--- /dev/null
+From 3b3e0efb5c72c4fc940af50b33626b8a78a907dc Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Sun, 9 Mar 2014 11:02:54 +0100
+Subject: ath9k: fix ready time of the multicast buffer queue
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 3b3e0efb5c72c4fc940af50b33626b8a78a907dc upstream.
+
+qi->tqi_readyTime is written directly to registers that expect
+microseconds as unit instead of TU.
+When setting the CABQ ready time, cur_conf->beacon_interval is in TU, so
+convert it to microseconds before passing it to ath9k_hw.
+
+This should hopefully fix some Tx DMA issues with buffered multicast
+frames in AP mode.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1698,7 +1698,7 @@ int ath_cabq_update(struct ath_softc *sc
+
+ ath9k_hw_get_txq_props(sc->sc_ah, qnum, &qi);
+
+- qi.tqi_readyTime = (cur_conf->beacon_interval *
++ qi.tqi_readyTime = (TU_TO_USEC(cur_conf->beacon_interval) *
+ ATH_CABQ_READY_TIME) / 100;
+ ath_txq_update(sc, qnum, &qi);
+
--- /dev/null
+From 764152ff66f4a8be1f9d7981e542ffdaa5bd7aff Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Thu, 10 Apr 2014 15:06:48 +0200
+Subject: mac80211: exclude AP_VLAN interfaces from tx power calculation
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 764152ff66f4a8be1f9d7981e542ffdaa5bd7aff upstream.
+
+Their power value is initialized to zero. This patch fixes an issue
+where the configured power drops to the minimum value when AP_VLAN
+interfaces are created/removed.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -148,6 +148,8 @@ static u32 ieee80211_hw_conf_chan(struct
+ list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+ if (!rcu_access_pointer(sdata->vif.chanctx_conf))
+ continue;
++ if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
++ continue;
+ power = min(power, sdata->vif.bss_conf.txpower);
+ }
+ rcu_read_unlock();
--- /dev/null
+From d2722f8b87fb172ff2f31d3a2816b31d58678d40 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 4 Mar 2014 11:43:28 +0100
+Subject: mac80211: fix potential use-after-free
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit d2722f8b87fb172ff2f31d3a2816b31d58678d40 upstream.
+
+The bss struct might be freed in ieee80211_rx_bss_put(),
+so we shouldn't use it afterwards.
+
+Fixes: 817cee7675237 ("mac80211: track AP's beacon rate and give it to the driver")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/mlme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2708,8 +2708,8 @@ static void ieee80211_rx_bss_info(struct
+ bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
+ channel);
+ if (bss) {
+- ieee80211_rx_bss_put(local, bss);
+ sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
++ ieee80211_rx_bss_put(local, bss);
+ }
+ }
+
--- /dev/null
+From 115b943a6ea12656088fa1ff6634c0d30815e55b Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 27 Mar 2014 15:39:20 +0100
+Subject: mac80211: fix software remain-on-channel implementation
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 115b943a6ea12656088fa1ff6634c0d30815e55b upstream.
+
+Jouni reported that when doing off-channel transmissions mixed
+with on-channel transmissions, the on-channel ones ended up on
+the off-channel in some cases.
+
+The reason for that is that during the refactoring of the off-
+channel code, I lost the part that stopped all activity and as
+a consequence the on-channel frames (including data frames)
+were no longer queued but would be transmitted on the temporary
+channel.
+
+Fix this by simply restoring the lost activity stop call.
+
+Fixes: 2eb278e083549 ("mac80211: unify SW/offload remain-on-channel")
+Reported-by: Jouni Malinen <j@w1.fi>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/offchannel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/mac80211/offchannel.c
++++ b/net/mac80211/offchannel.c
+@@ -355,6 +355,7 @@ void ieee80211_sw_roc_work(struct work_s
+ struct ieee80211_roc_work *dep;
+
+ /* start this ROC */
++ ieee80211_offchannel_stop_vifs(local);
+
+ /* switch channel etc */
+ ieee80211_recalc_idle(local);
--- /dev/null
+From 1a1cb744de160ee70086a77afff605bbc275d291 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 19 Mar 2014 09:55:55 +0100
+Subject: mac80211: fix suspend vs. authentication race
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 1a1cb744de160ee70086a77afff605bbc275d291 upstream.
+
+Since Stanislaw's patch removing the quiescing code, mac80211 had
+a race regarding suspend vs. authentication: as cfg80211 doesn't
+track authentication attempts, it can't abort them. Therefore the
+attempts may be kept running while suspending, which can lead to
+all kinds of issues, in at least some cases causing an error in
+iwlmvm firmware.
+
+Fix this by aborting the authentication attempt when suspending.
+
+Fixes: 12e7f517029d ("mac80211: cleanup generic suspend/resume procedures")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/ieee80211_i.h | 1 +
+ net/mac80211/mlme.c | 26 ++++++++++++++++++++++++++
+ net/mac80211/pm.c | 14 +++++++++++---
+ 3 files changed, 38 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1385,6 +1385,7 @@ void ieee80211_sta_reset_conn_monitor(st
+ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
+ void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
+ __le16 fc, bool acked);
++void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata);
+ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
+
+ /* IBSS code */
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3504,6 +3504,32 @@ static void ieee80211_restart_sta_timer(
+ }
+
+ #ifdef CONFIG_PM
++void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
++{
++ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
++ u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++
++ sdata_lock(sdata);
++
++ if (ifmgd->auth_data) {
++ /*
++ * If we are trying to authenticate while suspending, cfg80211
++ * won't know and won't actually abort those attempts, thus we
++ * need to do that ourselves.
++ */
++ ieee80211_send_deauth_disassoc(sdata,
++ ifmgd->auth_data->bss->bssid,
++ IEEE80211_STYPE_DEAUTH,
++ WLAN_REASON_DEAUTH_LEAVING,
++ false, frame_buf);
++ ieee80211_destroy_auth_data(sdata, false);
++ cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
++ IEEE80211_DEAUTH_FRAME_LEN);
++ }
++
++ sdata_unlock(sdata);
++}
++
+ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
+ {
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -100,10 +100,18 @@ int __ieee80211_suspend(struct ieee80211
+
+ /* remove all interfaces that were created in the driver */
+ list_for_each_entry(sdata, &local->interfaces, list) {
+- if (!ieee80211_sdata_running(sdata) ||
+- sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+- sdata->vif.type == NL80211_IFTYPE_MONITOR)
++ if (!ieee80211_sdata_running(sdata))
+ continue;
++ switch (sdata->vif.type) {
++ case NL80211_IFTYPE_AP_VLAN:
++ case NL80211_IFTYPE_MONITOR:
++ continue;
++ case NL80211_IFTYPE_STATION:
++ ieee80211_mgd_quiesce(sdata);
++ break;
++ default:
++ break;
++ }
+
+ drv_remove_interface(local, sdata);
+ }
--- /dev/null
+From 112c44b2df0984121a52fbda89425843b8e1a457 Mon Sep 17 00:00:00 2001
+From: Michael Braun <michael-dev@fami-braun.de>
+Date: Thu, 6 Mar 2014 15:08:43 +0100
+Subject: mac80211: fix WPA with VLAN on AP side with ps-sta again
+
+From: Michael Braun <michael-dev@fami-braun.de>
+
+commit 112c44b2df0984121a52fbda89425843b8e1a457 upstream.
+
+commit de74a1d9032f4d37ea453ad2a647e1aff4cd2591
+ "mac80211: fix WPA with VLAN on AP side with ps-sta"
+fixed an issue where queued multicast packets would
+be sent out encrypted with the key of an other bss.
+
+commit "7cbf9d017dbb5e3276de7d527925d42d4c11e732"
+ "mac80211: fix oops on mesh PS broadcast forwarding"
+essentially reverted it, because vif.type cannot be AP_VLAN
+due to the check to vif.type in ieee80211_get_buffered_bc before.
+
+As the later commit intended to fix the MESH case, fix it
+by checking for IFTYPE_AP instead of IFTYPE_AP_VLAN.
+
+Fixes: 7cbf9d017dbb ("mac80211: fix oops on mesh PS broadcast forwarding")
+Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -2909,7 +2909,7 @@ ieee80211_get_buffered_bc(struct ieee802
+ cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+ }
+
+- if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
++ if (sdata->vif.type == NL80211_IFTYPE_AP)
+ sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
+ if (!ieee80211_tx_prepare(sdata, &tx, skb))
+ break;
iwlwifi-dvm-take-mutex-when-sending-sync-bt-config-command.patch
iwlwifi-mvm-disable-uapsd-due-to-bugs-in-the-firmware.patch
crush-fix-off-by-one-errors-in-total_tries-refactor.patch
+mac80211-fix-potential-use-after-free.patch
+mac80211-fix-wpa-with-vlan-on-ap-side-with-ps-sta-again.patch
+mac80211-fix-suspend-vs.-authentication-race.patch
+mac80211-fix-software-remain-on-channel-implementation.patch
+mac80211-exclude-ap_vlan-interfaces-from-tx-power-calculation.patch
+ath9k-fix-ready-time-of-the-multicast-buffer-queue.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
