From: Greg Kroah-Hartman Date: Mon, 5 Aug 2013 02:18:23 +0000 (+0800) Subject: 3.10-stable patches X-Git-Tag: v3.0.90~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=352f7d7e8f694f3872ac21c482af603b6109f97f;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: ath9k_htc-do-some-initial-hardware-configuration.patch ath9k_htc-reboot-firmware-if-it-was-loaded.patch ath-wil6210-fix-build-error.patch bluetooth-add-support-for-atheros_2.patch bluetooth-add-support-for-atheros.patch bluetooth-add-support-for-mediatek-bluetooth-device.patch bluetooth-ath3k-add-support-for-fujitsu-lifebook-uh5x2.patch bluetooth-ath3k-add-support-for-id-0x13d3-0x3402.patch bluetooth-ath3k-don-t-use-stack-memory-for-dma.patch bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch bluetooth-fix-wrong-use-of-ptr_err-in-btusb.patch ixgbe-fix-tx-hang-issue-with-lldpad-on-82598eb.patch mac80211-fix-duplicate-retransmission-detection.patch mac80211-fix-ethtool-stats-for-non-station-interfaces.patch mac80211-fix-monitor-interface-suspend-crash-regression.patch mac80211-minstrel-fix-null-pointer-dereference-issue.patch mac80211-minstrel_ht-fix-cck-rate-sampling.patch nl80211-fix-mgmt-tx-status-and-testmode-reporting-for-netns.patch --- diff --git a/queue-3.10/ath-wil6210-fix-build-error.patch b/queue-3.10/ath-wil6210-fix-build-error.patch new file mode 100644 index 00000000000..7fa1b4b5820 --- /dev/null +++ b/queue-3.10/ath-wil6210-fix-build-error.patch @@ -0,0 +1,80 @@ +From 5d21608a592a9afcac8d82c6478a564e911ce70b Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sat, 20 Jul 2013 21:46:48 -0500 +Subject: ath: wil6210: Fix build error + +From: Larry Finger + +commit 5d21608a592a9afcac8d82c6478a564e911ce70b upstream. + +Building driver wil6210 in 3.10 and 3.11 kernels yields the following errors: + + CC [M] drivers/net/wireless/ath/wil6210/debugfs.o +drivers/net/wireless/ath/wil6210/debugfs.c: In function 'wil_print_ring': +drivers/net/wireless/ath/wil6210/debugfs.c:163:11: error: pointer targets in passing argument 5 of 'hex_dump_to_buffer' differ in signedness [-Werror=pointer-sign] + false); + ^ +In file included from include/linux/kernel.h:13:0, + from include/linux/cache.h:4, + from include/linux/time.h:4, + from include/linux/stat.h:18, + from include/linux/module.h:10, + from drivers/net/wireless/ath/wil6210/debugfs.c:17: +include/linux/printk.h:361:13: note: expected 'char *' but argument is of type 'unsigned char *' + extern void hex_dump_to_buffer(const void *buf, size_t len, + ^ +drivers/net/wireless/ath/wil6210/debugfs.c: In function 'wil_txdesc_debugfs_show': +drivers/net/wireless/ath/wil6210/debugfs.c:429:10: error: pointer targets in passing argument 5 of 'hex_dump_to_buffer' differ in signedness [-Werror=pointer-sign] + sizeof(printbuf), false); + ^ +In file included from include/linux/kernel.h:13:0, + from include/linux/cache.h:4, + from include/linux/time.h:4, + from include/linux/stat.h:18, + from include/linux/module.h:10, + from drivers/net/wireless/ath/wil6210/debugfs.c:17: +include/linux/printk.h:361:13: note: expected 'char *' but argument is of type 'unsigned char *' + extern void hex_dump_to_buffer(const void *buf, size_t len, + ^ +cc1: all warnings being treated as errors +make[5]: *** [drivers/net/wireless/ath/wil6210/debugfs.o] Error 1 +make[4]: *** [drivers/net/wireless/ath/wil6210] Error 2 +make[3]: *** [drivers/net/wireless/ath] Error 2 +make[2]: *** [drivers/net/wireless] Error 2 +make[1]: *** [drivers/net] Error 2 +make: *** [drivers] Error 2 + +These errors are fixed by changing the type of the buffer from "unsigned char *" to "char *". + +Reported-by: Thomas Fjellstrom +Tested-by: Thomas Fjellstrom +Signed-off-by: Larry Finger +Cc: Thomas Fjellstrom +Signed-off-by: Vladimir Kondratiev +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/wil6210/debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/wil6210/debugfs.c ++++ b/drivers/net/wireless/ath/wil6210/debugfs.c +@@ -145,7 +145,7 @@ static void wil_print_ring(struct seq_fi + le16_to_cpu(hdr.type), hdr.flags); + if (len <= MAX_MBOXITEM_SIZE) { + int n = 0; +- unsigned char printbuf[16 * 3 + 2]; ++ char printbuf[16 * 3 + 2]; + unsigned char databuf[MAX_MBOXITEM_SIZE]; + void __iomem *src = wmi_buffer(wil, d.addr) + + sizeof(struct wil6210_mbox_hdr); +@@ -416,7 +416,7 @@ static int wil_txdesc_debugfs_show(struc + seq_printf(s, " SKB = %p\n", skb); + + if (skb) { +- unsigned char printbuf[16 * 3 + 2]; ++ char printbuf[16 * 3 + 2]; + int i = 0; + int len = skb_headlen(skb); + void *p = skb->data; diff --git a/queue-3.10/ath9k_htc-do-some-initial-hardware-configuration.patch b/queue-3.10/ath9k_htc-do-some-initial-hardware-configuration.patch new file mode 100644 index 00000000000..f49f405427f --- /dev/null +++ b/queue-3.10/ath9k_htc-do-some-initial-hardware-configuration.patch @@ -0,0 +1,38 @@ +From dc2a87f519a4d8cb376ab54f22b6b98a943b51ce Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Fri, 19 Jul 2013 20:16:17 +0200 +Subject: ath9k_htc: do some initial hardware configuration + +From: Oleksij Rempel + +commit dc2a87f519a4d8cb376ab54f22b6b98a943b51ce upstream. + +Currently we configure harwdare and clock, only after +interface start. In this case, if we reload module or +reboot PC without configuring adapter, firmware will freeze. +There is no software way to reset adpter. + +This patch add initial configuration and set it in +disabled state, to avoid this freeze. Behaviour of this patch +should be similar to: ifconfig wlan0 up; ifconfig wlan0 down. + +Bug: https://github.com/qca/open-ath9k-htc-firmware/issues/1 +Tested-by: Bo Shi +Signed-off-by: Oleksij Rempel +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -846,6 +846,7 @@ static int ath9k_init_device(struct ath9 + if (error != 0) + goto err_rx; + ++ ath9k_hw_disable(priv->ah); + #ifdef CONFIG_MAC80211_LEDS + /* must be initialized before ieee80211_register_hw */ + priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw, diff --git a/queue-3.10/ath9k_htc-reboot-firmware-if-it-was-loaded.patch b/queue-3.10/ath9k_htc-reboot-firmware-if-it-was-loaded.patch new file mode 100644 index 00000000000..f6cc6a13daa --- /dev/null +++ b/queue-3.10/ath9k_htc-reboot-firmware-if-it-was-loaded.patch @@ -0,0 +1,42 @@ +From 4928bd2ef8ece262f4f314630219999a91eaa440 Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Fri, 19 Jul 2013 20:16:18 +0200 +Subject: ath9k_htc: reboot firmware if it was loaded + +From: Oleksij Rempel + +commit 4928bd2ef8ece262f4f314630219999a91eaa440 upstream. + +Currently ath9k_htc will reboot firmware only if interface was +ever started. Which lead to the problem in case where interface +was never started but module need to be reloaded. + +This patch will partially fix bug "ath9k_htc: Target is unresponsive" +https://github.com/qca/open-ath9k-htc-firmware/issues/1 + +Reproduction case: +- plug adapter +- make sure nothing will touch it. Stop Networkmanager or blacklist mac address of this adapter. +- rmmod ath9k_htc; sleep 1; modprobe ath9k_htc + +Signed-off-by: Oleksij Rempel +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -1289,7 +1289,9 @@ static void ath9k_hif_usb_disconnect(str + + usb_set_intfdata(interface, NULL); + +- if (!unplugged && (hif_dev->flags & HIF_USB_START)) ++ /* If firmware was loaded we should drop it ++ * go back to first stage bootloader. */ ++ if (!unplugged && (hif_dev->flags & HIF_USB_READY)) + ath9k_hif_usb_reboot(udev); + + kfree(hif_dev); diff --git a/queue-3.10/bluetooth-add-support-for-atheros.patch b/queue-3.10/bluetooth-add-support-for-atheros.patch new file mode 100644 index 00000000000..ce9e43b2989 --- /dev/null +++ b/queue-3.10/bluetooth-add-support-for-atheros.patch @@ -0,0 +1,55 @@ +From 1ebd0b21ab14efb75950079840eac29afea2a26e Mon Sep 17 00:00:00 2001 +From: AceLan Kao +Date: Wed, 17 Jul 2013 11:27:40 +0800 +Subject: Bluetooth: Add support for Atheros [0cf3:3121] + +From: AceLan Kao + +commit 1ebd0b21ab14efb75950079840eac29afea2a26e upstream. + +Add support for the AR3012 chip. + +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=01 Dev#= 6 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0cf3 ProdID=3121 Rev=00.02 +C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + +Signed-off-by: AceLan Kao +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 2 ++ + drivers/bluetooth/btusb.c | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -93,6 +93,7 @@ static struct usb_device_id ath3k_table[ + { USB_DEVICE(0x0489, 0xe04d) }, + { USB_DEVICE(0x04c5, 0x1330) }, + { USB_DEVICE(0x13d3, 0x3402) }, ++ { USB_DEVICE(0x0cf3, 0x3121) }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE02C) }, +@@ -132,6 +133,7 @@ static struct usb_device_id ath3k_blist_ + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -153,6 +153,7 @@ static struct usb_device_id blacklist_ta + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, diff --git a/queue-3.10/bluetooth-add-support-for-atheros_2.patch b/queue-3.10/bluetooth-add-support-for-atheros_2.patch new file mode 100644 index 00000000000..b1b4534e385 --- /dev/null +++ b/queue-3.10/bluetooth-add-support-for-atheros_2.patch @@ -0,0 +1,55 @@ +From 1d5b569ef85d013a775560a90050dc630614c045 Mon Sep 17 00:00:00 2001 +From: AceLan Kao +Date: Thu, 20 Jun 2013 13:38:45 +0800 +Subject: Bluetooth: Add support for Atheros [0cf3:e003] + +From: AceLan Kao + +commit 1d5b569ef85d013a775560a90050dc630614c045 upstream. + +Add support for the AR9462 chip + +T: Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#= 4 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0cf3 ProdID=e003 Rev=00.02 +C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + +Signed-off-by: AceLan Kao +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 2 ++ + drivers/bluetooth/btusb.c | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -94,6 +94,7 @@ static struct usb_device_id ath3k_table[ + { USB_DEVICE(0x04c5, 0x1330) }, + { USB_DEVICE(0x13d3, 0x3402) }, + { USB_DEVICE(0x0cf3, 0x3121) }, ++ { USB_DEVICE(0x0cf3, 0xe003) }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE02C) }, +@@ -134,6 +135,7 @@ static struct usb_device_id ath3k_blist_ + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -154,6 +154,7 @@ static struct usb_device_id blacklist_ta + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, diff --git a/queue-3.10/bluetooth-add-support-for-mediatek-bluetooth-device.patch b/queue-3.10/bluetooth-add-support-for-mediatek-bluetooth-device.patch new file mode 100644 index 00000000000..c47bd1fbf1e --- /dev/null +++ b/queue-3.10/bluetooth-add-support-for-mediatek-bluetooth-device.patch @@ -0,0 +1,66 @@ +From 178c059e7640aa8e50213400c6f3dde00189d979 Mon Sep 17 00:00:00 2001 +From: "Cho, Yu-Chen" +Date: Tue, 4 Jun 2013 21:40:26 +0800 +Subject: Bluetooth: Add support for Mediatek Bluetooth device [0e8d:763f] + +From: "Cho, Yu-Chen" + +commit 178c059e7640aa8e50213400c6f3dde00189d979 upstream. + +This patch adds support for Mediatek Bluetooth device + +T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0e8d ProdID=763f Rev= 1.00 +S: Manufacturer=MediaTek +S: Product=BT +S: SerialNumber=1.0 +C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=450mA +A: FirstIf#= 0 IfCount= 2 Cls=ff(vend.) Sub=ff Prot=ff +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=125us +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I: If#= 1 Alt= 6 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms + +Signed-off-by: Cho, Yu-Chen +Signed-off-by: Gustavo Padovan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -57,6 +57,9 @@ static struct usb_device_id btusb_table[ + /* Apple-specific (Broadcom) devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) }, + ++ /* MediaTek MT76x0E */ ++ { USB_DEVICE(0x0e8d, 0x763f) }, ++ + /* Broadcom SoftSailing reporting vendor specific */ + { USB_DEVICE(0x0a5c, 0x21e1) }, + diff --git a/queue-3.10/bluetooth-ath3k-add-support-for-fujitsu-lifebook-uh5x2.patch b/queue-3.10/bluetooth-ath3k-add-support-for-fujitsu-lifebook-uh5x2.patch new file mode 100644 index 00000000000..4b70e452eef --- /dev/null +++ b/queue-3.10/bluetooth-ath3k-add-support-for-fujitsu-lifebook-uh5x2.patch @@ -0,0 +1,58 @@ +From 84eb2ae1807dd1467bf6f500fc69ae61f1907b75 Mon Sep 17 00:00:00 2001 +From: Thomas Loo +Date: Wed, 3 Jul 2013 02:53:54 +0200 +Subject: Bluetooth: ath3k: Add support for Fujitsu Lifebook UH5x2 [04c5:1330] + +From: Thomas Loo + +commit 84eb2ae1807dd1467bf6f500fc69ae61f1907b75 upstream. + +The Fujitsu Lifebook UH552/UH572 ships with a Qualcomm AR9462/AR3012 +WLAN/BT-Combo card. +Add device ID to the ath3k driver to enable the bluetooth side of things. +Patch against v3.10. + +T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=04c5 ProdID=1330 Rev=00.02 +C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + +Signed-off-by: Thomas Loo +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 2 ++ + drivers/bluetooth/btusb.c | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -91,6 +91,7 @@ static struct usb_device_id ath3k_table[ + { USB_DEVICE(0x0489, 0xe04e) }, + { USB_DEVICE(0x0489, 0xe056) }, + { USB_DEVICE(0x0489, 0xe04d) }, ++ { USB_DEVICE(0x04c5, 0x1330) }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE02C) }, +@@ -128,6 +129,7 @@ static struct usb_device_id ath3k_blist_ + { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -151,6 +151,7 @@ static struct usb_device_id blacklist_ta + { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, diff --git a/queue-3.10/bluetooth-ath3k-add-support-for-id-0x13d3-0x3402.patch b/queue-3.10/bluetooth-ath3k-add-support-for-id-0x13d3-0x3402.patch new file mode 100644 index 00000000000..74ed06831a0 --- /dev/null +++ b/queue-3.10/bluetooth-ath3k-add-support-for-id-0x13d3-0x3402.patch @@ -0,0 +1,57 @@ +From 5b77a1f3d7b7360dc2b7c6d2188d39b9f8432907 Mon Sep 17 00:00:00 2001 +From: Sujith Manoharan +Date: Mon, 15 Jul 2013 09:29:03 +0530 +Subject: Bluetooth: ath3k: Add support for ID 0x13d3/0x3402 + +From: Sujith Manoharan + +commit 5b77a1f3d7b7360dc2b7c6d2188d39b9f8432907 upstream. + +T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 5 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3402 Rev= 0.02 +S: Manufacturer=Atheros Communications +S: Product=Bluetooth USB Host Controller +S: SerialNumber=Alaska Day 2006 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=59701 + +Signed-off-by: Sujith Manoharan +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 2 ++ + drivers/bluetooth/btusb.c | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -92,6 +92,7 @@ static struct usb_device_id ath3k_table[ + { USB_DEVICE(0x0489, 0xe056) }, + { USB_DEVICE(0x0489, 0xe04d) }, + { USB_DEVICE(0x04c5, 0x1330) }, ++ { USB_DEVICE(0x13d3, 0x3402) }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE02C) }, +@@ -130,6 +131,7 @@ static struct usb_device_id ath3k_blist_ + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU22 with sflash firmware */ + { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 }, +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -152,6 +152,7 @@ static struct usb_device_id blacklist_ta + { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, + + /* Atheros AR5BBU12 with sflash firmware */ + { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, diff --git a/queue-3.10/bluetooth-ath3k-don-t-use-stack-memory-for-dma.patch b/queue-3.10/bluetooth-ath3k-don-t-use-stack-memory-for-dma.patch new file mode 100644 index 00000000000..b29331f77e0 --- /dev/null +++ b/queue-3.10/bluetooth-ath3k-don-t-use-stack-memory-for-dma.patch @@ -0,0 +1,80 @@ +From 517828a87994f41af6ae5a0f96f0f069f05baa81 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Mon, 8 Jul 2013 10:27:23 +0200 +Subject: Bluetooth: ath3k: don't use stack memory for DMA + +From: Stanislaw Gruszka + +commit 517828a87994f41af6ae5a0f96f0f069f05baa81 upstream. + +Memory allocated by vmalloc (including stack) can not be used for DMA, +i.e. data pointer on usb_control_msg() should not point to stack memory. + +Resolves: +https://bugzilla.redhat.com/show_bug.cgi?id=977558 + +Reported-and-tested-by: Andy Lawrence +Signed-off-by: Stanislaw Gruszka +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 38 +++++++++++++++++++++++++++++--------- + 1 file changed, 29 insertions(+), 9 deletions(-) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -195,24 +195,44 @@ error: + + static int ath3k_get_state(struct usb_device *udev, unsigned char *state) + { +- int pipe = 0; ++ int ret, pipe = 0; ++ char *buf; ++ ++ buf = kmalloc(sizeof(*buf), GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; + + pipe = usb_rcvctrlpipe(udev, 0); +- return usb_control_msg(udev, pipe, ATH3K_GETSTATE, +- USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, +- state, 0x01, USB_CTRL_SET_TIMEOUT); ++ ret = usb_control_msg(udev, pipe, ATH3K_GETSTATE, ++ USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, ++ buf, sizeof(*buf), USB_CTRL_SET_TIMEOUT); ++ ++ *state = *buf; ++ kfree(buf); ++ ++ return ret; + } + + static int ath3k_get_version(struct usb_device *udev, + struct ath3k_version *version) + { +- int pipe = 0; ++ int ret, pipe = 0; ++ struct ath3k_version *buf; ++ const int size = sizeof(*buf); ++ ++ buf = kmalloc(size, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; + + pipe = usb_rcvctrlpipe(udev, 0); +- return usb_control_msg(udev, pipe, ATH3K_GETVERSION, +- USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, version, +- sizeof(struct ath3k_version), +- USB_CTRL_SET_TIMEOUT); ++ ret = usb_control_msg(udev, pipe, ATH3K_GETVERSION, ++ USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, ++ buf, size, USB_CTRL_SET_TIMEOUT); ++ ++ memcpy(version, buf, size); ++ kfree(buf); ++ ++ return ret; + } + + static int ath3k_load_fwfile(struct usb_device *udev, diff --git a/queue-3.10/bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch b/queue-3.10/bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch new file mode 100644 index 00000000000..a364b6f0d93 --- /dev/null +++ b/queue-3.10/bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch @@ -0,0 +1,48 @@ +From da9910ac4a816b4340944c78d94c02a35527db46 Mon Sep 17 00:00:00 2001 +From: Jaganath Kanakkassery +Date: Fri, 21 Jun 2013 19:55:11 +0530 +Subject: Bluetooth: Fix invalid length check in l2cap_information_rsp() + +From: Jaganath Kanakkassery + +commit da9910ac4a816b4340944c78d94c02a35527db46 upstream. + +The length check is invalid since the length varies with type of +info response. + +This was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888 + +Because of this, l2cap info rsp is not handled and command reject is sent. + +> ACL data: handle 11 flags 0x02 dlen 16 + L2CAP(s): Info rsp: type 2 result 0 + Extended feature mask 0x00b8 + Enhanced Retransmission mode + Streaming mode + FCS Option + Fixed Channels +< ACL data: handle 11 flags 0x00 dlen 10 + L2CAP(s): Command rej: reason 0 + Command not understood + +Signed-off-by: Jaganath Kanakkassery +Signed-off-by: Chan-Yeol Park +Acked-by: Johan Hedberg +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/l2cap_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4240,7 +4240,7 @@ static inline int l2cap_disconnect_rsp(s + u16 dcid, scid; + struct l2cap_chan *chan; + +- if (cmd_len != sizeof(*rsp)) ++ if (cmd_len < sizeof(*rsp)) + return -EPROTO; + + scid = __le16_to_cpu(rsp->scid); diff --git a/queue-3.10/bluetooth-fix-wrong-use-of-ptr_err-in-btusb.patch b/queue-3.10/bluetooth-fix-wrong-use-of-ptr_err-in-btusb.patch new file mode 100644 index 00000000000..19306c982c8 --- /dev/null +++ b/queue-3.10/bluetooth-fix-wrong-use-of-ptr_err-in-btusb.patch @@ -0,0 +1,115 @@ +From d9c78e9738ccd0017b10b8f44462aafb61904a4a Mon Sep 17 00:00:00 2001 +From: Adam Lee +Date: Wed, 10 Jul 2013 10:02:12 +0800 +Subject: Bluetooth: fix wrong use of PTR_ERR() in btusb + +From: Adam Lee + +commit d9c78e9738ccd0017b10b8f44462aafb61904a4a upstream. + +PTR_ERR() returns a signed long type value which is limited by IS_ERR(), +it must be a negative number whose range is [-MAX_ERRNO, 0). + +The bug here returns negative numbers as error codes, then check it by +"if (ret < 0)", but -PTR_ERR() is actually positive. The wrong use here +leads to failure as below, even panic. + +[ 12.958920] Bluetooth: hci0 command 0xfc8e tx timeout +[ 14.961765] Bluetooth: hci0 command 0xfc8e tx timeout +[ 16.964688] Bluetooth: hci0 command 0xfc8e tx timeout +[ 20.954501] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110) +[ 22.957358] Bluetooth: hci0 command 0xfc8e tx timeout +[ 30.948922] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110) +[ 32.951780] Bluetooth: hci0 command 0xfc8e tx timeout +[ 40.943359] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110) +[ 42.946219] Bluetooth: hci0 command 0xfc8e tx timeout +[ 50.937812] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110) +[ 52.940670] Bluetooth: hci0 command 0xfc8e tx timeout +[ 60.932236] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110) +[ 62.935092] Bluetooth: hci0 command 0xfc8e tx timeout +[ 70.926688] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110) +[ 72.929545] Bluetooth: hci0 command 0xfc8e tx timeout +[ 80.921111] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-110) +[ 82.923969] Bluetooth: hci0 command 0xfc2f tx timeout +[ 90.915542] Bluetooth: hci0 sending Intel patch command (0xfc2f) failed (-110) +[ 92.918406] Bluetooth: hci0 command 0xfc11 tx timeout +[ 100.909955] Bluetooth: hci0 sending Intel patch command (0xfc11) failed (-110) +[ 102.912858] Bluetooth: hci0 command 0xfc60 tx timeout +[ 110.904394] Bluetooth: hci0 sending Intel patch command (0xfc60) failed (-110) +[ 112.907293] Bluetooth: hci0 command 0xfc11 tx timeout +[ 120.898831] Bluetooth: hci0 exiting Intel manufacturer mode failed (-110) +[ 120.904757] bluetoothd[1030]: segfault at 4 ip 00007f8b2eb55236 sp 00007fff53ff6920 error 4 in bluetoothd[7f8b2eaff000+cb000] + +Signed-off-by: Adam Lee +Signed-off-by: Gustavo Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1099,7 +1099,7 @@ static int btusb_setup_intel_patching(st + if (IS_ERR(skb)) { + BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)", + hdev->name, cmd->opcode, PTR_ERR(skb)); +- return -PTR_ERR(skb); ++ return PTR_ERR(skb); + } + + /* It ensures that the returned event matches the event data read from +@@ -1151,7 +1151,7 @@ static int btusb_setup_intel(struct hci_ + if (IS_ERR(skb)) { + BT_ERR("%s sending initial HCI reset command failed (%ld)", + hdev->name, PTR_ERR(skb)); +- return -PTR_ERR(skb); ++ return PTR_ERR(skb); + } + kfree_skb(skb); + +@@ -1165,7 +1165,7 @@ static int btusb_setup_intel(struct hci_ + if (IS_ERR(skb)) { + BT_ERR("%s reading Intel fw version command failed (%ld)", + hdev->name, PTR_ERR(skb)); +- return -PTR_ERR(skb); ++ return PTR_ERR(skb); + } + + if (skb->len != sizeof(*ver)) { +@@ -1223,7 +1223,7 @@ static int btusb_setup_intel(struct hci_ + BT_ERR("%s entering Intel manufacturer mode failed (%ld)", + hdev->name, PTR_ERR(skb)); + release_firmware(fw); +- return -PTR_ERR(skb); ++ return PTR_ERR(skb); + } + + if (skb->data[0]) { +@@ -1280,7 +1280,7 @@ static int btusb_setup_intel(struct hci_ + if (IS_ERR(skb)) { + BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", + hdev->name, PTR_ERR(skb)); +- return -PTR_ERR(skb); ++ return PTR_ERR(skb); + } + kfree_skb(skb); + +@@ -1296,7 +1296,7 @@ exit_mfg_disable: + if (IS_ERR(skb)) { + BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", + hdev->name, PTR_ERR(skb)); +- return -PTR_ERR(skb); ++ return PTR_ERR(skb); + } + kfree_skb(skb); + +@@ -1314,7 +1314,7 @@ exit_mfg_deactivate: + if (IS_ERR(skb)) { + BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", + hdev->name, PTR_ERR(skb)); +- return -PTR_ERR(skb); ++ return PTR_ERR(skb); + } + kfree_skb(skb); + diff --git a/queue-3.10/ixgbe-fix-tx-hang-issue-with-lldpad-on-82598eb.patch b/queue-3.10/ixgbe-fix-tx-hang-issue-with-lldpad-on-82598eb.patch new file mode 100644 index 00000000000..65091022dfe --- /dev/null +++ b/queue-3.10/ixgbe-fix-tx-hang-issue-with-lldpad-on-82598eb.patch @@ -0,0 +1,37 @@ +From 1eb9ac14c34a948bf1538bfb9034e8ab29099a64 Mon Sep 17 00:00:00 2001 +From: Jacob Keller +Date: Fri, 26 Jul 2013 05:46:35 -0700 +Subject: ixgbe: Fix Tx Hang issue with lldpad on 82598EB + +From: Jacob Keller + +commit 1eb9ac14c34a948bf1538bfb9034e8ab29099a64 upstream. + +This patch fixes an issue with the 82598EB device, where lldpad is causing Tx +Hangs on the card as soon as it attempts to configure DCB for the device. The +adapter will continually Tx hang and reset in a loop. + +Signed-off-by: Jacob Keller +Tested-by: Phil Schmitt +Tested-by: Jack Morgan +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c +@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_825 + + /* Enable arbiter */ + reg &= ~IXGBE_DPMCS_ARBDIS; +- /* Enable DFP and Recycle mode */ +- reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM); + reg |= IXGBE_DPMCS_TSOEF; ++ + /* Configure Max TSO packet size 34KB including payload and headers */ + reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT); + diff --git a/queue-3.10/mac80211-fix-duplicate-retransmission-detection.patch b/queue-3.10/mac80211-fix-duplicate-retransmission-detection.patch new file mode 100644 index 00000000000..96c8984c94d --- /dev/null +++ b/queue-3.10/mac80211-fix-duplicate-retransmission-detection.patch @@ -0,0 +1,51 @@ +From 6b0f32745dcfba01d7be33acd1b40306c7a914c6 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 11 Jul 2013 22:33:26 +0200 +Subject: mac80211: fix duplicate retransmission detection + +From: Johannes Berg + +commit 6b0f32745dcfba01d7be33acd1b40306c7a914c6 upstream. + +The duplicate retransmission detection code in mac80211 +erroneously attempts to do the check for every frame, +even frames that don't have a sequence control field or +that don't use it (QoS-Null frames.) + +This is problematic because it causes the code to access +data beyond the end of the SKB and depending on the data +there will drop packets erroneously. + +Correct the code to not do duplicate detection for such +frames. + +I found this error while testing AP powersave, it lead +to retransmitted PS-Poll frames being dropped entirely +as the data beyond the end of the SKB was always zero. + +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -932,8 +932,14 @@ ieee80211_rx_h_check(struct ieee80211_rx + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; + struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); + +- /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */ +- if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) { ++ /* ++ * Drop duplicate 802.11 retransmissions ++ * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") ++ */ ++ if (rx->skb->len >= 24 && rx->sta && ++ !ieee80211_is_ctl(hdr->frame_control) && ++ !ieee80211_is_qos_nullfunc(hdr->frame_control) && ++ !is_multicast_ether_addr(hdr->addr1)) { + if (unlikely(ieee80211_has_retry(hdr->frame_control) && + rx->sta->last_seq_ctrl[rx->seqno_idx] == + hdr->seq_ctrl)) { diff --git a/queue-3.10/mac80211-fix-ethtool-stats-for-non-station-interfaces.patch b/queue-3.10/mac80211-fix-ethtool-stats-for-non-station-interfaces.patch new file mode 100644 index 00000000000..dce79e95792 --- /dev/null +++ b/queue-3.10/mac80211-fix-ethtool-stats-for-non-station-interfaces.patch @@ -0,0 +1,34 @@ +From e13bae4f807401729b3f27c7e882a96b8b292809 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 8 Jul 2013 10:43:31 +0200 +Subject: mac80211: fix ethtool stats for non-station interfaces + +From: Johannes Berg + +commit e13bae4f807401729b3f27c7e882a96b8b292809 upstream. + +As reported in https://bugzilla.kernel.org/show_bug.cgi?id=60514, +the station loop never initialises 'sinfo' and therefore adds up +a stack values, leaking stack information (the number of times it +adds values is easily obtained another way.) + +Fix this by initialising the sinfo for each station to add. + +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/cfg.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -652,6 +652,8 @@ static void ieee80211_get_et_stats(struc + if (sta->sdata->dev != dev) + continue; + ++ sinfo.filled = 0; ++ sta_set_sinfo(sta, &sinfo); + i = 0; + ADD_STA_STATS(sta); + } diff --git a/queue-3.10/mac80211-fix-monitor-interface-suspend-crash-regression.patch b/queue-3.10/mac80211-fix-monitor-interface-suspend-crash-regression.patch new file mode 100644 index 00000000000..4f7ccce7aae --- /dev/null +++ b/queue-3.10/mac80211-fix-monitor-interface-suspend-crash-regression.patch @@ -0,0 +1,52 @@ +From cd34f647a78e7f2296fcb72392b9e5c832793e65 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Tue, 23 Jul 2013 13:56:50 +0200 +Subject: mac80211: fix monitor interface suspend crash regression + +From: Stanislaw Gruszka + +commit cd34f647a78e7f2296fcb72392b9e5c832793e65 upstream. + +My commit: + +commit 12e7f517029dad819c45eca9ca01fdb9ba57616b +Author: Stanislaw Gruszka +Date: Thu Feb 28 10:55:26 2013 +0100 + + mac80211: cleanup generic suspend/resume procedures + +removed check for deleting MONITOR and AP_VLAN when suspend. That can +cause a crash (i.e. in iwlagn_mac_remove_interface()) since we remove +interface in the driver that we did not add before. + +Reference: +http://marc.info/?l=linux-kernel&m=137391815113860&w=2 + +Bisected-by: Ortwin Glück +Reported-and-tested-by: Ortwin Glück +Signed-off-by: Stanislaw Gruszka +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/pm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/mac80211/pm.c ++++ b/net/mac80211/pm.c +@@ -99,10 +99,13 @@ int __ieee80211_suspend(struct ieee80211 + } + mutex_unlock(&local->sta_mtx); + +- /* remove all interfaces */ ++ /* remove all interfaces that were created in the driver */ + list_for_each_entry(sdata, &local->interfaces, list) { +- if (!ieee80211_sdata_running(sdata)) ++ if (!ieee80211_sdata_running(sdata) || ++ sdata->vif.type == NL80211_IFTYPE_AP_VLAN || ++ sdata->vif.type == NL80211_IFTYPE_MONITOR) + continue; ++ + drv_remove_interface(local, sdata); + } + diff --git a/queue-3.10/mac80211-minstrel-fix-null-pointer-dereference-issue.patch b/queue-3.10/mac80211-minstrel-fix-null-pointer-dereference-issue.patch new file mode 100644 index 00000000000..c51e848d1e6 --- /dev/null +++ b/queue-3.10/mac80211-minstrel-fix-null-pointer-dereference-issue.patch @@ -0,0 +1,40 @@ +From 5c9fc93bc9bc417418fc1b6366833ae6a07b804d Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Mon, 15 Jul 2013 14:35:06 +0200 +Subject: mac80211/minstrel: fix NULL pointer dereference issue + +From: Felix Fietkau + +commit 5c9fc93bc9bc417418fc1b6366833ae6a07b804d upstream. + +When priv_sta == NULL, mi->prev_sample is dereferenced too early. Move +the assignment further down, after the rate_control_send_low call. + +Reported-by: Krzysztof Mazur +Signed-off-by: Felix Fietkau +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rc80211_minstrel.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mac80211/rc80211_minstrel.c ++++ b/net/mac80211/rc80211_minstrel.c +@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct iee + struct minstrel_rate *msr, *mr; + unsigned int ndx; + bool mrr_capable; +- bool prev_sample = mi->prev_sample; ++ bool prev_sample; + int delta; + int sampling_ratio; + +@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct iee + (mi->sample_count + mi->sample_deferred / 2); + + /* delta < 0: no sampling required */ ++ prev_sample = mi->prev_sample; + mi->prev_sample = false; + if (delta < 0 || (!mrr_capable && prev_sample)) + return; diff --git a/queue-3.10/mac80211-minstrel_ht-fix-cck-rate-sampling.patch b/queue-3.10/mac80211-minstrel_ht-fix-cck-rate-sampling.patch new file mode 100644 index 00000000000..60cbe86d293 --- /dev/null +++ b/queue-3.10/mac80211-minstrel_ht-fix-cck-rate-sampling.patch @@ -0,0 +1,43 @@ +From 1cd158573951f737fbc878a35cb5eb47bf9af3d5 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Fri, 28 Jun 2013 21:04:35 +0200 +Subject: mac80211/minstrel_ht: fix cck rate sampling + +From: Felix Fietkau + +commit 1cd158573951f737fbc878a35cb5eb47bf9af3d5 upstream. + +The CCK group needs special treatment to set the right flags and rate +index. Add this missing check to prevent setting broken rates for tx +packets. + +Signed-off-by: Felix Fietkau +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rc80211_minstrel_ht.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/net/mac80211/rc80211_minstrel_ht.c ++++ b/net/mac80211/rc80211_minstrel_ht.c +@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct + + sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES]; + info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE; ++ rate->count = 1; ++ ++ if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) { ++ int idx = sample_idx % ARRAY_SIZE(mp->cck_rates); ++ rate->idx = mp->cck_rates[idx]; ++ rate->flags = 0; ++ return; ++ } ++ + rate->idx = sample_idx % MCS_GROUP_RATES + + (sample_group->streams - 1) * MCS_GROUP_RATES; + rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags; +- rate->count = 1; + } + + static void diff --git a/queue-3.10/nl80211-fix-mgmt-tx-status-and-testmode-reporting-for-netns.patch b/queue-3.10/nl80211-fix-mgmt-tx-status-and-testmode-reporting-for-netns.patch new file mode 100644 index 00000000000..3160b19b232 --- /dev/null +++ b/queue-3.10/nl80211-fix-mgmt-tx-status-and-testmode-reporting-for-netns.patch @@ -0,0 +1,53 @@ +From a0ec570f4f69c4cb700d743a915096c2c8f56a99 Mon Sep 17 00:00:00 2001 +From: Michal Kazior +Date: Tue, 25 Jun 2013 09:17:17 +0200 +Subject: nl80211: fix mgmt tx status and testmode reporting for netns + +From: Michal Kazior + +commit a0ec570f4f69c4cb700d743a915096c2c8f56a99 upstream. + +These two events were sent to the default network +namespace. + +This caused AP mode in a non-default netns to not +work correctly. Mgmt tx status was multicasted to +a different (default) netns instead of the one the +AP was in. + +Signed-off-by: Michal Kazior +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/nl80211.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -6588,12 +6588,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_ev + + void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp) + { ++ struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; + void *hdr = ((void **)skb->cb)[1]; + struct nlattr *data = ((void **)skb->cb)[2]; + + nla_nest_end(skb, data); + genlmsg_end(skb, hdr); +- genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp); ++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0, ++ nl80211_testmode_mcgrp.id, gfp); + } + EXPORT_SYMBOL(cfg80211_testmode_event); + #endif +@@ -10028,7 +10030,8 @@ void cfg80211_mgmt_tx_status(struct wire + + genlmsg_end(msg, hdr); + +- genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp); ++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0, ++ nl80211_mlme_mcgrp.id, gfp); + return; + + nla_put_failure: diff --git a/queue-3.10/series b/queue-3.10/series index 6ab3edde42d..ee6d81eb371 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -34,3 +34,21 @@ iwlwifi-add-dell-sku-for-5150-hmc.patch iwlwifi-mvm-fix-flushing-not-started-aggregation-sessions.patch iwlwifi-pcie-clear-rfkill-interrupt-in-ampg.patch atl1c-fix-misuse-of-netdev_alloc_skb-in-refilling-rx-ring.patch +ath9k_htc-do-some-initial-hardware-configuration.patch +ath9k_htc-reboot-firmware-if-it-was-loaded.patch +nl80211-fix-mgmt-tx-status-and-testmode-reporting-for-netns.patch +mac80211-minstrel-fix-null-pointer-dereference-issue.patch +mac80211-minstrel_ht-fix-cck-rate-sampling.patch +mac80211-fix-duplicate-retransmission-detection.patch +mac80211-fix-ethtool-stats-for-non-station-interfaces.patch +mac80211-fix-monitor-interface-suspend-crash-regression.patch +ixgbe-fix-tx-hang-issue-with-lldpad-on-82598eb.patch +ath-wil6210-fix-build-error.patch +bluetooth-fix-invalid-length-check-in-l2cap_information_rsp.patch +bluetooth-ath3k-add-support-for-fujitsu-lifebook-uh5x2.patch +bluetooth-ath3k-don-t-use-stack-memory-for-dma.patch +bluetooth-ath3k-add-support-for-id-0x13d3-0x3402.patch +bluetooth-add-support-for-atheros.patch +bluetooth-add-support-for-atheros_2.patch +bluetooth-add-support-for-mediatek-bluetooth-device.patch +bluetooth-fix-wrong-use-of-ptr_err-in-btusb.patch