--- /dev/null
+From 998d516d9546eba04dd99ae49a78acb0cf770478 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+Date: Wed, 8 Dec 2010 20:01:05 +0530
+Subject: ath: Missed to clear key4 of micentry
+
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+
+commit 998d516d9546eba04dd99ae49a78acb0cf770478 upstream.
+
+key4 of micentry is used, if ATH_CRYPT_CAP_MIC_COMBINED is set.
+But is not cleared on key cache reset.
+
+Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/key.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/key.c
++++ b/drivers/net/wireless/ath/key.c
+@@ -60,6 +60,8 @@ bool ath_hw_keyreset(struct ath_common *
+ REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
+ REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), 0);
+ REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
++ if (common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)
++ REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), 0);
+
+ }
+
--- /dev/null
+From afe68d0a8f5961652e26cea39d74e2cc820de841 Mon Sep 17 00:00:00 2001
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+Date: Mon, 20 Dec 2010 11:29:59 -0500
+Subject: ath9k: fix aphy / wiphy idle mismatch
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit afe68d0a8f5961652e26cea39d74e2cc820de841 upstream.
+
+ath9k supports its own set of virtual wiphys, and it uses
+the mac80211 idle notifications to know when a device needs
+to be idle or not. We recently changed ath9k to force idle
+on driver stop() and on resume but forgot to take into account
+ath9k's own virtual wiphy idle states. These are used internally
+by ath9k to check if the device's radio should be powered down
+on each idle call. Without this change its possible that the
+device could have been forced off but the virtual wiphy idle
+was left on.
+
+Cc: Paul Stewart <pstew@google.com>
+Cc: Amod Bodas <amod.bodas@atheros.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/main.c | 1 +
+ drivers/net/wireless/ath/ath9k/pci.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1419,6 +1419,7 @@ static void ath9k_stop(struct ieee80211_
+ ath9k_ps_restore(sc);
+
+ sc->ps_idle = true;
++ ath9k_set_wiphy_idle(aphy, true);
+ ath_radio_disable(sc, hw);
+
+ sc->sc_flags |= SC_OP_INVALID;
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -291,6 +291,7 @@ static int ath_pci_resume(struct pci_dev
+ ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
+
+ sc->ps_idle = true;
++ ath9k_set_wiphy_idle(aphy, true);
+ ath_radio_disable(sc, hw);
+
+ return 0;
--- /dev/null
+From a08e7ade9ddf4fe79576f953cc5c1725e944d26c Mon Sep 17 00:00:00 2001
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+Date: Tue, 7 Dec 2010 15:13:20 -0800
+Subject: ath9k: fix assumptions for idle calls on suspend/resume
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit a08e7ade9ddf4fe79576f953cc5c1725e944d26c upstream.
+
+mac80211 will notify drivers when to go idle and ath9k
+assumed that it would get further notifications for idle
+states after a device stop() config call but as per agreed
+semantics the idle state of the radio is left up to driver
+after mac80211 issues the stop() callback. The driver is
+resposnbile for ensuring the device remains idle after
+that even between suspend / resume calls.
+
+This fixes suspend/resume when you issue suspend and resume
+twice on ath9k when ath9k_stop() was already called. We need
+to put the radio to full sleep in order for resume to work
+correctly.
+
+What might seem fishy is we are turning the radio off
+after resume. The reason why we do this is because we know
+we should not have anything enabled after a mac80211 tells
+us to stop(), if we resume and never get a start() we won't
+get another stop() by mac80211 so to be safe always bring
+the 802.11 device with the radio disabled after resume,
+this ensures that if we suspend we already have the radio
+disabled and only a start() will ever trigger it on.
+
+Cc: Paul Stewart <pstew@google.com>
+Cc: Amod Bodas <amod.bodas@atheros.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/main.c | 4 ++--
+ drivers/net/wireless/ath/ath9k/pci.c | 3 +++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1418,8 +1418,8 @@ static void ath9k_stop(struct ieee80211_
+ ath9k_hw_configpcipowersave(ah, 1, 1);
+ ath9k_ps_restore(sc);
+
+- /* Finally, put the chip in FULL SLEEP mode */
+- ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
++ sc->ps_idle = true;
++ ath_radio_disable(sc, hw);
+
+ sc->sc_flags |= SC_OP_INVALID;
+
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -290,6 +290,9 @@ static int ath_pci_resume(struct pci_dev
+ AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+ ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
+
++ sc->ps_idle = true;
++ ath_radio_disable(sc, hw);
++
+ return 0;
+ }
+
--- /dev/null
+From 1186488b4a4d4871e40cb1604ba3ede3d4b7cc90 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+Date: Thu, 30 Dec 2010 19:07:44 +0530
+Subject: ath9k: fix beacon restart on channel change
+
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+
+commit 1186488b4a4d4871e40cb1604ba3ede3d4b7cc90 upstream.
+
+Restart the beacon timers only if the beacon
+was already configured. Otherwise beacons timers
+are restarted unnecessarily in unassociated state too.
+
+Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -295,7 +295,8 @@ int ath_set_channel(struct ath_softc *sc
+ ath9k_hw_set_interrupts(ah, ah->imask);
+
+ if (!(sc->sc_flags & (SC_OP_OFFCHANNEL))) {
+- ath_beacon_config(sc, NULL);
++ if (sc->sc_flags & SC_OP_BEACONS)
++ ath_beacon_config(sc, NULL);
+ ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+ ath_start_ani(common);
+ }
--- /dev/null
+From 39ec2997c374b528cdbf65099b6d6b8593a67f7f Mon Sep 17 00:00:00 2001
+From: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Date: Wed, 10 Nov 2010 05:03:15 -0800
+Subject: ath9k: Fix bug in delimiter padding computation
+
+From: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+
+commit 39ec2997c374b528cdbf65099b6d6b8593a67f7f upstream.
+
+There is a roundng error in delimiter padding computation
+which causes severe throughput drop with some of AR9003.
+
+signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ath9k.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -178,8 +178,8 @@ void ath_descdma_cleanup(struct ath_soft
+
+ /* returns delimiter padding required given the packet length */
+ #define ATH_AGGR_GET_NDELIM(_len) \
+- (((((_len) + ATH_AGGR_DELIM_SZ) < ATH_AGGR_MINPLEN) ? \
+- (ATH_AGGR_MINPLEN - (_len) - ATH_AGGR_DELIM_SZ) : 0) >> 2)
++ (((_len) >= ATH_AGGR_MINPLEN) ? 0 : \
++ DIV_ROUND_UP(ATH_AGGR_MINPLEN - (_len), ATH_AGGR_DELIM_SZ))
+
+ #define BAW_WITHIN(_start, _bawsz, _seqno) \
+ ((((_seqno) - (_start)) & 4095) < (_bawsz))
--- /dev/null
+From 203043f579ece44bb30291442cd56332651dd37d Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 25 Jan 2011 14:08:40 +0100
+Subject: ath9k: fix race conditions when stop device
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 203043f579ece44bb30291442cd56332651dd37d upstream.
+
+We do not kill any scheduled tasklets when stopping device, that may
+cause usage of resources after free. Moreover we enable interrupts
+in tasklet function, so we could potentially end with interrupts
+enabled when driver is not ready to receive them.
+
+I think patch should fix Ben's kernel crash from:
+http://marc.info/?l=linux-wireless&m=129438358921501&w=2
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/init.c | 5 -----
+ drivers/net/wireless/ath/ath9k/main.c | 9 +++++++++
+ 2 files changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -633,8 +633,6 @@ err_queues:
+ err_debug:
+ ath9k_hw_deinit(ah);
+ err_hw:
+- tasklet_kill(&sc->intr_tq);
+- tasklet_kill(&sc->bcon_tasklet);
+
+ kfree(ah);
+ sc->sc_ah = NULL;
+@@ -802,9 +800,6 @@ static void ath9k_deinit_softc(struct at
+ ath9k_exit_debug(sc->sc_ah);
+ ath9k_hw_deinit(sc->sc_ah);
+
+- tasklet_kill(&sc->intr_tq);
+- tasklet_kill(&sc->bcon_tasklet);
+-
+ kfree(sc->sc_ah);
+ sc->sc_ah = NULL;
+ }
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1401,6 +1401,9 @@ static void ath9k_stop(struct ieee80211_
+ ath9k_btcoex_timer_pause(sc);
+ }
+
++ /* prevent tasklets to enable interrupts once we disable them */
++ ah->imask &= ~ATH9K_INT_GLOBAL;
++
+ /* make sure h/w will not generate any interrupt
+ * before setting the invalid flag. */
+ ath9k_hw_set_interrupts(ah, 0);
+@@ -1901,6 +1904,12 @@ static int ath9k_set_key(struct ieee8021
+ ret = -EINVAL;
+ }
+
++ /* we can now sync irq and kill any running tasklets, since we already
++ * disabled interrupts and not holding a spin lock */
++ synchronize_irq(sc->irq);
++ tasklet_kill(&sc->intr_tq);
++ tasklet_kill(&sc->bcon_tasklet);
++
+ ath9k_ps_restore(sc);
+ mutex_unlock(&sc->mutex);
+
--- /dev/null
+From ff8f59b5bbdf1527235b8c88d859c7d23691324f Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <Sujith.Manoharan@atheros.com>
+Date: Tue, 28 Dec 2010 14:28:05 +0530
+Subject: ath9k_htc: Handle pending URBs properly
+
+From: Sujith Manoharan <Sujith.Manoharan@atheros.com>
+
+commit ff8f59b5bbdf1527235b8c88d859c7d23691324f upstream.
+
+When doing a channel change, the pending URBs have to be killed
+properly on calling htc_stop().
+
+This fixes the probe response timeout seen when sending UDP traffic at
+a high rate and running background scan at the same time.
+
+Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hif_usb.c | 40 +++++++++++++++++++++++++++----
+ drivers/net/wireless/ath/ath9k/hif_usb.h | 1
+ 2 files changed, 37 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -144,16 +144,36 @@ static void hif_usb_tx_cb(struct urb *ur
+ case -ENODEV:
+ case -ESHUTDOWN:
+ /*
+- * The URB has been killed, free the SKBs
+- * and return.
++ * The URB has been killed, free the SKBs.
+ */
+ ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
+- return;
++
++ /*
++ * If the URBs are being flushed, no need to add this
++ * URB to the free list.
++ */
++ spin_lock(&hif_dev->tx.tx_lock);
++ if (hif_dev->tx.flags & HIF_USB_TX_FLUSH) {
++ spin_unlock(&hif_dev->tx.tx_lock);
++ return;
++ }
++ spin_unlock(&hif_dev->tx.tx_lock);
++
++ /*
++ * In the stop() case, this URB has to be added to
++ * the free list.
++ */
++ goto add_free;
+ default:
+ break;
+ }
+
+- /* Check if TX has been stopped */
++ /*
++ * Check if TX has been stopped, this is needed because
++ * this CB could have been invoked just after the TX lock
++ * was released in hif_stop() and kill_urb() hasn't been
++ * called yet.
++ */
+ spin_lock(&hif_dev->tx.tx_lock);
+ if (hif_dev->tx.flags & HIF_USB_TX_STOP) {
+ spin_unlock(&hif_dev->tx.tx_lock);
+@@ -305,6 +325,7 @@ static void hif_usb_start(void *hif_hand
+ static void hif_usb_stop(void *hif_handle, u8 pipe_id)
+ {
+ struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
++ struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
+ unsigned long flags;
+
+ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+@@ -312,6 +333,12 @@ static void hif_usb_stop(void *hif_handl
+ hif_dev->tx.tx_skb_cnt = 0;
+ hif_dev->tx.flags |= HIF_USB_TX_STOP;
+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
++
++ /* The pending URBs have to be canceled. */
++ list_for_each_entry_safe(tx_buf, tx_buf_tmp,
++ &hif_dev->tx.tx_pending, list) {
++ usb_kill_urb(tx_buf->urb);
++ }
+ }
+
+ static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb,
+@@ -578,6 +605,7 @@ free:
+ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
+ {
+ struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
++ unsigned long flags;
+
+ list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+ &hif_dev->tx.tx_buf, list) {
+@@ -588,6 +616,10 @@ static void ath9k_hif_usb_dealloc_tx_urb
+ kfree(tx_buf);
+ }
+
++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
++ hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
++
+ list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+ &hif_dev->tx.tx_pending, list) {
+ usb_kill_urb(tx_buf->urb);
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
+@@ -62,6 +62,7 @@ struct tx_buf {
+ };
+
+ #define HIF_USB_TX_STOP BIT(0)
++#define HIF_USB_TX_FLUSH BIT(1)
+
+ struct hif_usb_tx {
+ u8 flags;
--- /dev/null
+From 6f4810101a629b31b5427872a09ea092cfc5c4bd Mon Sep 17 00:00:00 2001
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+Date: Thu, 20 Jan 2011 17:47:39 -0800
+Subject: ath9k_hw: disabled PAPRD for AR9003
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit 6f4810101a629b31b5427872a09ea092cfc5c4bd upstream.
+
+AR9003's PAPRD was enabled prematurely, and is causing some
+large discrepancies on throughput and network connectivity.
+For example downlink (RX) throughput against an AR9280 AP
+can vary widlely from 43-73 Mbit/s while disabling this
+gets AR9382 (2x2) up to around 93 Mbit/s in a 2.4 GHz HT20 setup.
+
+Cc: Paul Shaw <paul.shaw@atheros.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 6 +++++-
+ drivers/net/wireless/ath/ath9k/hw.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -385,6 +385,9 @@ static void ath9k_hw_init_config(struct
+ else
+ ah->config.ht_enable = 0;
+
++ /* PAPRD needs some more work to be enabled */
++ ah->config.paprd_disable = 1;
++
+ ah->config.rx_intr_mitigation = true;
+ ah->config.pcieSerDesWrite = true;
+
+@@ -1949,7 +1952,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw
+ pCap->rx_status_len = sizeof(struct ar9003_rxs);
+ pCap->tx_desc_len = sizeof(struct ar9003_txc);
+ pCap->txs_len = sizeof(struct ar9003_txs);
+- if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
++ if (!ah->config.paprd_disable &&
++ ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+ pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
+ } else {
+ pCap->tx_desc_len = sizeof(struct ath_desc);
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -215,6 +215,7 @@ struct ath9k_ops_config {
+ u32 pcie_waen;
+ u8 analog_shiftreg;
+ u8 ht_enable;
++ u8 paprd_disable;
+ u32 ofdm_trig_low;
+ u32 ofdm_trig_high;
+ u32 cck_trig_high;
--- /dev/null
+From 811ea256b30b37091b5bbf41517404cf98ab56c1 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+Date: Mon, 17 Jan 2011 15:21:40 +0530
+Subject: ath9k_hw: do PA offset calibration only on longcal interval
+
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+
+commit 811ea256b30b37091b5bbf41517404cf98ab56c1 upstream.
+
+The power detector adc offset calibration has to be done
+on 4 minutes interval (longcal * pa_skip_count). But the commit
+"ath9k_hw: fix a noise floor calibration related race condition"
+makes the PA calibration executed more frequently beased on
+nfcal_pending value. Running PAOffset calibration lesser than
+longcal interval doesn't help anything and the worse part is that
+it causes NF load timeouts and RX deaf conditions.
+
+In a very noisy environment, where the distance b/w AP & station
+is ~10 meter and running a downlink udp traffic with frequent
+background scan causes "Timeout while waiting for nf to load:
+AR_PHY_AGC_CONTROL=0x40d1a" and moves the chip into deaf state.
+This issue was originaly reported in Android platform where
+the network-manager application does bgscan more frequently
+on AR9271 chips. (AR9285 family usb device).
+
+Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9002_calib.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+@@ -681,10 +681,6 @@ static bool ar9002_hw_calibrate(struct a
+
+ /* Do NF cal only at longer intervals */
+ if (longcal || nfcal_pending) {
+- /* Do periodic PAOffset Cal */
+- ar9002_hw_pa_cal(ah, false);
+- ar9002_hw_olc_temp_compensation(ah);
+-
+ /*
+ * Get the value from the previous NF cal and update
+ * history buffer.
+@@ -699,8 +695,12 @@ static bool ar9002_hw_calibrate(struct a
+ ath9k_hw_loadnf(ah, ah->curchan);
+ }
+
+- if (longcal)
++ if (longcal) {
+ ath9k_hw_start_nfcal(ah, false);
++ /* Do periodic PAOffset Cal */
++ ar9002_hw_pa_cal(ah, false);
++ ar9002_hw_olc_temp_compensation(ah);
++ }
+ }
+
+ return iscaldone;
--- /dev/null
+From 5b64aa72ead6f8be488d2be7af579f0d69fb7a6e Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+Date: Thu, 27 Jan 2011 18:39:37 +0530
+Subject: ath9k_hw: Fix system hang when resuming from S3/S4
+
+From: Rajkumar Manoharan <rmanoharan@atheros.com>
+
+commit 5b64aa72ead6f8be488d2be7af579f0d69fb7a6e upstream.
+
+The bit 6 & 7 of AR_WA (0x4004) should be enabled only
+for the chips that are supporting L0s functionality
+while resuming back from S3/S4.
+
+Enabling these bits for AR9280 is causing system hang
+within a few S3/S4-resume cycles.
+
+Cc: Jack Lee <jlee@atheros.com>
+Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9002_hw.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+@@ -444,9 +444,8 @@ static void ar9002_hw_configpcipowersave
+ }
+
+ /* WAR for ASPM system hang */
+- if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
++ if (AR_SREV_9285(ah) || AR_SREV_9287(ah))
+ val |= (AR_WA_BIT6 | AR_WA_BIT7);
+- }
+
+ if (AR_SREV_9285E_20(ah))
+ val |= AR_WA_BIT23;
--- /dev/null
+From 52a0e2477dac2106bc1688cbe9615cdafc9deb7d Mon Sep 17 00:00:00 2001
+From: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Date: Wed, 10 Nov 2010 05:03:11 -0800
+Subject: ath9k_hw: Fix XPABIAS level configuration for AR9003
+
+From: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+
+commit 52a0e2477dac2106bc1688cbe9615cdafc9deb7d upstream.
+
+Improper configuration of 0x16288 and 0x16290 would affect transmission.
+
+Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -22,12 +22,14 @@
+ #define COMP_CKSUM_LEN 2
+
+ #define AR_CH0_TOP (0x00016288)
+-#define AR_CH0_TOP_XPABIASLVL (0x3)
++#define AR_CH0_TOP_XPABIASLVL (0x300)
+ #define AR_CH0_TOP_XPABIASLVL_S (8)
+
+ #define AR_CH0_THERM (0x00016290)
+-#define AR_CH0_THERM_SPARE (0x3f)
+-#define AR_CH0_THERM_SPARE_S (0)
++#define AR_CH0_THERM_XPABIASLVL_MSB 0x3
++#define AR_CH0_THERM_XPABIASLVL_MSB_S 0
++#define AR_CH0_THERM_XPASHORT2GND 0x4
++#define AR_CH0_THERM_XPASHORT2GND_S 2
+
+ #define AR_SWITCH_TABLE_COM_ALL (0xffff)
+ #define AR_SWITCH_TABLE_COM_ALL_S (0)
+@@ -995,9 +997,9 @@ static s32 ar9003_hw_xpa_bias_level_get(
+ static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
+ {
+ int bias = ar9003_hw_xpa_bias_level_get(ah, is2ghz);
+- REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, (bias & 0x3));
+- REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_SPARE,
+- ((bias >> 2) & 0x3));
++ REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
++ REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPABIASLVL_MSB, bias >> 2);
++ REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPASHORT2GND, 1);
+ }
+
+ static u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz)
--- /dev/null
+From 554d1d027b19265c4aa3f718b3126d2b86e09a08 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Thu, 23 Dec 2010 12:38:21 +0100
+Subject: iwlagn: enable only rfkill interrupt when device is down
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 554d1d027b19265c4aa3f718b3126d2b86e09a08 upstream.
+
+Since commit 6cd0b1cb872b3bf9fc5de4536404206ab74bafdd "iwlagn: fix
+hw-rfkill while the interface is down", we enable interrupts when
+device is not ready to receive them. However hardware, when it is in
+some inconsistent state, can generate other than rfkill interrupts
+and crash the system. I can reproduce crash with "kernel BUG at
+drivers/net/wireless/iwlwifi/iwl-agn.c:1010!" message, when forcing
+firmware restarts.
+
+To fix only enable rfkill interrupt when down device and after probe.
+I checked patch on laptop with 5100 device, rfkill change is still
+passed to user space when device is down.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Acked-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-agn.c | 9 +++++----
+ drivers/net/wireless/iwlwifi/iwl-helpers.h | 6 ++++++
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -3530,9 +3530,10 @@ static void iwl_mac_stop(struct ieee8021
+
+ flush_workqueue(priv->workqueue);
+
+- /* enable interrupts again in order to receive rfkill changes */
++ /* User space software may expect getting rfkill changes
++ * even if interface is down */
+ iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
+- iwl_enable_interrupts(priv);
++ iwl_enable_rfkill_int(priv);
+
+ IWL_DEBUG_MAC80211(priv, "leave\n");
+ }
+@@ -4515,14 +4516,14 @@ static int iwl_pci_probe(struct pci_dev
+ * 8. Enable interrupts and read RFKILL state
+ *********************************************/
+
+- /* enable interrupts if needed: hw bug w/a */
++ /* enable rfkill interrupt: hw bug w/a */
+ pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
+ if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
+ pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
+ pci_write_config_word(priv->pci_dev, PCI_COMMAND, pci_cmd);
+ }
+
+- iwl_enable_interrupts(priv);
++ iwl_enable_rfkill_int(priv);
+
+ /* If platform's RF_KILL switch is NOT set to KILL */
+ if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
+--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
++++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
+@@ -163,6 +163,12 @@ static inline void iwl_disable_interrupt
+ IWL_DEBUG_ISR(priv, "Disabled interrupts\n");
+ }
+
++static inline void iwl_enable_rfkill_int(struct iwl_priv *priv)
++{
++ IWL_DEBUG_ISR(priv, "Enabling rfkill interrupt\n");
++ iwl_write32(priv, CSR_INT_MASK, CSR_INT_BIT_RF_KILL);
++}
++
+ static inline void iwl_enable_interrupts(struct iwl_priv *priv)
+ {
+ IWL_DEBUG_ISR(priv, "Enabling interrupts\n");
--- /dev/null
+From 3dd823e6b86407aed1a025041d8f1df77e43a9c8 Mon Sep 17 00:00:00 2001
+From: Don Fry <donald.h.fry@intel.com>
+Date: Sun, 6 Feb 2011 09:29:45 -0800
+Subject: iwlagn: Re-enable RF_KILL interrupt when down
+
+From: Don Fry <donald.h.fry@intel.com>
+
+commit 3dd823e6b86407aed1a025041d8f1df77e43a9c8 upstream.
+
+With commit 554d1d027b19265c4aa3f718b3126d2b86e09a08 only one RF_KILL
+interrupt will be seen by the driver when the interface is down.
+
+Re-enable the interrupt when it occurs to see all transitions.
+
+Signed-off-by: Don Fry <donald.h.fry@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-agn.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -1319,6 +1319,9 @@ static void iwl_irq_tasklet_legacy(struc
+ /* only Re-enable if diabled by irq */
+ if (test_bit(STATUS_INT_ENABLED, &priv->status))
+ iwl_enable_interrupts(priv);
++ /* Re-enable RF_KILL if it occurred */
++ else if (handled & CSR_INT_BIT_RF_KILL)
++ iwl_enable_rfkill_int(priv);
+
+ #ifdef CONFIG_IWLWIFI_DEBUG
+ if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
+@@ -1533,6 +1536,9 @@ static void iwl_irq_tasklet(struct iwl_p
+ /* only Re-enable if diabled by irq */
+ if (test_bit(STATUS_INT_ENABLED, &priv->status))
+ iwl_enable_interrupts(priv);
++ /* Re-enable RF_KILL if it occurred */
++ else if (handled & CSR_INT_BIT_RF_KILL)
++ iwl_enable_rfkill_int(priv);
+ }
+
+ /* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
--- /dev/null
+From d2460f4b2fa6dbdeec800414f9cf5b1fc8b71197 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 3 Jan 2011 19:42:24 +0100
+Subject: mac80211: add missing synchronize_rcu
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit d2460f4b2fa6dbdeec800414f9cf5b1fc8b71197 upstream.
+
+commit ad0e2b5a00dbec303e4682b403bb6703d11dcdb2
+Author: Johannes Berg <johannes.berg@intel.com>
+Date: Tue Jun 1 10:19:19 2010 +0200
+
+ mac80211: simplify key locking
+
+removed the synchronization against RCU and thus
+opened a race window where we can use a key for
+TX while it is already freed. Put a synchronisation
+into the right place to close that window.
+
+Reported-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+---
+ net/mac80211/key.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -366,6 +366,12 @@ static void __ieee80211_key_destroy(stru
+ if (!key)
+ return;
+
++ /*
++ * Synchronize so the TX path can no longer be using
++ * this key before we free/remove it.
++ */
++ synchronize_rcu();
++
+ if (key->local)
+ ieee80211_key_disable_hw_accel(key);
+
--- /dev/null
+From eb3e554b4b3a56386ef5214dbe0e3935a350178b Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Mon, 24 Jan 2011 19:28:49 +0100
+Subject: mac80211: fix a crash in ieee80211_beacon_get_tim on change_interface
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit eb3e554b4b3a56386ef5214dbe0e3935a350178b upstream.
+
+Some drivers (e.g. ath9k) do not always disable beacons when they're
+supposed to. When an interface is changed using the change_interface op,
+the mode specific sdata part is in an undefined state and trying to
+get a beacon at this point can produce weird crashes.
+
+To fix this, add a check for ieee80211_sdata_running before using
+anything from the sdata.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/tx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -2207,6 +2207,9 @@ struct sk_buff *ieee80211_beacon_get_tim
+
+ sdata = vif_to_sdata(vif);
+
++ if (!ieee80211_sdata_running(sdata))
++ goto out;
++
+ if (tim_offset)
+ *tim_offset = 0;
+ if (tim_length)
--- /dev/null
+From 489ee9195a7de9e6bc833d639ff6b553ffdad90e Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sat, 18 Dec 2010 19:30:48 +0100
+Subject: mac80211: fix initialization of skb->cb in ieee80211_subif_start_xmit
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 489ee9195a7de9e6bc833d639ff6b553ffdad90e upstream.
+
+The change 'mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs'
+added a check for copying the skb if it's shared, however the tx info variable
+still points at the cb of the old skb
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Acked-by: Helmut Schaa <helmut.schaa@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/tx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1726,7 +1726,7 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+ {
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ struct ieee80211_local *local = sdata->local;
+- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++ struct ieee80211_tx_info *info;
+ int ret = NETDEV_TX_BUSY, head_need;
+ u16 ethertype, hdrlen, meshhdrlen = 0;
+ __le16 fc;
+@@ -2017,6 +2017,7 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+ skb_set_network_header(skb, nh_pos);
+ skb_set_transport_header(skb, h_pos);
+
++ info = IEEE80211_SKB_CB(skb);
+ memset(info, 0, sizeof(*info));
+
+ dev->trans_start = jiffies;
--- /dev/null
+From 919bbad580445801c22ef6ccbe624551fee652bd Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@bga.com>
+Date: Thu, 30 Dec 2010 02:01:03 -0600
+Subject: mac80211: fix mesh forwarding when ratelimited too
+
+From: Milton Miller <miltonm@bga.com>
+
+commit 919bbad580445801c22ef6ccbe624551fee652bd upstream.
+
+Commit b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 said:
+
+ Under memory pressure, the mac80211 mesh code
+ may helpfully print a message that it failed
+ to clone a mesh frame and then will proceed
+ to crash trying to use it anyway. Fix that.
+
+Avoid the reference whenever the frame copy is unsuccessful
+regardless of the debug message being suppressed or printed.
+
+Signed-off-by: Milton Miller <miltonm@bga.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/rx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1788,11 +1788,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+
+ fwd_skb = skb_copy(skb, GFP_ATOMIC);
+
+- if (!fwd_skb && net_ratelimit()) {
++ if (!fwd_skb && net_ratelimit())
+ printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
+ sdata->name);
++ if (!fwd_skb)
+ goto out;
+- }
+
+ fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
+ memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
--- /dev/null
+From 82694f764dad783a123394e2220b92b9be721b43 Mon Sep 17 00:00:00 2001
+From: Luciano Coelho <coelho@ti.com>
+Date: Wed, 12 Jan 2011 15:18:11 +0200
+Subject: mac80211: use maximum number of AMPDU frames as default in BA RX
+
+From: Luciano Coelho <coelho@ti.com>
+
+commit 82694f764dad783a123394e2220b92b9be721b43 upstream.
+
+When the buffer size is set to zero in the block ack parameter set
+field, we should use the maximum supported number of subframes. The
+existing code was bogus and was doing some unnecessary calculations
+that lead to wrong values.
+
+Thanks Johannes for helping me figure this one out.
+
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Luciano Coelho <coelho@ti.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+
+---
+ net/mac80211/agg-rx.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -187,8 +187,6 @@ void ieee80211_process_addba_request(str
+ struct ieee80211_mgmt *mgmt,
+ size_t len)
+ {
+- struct ieee80211_hw *hw = &local->hw;
+- struct ieee80211_conf *conf = &hw->conf;
+ struct tid_ampdu_rx *tid_agg_rx;
+ u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
+ u8 dialog_token;
+@@ -233,13 +231,8 @@ void ieee80211_process_addba_request(str
+ goto end_no_lock;
+ }
+ /* determine default buffer size */
+- if (buf_size == 0) {
+- struct ieee80211_supported_band *sband;
+-
+- sband = local->hw.wiphy->bands[conf->channel->band];
+- buf_size = IEEE80211_MIN_AMPDU_BUF;
+- buf_size = buf_size << sband->ht_cap.ampdu_factor;
+- }
++ if (buf_size == 0)
++ buf_size = IEEE80211_MAX_AMPDU_BUF;
+
+
+ /* examine state machine */
staging-rt2860-fix-incorrect-netif_stop_queue-usage-warning.patch
staging-speakup-confusion-in-silent_store.patch
staging-brcm80211-fix-suspend-resume-issue-in-brcmsmac.patch
+mac80211-fix-mesh-forwarding-when-ratelimited-too.patch
+mac80211-add-missing-synchronize_rcu.patch
+mac80211-use-maximum-number-of-ampdu-frames-as-default-in-ba-rx.patch
+mac80211-fix-a-crash-in-ieee80211_beacon_get_tim-on-change_interface.patch
+mac80211-fix-initialization-of-skb-cb-in-ieee80211_subif_start_xmit.patch
+iwlagn-enable-only-rfkill-interrupt-when-device-is-down.patch
+iwlagn-re-enable-rf_kill-interrupt-when-down.patch
+ath9k_htc-handle-pending-urbs-properly.patch
+ath9k_hw-fix-xpabias-level-configuration-for-ar9003.patch
+ath9k-fix-bug-in-delimiter-padding-computation.patch
+ath9k-fix-assumptions-for-idle-calls-on-suspend-resume.patch
+ath9k-fix-aphy-wiphy-idle-mismatch.patch
+ath9k-fix-beacon-restart-on-channel-change.patch
+ath9k_hw-do-pa-offset-calibration-only-on-longcal-interval.patch
+ath9k_hw-disabled-paprd-for-ar9003.patch
+ath9k_hw-fix-system-hang-when-resuming-from-s3-s4.patch
+ath9k-fix-race-conditions-when-stop-device.patch
+ath-missed-to-clear-key4-of-micentry.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
