_detach(&bus->ci);

		}



		brcmu_pkt_buf_free_skb(bus->txglom_sgpad);

		kfree(bus->rxbuf);

		kfree(bus->hdrbuf);

		kfree(bus);