--- /dev/null
+From b3050248c167871ca52cfdb2ce78aa2460249346 Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Date: Fri, 14 Feb 2014 08:15:20 +0530
+Subject: ath9k: Fix ETSI compliance for AR9462 2.0
+
+From: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+
+commit b3050248c167871ca52cfdb2ce78aa2460249346 upstream.
+
+The minimum CCA power threshold values have to be adjusted
+for existing cards to be in compliance with new regulations.
+Newer cards will make use of the values obtained from EEPROM,
+support for this was added earlier. To make sure that cards
+that are already in use and don't have proper values in EEPROM,
+do not violate regulations, use the initvals instead.
+
+Reported-by: Jeang Daniel <dyjeong@qca.qualcomm.com>
+Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
++++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+@@ -55,7 +55,7 @@ static const u32 ar9462_2p0_baseband_pos
+ {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3376605e, 0x33795d5e},
+ {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+ {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+- {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
++ {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
+ {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+ {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
+ {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
+@@ -94,7 +94,7 @@ static const u32 ar9462_2p0_baseband_pos
+ {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
+ {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+ {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+- {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
++ {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
+ {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
+ };
+
--- /dev/null
+From 9ef7506f7eff3fc42724269f62e30164c141661f Mon Sep 17 00:00:00 2001
+From: Rob Clark <rclark@redhat.com>
+Date: Wed, 12 Mar 2014 10:59:37 -0400
+Subject: drm/ttm: don't oops if no invalidate_caches()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rob Clark <rclark@redhat.com>
+
+commit 9ef7506f7eff3fc42724269f62e30164c141661f upstream.
+
+A few of the simpler TTM drivers (cirrus, ast, mgag200) do not implement
+this function. Yet can end up somehow with an evicted bo:
+
+ BUG: unable to handle kernel NULL pointer dereference at (null)
+ IP: [< (null)>] (null)
+ PGD 16e761067 PUD 16e6cf067 PMD 0
+ Oops: 0010 [#1] SMP
+ Modules linked in: bnep bluetooth rfkill fuse ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg btrfs zlib_deflate raid6_pq xor dm_queue_length iTCO_wdt iTCO_vendor_support coretemp kvm dcdbas dm_service_time microcode serio_raw pcspkr lpc_ich mfd_core i7core_edac edac_core ses enclosure ipmi_si ipmi_msghandler shpchp acpi_power_meter mperf nfsd auth_rpcgss nfs_acl lockd uinput sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sr_mod cdrom
+ sd_mod usb_storage mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit lpfc drm_kms_helper ttm crc32c_intel ata_piix bfa drm ixgbe libata i2c_core mdio crc_t10dif ptp crct10dif_common pps_core scsi_transport_fc dca scsi_tgt megaraid_sas bnx2 dm_mirror dm_region_hash dm_log dm_mod
+ CPU: 16 PID: 2572 Comm: X Not tainted 3.10.0-86.el7.x86_64 #1
+ Hardware name: Dell Inc. PowerEdge R810/0H235N, BIOS 0.3.0 11/14/2009
+ task: ffff8801799dabc0 ti: ffff88016c884000 task.ti: ffff88016c884000
+ RIP: 0010:[<0000000000000000>] [< (null)>] (null)
+ RSP: 0018:ffff88016c885ad8 EFLAGS: 00010202
+ RAX: ffffffffa04e94c0 RBX: ffff880178937a20 RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: 0000000000240004 RDI: ffff880178937a00
+ RBP: ffff88016c885b60 R08: 00000000000171a0 R09: ffff88007cf171a0
+ R10: ffffea0005842540 R11: ffffffff810487b9 R12: ffff880178937b30
+ R13: ffff880178937a00 R14: ffff88016c885b78 R15: ffff880179929400
+ FS: 00007f81ba2ef980(0000) GS:ffff88007cf00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 000000016e763000 CR4: 00000000000007e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ Stack:
+ ffffffffa0306fae ffff8801799295c0 0000000000260004 0000000000000001
+ ffff88016c885b60 ffffffffa0307669 00ff88007cf17738 ffff88017cf17700
+ ffff880178937a00 ffff880100000000 ffff880100000000 0000000079929400
+ Call Trace:
+ [<ffffffffa0306fae>] ? ttm_bo_handle_move_mem+0x54e/0x5b0 [ttm]
+ [<ffffffffa0307669>] ? ttm_bo_mem_space+0x169/0x340 [ttm]
+ [<ffffffffa0307bd7>] ttm_bo_move_buffer+0x117/0x130 [ttm]
+ [<ffffffff81130001>] ? perf_event_init_context+0x141/0x220
+ [<ffffffffa0307cb1>] ttm_bo_validate+0xc1/0x130 [ttm]
+ [<ffffffffa04e7377>] mgag200_bo_pin+0x87/0xc0 [mgag200]
+ [<ffffffffa04e56c4>] mga_crtc_cursor_set+0x474/0xbb0 [mgag200]
+ [<ffffffff811971d2>] ? __mem_cgroup_commit_charge+0x152/0x3b0
+ [<ffffffff815c4182>] ? mutex_lock+0x12/0x2f
+ [<ffffffffa0201433>] drm_mode_cursor_common+0x123/0x170 [drm]
+ [<ffffffffa0205231>] drm_mode_cursor_ioctl+0x41/0x50 [drm]
+ [<ffffffffa01f5ca2>] drm_ioctl+0x502/0x630 [drm]
+ [<ffffffff815cbab4>] ? __do_page_fault+0x1f4/0x510
+ [<ffffffff8101cb68>] ? __restore_xstate_sig+0x218/0x4f0
+ [<ffffffff811b4445>] do_vfs_ioctl+0x2e5/0x4d0
+ [<ffffffff8124488e>] ? file_has_perm+0x8e/0xa0
+ [<ffffffff811b46b1>] SyS_ioctl+0x81/0xa0
+ [<ffffffff815d05d9>] system_call_fastpath+0x16/0x1b
+ Code: Bad RIP value.
+ RIP [< (null)>] (null)
+ RSP <ffff88016c885ad8>
+ CR2: 0000000000000000
+
+Signed-off-by: Rob Clark <rclark@redhat.com>
+Reviewed-by: Jérôme Glisse <jglisse@redhat.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_bo.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -430,9 +430,11 @@ static int ttm_bo_handle_move_mem(struct
+
+ moved:
+ if (bo->evicted) {
+- ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
+- if (ret)
+- pr_err("Can not flush read caches\n");
++ if (bdev->driver->invalidate_caches) {
++ ret = bdev->driver->invalidate_caches(bdev, bo->mem.placement);
++ if (ret)
++ pr_err("Can not flush read caches\n");
++ }
+ bo->evicted = false;
+ }
+
--- /dev/null
+From 1d147bfa64293b2723c4fec50922168658e613ba Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 20 Feb 2014 09:22:11 +0200
+Subject: mac80211: fix AP powersave TX vs. wakeup race
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit 1d147bfa64293b2723c4fec50922168658e613ba upstream.
+
+There is a race between the TX path and the STA wakeup: while
+a station is sleeping, mac80211 buffers frames until it wakes
+up, then the frames are transmitted. However, the RX and TX
+path are concurrent, so the packet indicating wakeup can be
+processed while a packet is being transmitted.
+
+This can lead to a situation where the buffered frames list
+is emptied on the one side, while a frame is being added on
+the other side, as the station is still seen as sleeping in
+the TX path.
+
+As a result, the newly added frame will not be send anytime
+soon. It might be sent much later (and out of order) when the
+station goes to sleep and wakes up the next time.
+
+Additionally, it can lead to the crash below.
+
+Fix all this by synchronising both paths with a new lock.
+Both path are not fastpath since they handle PS situations.
+
+In a later patch we'll remove the extra skb queue locks to
+reduce locking overhead.
+
+BUG: unable to handle kernel
+NULL pointer dereference at 000000b0
+IP: [<ff6f1791>] ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
+*pde = 00000000
+Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
+EIP: 0060:[<ff6f1791>] EFLAGS: 00210282 CPU: 1
+EIP is at ieee80211_report_used_skb+0x11/0x3e0 [mac80211]
+EAX: e5900da0 EBX: 00000000 ECX: 00000001 EDX: 00000000
+ESI: e41d00c0 EDI: e5900da0 EBP: ebe458e4 ESP: ebe458b0
+ DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+CR0: 8005003b CR2: 000000b0 CR3: 25a78000 CR4: 000407d0
+DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
+DR6: ffff0ff0 DR7: 00000400
+Process iperf (pid: 3934, ti=ebe44000 task=e757c0b0 task.ti=ebe44000)
+iwlwifi 0000:02:00.0: I iwl_pcie_enqueue_hcmd Sending command LQ_CMD (#4e), seq: 0x0903, 92 bytes at 3[3]:9
+Stack:
+ e403b32c ebe458c4 00200002 00200286 e403b338 ebe458cc c10960bb e5900da0
+ ff76a6ec ebe458d8 00000000 e41d00c0 e5900da0 ebe458f0 ff6f1b75 e403b210
+ ebe4598c ff723dc1 00000000 ff76a6ec e597c978 e403b758 00000002 00000002
+Call Trace:
+ [<ff6f1b75>] ieee80211_free_txskb+0x15/0x20 [mac80211]
+ [<ff723dc1>] invoke_tx_handlers+0x1661/0x1780 [mac80211]
+ [<ff7248a5>] ieee80211_tx+0x75/0x100 [mac80211]
+ [<ff7249bf>] ieee80211_xmit+0x8f/0xc0 [mac80211]
+ [<ff72550e>] ieee80211_subif_start_xmit+0x4fe/0xe20 [mac80211]
+ [<c149ef70>] dev_hard_start_xmit+0x450/0x950
+ [<c14b9aa9>] sch_direct_xmit+0xa9/0x250
+ [<c14b9c9b>] __qdisc_run+0x4b/0x150
+ [<c149f732>] dev_queue_xmit+0x2c2/0xca0
+
+Reported-by: Yaara Rozenblum <yaara.rozenblum@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
+[reword commit log, use a separate lock]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/sta_info.c | 4 ++++
+ net/mac80211/sta_info.h | 7 +++----
+ net/mac80211/tx.c | 15 +++++++++++++++
+ 3 files changed, 22 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -242,6 +242,7 @@ struct sta_info *sta_info_alloc(struct i
+ return NULL;
+
+ spin_lock_init(&sta->lock);
++ spin_lock_init(&sta->ps_lock);
+ INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
+ INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
+ mutex_init(&sta->ampdu_mlme.mtx);
+@@ -971,6 +972,8 @@ void ieee80211_sta_ps_deliver_wakeup(str
+
+ skb_queue_head_init(&pending);
+
++ /* sync with ieee80211_tx_h_unicast_ps_buf */
++ spin_lock(&sta->ps_lock);
+ /* Send all buffered frames to the station */
+ for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+ int count = skb_queue_len(&pending), tmp;
+@@ -990,6 +993,7 @@ void ieee80211_sta_ps_deliver_wakeup(str
+ }
+
+ ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta);
++ spin_unlock(&sta->ps_lock);
+
+ local->total_ps_buffered -= buffered;
+
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -227,6 +227,7 @@ struct sta_ampdu_mlme {
+ * @drv_unblock_wk: used for driver PS unblocking
+ * @listen_interval: listen interval of this station, when we're acting as AP
+ * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
++ * @ps_lock: used for powersave (when mac80211 is the AP) related locking
+ * @ps_tx_buf: buffers (per AC) of frames to transmit to this station
+ * when it leaves power saving state or polls
+ * @tx_filtered: buffers (per AC) of frames we already tried to
+@@ -297,10 +298,8 @@ struct sta_info {
+ /* use the accessors defined below */
+ unsigned long _flags;
+
+- /*
+- * STA powersave frame queues, no more than the internal
+- * locking required.
+- */
++ /* STA powersave lock and frame queues */
++ spinlock_t ps_lock;
+ struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS];
+ struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS];
+ unsigned long driver_buffered_tids;
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -471,6 +471,20 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
+ if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
+ purge_old_ps_buffers(tx->local);
++
++ /* sync with ieee80211_sta_ps_deliver_wakeup */
++ spin_lock(&sta->ps_lock);
++ /*
++ * STA woke up the meantime and all the frames on ps_tx_buf have
++ * been queued to pending queue. No reordering can happen, go
++ * ahead and Tx the packet.
++ */
++ if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
++ !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
++ spin_unlock(&sta->ps_lock);
++ return TX_CONTINUE;
++ }
++
+ if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
+ struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
+ #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
+@@ -487,6 +501,7 @@ ieee80211_tx_h_unicast_ps_buf(struct iee
+ info->control.vif = &tx->sdata->vif;
+ info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+ skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
++ spin_unlock(&sta->ps_lock);
+
+ if (!timer_pending(&local->sta_cleanup))
+ mod_timer(&local->sta_cleanup,
--- /dev/null
+From 1bf4bbb4024dcdab5e57634dd8ae1072d42a53ac Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 11 Feb 2014 16:02:47 +0100
+Subject: mac80211: send control port protocol frames to the VO queue
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 1bf4bbb4024dcdab5e57634dd8ae1072d42a53ac upstream.
+
+Improves reliability of wifi connections with WPA, since authentication
+frames are prioritized over normal traffic and also typically exempt
+from aggregation.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/wme.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/mac80211/wme.c
++++ b/net/mac80211/wme.c
+@@ -132,6 +132,11 @@ u16 ieee80211_select_queue(struct ieee80
+ return IEEE80211_AC_BE;
+ }
+
++ if (skb->protocol == sdata->control_port_protocol) {
++ skb->priority = 7;
++ return ieee80211_downgrade_queue(sdata, skb);
++ }
++
+ /* use the data classifier to determine what 802.1d tag the
+ * data frame has */
+ skb->priority = cfg80211_classify8021d(skb);
--- /dev/null
+From c99b1861c232e1f641f13b8645e0febb3712cc71 Mon Sep 17 00:00:00 2001
+From: Amitkumar Karwar <akarwar@marvell.com>
+Date: Tue, 4 Mar 2014 18:43:13 -0800
+Subject: mwifiex: copy AP's HT capability info correctly
+
+From: Amitkumar Karwar <akarwar@marvell.com>
+
+commit c99b1861c232e1f641f13b8645e0febb3712cc71 upstream.
+
+While preparing association request, intersection of device's HT
+capability information and corresponding fields advertised by AP
+is used.
+
+This patch fixes an error while copying this field from AP's
+beacon.
+
+Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/11n.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/mwifiex/11n.c
++++ b/drivers/net/wireless/mwifiex/11n.c
+@@ -340,8 +340,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifie
+ ht_cap->header.len =
+ cpu_to_le16(sizeof(struct ieee80211_ht_cap));
+ memcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header),
+- (u8 *) bss_desc->bcn_ht_cap +
+- sizeof(struct ieee_types_header),
++ (u8 *)bss_desc->bcn_ht_cap,
+ le16_to_cpu(ht_cap->header.len));
+
+ mwifiex_fill_cap_info(priv, radio_type, ht_cap);
virtio-net-alloc-big-buffers-also-when-guest-can-receive-ufo.patch
tg3-don-t-check-undefined-error-bits-in-rxbd.patch
net-sctp-fix-sctp_sf_do_5_1d_ce-to-verify-if-we-peer-is-auth-capable.patch
+mac80211-send-control-port-protocol-frames-to-the-vo-queue.patch
+mac80211-fix-ap-powersave-tx-vs.-wakeup-race.patch
+ath9k-fix-etsi-compliance-for-ar9462-2.0.patch
+mwifiex-copy-ap-s-ht-capability-info-correctly.patch
+drm-ttm-don-t-oops-if-no-invalidate_caches.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
