]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.7-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 4 Oct 2016 16:22:35 +0000 (18:22 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 4 Oct 2016 16:22:35 +0000 (18:22 +0200)
added patches:
iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch
iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch
iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch
iwlwifi-mvm-fix-txq-aggregation-bug.patch
iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch
iwlwifi-mvm-handle-frame_release-in-mq-code.patch
iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch
iwlwifi-mvm-write-the-correct-internal-txf-index.patch
iwlwifi-pcie-fix-access-to-scratch-buffer.patch

queue-4.7/iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch [new file with mode: 0644]
queue-4.7/iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch [new file with mode: 0644]
queue-4.7/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch [new file with mode: 0644]
queue-4.7/iwlwifi-mvm-fix-txq-aggregation-bug.patch [new file with mode: 0644]
queue-4.7/iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch [new file with mode: 0644]
queue-4.7/iwlwifi-mvm-handle-frame_release-in-mq-code.patch [new file with mode: 0644]
queue-4.7/iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch [new file with mode: 0644]
queue-4.7/iwlwifi-mvm-write-the-correct-internal-txf-index.patch [new file with mode: 0644]
queue-4.7/iwlwifi-pcie-fix-access-to-scratch-buffer.patch [new file with mode: 0644]
queue-4.7/series

diff --git a/queue-4.7/iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch b/queue-4.7/iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch
new file mode 100644 (file)
index 0000000..c694f00
--- /dev/null
@@ -0,0 +1,107 @@
+From 5a7d87da8d9b9f04ecdbebe7e5710a1391f85fa8 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 27 May 2016 15:07:03 +0200
+Subject: iwlwifi: mvm: avoid harmless -Wmaybe-uninialized warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 5a7d87da8d9b9f04ecdbebe7e5710a1391f85fa8 upstream.
+
+gcc is apparently unablel to track the state of the local 'resp_v2'
+variable across the kzalloc() function, and warns about the response
+variable being used without an initialization:
+
+drivers/net/wireless/intel/iwlwifi/mvm/nvm.c: In function ‘iwl_mvm_update_mcc’:
+drivers/net/wireless/intel/iwlwifi/mvm/nvm.c:727:36: warning: ‘mcc_resp_v1’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+   resp_cp->n_channels = mcc_resp_v1->n_channels;
+drivers/net/wireless/intel/iwlwifi/mvm/nvm.c:721:3: warning: ‘mcc_resp’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+   memcpy(resp_cp, mcc_resp, resp_len);
+
+The warning showed up in x86 allmodconfig after my patch to
+unhide -Wmaybe-uninitialized warnings by default was merged,
+though it always existed in randconfig builds. I did not
+catch the warning earlier because I was testing on ARM, which
+never produced the warning.
+
+This rearranges the code in a way that improves readability for
+both humans and the compiler, and that avoids the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 6fa52430f0b3 ("iwlwifi: mvm: change mcc update API")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/nvm.c |   41 +++++++++++++--------------
+ 1 file changed, 21 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+@@ -667,8 +667,7 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm,
+               .mcc = cpu_to_le16(alpha2[0] << 8 | alpha2[1]),
+               .source_id = (u8)src_id,
+       };
+-      struct iwl_mcc_update_resp *mcc_resp, *resp_cp = NULL;
+-      struct iwl_mcc_update_resp_v1 *mcc_resp_v1 = NULL;
++      struct iwl_mcc_update_resp *resp_cp;
+       struct iwl_rx_packet *pkt;
+       struct iwl_host_cmd cmd = {
+               .id = MCC_UPDATE_CMD,
+@@ -701,34 +700,36 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm,
+       /* Extract MCC response */
+       if (resp_v2) {
+-              mcc_resp = (void *)pkt->data;
++              struct iwl_mcc_update_resp *mcc_resp = (void *)pkt->data;
++
+               n_channels =  __le32_to_cpu(mcc_resp->n_channels);
++              resp_len = sizeof(struct iwl_mcc_update_resp) +
++                         n_channels * sizeof(__le32);
++              resp_cp = kmemdup(mcc_resp, resp_len, GFP_KERNEL);
+       } else {
+-              mcc_resp_v1 = (void *)pkt->data;
++              struct iwl_mcc_update_resp_v1 *mcc_resp_v1 = (void *)pkt->data;
++
+               n_channels =  __le32_to_cpu(mcc_resp_v1->n_channels);
++              resp_len = sizeof(struct iwl_mcc_update_resp) +
++                         n_channels * sizeof(__le32);
++              resp_cp = kzalloc(resp_len, GFP_KERNEL);
++
++              if (resp_cp) {
++                      resp_cp->status = mcc_resp_v1->status;
++                      resp_cp->mcc = mcc_resp_v1->mcc;
++                      resp_cp->cap = mcc_resp_v1->cap;
++                      resp_cp->source_id = mcc_resp_v1->source_id;
++                      resp_cp->n_channels = mcc_resp_v1->n_channels;
++                      memcpy(resp_cp->channels, mcc_resp_v1->channels,
++                             n_channels * sizeof(__le32));
++              }
+       }
+-      resp_len = sizeof(struct iwl_mcc_update_resp) + n_channels *
+-              sizeof(__le32);
+-
+-      resp_cp = kzalloc(resp_len, GFP_KERNEL);
+       if (!resp_cp) {
+               ret = -ENOMEM;
+               goto exit;
+       }
+-      if (resp_v2) {
+-              memcpy(resp_cp, mcc_resp, resp_len);
+-      } else {
+-              resp_cp->status = mcc_resp_v1->status;
+-              resp_cp->mcc = mcc_resp_v1->mcc;
+-              resp_cp->cap = mcc_resp_v1->cap;
+-              resp_cp->source_id = mcc_resp_v1->source_id;
+-              resp_cp->n_channels = mcc_resp_v1->n_channels;
+-              memcpy(resp_cp->channels, mcc_resp_v1->channels,
+-                     n_channels * sizeof(__le32));
+-      }
+-
+       status = le32_to_cpu(resp_cp->status);
+       mcc = le16_to_cpu(resp_cp->mcc);
diff --git a/queue-4.7/iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch b/queue-4.7/iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch
new file mode 100644 (file)
index 0000000..d655c19
--- /dev/null
@@ -0,0 +1,58 @@
+From ecf51424152bad1b2727409f42ddf1bd86f44b7d Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Wed, 8 Jun 2016 15:15:41 +0300
+Subject: iwlwifi: mvm: checksum IPv6 fragmented packet
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+commit ecf51424152bad1b2727409f42ddf1bd86f44b7d upstream.
+
+Our HW does not support checksum of fragmented packets.
+Fix code accordingly to checksum those packets in the driver.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Fixes: 5e6a98dc4863 ("iwlwifi: mvm: enable TCP/UDP checksum support for 9000 family")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c |   21 ++++++---------------
+ 1 file changed, 6 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -138,28 +138,19 @@ static void iwl_mvm_tx_csum(struct iwl_m
+               protocol = ipv6h->nexthdr;
+               while (protocol != NEXTHDR_NONE && ipv6_ext_hdr(protocol)) {
++                      struct ipv6_opt_hdr *hp;
++
+                       /* only supported extension headers */
+                       if (protocol != NEXTHDR_ROUTING &&
+                           protocol != NEXTHDR_HOP &&
+-                          protocol != NEXTHDR_DEST &&
+-                          protocol != NEXTHDR_FRAGMENT) {
++                          protocol != NEXTHDR_DEST) {
+                               skb_checksum_help(skb);
+                               return;
+                       }
+-                      if (protocol == NEXTHDR_FRAGMENT) {
+-                              struct frag_hdr *hp =
+-                                      OPT_HDR(struct frag_hdr, skb, off);
+-
+-                              protocol = hp->nexthdr;
+-                              off += sizeof(struct frag_hdr);
+-                      } else {
+-                              struct ipv6_opt_hdr *hp =
+-                                      OPT_HDR(struct ipv6_opt_hdr, skb, off);
+-
+-                              protocol = hp->nexthdr;
+-                              off += ipv6_optlen(hp);
+-                      }
++                      hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);
++                      protocol = hp->nexthdr;
++                      off += ipv6_optlen(hp);
+               }
+               /* if we get here - protocol now should be TCP/UDP */
+ #endif
diff --git a/queue-4.7/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch b/queue-4.7/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch
new file mode 100644 (file)
index 0000000..985f24e
--- /dev/null
@@ -0,0 +1,31 @@
+From ff6e58e648ed5f3cc43891767811d5c3c88bbd41 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Wed, 3 Aug 2016 22:06:43 +0300
+Subject: iwlwifi: mvm: don't use ret when not initialised
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit ff6e58e648ed5f3cc43891767811d5c3c88bbd41 upstream.
+
+fw-dbg code return ret but that variable was either 0
+or not initialised. Return 0 always.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Fixes: 6a95126763fb ("iwlwifi: mvm: send dbg config hcmds to fw if set in tlv")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+@@ -960,5 +960,6 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl
+       }
+       mvm->fw_dbg_conf = conf_id;
+-      return ret;
++
++      return 0;
+ }
diff --git a/queue-4.7/iwlwifi-mvm-fix-txq-aggregation-bug.patch b/queue-4.7/iwlwifi-mvm-fix-txq-aggregation-bug.patch
new file mode 100644 (file)
index 0000000..9bdaf66
--- /dev/null
@@ -0,0 +1,55 @@
+From 2c4a247e42526d9aae8f5ce1f190b893532f2806 Mon Sep 17 00:00:00 2001
+From: Oren Givon <oren.givon@intel.com>
+Date: Sun, 29 May 2016 14:05:50 +0300
+Subject: iwlwifi: mvm: fix txq aggregation bug
+
+From: Oren Givon <oren.givon@intel.com>
+
+commit 2c4a247e42526d9aae8f5ce1f190b893532f2806 upstream.
+
+Fix an issue where nullfunc frames and block ack requests
+had the same tid as aggregation frames and were queued on
+a non aggregation queue. The pending frames counter included
+those frames but the check whether to decrement the pending
+frames counter relied on the tid status and not on the txq id.
+The result was an inconsistent state of the pending frames
+counter followed by a failure to remove the station.
+This failure triggered SYSASSERT 0x3421.
+
+In addition, fix a situation in DQA mode where the number
+of pending frames turned negative. This was due to the TX queue
+being on the IWL_EMPTYING_HW_QUEUE_DELBA state and its frames
+were still decremented.
+
+Even though the SYSASSERT issue is fixed when DQA is disabled,
+the issue is not completely solved when DQA is enabled and
+should still be fixed.
+
+Signed-off-by: Oren Givon <oren.givon@intel.com>
+Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c |   10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1303,7 +1303,15 @@ static void iwl_mvm_rx_tx_cmd_single(str
+                       bool send_eosp_ndp = false;
+                       spin_lock_bh(&mvmsta->lock);
+-                      txq_agg = (mvmsta->tid_data[tid].state == IWL_AGG_ON);
++                      if (iwl_mvm_is_dqa_supported(mvm)) {
++                              enum iwl_mvm_agg_state state;
++
++                              state = mvmsta->tid_data[tid].state;
++                              txq_agg = (state == IWL_AGG_ON ||
++                                      state == IWL_EMPTYING_HW_QUEUE_DELBA);
++                      } else {
++                              txq_agg = txq_id >= mvm->first_agg_queue;
++                      }
+                       if (!is_ndp) {
+                               tid_data->next_reclaimed = next_reclaimed;
diff --git a/queue-4.7/iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch b/queue-4.7/iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch
new file mode 100644 (file)
index 0000000..f1d0c9b
--- /dev/null
@@ -0,0 +1,40 @@
+From 60dec5233cd8651860e8010c953d116fb0f1ba86 Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Tue, 21 Jun 2016 14:14:08 +0300
+Subject: iwlwifi: mvm: free RX reorder buffer on restart
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+commit 60dec5233cd8651860e8010c953d116fb0f1ba86 upstream.
+
+Restart flow zeroes the rx_ba_sessions counter. Mac80211 asks
+driver to tear down of the session only afterwards, and as a
+result driver didn't free the data. Fix it.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Fixes: 10b2b2019d81 ("iwlwifi: mvm: add infrastructure for tracking BA session in driver")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -1374,11 +1374,12 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *m
+                */
+               WARN_ON(rcu_access_pointer(mvm->baid_map[baid]));
+               rcu_assign_pointer(mvm->baid_map[baid], baid_data);
+-      } else if (mvm->rx_ba_sessions > 0) {
++      } else  {
+               u8 baid = mvm_sta->tid_to_baid[tid];
+-              /* check that restart flow didn't zero the counter */
+-              mvm->rx_ba_sessions--;
++              if (mvm->rx_ba_sessions > 0)
++                      /* check that restart flow didn't zero the counter */
++                      mvm->rx_ba_sessions--;
+               if (!iwl_mvm_has_new_rx_api(mvm))
+                       return 0;
diff --git a/queue-4.7/iwlwifi-mvm-handle-frame_release-in-mq-code.patch b/queue-4.7/iwlwifi-mvm-handle-frame_release-in-mq-code.patch
new file mode 100644 (file)
index 0000000..ffe7a49
--- /dev/null
@@ -0,0 +1,43 @@
+From 58035432d60616cc2ef6514a3d0e6d6ad01bf705 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 27 Apr 2016 13:33:26 +0200
+Subject: iwlwifi: mvm: handle FRAME_RELEASE in MQ code
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 58035432d60616cc2ef6514a3d0e6d6ad01bf705 upstream.
+
+For some reason, the FRAME_RELEASE message handling for the
+default queue ended up being in the only/default queue for
+non-RSS devices; fix that and handle FRAME_RELEASE properly
+on the default queue for RSS devices.
+
+Fixes: 585a6fccf5b8 ("iwlwifi: mvm: infrastructure for frame-release message")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/ops.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+@@ -936,8 +936,6 @@ static void iwl_mvm_rx(struct iwl_op_mod
+       if (likely(pkt->hdr.cmd == REPLY_RX_MPDU_CMD))
+               iwl_mvm_rx_rx_mpdu(mvm, napi, rxb);
+-      else if (pkt->hdr.cmd == FRAME_RELEASE)
+-              iwl_mvm_rx_frame_release(mvm, napi, rxb, 0);
+       else if (pkt->hdr.cmd == REPLY_RX_PHY_CMD)
+               iwl_mvm_rx_rx_phy_cmd(mvm, rxb);
+       else
+@@ -958,6 +956,8 @@ static void iwl_mvm_rx_mq(struct iwl_op_
+       else if (unlikely(pkt->hdr.group_id == DATA_PATH_GROUP &&
+                         pkt->hdr.cmd == RX_QUEUES_NOTIFICATION))
+               iwl_mvm_rx_queue_notif(mvm, rxb, 0);
++      else if (pkt->hdr.cmd == FRAME_RELEASE)
++              iwl_mvm_rx_frame_release(mvm, napi, rxb, 0);
+       else
+               iwl_mvm_rx_common(mvm, rxb, pkt);
+ }
diff --git a/queue-4.7/iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch b/queue-4.7/iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch
new file mode 100644 (file)
index 0000000..748e503
--- /dev/null
@@ -0,0 +1,48 @@
+From 3edbc7dabab8ce85aa75c5e290ecda7a3692ebc9 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sun, 19 Jun 2016 20:57:02 +0300
+Subject: iwlwifi: mvm: unmap the paging memory before freeing it
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 3edbc7dabab8ce85aa75c5e290ecda7a3692ebc9 upstream.
+
+This led to a DMA splat.
+
+Fixes: a6c4fb4441f4 ("iwlwifi: mvm: Add FW paging mechanism for the UMAC on PCI")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c |   12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -139,17 +139,21 @@ void iwl_free_fw_paging(struct iwl_mvm *
+               return;
+       for (i = 0; i < NUM_OF_FW_PAGING_BLOCKS; i++) {
+-              if (!mvm->fw_paging_db[i].fw_paging_block) {
++              struct iwl_fw_paging *paging = &mvm->fw_paging_db[i];
++
++              if (!paging->fw_paging_block) {
+                       IWL_DEBUG_FW(mvm,
+                                    "Paging: block %d already freed, continue to next page\n",
+                                    i);
+                       continue;
+               }
++              dma_unmap_page(mvm->trans->dev, paging->fw_paging_phys,
++                             paging->fw_paging_size, DMA_BIDIRECTIONAL);
+-              __free_pages(mvm->fw_paging_db[i].fw_paging_block,
+-                           get_order(mvm->fw_paging_db[i].fw_paging_size));
+-              mvm->fw_paging_db[i].fw_paging_block = NULL;
++              __free_pages(paging->fw_paging_block,
++                           get_order(paging->fw_paging_size));
++              paging->fw_paging_block = NULL;
+       }
+       kfree(mvm->trans->paging_download_buf);
+       mvm->trans->paging_download_buf = NULL;
diff --git a/queue-4.7/iwlwifi-mvm-write-the-correct-internal-txf-index.patch b/queue-4.7/iwlwifi-mvm-write-the-correct-internal-txf-index.patch
new file mode 100644 (file)
index 0000000..f97b631
--- /dev/null
@@ -0,0 +1,39 @@
+From e7c9bd1cc632e924a69bf704385484386bb10933 Mon Sep 17 00:00:00 2001
+From: Golan Ben-Ami <golan.ben.ami@intel.com>
+Date: Wed, 15 Jun 2016 09:16:24 +0300
+Subject: iwlwifi: mvm: write the correct internal TXF index
+
+From: Golan Ben-Ami <golan.ben.ami@intel.com>
+
+commit e7c9bd1cc632e924a69bf704385484386bb10933 upstream.
+
+The TX fifos are arranged consecutively in the SMEM, beginning
+with the regular fifos, and tailed by the internal fifos.
+In the current code, while trying to read the internal fifos,
+we read the fifos beginning with the index zero.
+By doing this we actually re-read the regular fifos.
+
+In order to read the internal fifos, start the reading index
+from the number of regular fifos configured by the fw.
+
+Signed-off-by: Golan Ben-Ami <golan.ben.ami@intel.com>
+Fixes: 39654cb3a6a2 ("iwlwifi: don't access a nonexistent register upon assert")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+@@ -288,7 +288,8 @@ static void iwl_mvm_dump_fifos(struct iw
+                       fifo_hdr->fifo_num = cpu_to_le32(i);
+                       /* Mark the number of TXF we're pulling now */
+-                      iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i);
++                      iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i +
++                              ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size));
+                       fifo_hdr->available_bytes =
+                               cpu_to_le32(iwl_trans_read_prph(mvm->trans,
diff --git a/queue-4.7/iwlwifi-pcie-fix-access-to-scratch-buffer.patch b/queue-4.7/iwlwifi-pcie-fix-access-to-scratch-buffer.patch
new file mode 100644 (file)
index 0000000..90feb8e
--- /dev/null
@@ -0,0 +1,43 @@
+From d5d0689aefc59c6a5352ca25d7e6d47d03f543ce Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Thu, 9 Jun 2016 17:19:35 +0300
+Subject: iwlwifi: pcie: fix access to scratch buffer
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+commit d5d0689aefc59c6a5352ca25d7e6d47d03f543ce upstream.
+
+This fixes a pretty ancient bug that hasn't manifested itself
+until now.
+The scratchbuf for command queue is allocated only for 32 slots
+but is accessed with the queue write pointer - which can be
+up to 256.
+Since the scratch buf size was 16 and there are up to 256 TFDs
+we never passed a page boundary when accessing the scratch buffer,
+but when attempting to increase the size of the scratch buffer a
+panic was quick to follow when trying to access the address resulted
+in a page boundary.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Fixes: 38c0f334b359 ("iwlwifi: use coherent DMA memory for command header")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/tx.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1595,9 +1595,9 @@ static int iwl_pcie_enqueue_hcmd(struct
+       /* start the TFD with the scratchbuf */
+       scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
+-      memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
++      memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);
+       iwl_pcie_txq_build_tfd(trans, txq,
+-                             iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
++                             iwl_pcie_get_scratchbuf_dma(txq, idx),
+                              scratch_size, true);
+       /* map first command fragment, if any remains */
index 13892482e95300fa2df107bd79119ecadab01ebd..6e11e66a7b7d28a25f8cf27ff7ba4a307509ca6a 100644 (file)
@@ -24,3 +24,12 @@ nvmem-declare-nvmem_cell_read-consistently.patch
 hwmon-adt7411-set-bit-3-in-cfg1-register.patch
 sched-cputime-fix-prev-steal-time-accouting-during-cpu-hotplug.patch
 spi-sh-msiof-avoid-invalid-clock-generator-parameters.patch
+iwlwifi-mvm-handle-frame_release-in-mq-code.patch
+iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch
+iwlwifi-mvm-fix-txq-aggregation-bug.patch
+iwlwifi-mvm-write-the-correct-internal-txf-index.patch
+iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch
+iwlwifi-pcie-fix-access-to-scratch-buffer.patch
+iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch
+iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch
+iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch