aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2013-04-01 11:06:30 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2013-04-01 11:06:30 -0400
commitff3421dee60928de95b68a13a1b64125b62b10a4 (patch)
treefd4fc33c7b9ceea20c5a4f3a8881ae46fa01b187
parent07961ac7c0ee8b546658717034fe692fd12eefa9 (diff)
parent6741f40d198c6a5feb23653a1efd4ca47f93d83d (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) sadb_msg prepared for IPSEC userspace forgets to initialize the satype field, fix from Nicolas Dichtel. 2) Fix mac80211 synchronization during station removal, from Johannes Berg. 3) Fix IPSEC sequence number notifications when they wrap, from Steffen Klassert. 4) Fix cfg80211 wdev tracing crashes when add_virtual_intf() returns an error pointer, from Johannes Berg. 5) In mac80211, don't call into the channel context code with the interface list mutex held. From Johannes Berg. 6) In mac80211, if we don't actually associate, do not restart the STA timer, otherwise we can crash. From Ben Greear. 7) Missing dma_mapping_error() check in e1000, ixgb, and e1000e. From Christoph Paasch. 8) Fix sja1000 driver defines to not conflict with SH port, from Marc Kleine-Budde. 9) Don't call il4965_rs_use_green with a NULL station, from Colin Ian King. 10) Suspend/Resume in the FEC driver fail because the buffer descriptors are not initialized at all the moments in which they should. Fix from Frank Li. 11) cpsw and davinci_emac drivers both use the wrong interface to restart a stopped TX queue. Use netif_wake_queue not netif_start_queue, the latter is for initialization/bringup not active management of the queue. From Mugunthan V N. 12) Fix regression in rate calculations done by psched_ratecfg_precompute(), missing u64 type promotion. From Sergey Popovich. 13) Fix length overflow in tg3 VPD parsing, from Kees Cook. 14) AOE driver fails to allocate enough headroom, resulting in crashes. Fix from Eric Dumazet. 15) RX overflow happens too quickly in sky2 driver because pause packet thresholds are not programmed correctly. From Mirko Lindner. 16) Bonding driver manages arp_interval and miimon settings incorrectly, disabling one unintentionally disables both. Fix from Nikolay Aleksandrov. 17) smsc75xx drivers don't program the RX mac properly for jumbo frames. Fix from Steve Glendinning. 18) Fix off-by-one in Codel packet scheduler. From Vijay Subramanian. 19) Fix packet corruption in atl1c by disabling MSI support, from Hannes Frederic Sowa. 20) netdev_rx_handler_unregister() needs a synchronize_net() to fix crashes in bonding driver unload stress tests. From Eric Dumazet. 21) rxlen field of ks8851 RX packet descriptors not interpreted correctly (it is 12 bits not 16 bits, so needs to be masked after shifting the 32-bit value down 16 bits). Fix from Max Nekludov. 22) Fix missed RX/TX enable in sh_eth driver due to mishandling of link change indications. From Sergei Shtylyov. 23) Fix crashes during spurious ECI interrupts in sh_eth driver, also from Sergei Shtylyov. 24) dm9000 driver initialization is done wrong for revision B devices with DSP PHY, from Joseph CHANG. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (53 commits) DM9000B: driver initialization upgrade sh_eth: make 'link' field of 'struct sh_eth_private' *int* sh_eth: workaround for spurious ECI interrupt sh_eth: fix handling of no LINK signal ks8851: Fix interpretation of rxlen field. net: add a synchronize_net() in netdev_rx_handler_unregister() MAINTAINERS: Update netxen_nic maintainers list atl1e: drop pci-msi support because of packet corruption net: fq_codel: Fix off-by-one error net: calxedaxgmac: Wake-on-LAN fixes net: calxedaxgmac: fix rx ring handling when OOM net: core: Remove redundant call to 'nf_reset' in 'dev_forward_skb' smsc75xx: fix jumbo frame support net: fix the use of this_cpu_ptr bonding: fix disabling of arp_interval and miimon ipv6: don't accept node local multicast traffic from the wire sky2: Threshold for Pause Packet is set wrong sky2: Receive Overflows not counted aoe: reserve enough headroom on skbs line up comment for ndo_bridge_getlink ...
Diffstat
-rw-r--r--MAINTAINERS4
-rw-r--r--drivers/block/aoe/aoecmd.c3
-rw-r--r--drivers/net/bonding/bond_sysfs.c92
-rw-r--r--drivers/net/can/sja1000/Kconfig1
-rw-r--r--drivers/net/can/sja1000/plx_pci.c4
-rw-r--r--drivers/net/can/sja1000/sja1000.c6
-rw-r--r--drivers/net/can/sja1000/sja1000.h2
-rw-r--r--drivers/net/ethernet/atheros/atl1e/atl1e.h1
-rw-r--r--drivers/net/ethernet/atheros/atl1e/atl1e_main.c19
-rw-r--r--drivers/net/ethernet/broadcom/tg3.c7
-rw-r--r--drivers/net/ethernet/calxeda/xgmac.c9
-rw-r--r--drivers/net/ethernet/davicom/dm9000.c214
-rw-r--r--drivers/net/ethernet/davicom/dm9000.h11
-rw-r--r--drivers/net/ethernet/freescale/fec.c82
-rw-r--r--drivers/net/ethernet/intel/e1000/e1000_ethtool.c14
-rw-r--r--drivers/net/ethernet/intel/e1000e/netdev.c7
-rw-r--r--drivers/net/ethernet/intel/ixgb/ixgb_main.c7
-rw-r--r--drivers/net/ethernet/marvell/sky2.c2
-rw-r--r--drivers/net/ethernet/marvell/sky2.h2
-rw-r--r--drivers/net/ethernet/micrel/ks8851.c2
-rw-r--r--drivers/net/ethernet/renesas/sh_eth.c28
-rw-r--r--drivers/net/ethernet/renesas/sh_eth.h2
-rw-r--r--drivers/net/ethernet/ti/cpsw.c2
-rw-r--r--drivers/net/ethernet/ti/davinci_emac.c2
-rw-r--r--drivers/net/usb/smsc75xx.c12
-rw-r--r--drivers/net/wireless/ath/ath9k/link.c3
-rw-r--r--drivers/net/wireless/b43/dma.c65
-rw-r--r--drivers/net/wireless/b43/phy_n.c8
-rw-r--r--drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c369
-rw-r--r--drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c64
-rw-r--r--drivers/net/wireless/iwlegacy/4965-rs.c3
-rw-r--r--drivers/net/wireless/iwlwifi/dvm/lib.c9
-rw-r--r--drivers/net/wireless/iwlwifi/dvm/ucode.c4
-rw-r--r--drivers/net/wireless/iwlwifi/pcie/trans.c13
-rw-r--r--drivers/net/wireless/iwlwifi/pcie/tx.c2
-rw-r--r--drivers/net/wireless/mwifiex/pcie.c1
-rw-r--r--include/linux/netdevice.h2
-rw-r--r--net/core/dev.c7
-rw-r--r--net/core/flow.c2
-rw-r--r--net/core/rtnetlink.c4
-rw-r--r--net/ipv6/ip6_input.c12
-rw-r--r--net/key/af_key.c1
-rw-r--r--net/mac80211/iface.c35
-rw-r--r--net/mac80211/mesh.c3
-rw-r--r--net/mac80211/mlme.c6
-rw-r--r--net/mac80211/rx.c14
-rw-r--r--net/mac80211/sta_info.c12
-rw-r--r--net/sched/sch_fq_codel.c2
-rw-r--r--net/sched/sch_generic.c2
-rw-r--r--net/wireless/core.c64
-rw-r--r--net/wireless/core.h3
-rw-r--r--net/wireless/nl80211.c52
-rw-r--r--net/wireless/scan.c24
-rw-r--r--net/wireless/sme.c6
-rw-r--r--net/wireless/trace.h5
-rw-r--r--net/wireless/wext-sme.c6
-rw-r--r--net/xfrm/xfrm_replay.c66
57 files changed, 793 insertions, 611 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 74e58a4d035b..836a6183c37f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5065,9 +5065,8 @@ S: Maintained
5065F: drivers/net/ethernet/marvell/sk* 5065F: drivers/net/ethernet/marvell/sk*
5066 5066
5067MARVELL LIBERTAS WIRELESS DRIVER 5067MARVELL LIBERTAS WIRELESS DRIVER
5068M: Dan Williams <dcbw@redhat.com>
5069L: libertas-dev@lists.infradead.org 5068L: libertas-dev@lists.infradead.org
5070S: Maintained 5069S: Orphan
5071F: drivers/net/wireless/libertas/ 5070F: drivers/net/wireless/libertas/
5072 5071
5073MARVELL MV643XX ETHERNET DRIVER 5072MARVELL MV643XX ETHERNET DRIVER
@@ -5569,6 +5568,7 @@ F: include/uapi/linux/if_*
5569F: include/uapi/linux/netdevice.h 5568F: include/uapi/linux/netdevice.h
5570 5569
5571NETXEN (1/10) GbE SUPPORT 5570NETXEN (1/10) GbE SUPPORT
5571M: Manish Chopra <manish.chopra@qlogic.com>
5572M: Sony Chacko <sony.chacko@qlogic.com> 5572M: Sony Chacko <sony.chacko@qlogic.com>
5573M: Rajesh Borundia <rajesh.borundia@qlogic.com> 5573M: Rajesh Borundia <rajesh.borundia@qlogic.com>
5574L: netdev@vger.kernel.org 5574L: netdev@vger.kernel.org
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 25ef5c014fca..92b6d7c51e39 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -51,8 +51,9 @@ new_skb(ulong len)
51{ 51{
52 struct sk_buff *skb; 52 struct sk_buff *skb;
53 53
54 skb = alloc_skb(len, GFP_ATOMIC); 54 skb = alloc_skb(len + MAX_HEADER, GFP_ATOMIC);
55 if (skb) { 55 if (skb) {
56 skb_reserve(skb, MAX_HEADER);
56 skb_reset_mac_header(skb); 57 skb_reset_mac_header(skb);
57 skb_reset_network_header(skb); 58 skb_reset_network_header(skb);
58 skb->protocol = __constant_htons(ETH_P_AOE); 59 skb->protocol = __constant_htons(ETH_P_AOE);
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index db103e03ba05..ea7a388f4843 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -527,7 +527,7 @@ static ssize_t bonding_store_arp_interval(struct device *d,
527 goto out; 527 goto out;
528 } 528 }
529 if (new_value < 0) { 529 if (new_value < 0) {
530 pr_err("%s: Invalid arp_interval value %d not in range 1-%d; rejected.\n", 530 pr_err("%s: Invalid arp_interval value %d not in range 0-%d; rejected.\n",
531 bond->dev->name, new_value, INT_MAX); 531 bond->dev->name, new_value, INT_MAX);
532 ret = -EINVAL; 532 ret = -EINVAL;
533 goto out; 533 goto out;
@@ -542,14 +542,15 @@ static ssize_t bonding_store_arp_interval(struct device *d,
542 pr_info("%s: Setting ARP monitoring interval to %d.\n", 542 pr_info("%s: Setting ARP monitoring interval to %d.\n",
543 bond->dev->name, new_value); 543 bond->dev->name, new_value);
544 bond->params.arp_interval = new_value; 544 bond->params.arp_interval = new_value;
545 if (bond->params.miimon) { 545 if (new_value) {
546 pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n", 546 if (bond->params.miimon) {
547 bond->dev->name, bond->dev->name); 547 pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
548 bond->params.miimon = 0; 548 bond->dev->name, bond->dev->name);
549 } 549 bond->params.miimon = 0;
550 if (!bond->params.arp_targets[0]) { 550 }
551 pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n", 551 if (!bond->params.arp_targets[0])
552 bond->dev->name); 552 pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
553 bond->dev->name);
553 } 554 }
554 if (bond->dev->flags & IFF_UP) { 555 if (bond->dev->flags & IFF_UP) {
555 /* If the interface is up, we may need to fire off 556 /* If the interface is up, we may need to fire off
@@ -557,10 +558,13 @@ static ssize_t bonding_store_arp_interval(struct device *d,
557 * timer will get fired off when the open function 558 * timer will get fired off when the open function
558 * is called. 559 * is called.
559 */ 560 */
560 cancel_delayed_work_sync(&bond->mii_work); 561 if (!new_value) {
561 queue_delayed_work(bond->wq, &bond->arp_work, 0); 562 cancel_delayed_work_sync(&bond->arp_work);
563 } else {
564 cancel_delayed_work_sync(&bond->mii_work);
565 queue_delayed_work(bond->wq, &bond->arp_work, 0);
566 }
562 } 567 }
563
564out: 568out:
565 rtnl_unlock(); 569 rtnl_unlock();
566 return ret; 570 return ret;
@@ -702,7 +706,7 @@ static ssize_t bonding_store_downdelay(struct device *d,
702 } 706 }
703 if (new_value < 0) { 707 if (new_value < 0) {
704 pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n", 708 pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
705 bond->dev->name, new_value, 1, INT_MAX); 709 bond->dev->name, new_value, 0, INT_MAX);
706 ret = -EINVAL; 710 ret = -EINVAL;
707 goto out; 711 goto out;
708 } else { 712 } else {
@@ -757,8 +761,8 @@ static ssize_t bonding_store_updelay(struct device *d,
757 goto out; 761 goto out;
758 } 762 }
759 if (new_value < 0) { 763 if (new_value < 0) {
760 pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n", 764 pr_err("%s: Invalid up delay value %d not in range %d-%d; rejected.\n",
761 bond->dev->name, new_value, 1, INT_MAX); 765 bond->dev->name, new_value, 0, INT_MAX);
762 ret = -EINVAL; 766 ret = -EINVAL;
763 goto out; 767 goto out;
764 } else { 768 } else {
@@ -968,37 +972,37 @@ static ssize_t bonding_store_miimon(struct device *d,
968 } 972 }
969 if (new_value < 0) { 973 if (new_value < 0) {
970 pr_err("%s: Invalid miimon value %d not in range %d-%d; rejected.\n", 974 pr_err("%s: Invalid miimon value %d not in range %d-%d; rejected.\n",
971 bond->dev->name, new_value, 1, INT_MAX); 975 bond->dev->name, new_value, 0, INT_MAX);
972 ret = -EINVAL; 976 ret = -EINVAL;
973 goto out; 977 goto out;
974 } else { 978 }
975 pr_info("%s: Setting MII monitoring interval to %d.\n", 979 pr_info("%s: Setting MII monitoring interval to %d.\n",
976 bond->dev->name, new_value); 980 bond->dev->name, new_value);
977 bond->params.miimon = new_value; 981 bond->params.miimon = new_value;
978 if (bond->params.updelay) 982 if (bond->params.updelay)
979 pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n", 983 pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
980 bond->dev->name, 984 bond->dev->name,
981 bond->params.updelay * bond->params.miimon); 985 bond->params.updelay * bond->params.miimon);
982 if (bond->params.downdelay) 986 if (bond->params.downdelay)
983 pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n", 987 pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
984 bond->dev->name, 988 bond->dev->name,
985 bond->params.downdelay * bond->params.miimon); 989 bond->params.downdelay * bond->params.miimon);
986 if (bond->params.arp_interval) { 990 if (new_value && bond->params.arp_interval) {
987 pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n", 991 pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
988 bond->dev->name); 992 bond->dev->name);
989 bond->params.arp_interval = 0; 993 bond->params.arp_interval = 0;
990 if (bond->params.arp_validate) { 994 if (bond->params.arp_validate)
991 bond->params.arp_validate = 995 bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
992 BOND_ARP_VALIDATE_NONE; 996 }
993 } 997 if (bond->dev->flags & IFF_UP) {
994 } 998 /* If the interface is up, we may need to fire off
995 999 * the MII timer. If the interface is down, the
996 if (bond->dev->flags & IFF_UP) { 1000 * timer will get fired off when the open function
997 /* If the interface is up, we may need to fire off 1001 * is called.
998 * the MII timer. If the interface is down, the 1002 */
999 * timer will get fired off when the open function 1003 if (!new_value) {
1000 * is called. 1004 cancel_delayed_work_sync(&bond->mii_work);
1001 */ 1005 } else {
1002 cancel_delayed_work_sync(&bond->arp_work); 1006 cancel_delayed_work_sync(&bond->arp_work);
1003 queue_delayed_work(bond->wq, &bond->mii_work, 0); 1007 queue_delayed_work(bond->wq, &bond->mii_work, 0);
1004 } 1008 }
diff --git a/drivers/net/can/sja1000/Kconfig b/drivers/net/can/sja1000/Kconfig
index b39ca5b3ea7f..ff2ba86cd4a4 100644
--- a/drivers/net/can/sja1000/Kconfig
+++ b/drivers/net/can/sja1000/Kconfig
@@ -46,6 +46,7 @@ config CAN_EMS_PCI
46config CAN_PEAK_PCMCIA 46config CAN_PEAK_PCMCIA
47 tristate "PEAK PCAN-PC Card" 47 tristate "PEAK PCAN-PC Card"
48 depends on PCMCIA 48 depends on PCMCIA
49 depends on HAS_IOPORT
49 ---help--- 50 ---help---
50 This driver is for the PCAN-PC Card PCMCIA adapter (1 or 2 channels) 51 This driver is for the PCAN-PC Card PCMCIA adapter (1 or 2 channels)
51 from PEAK-System (http://www.peak-system.com). To compile this 52 from PEAK-System (http://www.peak-system.com). To compile this
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index a042cdc260dc..3c18d7d000ed 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -348,7 +348,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
348 */ 348 */
349 if ((priv->read_reg(priv, REG_CR) & REG_CR_BASICCAN_INITIAL_MASK) == 349 if ((priv->read_reg(priv, REG_CR) & REG_CR_BASICCAN_INITIAL_MASK) ==
350 REG_CR_BASICCAN_INITIAL && 350 REG_CR_BASICCAN_INITIAL &&
351 (priv->read_reg(priv, REG_SR) == REG_SR_BASICCAN_INITIAL) && 351 (priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_BASICCAN_INITIAL) &&
352 (priv->read_reg(priv, REG_IR) == REG_IR_BASICCAN_INITIAL)) 352 (priv->read_reg(priv, REG_IR) == REG_IR_BASICCAN_INITIAL))
353 flag = 1; 353 flag = 1;
354 354
@@ -360,7 +360,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
360 * See states on p. 23 of the Datasheet. 360 * See states on p. 23 of the Datasheet.
361 */ 361 */
362 if (priv->read_reg(priv, REG_MOD) == REG_MOD_PELICAN_INITIAL && 362 if (priv->read_reg(priv, REG_MOD) == REG_MOD_PELICAN_INITIAL &&
363 priv->read_reg(priv, REG_SR) == REG_SR_PELICAN_INITIAL && 363 priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_PELICAN_INITIAL &&
364 priv->read_reg(priv, REG_IR) == REG_IR_PELICAN_INITIAL) 364 priv->read_reg(priv, REG_IR) == REG_IR_PELICAN_INITIAL)
365 return flag; 365 return flag;
366 366
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index daf4013a8fc7..e4df307eaa90 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -92,7 +92,7 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
92 */ 92 */
93 spin_lock_irqsave(&priv->cmdreg_lock, flags); 93 spin_lock_irqsave(&priv->cmdreg_lock, flags);
94 priv->write_reg(priv, REG_CMR, val); 94 priv->write_reg(priv, REG_CMR, val);
95 priv->read_reg(priv, REG_SR); 95 priv->read_reg(priv, SJA1000_REG_SR);
96 spin_unlock_irqrestore(&priv->cmdreg_lock, flags); 96 spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
97} 97}
98 98
@@ -502,7 +502,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
502 502
503 while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) { 503 while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
504 n++; 504 n++;
505 status = priv->read_reg(priv, REG_SR); 505 status = priv->read_reg(priv, SJA1000_REG_SR);
506 /* check for absent controller due to hw unplug */ 506 /* check for absent controller due to hw unplug */
507 if (status == 0xFF && sja1000_is_absent(priv)) 507 if (status == 0xFF && sja1000_is_absent(priv))
508 return IRQ_NONE; 508 return IRQ_NONE;
@@ -530,7 +530,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
530 /* receive interrupt */ 530 /* receive interrupt */
531 while (status & SR_RBS) { 531 while (status & SR_RBS) {
532 sja1000_rx(dev); 532 sja1000_rx(dev);
533 status = priv->read_reg(priv, REG_SR); 533 status = priv->read_reg(priv, SJA1000_REG_SR);
534 /* check for absent controller */ 534 /* check for absent controller */
535 if (status == 0xFF && sja1000_is_absent(priv)) 535 if (status == 0xFF && sja1000_is_absent(priv))
536 return IRQ_NONE; 536 return IRQ_NONE;
diff --git a/drivers/net/can/sja1000/sja1000.h b/drivers/net/can/sja1000/sja1000.h
index afa99847a510..aa48e053da27 100644
--- a/drivers/net/can/sja1000/sja1000.h
+++ b/drivers/net/can/sja1000/sja1000.h
@@ -56,7 +56,7 @@
56/* SJA1000 registers - manual section 6.4 (Pelican Mode) */ 56/* SJA1000 registers - manual section 6.4 (Pelican Mode) */
57#define REG_MOD 0x00 57#define REG_MOD 0x00
58#define REG_CMR 0x01 58#define REG_CMR 0x01
59#define REG_SR 0x02 59#define SJA1000_REG_SR 0x02
60#define REG_IR 0x03 60#define REG_IR 0x03
61#define REG_IER 0x04 61#define REG_IER 0x04
62#define REG_ALC 0x0B 62#define REG_ALC 0x0B
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e.h b/drivers/net/ethernet/atheros/atl1e/atl1e.h
index 829b5ad71d0d..edfdf6b950e7 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e.h
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e.h
@@ -438,7 +438,6 @@ struct atl1e_adapter {
438 struct atl1e_hw hw; 438 struct atl1e_hw hw;
439 struct atl1e_hw_stats hw_stats; 439 struct atl1e_hw_stats hw_stats;
440 440
441 bool have_msi;
442 u32 wol; 441 u32 wol;
443 u16 link_speed; 442 u16 link_speed;
444 u16 link_duplex; 443 u16 link_duplex;
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index 92f4734f860d..f73d5609439a 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -1849,34 +1849,19 @@ static void atl1e_free_irq(struct atl1e_adapter *adapter)
1849 struct net_device *netdev = adapter->netdev; 1849 struct net_device *netdev = adapter->netdev;
1850 1850
1851 free_irq(adapter->pdev->irq, netdev); 1851 free_irq(adapter->pdev->irq, netdev);
1852
1853 if (adapter->have_msi)
1854 pci_disable_msi(adapter->pdev);
1855} 1852}
1856 1853
1857static int atl1e_request_irq(struct atl1e_adapter *adapter) 1854static int atl1e_request_irq(struct atl1e_adapter *adapter)
1858{ 1855{
1859 struct pci_dev *pdev = adapter->pdev; 1856 struct pci_dev *pdev = adapter->pdev;
1860 struct net_device *netdev = adapter->netdev; 1857 struct net_device *netdev = adapter->netdev;
1861 int flags = 0;
1862 int err = 0; 1858 int err = 0;
1863 1859
1864 adapter->have_msi = true; 1860 err = request_irq(pdev->irq, atl1e_intr, IRQF_SHARED, netdev->name,
1865 err = pci_enable_msi(pdev); 1861 netdev);
1866 if (err) {
1867 netdev_dbg(netdev,
1868 "Unable to allocate MSI interrupt Error: %d\n", err);
1869 adapter->have_msi = false;
1870 }
1871
1872 if (!adapter->have_msi)
1873 flags |= IRQF_SHARED;
1874 err = request_irq(pdev->irq, atl1e_intr, flags, netdev->name, netdev);
1875 if (err) { 1862 if (err) {
1876 netdev_dbg(adapter->netdev, 1863 netdev_dbg(adapter->netdev,
1877 "Unable to allocate interrupt Error: %d\n", err); 1864 "Unable to allocate interrupt Error: %d\n", err);
1878 if (adapter->have_msi)
1879 pci_disable_msi(pdev);
1880 return err; 1865 return err;
1881 } 1866 }
1882 netdev_dbg(netdev, "atl1e_request_irq OK\n"); 1867 netdev_dbg(netdev, "atl1e_request_irq OK\n");
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 67d2663b3974..17a972734ba7 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -14604,8 +14604,11 @@ static void tg3_read_vpd(struct tg3 *tp)
14604 if (j + len > block_end) 14604 if (j + len > block_end)
14605 goto partno; 14605 goto partno;
14606 14606
14607 memcpy(tp->fw_ver, &vpd_data[j], len); 14607 if (len >= sizeof(tp->fw_ver))
14608 strncat(tp->fw_ver, " bc ", vpdlen - len - 1); 14608 len = sizeof(tp->fw_ver) - 1;
14609 memset(tp->fw_ver, 0, sizeof(tp->fw_ver));
14610 snprintf(tp->fw_ver, sizeof(tp->fw_ver), "%.*s bc ", len,
14611 &vpd_data[j]);
14609 } 14612 }
14610 14613
14611partno: 14614partno:
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index a170065b5973..b0ebc9f6d55e 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -163,6 +163,7 @@
163#define XGMAC_FLOW_CTRL_FCB_BPA 0x00000001 /* Flow Control Busy ... */ 163#define XGMAC_FLOW_CTRL_FCB_BPA 0x00000001 /* Flow Control Busy ... */
164 164
165/* XGMAC_INT_STAT reg */ 165/* XGMAC_INT_STAT reg */
166#define XGMAC_INT_STAT_PMTIM 0x00800000 /* PMT Interrupt Mask */
166#define XGMAC_INT_STAT_PMT 0x0080 /* PMT Interrupt Status */ 167#define XGMAC_INT_STAT_PMT 0x0080 /* PMT Interrupt Status */
167#define XGMAC_INT_STAT_LPI 0x0040 /* LPI Interrupt Status */ 168#define XGMAC_INT_STAT_LPI 0x0040 /* LPI Interrupt Status */
168 169
@@ -960,6 +961,9 @@ static int xgmac_hw_init(struct net_device *dev)
960 writel(DMA_INTR_DEFAULT_MASK, ioaddr + XGMAC_DMA_STATUS); 961 writel(DMA_INTR_DEFAULT_MASK, ioaddr + XGMAC_DMA_STATUS);
961 writel(DMA_INTR_DEFAULT_MASK, ioaddr + XGMAC_DMA_INTR_ENA); 962 writel(DMA_INTR_DEFAULT_MASK, ioaddr + XGMAC_DMA_INTR_ENA);
962 963
964 /* Mask power mgt interrupt */
965 writel(XGMAC_INT_STAT_PMTIM, ioaddr + XGMAC_INT_STAT);
966
963 /* XGMAC requires AXI bus init. This is a 'magic number' for now */ 967 /* XGMAC requires AXI bus init. This is a 'magic number' for now */
964 writel(0x0077000E, ioaddr + XGMAC_DMA_AXI_BUS); 968 writel(0x0077000E, ioaddr + XGMAC_DMA_AXI_BUS);
965 969
@@ -1141,6 +1145,9 @@ static int xgmac_rx(struct xgmac_priv *priv, int limit)
1141 struct sk_buff *skb; 1145 struct sk_buff *skb;
1142 int frame_len; 1146 int frame_len;
1143 1147
1148 if (!dma_ring_cnt(priv->rx_head, priv->rx_tail, DMA_RX_RING_SZ))
1149 break;
1150
1144 entry = priv->rx_tail; 1151 entry = priv->rx_tail;
1145 p = priv->dma_rx + entry; 1152 p = priv->dma_rx + entry;
1146 if (desc_get_owner(p)) 1153 if (desc_get_owner(p))
@@ -1825,7 +1832,7 @@ static void xgmac_pmt(void __iomem *ioaddr, unsigned long mode)
1825 unsigned int pmt = 0; 1832 unsigned int pmt = 0;
1826 1833
1827 if (mode & WAKE_MAGIC) 1834 if (mode & WAKE_MAGIC)
1828 pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_MAGIC_PKT; 1835 pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_MAGIC_PKT_EN;
1829 if (mode & WAKE_UCAST) 1836 if (mode & WAKE_UCAST)
1830 pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_GLBL_UNICAST; 1837 pmt |= XGMAC_PMT_POWERDOWN | XGMAC_PMT_GLBL_UNICAST;
1831 1838
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 8cdf02503d13..9eada8e86078 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -257,6 +257,107 @@ static void dm9000_dumpblk_32bit(void __iomem *reg, int count)
257 tmp = readl(reg); 257 tmp = readl(reg);
258} 258}
259 259
260/*
261 * Sleep, either by using msleep() or if we are suspending, then
262 * use mdelay() to sleep.
263 */
264static void dm9000_msleep(board_info_t *db, unsigned int ms)
265{
266 if (db->in_suspend)
267 mdelay(ms);
268 else
269 msleep(ms);
270}
271
272/* Read a word from phyxcer */
273static int
274dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
275{
276 board_info_t *db = netdev_priv(dev);
277 unsigned long flags;
278 unsigned int reg_save;
279 int ret;
280
281 mutex_lock(&db->addr_lock);
282
283 spin_lock_irqsave(&db->lock, flags);
284
285 /* Save previous register address */
286 reg_save = readb(db->io_addr);
287
288 /* Fill the phyxcer register into REG_0C */
289 iow(db, DM9000_EPAR, DM9000_PHY | reg);
290
291 /* Issue phyxcer read command */
292 iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS);
293
294 writeb(reg_save, db->io_addr);
295 spin_unlock_irqrestore(&db->lock, flags);
296
297 dm9000_msleep(db, 1); /* Wait read complete */
298
299 spin_lock_irqsave(&db->lock, flags);
300 reg_save = readb(db->io_addr);
301
302 iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer read command */
303
304 /* The read data keeps on REG_0D & REG_0E */
305 ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
306
307 /* restore the previous address */
308 writeb(reg_save, db->io_addr);
309 spin_unlock_irqrestore(&db->lock, flags);
310
311 mutex_unlock(&db->addr_lock);
312
313 dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
314 return ret;
315}
316
317/* Write a word to phyxcer */
318static void
319dm9000_phy_write(struct net_device *dev,
320 int phyaddr_unused, int reg, int value)
321{
322 board_info_t *db = netdev_priv(dev);
323 unsigned long flags;
324 unsigned long reg_save;
325
326 dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
327 mutex_lock(&db->addr_lock);
328
329 spin_lock_irqsave(&db->lock, flags);
330
331 /* Save previous register address */
332 reg_save = readb(db->io_addr);
333
334 /* Fill the phyxcer register into REG_0C */
335 iow(db, DM9000_EPAR, DM9000_PHY | reg);
336
337 /* Fill the written data into REG_0D & REG_0E */
338 iow(db, DM9000_EPDRL, value);
339 iow(db, DM9000_EPDRH, value >> 8);
340
341 /* Issue phyxcer write command */
342 iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW);
343
344 writeb(reg_save, db->io_addr);
345 spin_unlock_irqrestore(&db->lock, flags);
346
347 dm9000_msleep(db, 1); /* Wait write complete */
348
349 spin_lock_irqsave(&db->lock, flags);
350 reg_save = readb(db->io_addr);
351
352 iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer write command */
353
354 /* restore the previous address */
355 writeb(reg_save, db->io_addr);
356
357 spin_unlock_irqrestore(&db->lock, flags);
358 mutex_unlock(&db->addr_lock);
359}
360
260/* dm9000_set_io 361/* dm9000_set_io
261 * 362 *
262 * select the specified set of io routines to use with the 363 * select the specified set of io routines to use with the
@@ -795,6 +896,9 @@ dm9000_init_dm9000(struct net_device *dev)
795 896
796 iow(db, DM9000_GPCR, GPCR_GEP_CNTL); /* Let GPIO0 output */ 897 iow(db, DM9000_GPCR, GPCR_GEP_CNTL); /* Let GPIO0 output */
797 898
899 dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET); /* PHY RESET */
900 dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM); /* Init */
901
798 ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0; 902 ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0;
799 903
800 /* if wol is needed, then always set NCR_WAKEEN otherwise we end 904 /* if wol is needed, then always set NCR_WAKEEN otherwise we end
@@ -1201,109 +1305,6 @@ dm9000_open(struct net_device *dev)
1201 return 0; 1305 return 0;
1202} 1306}
1203 1307
1204/*
1205 * Sleep, either by using msleep() or if we are suspending, then
1206 * use mdelay() to sleep.
1207 */
1208static void dm9000_msleep(board_info_t *db, unsigned int ms)
1209{
1210 if (db->in_suspend)
1211 mdelay(ms);
1212 else
1213 msleep(ms);
1214}
1215
1216/*
1217 * Read a word from phyxcer
1218 */
1219static int
1220dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
1221{
1222 board_info_t *db = netdev_priv(dev);
1223 unsigned long flags;
1224 unsigned int reg_save;
1225 int ret;
1226
1227 mutex_lock(&db->addr_lock);
1228
1229 spin_lock_irqsave(&db->lock,flags);
1230
1231 /* Save previous register address */
1232 reg_save = readb(db->io_addr);
1233
1234 /* Fill the phyxcer register into REG_0C */
1235 iow(db, DM9000_EPAR, DM9000_PHY | reg);
1236
1237 iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS); /* Issue phyxcer read command */
1238
1239 writeb(reg_save, db->io_addr);
1240 spin_unlock_irqrestore(&db->lock,flags);
1241
1242 dm9000_msleep(db, 1); /* Wait read complete */
1243
1244 spin_lock_irqsave(&db->lock,flags);
1245 reg_save = readb(db->io_addr);
1246
1247 iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer read command */
1248
1249 /* The read data keeps on REG_0D & REG_0E */
1250 ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
1251
1252 /* restore the previous address */
1253 writeb(reg_save, db->io_addr);
1254 spin_unlock_irqrestore(&db->lock,flags);
1255
1256 mutex_unlock(&db->addr_lock);
1257
1258 dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
1259 return ret;
1260}
1261
1262/*
1263 * Write a word to phyxcer
1264 */
1265static void
1266dm9000_phy_write(struct net_device *dev,
1267 int phyaddr_unused, int reg, int value)
1268{
1269 board_info_t *db = netdev_priv(dev);
1270 unsigned long flags;
1271 unsigned long reg_save;
1272
1273 dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
1274 mutex_lock(&db->addr_lock);
1275
1276 spin_lock_irqsave(&db->lock,flags);
1277
1278 /* Save previous register address */
1279 reg_save = readb(db->io_addr);
1280
1281 /* Fill the phyxcer register into REG_0C */
1282 iow(db, DM9000_EPAR, DM9000_PHY | reg);
1283
1284 /* Fill the written data into REG_0D & REG_0E */
1285 iow(db, DM9000_EPDRL, value);
1286 iow(db, DM9000_EPDRH, value >> 8);
1287
1288 iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW); /* Issue phyxcer write command */
1289
1290 writeb(reg_save, db->io_addr);
1291 spin_unlock_irqrestore(&db->lock, flags);
1292
1293 dm9000_msleep(db, 1); /* Wait write complete */
1294
1295 spin_lock_irqsave(&db->lock,flags);
1296 reg_save = readb(db->io_addr);
1297
1298 iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer write command */
1299
1300 /* restore the previous address */
1301 writeb(reg_save, db->io_addr);
1302
1303 spin_unlock_irqrestore(&db->lock, flags);
1304 mutex_unlock(&db->addr_lock);
1305}
1306
1307static void 1308static void
1308dm9000_shutdown(struct net_device *dev) 1309dm9000_shutdown(struct net_device *dev)
1309{ 1310{
@@ -1502,7 +1503,12 @@ dm9000_probe(struct platform_device *pdev)
1502 db->flags |= DM9000_PLATF_SIMPLE_PHY; 1503 db->flags |= DM9000_PLATF_SIMPLE_PHY;
1503#endif 1504#endif
1504 1505
1505 dm9000_reset(db); 1506 /* Fixing bug on dm9000_probe, takeover dm9000_reset(db),
1507 * Need 'NCR_MAC_LBK' bit to indeed stable our DM9000 fifo
1508 * while probe stage.
1509 */
1510
1511 iow(db, DM9000_NCR, NCR_MAC_LBK | NCR_RST);
1506 1512
1507 /* try multiple times, DM9000 sometimes gets the read wrong */ 1513 /* try multiple times, DM9000 sometimes gets the read wrong */
1508 for (i = 0; i < 8; i++) { 1514 for (i = 0; i < 8; i++) {
diff --git a/drivers/net/ethernet/davicom/dm9000.h b/drivers/net/ethernet/davicom/dm9000.h
index 55688bd1a3ef..9ce058adabab 100644
--- a/drivers/net/ethernet/davicom/dm9000.h
+++ b/drivers/net/ethernet/davicom/dm9000.h
@@ -69,7 +69,9 @@
69#define NCR_WAKEEN (1<<6) 69#define NCR_WAKEEN (1<<6)
70#define NCR_FCOL (1<<4) 70#define NCR_FCOL (1<<4)
71#define NCR_FDX (1<<3) 71#define NCR_FDX (1<<3)
72#define NCR_LBK (3<<1) 72
73#define NCR_RESERVED (3<<1)
74#define NCR_MAC_LBK (1<<1)
73#define NCR_RST (1<<0) 75#define NCR_RST (1<<0)
74 76
75#define NSR_SPEED (1<<7) 77#define NSR_SPEED (1<<7)
@@ -167,5 +169,12 @@
167#define ISR_LNKCHNG (1<<5) 169#define ISR_LNKCHNG (1<<5)
168#define ISR_UNDERRUN (1<<4) 170#define ISR_UNDERRUN (1<<4)
169 171
172/* Davicom MII registers.
173 */
174
175#define MII_DM_DSPCR 0x1b /* DSP Control Register */
176
177#define DSPCR_INIT_PARAM 0xE100 /* DSP init parameter */
178
170#endif /* _DM9000X_H_ */ 179#endif /* _DM9000X_H_ */
171 180
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index 911d0253dbb2..f292c3aa423f 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -345,6 +345,53 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
345 return NETDEV_TX_OK; 345 return NETDEV_TX_OK;
346} 346}
347 347
348/* Init RX & TX buffer descriptors
349 */
350static void fec_enet_bd_init(struct net_device *dev)
351{
352 struct fec_enet_private *fep = netdev_priv(dev);
353 struct bufdesc *bdp;
354 unsigned int i;
355
356 /* Initialize the receive buffer descriptors. */
357 bdp = fep->rx_bd_base;
358 for (i = 0; i < RX_RING_SIZE; i++) {
359
360 /* Initialize the BD for every fragment in the page. */
361 if (bdp->cbd_bufaddr)
362 bdp->cbd_sc = BD_ENET_RX_EMPTY;
363 else
364 bdp->cbd_sc = 0;
365 bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
366 }
367
368 /* Set the last buffer to wrap */
369 bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
370 bdp->cbd_sc |= BD_SC_WRAP;
371
372 fep->cur_rx = fep->rx_bd_base;
373
374 /* ...and the same for transmit */
375 bdp = fep->tx_bd_base;
376 fep->cur_tx = bdp;
377 for (i = 0; i < TX_RING_SIZE; i++) {
378
379 /* Initialize the BD for every fragment in the page. */
380 bdp->cbd_sc = 0;
381 if (bdp->cbd_bufaddr && fep->tx_skbuff[i]) {
382 dev_kfree_skb_any(fep->tx_skbuff[i]);
383 fep->tx_skbuff[i] = NULL;
384 }
385 bdp->cbd_bufaddr = 0;
386 bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
387 }
388
389 /* Set the last buffer to wrap */
390 bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
391 bdp->cbd_sc |= BD_SC_WRAP;
392 fep->dirty_tx = bdp;
393}
394
348/* This function is called to start or restart the FEC during a link 395/* This function is called to start or restart the FEC during a link
349 * change. This only happens when switching between half and full 396 * change. This only happens when switching between half and full
350 * duplex. 397 * duplex.
@@ -388,6 +435,8 @@ fec_restart(struct net_device *ndev, int duplex)
388 /* Set maximum receive buffer size. */ 435 /* Set maximum receive buffer size. */
389 writel(PKT_MAXBLR_SIZE, fep->hwp + FEC_R_BUFF_SIZE); 436 writel(PKT_MAXBLR_SIZE, fep->hwp + FEC_R_BUFF_SIZE);
390 437
438 fec_enet_bd_init(ndev);
439
391 /* Set receive and transmit descriptor base. */ 440 /* Set receive and transmit descriptor base. */
392 writel(fep->bd_dma, fep->hwp + FEC_R_DES_START); 441 writel(fep->bd_dma, fep->hwp + FEC_R_DES_START);
393 if (fep->bufdesc_ex) 442 if (fep->bufdesc_ex)
@@ -397,7 +446,6 @@ fec_restart(struct net_device *ndev, int duplex)
397 writel((unsigned long)fep->bd_dma + sizeof(struct bufdesc) 446 writel((unsigned long)fep->bd_dma + sizeof(struct bufdesc)
398 * RX_RING_SIZE, fep->hwp + FEC_X_DES_START); 447 * RX_RING_SIZE, fep->hwp + FEC_X_DES_START);
399 448
400 fep->cur_rx = fep->rx_bd_base;
401 449
402 for (i = 0; i <= TX_RING_MOD_MASK; i++) { 450 for (i = 0; i <= TX_RING_MOD_MASK; i++) {
403 if (fep->tx_skbuff[i]) { 451 if (fep->tx_skbuff[i]) {
@@ -1597,8 +1645,6 @@ static int fec_enet_init(struct net_device *ndev)
1597{ 1645{
1598 struct fec_enet_private *fep = netdev_priv(ndev); 1646 struct fec_enet_private *fep = netdev_priv(ndev);
1599 struct bufdesc *cbd_base; 1647 struct bufdesc *cbd_base;
1600 struct bufdesc *bdp;
1601 unsigned int i;
1602 1648
1603 /* Allocate memory for buffer descriptors. */ 1649 /* Allocate memory for buffer descriptors. */
1604 cbd_base = dma_alloc_coherent(NULL, PAGE_SIZE, &fep->bd_dma, 1650 cbd_base = dma_alloc_coherent(NULL, PAGE_SIZE, &fep->bd_dma,
@@ -1608,6 +1654,7 @@ static int fec_enet_init(struct net_device *ndev)
1608 return -ENOMEM; 1654 return -ENOMEM;
1609 } 1655 }
1610 1656
1657 memset(cbd_base, 0, PAGE_SIZE);
1611 spin_lock_init(&fep->hw_lock); 1658 spin_lock_init(&fep->hw_lock);
1612 1659
1613 fep->netdev = ndev; 1660 fep->netdev = ndev;
@@ -1631,35 +1678,6 @@ static int fec_enet_init(struct net_device *ndev)
1631 writel(FEC_RX_DISABLED_IMASK, fep->hwp + FEC_IMASK); 1678 writel(FEC_RX_DISABLED_IMASK, fep->hwp + FEC_IMASK);
1632 netif_napi_add(ndev, &fep->napi, fec_enet_rx_napi, FEC_NAPI_WEIGHT); 1679 netif_napi_add(ndev, &fep->napi, fec_enet_rx_napi, FEC_NAPI_WEIGHT);
1633 1680
1634 /* Initialize the receive buffer descriptors. */
1635 bdp = fep->rx_bd_base;
1636 for (i = 0; i < RX_RING_SIZE; i++) {
1637
1638 /* Initialize the BD for every fragment in the page. */
1639 bdp->cbd_sc = 0;
1640 bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
1641 }
1642
1643 /* Set the last buffer to wrap */
1644 bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
1645 bdp->cbd_sc |= BD_SC_WRAP;
1646
1647 /* ...and the same for transmit */
1648 bdp = fep->tx_bd_base;
1649 fep->cur_tx = bdp;
1650 for (i = 0; i < TX_RING_SIZE; i++) {
1651
1652 /* Initialize the BD for every fragment in the page. */
1653 bdp->cbd_sc = 0;
1654 bdp->cbd_bufaddr = 0;
1655 bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
1656 }
1657
1658 /* Set the last buffer to wrap */
1659 bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
1660 bdp->cbd_sc |= BD_SC_WRAP;
1661 fep->dirty_tx = bdp;
1662
1663 fec_restart(ndev, 0); 1681 fec_restart(ndev, 0);
1664 1682
1665 return 0; 1683 return 0;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 43462d596a4e..ffd287196bf8 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -1053,6 +1053,10 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
1053 txdr->buffer_info[i].dma = 1053 txdr->buffer_info[i].dma =
1054 dma_map_single(&pdev->dev, skb->data, skb->len, 1054 dma_map_single(&pdev->dev, skb->data, skb->len,
1055 DMA_TO_DEVICE); 1055 DMA_TO_DEVICE);
1056 if (dma_mapping_error(&pdev->dev, txdr->buffer_info[i].dma)) {
1057 ret_val = 4;
1058 goto err_nomem;
1059 }
1056 tx_desc->buffer_addr = cpu_to_le64(txdr->buffer_info[i].dma); 1060 tx_desc->buffer_addr = cpu_to_le64(txdr->buffer_info[i].dma);
1057 tx_desc->lower.data = cpu_to_le32(skb->len); 1061 tx_desc->lower.data = cpu_to_le32(skb->len);
1058 tx_desc->lower.data |= cpu_to_le32(E1000_TXD_CMD_EOP | 1062 tx_desc->lower.data |= cpu_to_le32(E1000_TXD_CMD_EOP |
@@ -1069,7 +1073,7 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
1069 rxdr->buffer_info = kcalloc(rxdr->count, sizeof(struct e1000_buffer), 1073 rxdr->buffer_info = kcalloc(rxdr->count, sizeof(struct e1000_buffer),
1070 GFP_KERNEL); 1074 GFP_KERNEL);
1071 if (!rxdr->buffer_info) { 1075 if (!rxdr->buffer_info) {
1072 ret_val = 4; 1076 ret_val = 5;
1073 goto err_nomem; 1077 goto err_nomem;
1074 } 1078 }
1075 1079
@@ -1077,7 +1081,7 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
1077 rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma, 1081 rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
1078 GFP_KERNEL); 1082 GFP_KERNEL);
1079 if (!rxdr->desc) { 1083 if (!rxdr->desc) {
1080 ret_val = 5; 1084 ret_val = 6;
1081 goto err_nomem; 1085 goto err_nomem;
1082 } 1086 }
1083 memset(rxdr->desc, 0, rxdr->size); 1087 memset(rxdr->desc, 0, rxdr->size);
@@ -1101,7 +1105,7 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
1101 1105
1102 skb = alloc_skb(E1000_RXBUFFER_2048 + NET_IP_ALIGN, GFP_KERNEL); 1106 skb = alloc_skb(E1000_RXBUFFER_2048 + NET_IP_ALIGN, GFP_KERNEL);
1103 if (!skb) { 1107 if (!skb) {
1104 ret_val = 6; 1108 ret_val = 7;
1105 goto err_nomem; 1109 goto err_nomem;
1106 } 1110 }
1107 skb_reserve(skb, NET_IP_ALIGN); 1111 skb_reserve(skb, NET_IP_ALIGN);
@@ -1110,6 +1114,10 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
1110 rxdr->buffer_info[i].dma = 1114 rxdr->buffer_info[i].dma =
1111 dma_map_single(&pdev->dev, skb->data, 1115 dma_map_single(&pdev->dev, skb->data,
1112 E1000_RXBUFFER_2048, DMA_FROM_DEVICE); 1116 E1000_RXBUFFER_2048, DMA_FROM_DEVICE);
1117 if (dma_mapping_error(&pdev->dev, rxdr->buffer_info[i].dma)) {
1118 ret_val = 8;
1119 goto err_nomem;
1120 }
1113 rx_desc->buffer_addr = cpu_to_le64(rxdr->buffer_info[i].dma); 1121 rx_desc->buffer_addr = cpu_to_le64(rxdr->buffer_info[i].dma);
1114 memset(skb->data, 0x00, skb->len); 1122 memset(skb->data, 0x00, skb->len);
1115 } 1123 }
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 948b86ffa4f0..7e615e2bf7e6 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -848,11 +848,16 @@ check_page:
848 } 848 }
849 } 849 }
850 850
851 if (!buffer_info->dma) 851 if (!buffer_info->dma) {
852 buffer_info->dma = dma_map_page(&pdev->dev, 852 buffer_info->dma = dma_map_page(&pdev->dev,
853 buffer_info->page, 0, 853 buffer_info->page, 0,
854 PAGE_SIZE, 854 PAGE_SIZE,
855 DMA_FROM_DEVICE); 855 DMA_FROM_DEVICE);
856 if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
857 adapter->alloc_rx_buff_failed++;
858 break;
859 }
860 }
856 861
857 rx_desc = E1000_RX_DESC_EXT(*rx_ring, i); 862 rx_desc = E1000_RX_DESC_EXT(*rx_ring, i);
858 rx_desc->read.buffer_addr = cpu_to_le64(buffer_info->dma); 863 rx_desc->read.buffer_addr = cpu_to_le64(buffer_info->dma);
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index ea4808373435..b5f94abe3cff 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -2159,6 +2159,10 @@ map_skb:
2159 skb->data, 2159 skb->data,
2160 adapter->rx_buffer_len, 2160 adapter->rx_buffer_len,
2161 DMA_FROM_DEVICE); 2161 DMA_FROM_DEVICE);
2162 if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
2163 adapter->alloc_rx_buff_failed++;
2164 break;
2165 }
2162 2166
2163 rx_desc = IXGB_RX_DESC(*rx_ring, i); 2167 rx_desc = IXGB_RX_DESC(*rx_ring, i);
2164 rx_desc->buff_addr = cpu_to_le64(buffer_info->dma); 2168 rx_desc->buff_addr = cpu_to_le64(buffer_info->dma);
@@ -2168,7 +2172,8 @@ map_skb:
2168 rx_desc->status = 0; 2172 rx_desc->status = 0;
2169 2173
2170 2174
2171 if (++i == rx_ring->count) i = 0; 2175 if (++i == rx_ring->count)
2176 i = 0;
2172 buffer_info = &rx_ring->buffer_info[i]; 2177 buffer_info = &rx_ring->buffer_info[i];
2173 } 2178 }
2174 2179
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index fc07ca35721b..6a0e671fcecd 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -1067,7 +1067,7 @@ static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 space)
1067 sky2_write32(hw, RB_ADDR(q, RB_RX_UTHP), tp); 1067 sky2_write32(hw, RB_ADDR(q, RB_RX_UTHP), tp);
1068 sky2_write32(hw, RB_ADDR(q, RB_RX_LTHP), space/2); 1068 sky2_write32(hw, RB_ADDR(q, RB_RX_LTHP), space/2);
1069 1069
1070 tp = space - 2048/8; 1070 tp = space - 8192/8;
1071 sky2_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp); 1071 sky2_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp);
1072 sky2_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4); 1072 sky2_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4);
1073 } else { 1073 } else {
diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
index 615ac63ea860..ec6dcd80152b 100644
--- a/drivers/net/ethernet/marvell/sky2.h
+++ b/drivers/net/ethernet/marvell/sky2.h
@@ -2074,7 +2074,7 @@ enum {
2074 GM_IS_RX_FF_OR = 1<<1, /* Receive FIFO Overrun */ 2074 GM_IS_RX_FF_OR = 1<<1, /* Receive FIFO Overrun */
2075 GM_IS_RX_COMPL = 1<<0, /* Frame Reception Complete */ 2075 GM_IS_RX_COMPL = 1<<0, /* Frame Reception Complete */
2076 2076
2077#define GMAC_DEF_MSK GM_IS_TX_FF_UR 2077#define GMAC_DEF_MSK (GM_IS_TX_FF_UR | GM_IS_RX_FF_OR)
2078}; 2078};
2079 2079
2080/* GMAC_LINK_CTRL 16 bit GMAC Link Control Reg (YUKON only) */ 2080/* GMAC_LINK_CTRL 16 bit GMAC Link Control Reg (YUKON only) */
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index 33bcb63d56a2..8fb481252e2c 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -528,7 +528,7 @@ static void ks8851_rx_pkts(struct ks8851_net *ks)
528 for (; rxfc != 0; rxfc--) { 528 for (; rxfc != 0; rxfc--) {
529 rxh = ks8851_rdreg32(ks, KS_RXFHSR); 529 rxh = ks8851_rdreg32(ks, KS_RXFHSR);
530 rxstat = rxh & 0xffff; 530 rxstat = rxh & 0xffff;
531 rxlen = rxh >> 16; 531 rxlen = (rxh >> 16) & 0xfff;
532 532
533 netif_dbg(ks, rx_status, ks->netdev, 533 netif_dbg(ks, rx_status, ks->netdev,
534 "rx: stat 0x%04x, len 0x%04x\n", rxstat, rxlen); 534 "rx: stat 0x%04x, len 0x%04x\n", rxstat, rxlen);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index bf5e3cf97c4d..6ed333fe5c04 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1216,10 +1216,7 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
1216 if (felic_stat & ECSR_LCHNG) { 1216 if (felic_stat & ECSR_LCHNG) {
1217 /* Link Changed */ 1217 /* Link Changed */
1218 if (mdp->cd->no_psr || mdp->no_ether_link) { 1218 if (mdp->cd->no_psr || mdp->no_ether_link) {
1219 if (mdp->link == PHY_DOWN) 1219 goto ignore_link;
1220 link_stat = 0;
1221 else
1222 link_stat = PHY_ST_LINK;
1223 } else { 1220 } else {
1224 link_stat = (sh_eth_read(ndev, PSR)); 1221 link_stat = (sh_eth_read(ndev, PSR));
1225 if (mdp->ether_link_active_low) 1222 if (mdp->ether_link_active_low)
@@ -1242,6 +1239,7 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
1242 } 1239 }
1243 } 1240 }
1244 1241
1242ignore_link:
1245 if (intr_status & EESR_TWB) { 1243 if (intr_status & EESR_TWB) {
1246 /* Write buck end. unused write back interrupt */ 1244 /* Write buck end. unused write back interrupt */
1247 if (intr_status & EESR_TABT) /* Transmit Abort int */ 1245 if (intr_status & EESR_TABT) /* Transmit Abort int */
@@ -1326,12 +1324,18 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
1326 struct sh_eth_private *mdp = netdev_priv(ndev); 1324 struct sh_eth_private *mdp = netdev_priv(ndev);
1327 struct sh_eth_cpu_data *cd = mdp->cd; 1325 struct sh_eth_cpu_data *cd = mdp->cd;
1328 irqreturn_t ret = IRQ_NONE; 1326 irqreturn_t ret = IRQ_NONE;
1329 u32 intr_status = 0; 1327 unsigned long intr_status;
1330 1328
1331 spin_lock(&mdp->lock); 1329 spin_lock(&mdp->lock);
1332 1330
1333 /* Get interrpt stat */ 1331 /* Get interrupt status */
1334 intr_status = sh_eth_read(ndev, EESR); 1332 intr_status = sh_eth_read(ndev, EESR);
1333 /* Mask it with the interrupt mask, forcing ECI interrupt to be always
1334 * enabled since it's the one that comes thru regardless of the mask,
1335 * and we need to fully handle it in sh_eth_error() in order to quench
1336 * it as it doesn't get cleared by just writing 1 to the ECI bit...
1337 */
1338 intr_status &= sh_eth_read(ndev, EESIPR) | DMAC_M_ECI;
1335 /* Clear interrupt */ 1339 /* Clear interrupt */
1336 if (intr_status & (EESR_FRC | EESR_RMAF | EESR_RRF | 1340 if (intr_status & (EESR_FRC | EESR_RMAF | EESR_RRF |
1337 EESR_RTLF | EESR_RTSF | EESR_PRE | EESR_CERF | 1341 EESR_RTLF | EESR_RTSF | EESR_PRE | EESR_CERF |
@@ -1373,7 +1377,7 @@ static void sh_eth_adjust_link(struct net_device *ndev)
1373 struct phy_device *phydev = mdp->phydev; 1377 struct phy_device *phydev = mdp->phydev;
1374 int new_state = 0; 1378 int new_state = 0;
1375 1379
1376 if (phydev->link != PHY_DOWN) { 1380 if (phydev->link) {
1377 if (phydev->duplex != mdp->duplex) { 1381 if (phydev->duplex != mdp->duplex) {
1378 new_state = 1; 1382 new_state = 1;
1379 mdp->duplex = phydev->duplex; 1383 mdp->duplex = phydev->duplex;
@@ -1387,17 +1391,21 @@ static void sh_eth_adjust_link(struct net_device *ndev)
1387 if (mdp->cd->set_rate) 1391 if (mdp->cd->set_rate)
1388 mdp->cd->set_rate(ndev); 1392 mdp->cd->set_rate(ndev);
1389 } 1393 }
1390 if (mdp->link == PHY_DOWN) { 1394 if (!mdp->link) {
1391 sh_eth_write(ndev, 1395 sh_eth_write(ndev,
1392 (sh_eth_read(ndev, ECMR) & ~ECMR_TXF), ECMR); 1396 (sh_eth_read(ndev, ECMR) & ~ECMR_TXF), ECMR);
1393 new_state = 1; 1397 new_state = 1;
1394 mdp->link = phydev->link; 1398 mdp->link = phydev->link;
1399 if (mdp->cd->no_psr || mdp->no_ether_link)
1400 sh_eth_rcv_snd_enable(ndev);
1395 } 1401 }
1396 } else if (mdp->link) { 1402 } else if (mdp->link) {
1397 new_state = 1; 1403 new_state = 1;
1398 mdp->link = PHY_DOWN; 1404 mdp->link = 0;
1399 mdp->speed = 0; 1405 mdp->speed = 0;
1400 mdp->duplex = -1; 1406 mdp->duplex = -1;
1407 if (mdp->cd->no_psr || mdp->no_ether_link)
1408 sh_eth_rcv_snd_disable(ndev);
1401 } 1409 }
1402 1410
1403 if (new_state && netif_msg_link(mdp)) 1411 if (new_state && netif_msg_link(mdp))
@@ -1414,7 +1422,7 @@ static int sh_eth_phy_init(struct net_device *ndev)
1414 snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT, 1422 snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT,
1415 mdp->mii_bus->id , mdp->phy_id); 1423 mdp->mii_bus->id , mdp->phy_id);
1416 1424
1417 mdp->link = PHY_DOWN; 1425 mdp->link = 0;
1418 mdp->speed = 0; 1426 mdp->speed = 0;
1419 mdp->duplex = -1; 1427 mdp->duplex = -1;
1420 1428
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index e6655678458e..828be4515008 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -723,7 +723,7 @@ struct sh_eth_private {
723 u32 phy_id; /* PHY ID */ 723 u32 phy_id; /* PHY ID */
724 struct mii_bus *mii_bus; /* MDIO bus control */ 724 struct mii_bus *mii_bus; /* MDIO bus control */
725 struct phy_device *phydev; /* PHY device control */ 725 struct phy_device *phydev; /* PHY device control */
726 enum phy_state link; 726 int link;
727 phy_interface_t phy_interface; 727 phy_interface_t phy_interface;
728 int msg_enable; 728 int msg_enable;
729 int speed; 729 int speed;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index df32a090d08e..80cad06e5eb2 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -436,7 +436,7 @@ void cpsw_tx_handler(void *token, int len, int status)
436 * queue is stopped then start the queue as we have free desc for tx 436 * queue is stopped then start the queue as we have free desc for tx
437 */ 437 */
438 if (unlikely(netif_queue_stopped(ndev))) 438 if (unlikely(netif_queue_stopped(ndev)))
439 netif_start_queue(ndev); 439 netif_wake_queue(ndev);
440 cpts_tx_timestamp(priv->cpts, skb); 440 cpts_tx_timestamp(priv->cpts, skb);
441 priv->stats.tx_packets++; 441 priv->stats.tx_packets++;
442 priv->stats.tx_bytes += len; 442 priv->stats.tx_bytes += len;
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index ae1b77aa199f..72300bc9e378 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1053,7 +1053,7 @@ static void emac_tx_handler(void *token, int len, int status)
1053 * queue is stopped then start the queue as we have free desc for tx 1053 * queue is stopped then start the queue as we have free desc for tx
1054 */ 1054 */
1055 if (unlikely(netif_queue_stopped(ndev))) 1055 if (unlikely(netif_queue_stopped(ndev)))
1056 netif_start_queue(ndev); 1056 netif_wake_queue(ndev);
1057 ndev->stats.tx_packets++; 1057 ndev->stats.tx_packets++;
1058 ndev->stats.tx_bytes += len; 1058 ndev->stats.tx_bytes += len;
1059 dev_kfree_skb_any(skb); 1059 dev_kfree_skb_any(skb);
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 9abe51710f22..1a15ec14c386 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -914,8 +914,12 @@ static int smsc75xx_set_rx_max_frame_length(struct usbnet *dev, int size)
914static int smsc75xx_change_mtu(struct net_device *netdev, int new_mtu) 914static int smsc75xx_change_mtu(struct net_device *netdev, int new_mtu)
915{ 915{
916 struct usbnet *dev = netdev_priv(netdev); 916 struct usbnet *dev = netdev_priv(netdev);
917 int ret;
918
919 if (new_mtu > MAX_SINGLE_PACKET_SIZE)
920 return -EINVAL;
917 921
918 int ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu); 922 ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu + ETH_HLEN);
919 if (ret < 0) { 923 if (ret < 0) {
920 netdev_warn(dev->net, "Failed to set mac rx frame length\n"); 924 netdev_warn(dev->net, "Failed to set mac rx frame length\n");
921 return ret; 925 return ret;
@@ -1324,7 +1328,7 @@ static int smsc75xx_reset(struct usbnet *dev)
1324 1328
1325 netif_dbg(dev, ifup, dev->net, "FCT_TX_CTL set to 0x%08x\n", buf); 1329 netif_dbg(dev, ifup, dev->net, "FCT_TX_CTL set to 0x%08x\n", buf);
1326 1330
1327 ret = smsc75xx_set_rx_max_frame_length(dev, 1514); 1331 ret = smsc75xx_set_rx_max_frame_length(dev, dev->net->mtu + ETH_HLEN);
1328 if (ret < 0) { 1332 if (ret < 0) {
1329 netdev_warn(dev->net, "Failed to set max rx frame length\n"); 1333 netdev_warn(dev->net, "Failed to set max rx frame length\n");
1330 return ret; 1334 return ret;
@@ -2134,8 +2138,8 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
2134 else if (rx_cmd_a & (RX_CMD_A_LONG | RX_CMD_A_RUNT)) 2138 else if (rx_cmd_a & (RX_CMD_A_LONG | RX_CMD_A_RUNT))
2135 dev->net->stats.rx_frame_errors++; 2139 dev->net->stats.rx_frame_errors++;
2136 } else { 2140 } else {
2137 /* ETH_FRAME_LEN + 4(CRC) + 2(COE) + 4(Vlan) */ 2141 /* MAX_SINGLE_PACKET_SIZE + 4(CRC) + 2(COE) + 4(Vlan) */
2138 if (unlikely(size > (ETH_FRAME_LEN + 12))) { 2142 if (unlikely(size > (MAX_SINGLE_PACKET_SIZE + ETH_HLEN + 12))) {
2139 netif_dbg(dev, rx_err, dev->net, 2143 netif_dbg(dev, rx_err, dev->net,
2140 "size err rx_cmd_a=0x%08x\n", 2144 "size err rx_cmd_a=0x%08x\n",
2141 rx_cmd_a); 2145 rx_cmd_a);
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 39c84ecf6a42..7fdac6c7b3ea 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -170,7 +170,8 @@ void ath_rx_poll(unsigned long data)
170{ 170{
171 struct ath_softc *sc = (struct ath_softc *)data; 171 struct ath_softc *sc = (struct ath_softc *)data;
172 172
173 ieee80211_queue_work(sc->hw, &sc->hw_check_work); 173 if (!test_bit(SC_OP_INVALID, &sc->sc_flags))
174 ieee80211_queue_work(sc->hw, &sc->hw_check_work);
174} 175}
175 176
176/* 177/*
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 38bc5a7997ff..122146943bf2 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1487,8 +1487,12 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
1487 const struct b43_dma_ops *ops; 1487 const struct b43_dma_ops *ops;
1488 struct b43_dmaring *ring; 1488 struct b43_dmaring *ring;
1489 struct b43_dmadesc_meta *meta; 1489 struct b43_dmadesc_meta *meta;
1490 static const struct b43_txstatus fake; /* filled with 0 */
1491 const struct b43_txstatus *txstat;
1490 int slot, firstused; 1492 int slot, firstused;
1491 bool frame_succeed; 1493 bool frame_succeed;
1494 int skip;
1495 static u8 err_out1, err_out2;
1492 1496
1493 ring = parse_cookie(dev, status->cookie, &slot); 1497 ring = parse_cookie(dev, status->cookie, &slot);
1494 if (unlikely(!ring)) 1498 if (unlikely(!ring))
@@ -1501,13 +1505,36 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
1501 firstused = ring->current_slot - ring->used_slots + 1; 1505 firstused = ring->current_slot - ring->used_slots + 1;
1502 if (firstused < 0) 1506 if (firstused < 0)
1503 firstused = ring->nr_slots + firstused; 1507 firstused = ring->nr_slots + firstused;
1508
1509 skip = 0;
1504 if (unlikely(slot != firstused)) { 1510 if (unlikely(slot != firstused)) {
1505 /* This possibly is a firmware bug and will result in 1511 /* This possibly is a firmware bug and will result in
1506 * malfunction, memory leaks and/or stall of DMA functionality. */ 1512 * malfunction, memory leaks and/or stall of DMA functionality.
1507 b43dbg(dev->wl, "Out of order TX status report on DMA ring %d. " 1513 */
1508 "Expected %d, but got %d\n", 1514 if (slot == next_slot(ring, next_slot(ring, firstused))) {
1509 ring->index, firstused, slot); 1515 /* If a single header/data pair was missed, skip over
1510 return; 1516 * the first two slots in an attempt to recover.
1517 */
1518 slot = firstused;
1519 skip = 2;
1520 if (!err_out1) {
1521 /* Report the error once. */
1522 b43dbg(dev->wl,
1523 "Skip on DMA ring %d slot %d.\n",
1524 ring->index, slot);
1525 err_out1 = 1;
1526 }
1527 } else {
1528 /* More than a single header/data pair were missed.
1529 * Report this error once.
1530 */
1531 if (!err_out2)
1532 b43dbg(dev->wl,
1533 "Out of order TX status report on DMA ring %d. Expected %d, but got %d\n",
1534 ring->index, firstused, slot);
1535 err_out2 = 1;
1536 return;
1537 }
1511 } 1538 }
1512 1539
1513 ops = ring->ops; 1540 ops = ring->ops;
@@ -1522,11 +1549,13 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
1522 slot, firstused, ring->index); 1549 slot, firstused, ring->index);
1523 break; 1550 break;
1524 } 1551 }
1552
1525 if (meta->skb) { 1553 if (meta->skb) {
1526 struct b43_private_tx_info *priv_info = 1554 struct b43_private_tx_info *priv_info =
1527 b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb)); 1555 b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
1528 1556
1529 unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len, 1); 1557 unmap_descbuffer(ring, meta->dmaaddr,
1558 meta->skb->len, 1);
1530 kfree(priv_info->bouncebuffer); 1559 kfree(priv_info->bouncebuffer);
1531 priv_info->bouncebuffer = NULL; 1560 priv_info->bouncebuffer = NULL;
1532 } else { 1561 } else {
@@ -1538,8 +1567,9 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
1538 struct ieee80211_tx_info *info; 1567 struct ieee80211_tx_info *info;
1539 1568
1540 if (unlikely(!meta->skb)) { 1569 if (unlikely(!meta->skb)) {
1541 /* This is a scatter-gather fragment of a frame, so 1570 /* This is a scatter-gather fragment of a frame,
1542 * the skb pointer must not be NULL. */ 1571 * so the skb pointer must not be NULL.
1572 */
1543 b43dbg(dev->wl, "TX status unexpected NULL skb " 1573 b43dbg(dev->wl, "TX status unexpected NULL skb "
1544 "at slot %d (first=%d) on ring %d\n", 1574 "at slot %d (first=%d) on ring %d\n",
1545 slot, firstused, ring->index); 1575 slot, firstused, ring->index);
@@ -1550,9 +1580,18 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
1550 1580
1551 /* 1581 /*
1552 * Call back to inform the ieee80211 subsystem about 1582 * Call back to inform the ieee80211 subsystem about
1553 * the status of the transmission. 1583 * the status of the transmission. When skipping over
1584 * a missed TX status report, use a status structure
1585 * filled with zeros to indicate that the frame was not
1586 * sent (frame_count 0) and not acknowledged
1554 */ 1587 */
1555 frame_succeed = b43_fill_txstatus_report(dev, info, status); 1588 if (unlikely(skip))
1589 txstat = &fake;
1590 else
1591 txstat = status;
1592
1593 frame_succeed = b43_fill_txstatus_report(dev, info,
1594 txstat);
1556#ifdef CONFIG_B43_DEBUG 1595#ifdef CONFIG_B43_DEBUG
1557 if (frame_succeed) 1596 if (frame_succeed)
1558 ring->nr_succeed_tx_packets++; 1597 ring->nr_succeed_tx_packets++;
@@ -1580,12 +1619,14 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
1580 /* Everything unmapped and free'd. So it's not used anymore. */ 1619 /* Everything unmapped and free'd. So it's not used anymore. */
1581 ring->used_slots--; 1620 ring->used_slots--;
1582 1621
1583 if (meta->is_last_fragment) { 1622 if (meta->is_last_fragment && !skip) {
1584 /* This is the last scatter-gather 1623 /* This is the last scatter-gather
1585 * fragment of the frame. We are done. */ 1624 * fragment of the frame. We are done. */
1586 break; 1625 break;
1587 } 1626 }
1588 slot = next_slot(ring, slot); 1627 slot = next_slot(ring, slot);
1628 if (skip > 0)
1629 --skip;
1589 } 1630 }
1590 if (ring->stopped) { 1631 if (ring->stopped) {
1591 B43_WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME); 1632 B43_WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME);
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 3c35382ee6c2..e8486c1e091a 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -1564,7 +1564,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
1564 u16 clip_off[2] = { 0xFFFF, 0xFFFF }; 1564 u16 clip_off[2] = { 0xFFFF, 0xFFFF };
1565 1565
1566 u8 vcm_final = 0; 1566 u8 vcm_final = 0;
1567 s8 offset[4]; 1567 s32 offset[4];
1568 s32 results[8][4] = { }; 1568 s32 results[8][4] = { };
1569 s32 results_min[4] = { }; 1569 s32 results_min[4] = { };
1570 s32 poll_results[4] = { }; 1570 s32 poll_results[4] = { };
@@ -1615,7 +1615,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
1615 } 1615 }
1616 for (i = 0; i < 4; i += 2) { 1616 for (i = 0; i < 4; i += 2) {
1617 s32 curr; 1617 s32 curr;
1618 s32 mind = 40; 1618 s32 mind = 0x100000;
1619 s32 minpoll = 249; 1619 s32 minpoll = 249;
1620 u8 minvcm = 0; 1620 u8 minvcm = 0;
1621 if (2 * core != i) 1621 if (2 * core != i)
@@ -1732,7 +1732,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
1732 u8 regs_save_radio[2]; 1732 u8 regs_save_radio[2];
1733 u16 regs_save_phy[2]; 1733 u16 regs_save_phy[2];
1734 1734
1735 s8 offset[4]; 1735 s32 offset[4];
1736 u8 core; 1736 u8 core;
1737 u8 rail; 1737 u8 rail;
1738 1738
@@ -1799,7 +1799,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
1799 } 1799 }
1800 1800
1801 for (i = 0; i < 4; i++) { 1801 for (i = 0; i < 4; i++) {
1802 s32 mind = 40; 1802 s32 mind = 0x100000;
1803 u8 minvcm = 0; 1803 u8 minvcm = 0;
1804 s32 minpoll = 249; 1804 s32 minpoll = 249;
1805 s32 curr; 1805 s32 curr;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index 21a824232478..18d37645e2cd 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1137,9 +1137,8 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
1137 gain0_15 = ((biq1 & 0xf) << 12) | 1137 gain0_15 = ((biq1 & 0xf) << 12) |
1138 ((tia & 0xf) << 8) | 1138 ((tia & 0xf) << 8) |
1139 ((lna2 & 0x3) << 6) | 1139 ((lna2 & 0x3) << 6) |
1140 ((lna2 & 0x3) << 4) | 1140 ((lna2 &
1141 ((lna1 & 0x3) << 2) | 1141 0x3) << 4) | ((lna1 & 0x3) << 2) | ((lna1 & 0x3) << 0);
1142 ((lna1 & 0x3) << 0);
1143 1142
1144 mod_phy_reg(pi, 0x4b6, (0xffff << 0), gain0_15 << 0); 1143 mod_phy_reg(pi, 0x4b6, (0xffff << 0), gain0_15 << 0);
1145 mod_phy_reg(pi, 0x4b7, (0xf << 0), gain16_19 << 0); 1144 mod_phy_reg(pi, 0x4b7, (0xf << 0), gain16_19 << 0);
@@ -1157,8 +1156,6 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
1157 } 1156 }
1158 1157
1159 mod_phy_reg(pi, 0x44d, (0x1 << 0), (!trsw) << 0); 1158 mod_phy_reg(pi, 0x44d, (0x1 << 0), (!trsw) << 0);
1160 mod_phy_reg(pi, 0x4b1, (0x3 << 11), lna1 << 11);
1161 mod_phy_reg(pi, 0x4e6, (0x3 << 3), lna1 << 3);
1162 1159
1163} 1160}
1164 1161
@@ -1331,43 +1328,6 @@ static u32 wlc_lcnphy_measure_digital_power(struct brcms_phy *pi, u16 nsamples)
1331 return (iq_est.i_pwr + iq_est.q_pwr) / nsamples; 1328 return (iq_est.i_pwr + iq_est.q_pwr) / nsamples;
1332} 1329}
1333 1330
1334static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
1335 u16 tia_gain, u16 lna2_gain)
1336{
1337 u32 i_thresh_l, q_thresh_l;
1338 u32 i_thresh_h, q_thresh_h;
1339 struct lcnphy_iq_est iq_est_h, iq_est_l;
1340
1341 wlc_lcnphy_set_rx_gain_by_distribution(pi, 0, 0, 0, biq1_gain, tia_gain,
1342 lna2_gain, 0);
1343
1344 wlc_lcnphy_rx_gain_override_enable(pi, true);
1345 wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
1346 udelay(500);
1347 write_radio_reg(pi, RADIO_2064_REG112, 0);
1348 if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
1349 return false;
1350
1351 wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
1352 udelay(500);
1353 write_radio_reg(pi, RADIO_2064_REG112, 0);
1354 if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
1355 return false;
1356
1357 i_thresh_l = (iq_est_l.i_pwr << 1);
1358 i_thresh_h = (iq_est_l.i_pwr << 2) + iq_est_l.i_pwr;
1359
1360 q_thresh_l = (iq_est_l.q_pwr << 1);
1361 q_thresh_h = (iq_est_l.q_pwr << 2) + iq_est_l.q_pwr;
1362 if ((iq_est_h.i_pwr > i_thresh_l) &&
1363 (iq_est_h.i_pwr < i_thresh_h) &&
1364 (iq_est_h.q_pwr > q_thresh_l) &&
1365 (iq_est_h.q_pwr < q_thresh_h))
1366 return true;
1367
1368 return false;
1369}
1370
1371static bool 1331static bool
1372wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi, 1332wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
1373 const struct lcnphy_rx_iqcomp *iqcomp, 1333 const struct lcnphy_rx_iqcomp *iqcomp,
@@ -1382,8 +1342,8 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
1382 RFOverrideVal0_old, rfoverride2_old, rfoverride2val_old, 1342 RFOverrideVal0_old, rfoverride2_old, rfoverride2val_old,
1383 rfoverride3_old, rfoverride3val_old, rfoverride4_old, 1343 rfoverride3_old, rfoverride3val_old, rfoverride4_old,
1384 rfoverride4val_old, afectrlovr_old, afectrlovrval_old; 1344 rfoverride4val_old, afectrlovr_old, afectrlovrval_old;
1385 int tia_gain, lna2_gain, biq1_gain; 1345 int tia_gain;
1386 bool set_gain; 1346 u32 received_power, rx_pwr_threshold;
1387 u16 old_sslpnCalibClkEnCtrl, old_sslpnRxFeClkEnCtrl; 1347 u16 old_sslpnCalibClkEnCtrl, old_sslpnRxFeClkEnCtrl;
1388 u16 values_to_save[11]; 1348 u16 values_to_save[11];
1389 s16 *ptr; 1349 s16 *ptr;
@@ -1408,134 +1368,126 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
1408 goto cal_done; 1368 goto cal_done;
1409 } 1369 }
1410 1370
1411 WARN_ON(module != 1); 1371 if (module == 1) {
1412 tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
1413 wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
1414
1415 for (i = 0; i < 11; i++)
1416 values_to_save[i] =
1417 read_radio_reg(pi, rxiq_cal_rf_reg[i]);
1418 Core1TxControl_old = read_phy_reg(pi, 0x631);
1419
1420 or_phy_reg(pi, 0x631, 0x0015);
1421
1422 RFOverride0_old = read_phy_reg(pi, 0x44c);
1423 RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
1424 rfoverride2_old = read_phy_reg(pi, 0x4b0);
1425 rfoverride2val_old = read_phy_reg(pi, 0x4b1);
1426 rfoverride3_old = read_phy_reg(pi, 0x4f9);
1427 rfoverride3val_old = read_phy_reg(pi, 0x4fa);
1428 rfoverride4_old = read_phy_reg(pi, 0x938);
1429 rfoverride4val_old = read_phy_reg(pi, 0x939);
1430 afectrlovr_old = read_phy_reg(pi, 0x43b);
1431 afectrlovrval_old = read_phy_reg(pi, 0x43c);
1432 old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
1433 old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
1434
1435 tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
1436 if (tx_gain_override_old) {
1437 wlc_lcnphy_get_tx_gain(pi, &old_gains);
1438 tx_gain_index_old = pi_lcn->lcnphy_current_index;
1439 }
1440
1441 wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
1442 1372
1443 mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0); 1373 tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
1444 mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0); 1374 wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
1445 1375
1446 mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1); 1376 for (i = 0; i < 11; i++)
1447 mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1); 1377 values_to_save[i] =
1378 read_radio_reg(pi, rxiq_cal_rf_reg[i]);
1379 Core1TxControl_old = read_phy_reg(pi, 0x631);
1380
1381 or_phy_reg(pi, 0x631, 0x0015);
1382
1383 RFOverride0_old = read_phy_reg(pi, 0x44c);
1384 RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
1385 rfoverride2_old = read_phy_reg(pi, 0x4b0);
1386 rfoverride2val_old = read_phy_reg(pi, 0x4b1);
1387 rfoverride3_old = read_phy_reg(pi, 0x4f9);
1388 rfoverride3val_old = read_phy_reg(pi, 0x4fa);
1389 rfoverride4_old = read_phy_reg(pi, 0x938);
1390 rfoverride4val_old = read_phy_reg(pi, 0x939);
1391 afectrlovr_old = read_phy_reg(pi, 0x43b);
1392 afectrlovrval_old = read_phy_reg(pi, 0x43c);
1393 old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
1394 old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
1395
1396 tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
1397 if (tx_gain_override_old) {
1398 wlc_lcnphy_get_tx_gain(pi, &old_gains);
1399 tx_gain_index_old = pi_lcn->lcnphy_current_index;
1400 }
1448 1401
1449 write_radio_reg(pi, RADIO_2064_REG116, 0x06); 1402 wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
1450 write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
1451 write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
1452 write_radio_reg(pi, RADIO_2064_REG098, 0x03);
1453 write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
1454 mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
1455 write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
1456 write_radio_reg(pi, RADIO_2064_REG114, 0x01);
1457 write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
1458 write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
1459
1460 mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
1461 mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
1462 mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
1463 mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
1464 mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
1465 mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
1466 mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
1467 mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
1468 mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
1469 mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
1470 1403
1471 mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0); 1404 mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
1472 mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0); 1405 mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
1473 1406
1474 write_phy_reg(pi, 0x6da, 0xffff); 1407 mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
1475 or_phy_reg(pi, 0x6db, 0x3); 1408 mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
1476 1409
1477 wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch); 1410 write_radio_reg(pi, RADIO_2064_REG116, 0x06);
1478 set_gain = false; 1411 write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
1479 1412 write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
1480 lna2_gain = 3; 1413 write_radio_reg(pi, RADIO_2064_REG098, 0x03);
1481 while ((lna2_gain >= 0) && !set_gain) { 1414 write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
1482 tia_gain = 4; 1415 mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
1483 1416 write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
1484 while ((tia_gain >= 0) && !set_gain) { 1417 write_radio_reg(pi, RADIO_2064_REG114, 0x01);
1485 biq1_gain = 6; 1418 write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
1486 1419 write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
1487 while ((biq1_gain >= 0) && !set_gain) { 1420
1488 set_gain = wlc_lcnphy_rx_iq_cal_gain(pi, 1421 mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
1489 (u16) 1422 mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
1490 biq1_gain, 1423 mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
1491 (u16) 1424 mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
1492 tia_gain, 1425 mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
1493 (u16) 1426 mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
1494 lna2_gain); 1427 mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
1495 biq1_gain -= 1; 1428 mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
1496 } 1429 mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
1430 mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
1431
1432 mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
1433 mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
1434
1435 wlc_lcnphy_start_tx_tone(pi, 2000, 120, 0);
1436 write_phy_reg(pi, 0x6da, 0xffff);
1437 or_phy_reg(pi, 0x6db, 0x3);
1438 wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
1439 wlc_lcnphy_rx_gain_override_enable(pi, true);
1440
1441 tia_gain = 8;
1442 rx_pwr_threshold = 950;
1443 while (tia_gain > 0) {
1497 tia_gain -= 1; 1444 tia_gain -= 1;
1445 wlc_lcnphy_set_rx_gain_by_distribution(pi,
1446 0, 0, 2, 2,
1447 (u16)
1448 tia_gain, 1, 0);
1449 udelay(500);
1450
1451 received_power =
1452 wlc_lcnphy_measure_digital_power(pi, 2000);
1453 if (received_power < rx_pwr_threshold)
1454 break;
1498 } 1455 }
1499 lna2_gain -= 1; 1456 result = wlc_lcnphy_calc_rx_iq_comp(pi, 0xffff);
1500 }
1501 1457
1502 if (set_gain) 1458 wlc_lcnphy_stop_tx_tone(pi);
1503 result = wlc_lcnphy_calc_rx_iq_comp(pi, 1024);
1504 else
1505 result = false;
1506 1459
1507 wlc_lcnphy_stop_tx_tone(pi); 1460 write_phy_reg(pi, 0x631, Core1TxControl_old);
1508 1461
1509 write_phy_reg(pi, 0x631, Core1TxControl_old); 1462 write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
1510 1463 write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
1511 write_phy_reg(pi, 0x44c, RFOverrideVal0_old); 1464 write_phy_reg(pi, 0x4b0, rfoverride2_old);
1512 write_phy_reg(pi, 0x44d, RFOverrideVal0_old); 1465 write_phy_reg(pi, 0x4b1, rfoverride2val_old);
1513 write_phy_reg(pi, 0x4b0, rfoverride2_old); 1466 write_phy_reg(pi, 0x4f9, rfoverride3_old);
1514 write_phy_reg(pi, 0x4b1, rfoverride2val_old); 1467 write_phy_reg(pi, 0x4fa, rfoverride3val_old);
1515 write_phy_reg(pi, 0x4f9, rfoverride3_old); 1468 write_phy_reg(pi, 0x938, rfoverride4_old);
1516 write_phy_reg(pi, 0x4fa, rfoverride3val_old); 1469 write_phy_reg(pi, 0x939, rfoverride4val_old);
1517 write_phy_reg(pi, 0x938, rfoverride4_old); 1470 write_phy_reg(pi, 0x43b, afectrlovr_old);
1518 write_phy_reg(pi, 0x939, rfoverride4val_old); 1471 write_phy_reg(pi, 0x43c, afectrlovrval_old);
1519 write_phy_reg(pi, 0x43b, afectrlovr_old); 1472 write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
1520 write_phy_reg(pi, 0x43c, afectrlovrval_old); 1473 write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
1521 write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
1522 write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
1523 1474
1524 wlc_lcnphy_clear_trsw_override(pi); 1475 wlc_lcnphy_clear_trsw_override(pi);
1525 1476
1526 mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2); 1477 mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
1527 1478
1528 for (i = 0; i < 11; i++) 1479 for (i = 0; i < 11; i++)
1529 write_radio_reg(pi, rxiq_cal_rf_reg[i], 1480 write_radio_reg(pi, rxiq_cal_rf_reg[i],
1530 values_to_save[i]); 1481 values_to_save[i]);
1531 1482
1532 if (tx_gain_override_old) 1483 if (tx_gain_override_old)
1533 wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old); 1484 wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
1534 else 1485 else
1535 wlc_lcnphy_disable_tx_gain_override(pi); 1486 wlc_lcnphy_disable_tx_gain_override(pi);
1536 1487
1537 wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl); 1488 wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
1538 wlc_lcnphy_rx_gain_override_enable(pi, false); 1489 wlc_lcnphy_rx_gain_override_enable(pi, false);
1490 }
1539 1491
1540cal_done: 1492cal_done:
1541 kfree(ptr); 1493 kfree(ptr);
@@ -1829,17 +1781,6 @@ wlc_lcnphy_radio_2064_channel_tune_4313(struct brcms_phy *pi, u8 channel)
1829 write_radio_reg(pi, RADIO_2064_REG038, 3); 1781 write_radio_reg(pi, RADIO_2064_REG038, 3);
1830 write_radio_reg(pi, RADIO_2064_REG091, 7); 1782 write_radio_reg(pi, RADIO_2064_REG091, 7);
1831 } 1783 }
1832
1833 if (!(pi->sh->boardflags & BFL_FEM)) {
1834 u8 reg038[14] = {0xd, 0xe, 0xd, 0xd, 0xd, 0xc,
1835 0xa, 0xb, 0xb, 0x3, 0x3, 0x2, 0x0, 0x0};
1836
1837 write_radio_reg(pi, RADIO_2064_REG02A, 0xf);
1838 write_radio_reg(pi, RADIO_2064_REG091, 0x3);
1839 write_radio_reg(pi, RADIO_2064_REG038, 0x3);
1840
1841 write_radio_reg(pi, RADIO_2064_REG038, reg038[channel - 1]);
1842 }
1843} 1784}
1844 1785
1845static int 1786static int
@@ -2034,16 +1975,6 @@ wlc_lcnphy_set_tssi_mux(struct brcms_phy *pi, enum lcnphy_tssi_mode pos)
2034 } else { 1975 } else {
2035 mod_radio_reg(pi, RADIO_2064_REG03A, 1, 0x1); 1976 mod_radio_reg(pi, RADIO_2064_REG03A, 1, 0x1);
2036 mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8); 1977 mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
2037 mod_radio_reg(pi, RADIO_2064_REG028, 0x1, 0x0);
2038 mod_radio_reg(pi, RADIO_2064_REG11A, 0x4, 1<<2);
2039 mod_radio_reg(pi, RADIO_2064_REG036, 0x10, 0x0);
2040 mod_radio_reg(pi, RADIO_2064_REG11A, 0x10, 1<<4);
2041 mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
2042 mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x77);
2043 mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, 0xe<<1);
2044 mod_radio_reg(pi, RADIO_2064_REG112, 0x80, 1<<7);
2045 mod_radio_reg(pi, RADIO_2064_REG005, 0x7, 1<<1);
2046 mod_radio_reg(pi, RADIO_2064_REG029, 0xf0, 0<<4);
2047 } 1978 }
2048 } else { 1979 } else {
2049 mod_phy_reg(pi, 0x4d9, (0x1 << 2), (0x1) << 2); 1980 mod_phy_reg(pi, 0x4d9, (0x1 << 2), (0x1) << 2);
@@ -2130,14 +2061,12 @@ static void wlc_lcnphy_pwrctrl_rssiparams(struct brcms_phy *pi)
2130 (auxpga_vmid_temp << 0) | (auxpga_gain_temp << 12)); 2061 (auxpga_vmid_temp << 0) | (auxpga_gain_temp << 12));
2131 2062
2132 mod_radio_reg(pi, RADIO_2064_REG082, (1 << 5), (1 << 5)); 2063 mod_radio_reg(pi, RADIO_2064_REG082, (1 << 5), (1 << 5));
2133 mod_radio_reg(pi, RADIO_2064_REG07C, (1 << 0), (1 << 0));
2134} 2064}
2135 2065
2136static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi) 2066static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
2137{ 2067{
2138 struct phytbl_info tab; 2068 struct phytbl_info tab;
2139 u32 rfseq, ind; 2069 u32 rfseq, ind;
2140 u8 tssi_sel;
2141 2070
2142 tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL; 2071 tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
2143 tab.tbl_width = 32; 2072 tab.tbl_width = 32;
@@ -2159,13 +2088,7 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
2159 2088
2160 mod_phy_reg(pi, 0x503, (0x1 << 4), (1) << 4); 2089 mod_phy_reg(pi, 0x503, (0x1 << 4), (1) << 4);
2161 2090
2162 if (pi->sh->boardflags & BFL_FEM) { 2091 wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
2163 tssi_sel = 0x1;
2164 wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
2165 } else {
2166 tssi_sel = 0xe;
2167 wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_POST_PA);
2168 }
2169 mod_phy_reg(pi, 0x4a4, (0x1 << 14), (0) << 14); 2092 mod_phy_reg(pi, 0x4a4, (0x1 << 14), (0) << 14);
2170 2093
2171 mod_phy_reg(pi, 0x4a4, (0x1 << 15), (1) << 15); 2094 mod_phy_reg(pi, 0x4a4, (0x1 << 15), (1) << 15);
@@ -2201,10 +2124,9 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
2201 mod_phy_reg(pi, 0x49a, (0x1ff << 0), (0xff) << 0); 2124 mod_phy_reg(pi, 0x49a, (0x1ff << 0), (0xff) << 0);
2202 2125
2203 if (LCNREV_IS(pi->pubpi.phy_rev, 2)) { 2126 if (LCNREV_IS(pi->pubpi.phy_rev, 2)) {
2204 mod_radio_reg(pi, RADIO_2064_REG028, 0xf, tssi_sel); 2127 mod_radio_reg(pi, RADIO_2064_REG028, 0xf, 0xe);
2205 mod_radio_reg(pi, RADIO_2064_REG086, 0x4, 0x4); 2128 mod_radio_reg(pi, RADIO_2064_REG086, 0x4, 0x4);
2206 } else { 2129 } else {
2207 mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, tssi_sel << 1);
2208 mod_radio_reg(pi, RADIO_2064_REG03A, 0x1, 1); 2130 mod_radio_reg(pi, RADIO_2064_REG03A, 0x1, 1);
2209 mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 1 << 3); 2131 mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 1 << 3);
2210 } 2132 }
@@ -2251,10 +2173,6 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
2251 2173
2252 mod_phy_reg(pi, 0x4d7, (0xf << 8), (0) << 8); 2174 mod_phy_reg(pi, 0x4d7, (0xf << 8), (0) << 8);
2253 2175
2254 mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x0);
2255 mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
2256 mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
2257
2258 wlc_lcnphy_pwrctrl_rssiparams(pi); 2176 wlc_lcnphy_pwrctrl_rssiparams(pi);
2259} 2177}
2260 2178
@@ -2873,8 +2791,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
2873 read_radio_reg(pi, RADIO_2064_REG007) & 1; 2791 read_radio_reg(pi, RADIO_2064_REG007) & 1;
2874 u16 SAVE_jtag_auxpga = read_radio_reg(pi, RADIO_2064_REG0FF) & 0x10; 2792 u16 SAVE_jtag_auxpga = read_radio_reg(pi, RADIO_2064_REG0FF) & 0x10;
2875 u16 SAVE_iqadc_aux_en = read_radio_reg(pi, RADIO_2064_REG11F) & 4; 2793 u16 SAVE_iqadc_aux_en = read_radio_reg(pi, RADIO_2064_REG11F) & 4;
2876 u8 SAVE_bbmult = wlc_lcnphy_get_bbmult(pi);
2877
2878 idleTssi = read_phy_reg(pi, 0x4ab); 2794 idleTssi = read_phy_reg(pi, 0x4ab);
2879 suspend = (0 == (bcma_read32(pi->d11core, D11REGOFFS(maccontrol)) & 2795 suspend = (0 == (bcma_read32(pi->d11core, D11REGOFFS(maccontrol)) &
2880 MCTL_EN_MAC)); 2796 MCTL_EN_MAC));
@@ -2892,12 +2808,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
2892 mod_radio_reg(pi, RADIO_2064_REG0FF, 0x10, 1 << 4); 2808 mod_radio_reg(pi, RADIO_2064_REG0FF, 0x10, 1 << 4);
2893 mod_radio_reg(pi, RADIO_2064_REG11F, 0x4, 1 << 2); 2809 mod_radio_reg(pi, RADIO_2064_REG11F, 0x4, 1 << 2);
2894 wlc_lcnphy_tssi_setup(pi); 2810 wlc_lcnphy_tssi_setup(pi);
2895
2896 mod_phy_reg(pi, 0x4d7, (0x1 << 0), (1 << 0));
2897 mod_phy_reg(pi, 0x4d7, (0x1 << 6), (1 << 6));
2898
2899 wlc_lcnphy_set_bbmult(pi, 0x0);
2900
2901 wlc_phy_do_dummy_tx(pi, true, OFF); 2811 wlc_phy_do_dummy_tx(pi, true, OFF);
2902 idleTssi = ((read_phy_reg(pi, 0x4ab) & (0x1ff << 0)) 2812 idleTssi = ((read_phy_reg(pi, 0x4ab) & (0x1ff << 0))
2903 >> 0); 2813 >> 0);
@@ -2919,7 +2829,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
2919 2829
2920 mod_phy_reg(pi, 0x44c, (0x1 << 12), (0) << 12); 2830 mod_phy_reg(pi, 0x44c, (0x1 << 12), (0) << 12);
2921 2831
2922 wlc_lcnphy_set_bbmult(pi, SAVE_bbmult);
2923 wlc_lcnphy_set_tx_gain_override(pi, tx_gain_override_old); 2832 wlc_lcnphy_set_tx_gain_override(pi, tx_gain_override_old);
2924 wlc_lcnphy_set_tx_gain(pi, &old_gains); 2833 wlc_lcnphy_set_tx_gain(pi, &old_gains);
2925 wlc_lcnphy_set_tx_pwr_ctrl(pi, SAVE_txpwrctrl); 2834 wlc_lcnphy_set_tx_pwr_ctrl(pi, SAVE_txpwrctrl);
@@ -3133,11 +3042,6 @@ static void wlc_lcnphy_tx_pwr_ctrl_init(struct brcms_phy_pub *ppi)
3133 wlc_lcnphy_write_table(pi, &tab); 3042 wlc_lcnphy_write_table(pi, &tab);
3134 tab.tbl_offset++; 3043 tab.tbl_offset++;
3135 } 3044 }
3136 mod_phy_reg(pi, 0x4d0, (0x1 << 0), (0) << 0);
3137 mod_phy_reg(pi, 0x4d3, (0xff << 0), (0) << 0);
3138 mod_phy_reg(pi, 0x4d3, (0xff << 8), (0) << 8);
3139 mod_phy_reg(pi, 0x4d0, (0x1 << 4), (0) << 4);
3140 mod_phy_reg(pi, 0x4d0, (0x1 << 2), (0) << 2);
3141 3045
3142 mod_phy_reg(pi, 0x410, (0x1 << 7), (0) << 7); 3046 mod_phy_reg(pi, 0x410, (0x1 << 7), (0) << 7);
3143 3047
@@ -3939,6 +3843,7 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
3939 target_gains.pad_gain = 21; 3843 target_gains.pad_gain = 21;
3940 target_gains.dac_gain = 0; 3844 target_gains.dac_gain = 0;
3941 wlc_lcnphy_set_tx_gain(pi, &target_gains); 3845 wlc_lcnphy_set_tx_gain(pi, &target_gains);
3846 wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
3942 3847
3943 if (LCNREV_IS(pi->pubpi.phy_rev, 1) || pi_lcn->lcnphy_hw_iqcal_en) { 3848 if (LCNREV_IS(pi->pubpi.phy_rev, 1) || pi_lcn->lcnphy_hw_iqcal_en) {
3944 3849
@@ -3949,7 +3854,6 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
3949 lcnphy_recal ? LCNPHY_CAL_RECAL : 3854 lcnphy_recal ? LCNPHY_CAL_RECAL :
3950 LCNPHY_CAL_FULL), false); 3855 LCNPHY_CAL_FULL), false);
3951 } else { 3856 } else {
3952 wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
3953 wlc_lcnphy_tx_iqlo_soft_cal_full(pi); 3857 wlc_lcnphy_tx_iqlo_soft_cal_full(pi);
3954 } 3858 }
3955 3859
@@ -4374,22 +4278,17 @@ wlc_lcnphy_load_tx_gain_table(struct brcms_phy *pi,
4374 if (CHSPEC_IS5G(pi->radio_chanspec)) 4278 if (CHSPEC_IS5G(pi->radio_chanspec))
4375 pa_gain = 0x70; 4279 pa_gain = 0x70;
4376 else 4280 else
4377 pa_gain = 0x60; 4281 pa_gain = 0x70;
4378 4282
4379 if (pi->sh->boardflags & BFL_FEM) 4283 if (pi->sh->boardflags & BFL_FEM)
4380 pa_gain = 0x10; 4284 pa_gain = 0x10;
4381
4382 tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL; 4285 tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
4383 tab.tbl_width = 32; 4286 tab.tbl_width = 32;
4384 tab.tbl_len = 1; 4287 tab.tbl_len = 1;
4385 tab.tbl_ptr = &val; 4288 tab.tbl_ptr = &val;
4386 4289
4387 for (j = 0; j < 128; j++) { 4290 for (j = 0; j < 128; j++) {
4388 if (pi->sh->boardflags & BFL_FEM) 4291 gm_gain = gain_table[j].gm;
4389 gm_gain = gain_table[j].gm;
4390 else
4391 gm_gain = 15;
4392
4393 val = (((u32) pa_gain << 24) | 4292 val = (((u32) pa_gain << 24) |
4394 (gain_table[j].pad << 16) | 4293 (gain_table[j].pad << 16) |
4395 (gain_table[j].pga << 8) | gm_gain); 4294 (gain_table[j].pga << 8) | gm_gain);
@@ -4600,10 +4499,7 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
4600 4499
4601 write_phy_reg(pi, 0x4ea, 0x4688); 4500 write_phy_reg(pi, 0x4ea, 0x4688);
4602 4501
4603 if (pi->sh->boardflags & BFL_FEM) 4502 mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
4604 mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
4605 else
4606 mod_phy_reg(pi, 0x4eb, (0x7 << 0), 3 << 0);
4607 4503
4608 mod_phy_reg(pi, 0x4eb, (0x7 << 6), 0 << 6); 4504 mod_phy_reg(pi, 0x4eb, (0x7 << 6), 0 << 6);
4609 4505
@@ -4614,13 +4510,6 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
4614 wlc_lcnphy_rcal(pi); 4510 wlc_lcnphy_rcal(pi);
4615 4511
4616 wlc_lcnphy_rc_cal(pi); 4512 wlc_lcnphy_rc_cal(pi);
4617
4618 if (!(pi->sh->boardflags & BFL_FEM)) {
4619 write_radio_reg(pi, RADIO_2064_REG032, 0x6f);
4620 write_radio_reg(pi, RADIO_2064_REG033, 0x19);
4621 write_radio_reg(pi, RADIO_2064_REG039, 0xe);
4622 }
4623
4624} 4513}
4625 4514
4626static void wlc_lcnphy_radio_init(struct brcms_phy *pi) 4515static void wlc_lcnphy_radio_init(struct brcms_phy *pi)
@@ -4650,20 +4539,22 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
4650 wlc_lcnphy_write_table(pi, &tab); 4539 wlc_lcnphy_write_table(pi, &tab);
4651 } 4540 }
4652 4541
4653 if (!(pi->sh->boardflags & BFL_FEM)) { 4542 tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
4654 tab.tbl_id = LCNPHY_TBL_ID_RFSEQ; 4543 tab.tbl_width = 16;
4655 tab.tbl_width = 16; 4544 tab.tbl_ptr = &val;
4656 tab.tbl_ptr = &val; 4545 tab.tbl_len = 1;
4657 tab.tbl_len = 1;
4658 4546
4659 val = 150; 4547 val = 114;
4660 tab.tbl_offset = 0; 4548 tab.tbl_offset = 0;
4661 wlc_lcnphy_write_table(pi, &tab); 4549 wlc_lcnphy_write_table(pi, &tab);
4662 4550
4663 val = 220; 4551 val = 130;
4664 tab.tbl_offset = 1; 4552 tab.tbl_offset = 1;
4665 wlc_lcnphy_write_table(pi, &tab); 4553 wlc_lcnphy_write_table(pi, &tab);
4666 } 4554
4555 val = 6;
4556 tab.tbl_offset = 8;
4557 wlc_lcnphy_write_table(pi, &tab);
4667 4558
4668 if (CHSPEC_IS2G(pi->radio_chanspec)) { 4559 if (CHSPEC_IS2G(pi->radio_chanspec)) {
4669 if (pi->sh->boardflags & BFL_FEM) 4560 if (pi->sh->boardflags & BFL_FEM)
@@ -5055,7 +4946,6 @@ void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec)
5055 wlc_lcnphy_load_tx_iir_filter(pi, true, 3); 4946 wlc_lcnphy_load_tx_iir_filter(pi, true, 3);
5056 4947
5057 mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3); 4948 mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3);
5058 wlc_lcnphy_tssi_setup(pi);
5059} 4949}
5060 4950
5061void wlc_phy_detach_lcnphy(struct brcms_phy *pi) 4951void wlc_phy_detach_lcnphy(struct brcms_phy *pi)
@@ -5094,7 +4984,8 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
5094 if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) 4984 if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
5095 return false; 4985 return false;
5096 4986
5097 if (LCNREV_IS(pi->pubpi.phy_rev, 1)) { 4987 if ((pi->sh->boardflags & BFL_FEM) &&
4988 (LCNREV_IS(pi->pubpi.phy_rev, 1))) {
5098 if (pi_lcn->lcnphy_tempsense_option == 3) { 4989 if (pi_lcn->lcnphy_tempsense_option == 3) {
5099 pi->hwpwrctrl = true; 4990 pi->hwpwrctrl = true;
5100 pi->hwpwrctrl_capable = true; 4991 pi->hwpwrctrl_capable = true;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
index b7e95acc2084..622c01ca72c5 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
@@ -1992,70 +1992,70 @@ static const u16 dot11lcn_sw_ctrl_tbl_4313_epa_rev0[] = {
1992}; 1992};
1993 1993
1994static const u16 dot11lcn_sw_ctrl_tbl_4313_rev0[] = { 1994static const u16 dot11lcn_sw_ctrl_tbl_4313_rev0[] = {
1995 0x0009,
1996 0x000a, 1995 0x000a,
1997 0x0005,
1998 0x0006,
1999 0x0009, 1996 0x0009,
2000 0x000a,
2001 0x0005,
2002 0x0006, 1997 0x0006,
2003 0x0009,
2004 0x000a,
2005 0x0005, 1998 0x0005,
2006 0x0006,
2007 0x0009,
2008 0x000a, 1999 0x000a,
2009 0x0005,
2010 0x0006,
2011 0x0009, 2000 0x0009,
2012 0x000a,
2013 0x0005,
2014 0x0006, 2001 0x0006,
2015 0x0009,
2016 0x000a,
2017 0x0005, 2002 0x0005,
2018 0x0006,
2019 0x0009,
2020 0x000a, 2003 0x000a,
2021 0x0005,
2022 0x0006,
2023 0x0009, 2004 0x0009,
2024 0x000a,
2025 0x0005,
2026 0x0006, 2005 0x0006,
2027 0x0009,
2028 0x000a,
2029 0x0005, 2006 0x0005,
2030 0x0006,
2031 0x0009,
2032 0x000a, 2007 0x000a,
2033 0x0005,
2034 0x0006,
2035 0x0009, 2008 0x0009,
2036 0x000a,
2037 0x0005,
2038 0x0006, 2009 0x0006,
2039 0x0009,
2040 0x000a,
2041 0x0005, 2010 0x0005,
2042 0x0006, 2011 0x000a,
2043 0x0009, 2012 0x0009,
2013 0x0006,
2014 0x0005,
2044 0x000a, 2015 0x000a,
2016 0x0009,
2017 0x0006,
2045 0x0005, 2018 0x0005,
2019 0x000a,
2020 0x0009,
2046 0x0006, 2021 0x0006,
2022 0x0005,
2023 0x000a,
2047 0x0009, 2024 0x0009,
2025 0x0006,
2026 0x0005,
2048 0x000a, 2027 0x000a,
2028 0x0009,
2029 0x0006,
2049 0x0005, 2030 0x0005,
2031 0x000a,
2032 0x0009,
2050 0x0006, 2033 0x0006,
2034 0x0005,
2035 0x000a,
2051 0x0009, 2036 0x0009,
2037 0x0006,
2038 0x0005,
2052 0x000a, 2039 0x000a,
2040 0x0009,
2041 0x0006,
2053 0x0005, 2042 0x0005,
2043 0x000a,
2044 0x0009,
2054 0x0006, 2045 0x0006,
2046 0x0005,
2047 0x000a,
2055 0x0009, 2048 0x0009,
2049 0x0006,
2050 0x0005,
2056 0x000a, 2051 0x000a,
2052 0x0009,
2053 0x0006,
2057 0x0005, 2054 0x0005,
2055 0x000a,
2056 0x0009,
2058 0x0006, 2057 0x0006,
2058 0x0005,
2059}; 2059};
2060 2060
2061static const u16 dot11lcn_sw_ctrl_tbl_rev0[] = { 2061static const u16 dot11lcn_sw_ctrl_tbl_rev0[] = {
diff --git a/drivers/net/wireless/iwlegacy/4965-rs.c b/drivers/net/wireless/iwlegacy/4965-rs.c
index e8324b5e5bfe..6c7493c2d698 100644
--- a/drivers/net/wireless/iwlegacy/4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/4965-rs.c
@@ -2152,7 +2152,7 @@ il4965_rs_initialize_lq(struct il_priv *il, struct ieee80211_conf *conf,
2152 int rate_idx; 2152 int rate_idx;
2153 int i; 2153 int i;
2154 u32 rate; 2154 u32 rate;
2155 u8 use_green = il4965_rs_use_green(il, sta); 2155 u8 use_green;
2156 u8 active_tbl = 0; 2156 u8 active_tbl = 0;
2157 u8 valid_tx_ant; 2157 u8 valid_tx_ant;
2158 struct il_station_priv *sta_priv; 2158 struct il_station_priv *sta_priv;
@@ -2160,6 +2160,7 @@ il4965_rs_initialize_lq(struct il_priv *il, struct ieee80211_conf *conf,
2160 if (!sta || !lq_sta) 2160 if (!sta || !lq_sta)
2161 return; 2161 return;
2162 2162
2163 use_green = il4965_rs_use_green(il, sta);
2163 sta_priv = (void *)sta->drv_priv; 2164 sta_priv = (void *)sta->drv_priv;
2164 2165
2165 i = lq_sta->last_txrate_idx; 2166 i = lq_sta->last_txrate_idx;
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index 86ea5f4c3939..44ca0e57f9f7 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -1262,6 +1262,15 @@ int iwl_dvm_send_cmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
1262 } 1262 }
1263 1263
1264 /* 1264 /*
1265 * This can happen upon FW ASSERT: we clear the STATUS_FW_ERROR flag
1266 * in iwl_down but cancel the workers only later.
1267 */
1268 if (!priv->ucode_loaded) {
1269 IWL_ERR(priv, "Fw not loaded - dropping CMD: %x\n", cmd->id);
1270 return -EIO;
1271 }
1272
1273 /*
1265 * Synchronous commands from this op-mode must hold 1274 * Synchronous commands from this op-mode must hold
1266 * the mutex, this ensures we don't try to send two 1275 * the mutex, this ensures we don't try to send two
1267 * (or more) synchronous commands at a time. 1276 * (or more) synchronous commands at a time.
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index 736fe9bb140e..1a4ac9236a44 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -367,6 +367,8 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
367 return -EIO; 367 return -EIO;
368 } 368 }
369 369
370 priv->ucode_loaded = true;
371
370 if (ucode_type != IWL_UCODE_WOWLAN) { 372 if (ucode_type != IWL_UCODE_WOWLAN) {
371 /* delay a bit to give rfkill time to run */ 373 /* delay a bit to give rfkill time to run */
372 msleep(5); 374 msleep(5);
@@ -380,8 +382,6 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
380 return ret; 382 return ret;
381 } 383 }
382 384
383 priv->ucode_loaded = true;
384
385 return 0; 385 return 0;
386} 386}
387 387
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 17bedc50e753..12c4f31ca8fb 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -475,6 +475,10 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
475 475
476 /* If platform's RF_KILL switch is NOT set to KILL */ 476 /* If platform's RF_KILL switch is NOT set to KILL */
477 hw_rfkill = iwl_is_rfkill_set(trans); 477 hw_rfkill = iwl_is_rfkill_set(trans);
478 if (hw_rfkill)
479 set_bit(STATUS_RFKILL, &trans_pcie->status);
480 else
481 clear_bit(STATUS_RFKILL, &trans_pcie->status);
478 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill); 482 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
479 if (hw_rfkill && !run_in_rfkill) 483 if (hw_rfkill && !run_in_rfkill)
480 return -ERFKILL; 484 return -ERFKILL;
@@ -641,6 +645,7 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
641 645
642static int iwl_trans_pcie_start_hw(struct iwl_trans *trans) 646static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
643{ 647{
648 struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
644 bool hw_rfkill; 649 bool hw_rfkill;
645 int err; 650 int err;
646 651
@@ -656,6 +661,10 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
656 iwl_enable_rfkill_int(trans); 661 iwl_enable_rfkill_int(trans);
657 662
658 hw_rfkill = iwl_is_rfkill_set(trans); 663 hw_rfkill = iwl_is_rfkill_set(trans);
664 if (hw_rfkill)
665 set_bit(STATUS_RFKILL, &trans_pcie->status);
666 else
667 clear_bit(STATUS_RFKILL, &trans_pcie->status);
659 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill); 668 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
660 669
661 return 0; 670 return 0;
@@ -694,6 +703,10 @@ static void iwl_trans_pcie_stop_hw(struct iwl_trans *trans,
694 * op_mode. 703 * op_mode.
695 */ 704 */
696 hw_rfkill = iwl_is_rfkill_set(trans); 705 hw_rfkill = iwl_is_rfkill_set(trans);
706 if (hw_rfkill)
707 set_bit(STATUS_RFKILL, &trans_pcie->status);
708 else
709 clear_bit(STATUS_RFKILL, &trans_pcie->status);
697 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill); 710 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
698 } 711 }
699} 712}
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 8595c16f74de..cb5c6792e3a8 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1264,7 +1264,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
1264 for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) { 1264 for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
1265 int copy = 0; 1265 int copy = 0;
1266 1266
1267 if (!cmd->len) 1267 if (!cmd->len[i])
1268 continue; 1268 continue;
1269 1269
1270 /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */ 1270 /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 5c395e2e6a2b..feb204613397 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1508,6 +1508,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
1508 } 1508 }
1509 memcpy(adapter->upld_buf, skb->data, 1509 memcpy(adapter->upld_buf, skb->data,
1510 min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len)); 1510 min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len));
1511 skb_push(skb, INTF_HEADER_LEN);
1511 if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, 1512 if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
1512 PCI_DMA_FROMDEVICE)) 1513 PCI_DMA_FROMDEVICE))
1513 return -1; 1514 return -1;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index b3d00fa4b314..8bfa95600e48 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -895,7 +895,7 @@ struct netdev_fcoe_hbainfo {
895 * 895 *
896 * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh) 896 * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh)
897 * int (*ndo_bridge_getlink)(struct sk_buff *skb, u32 pid, u32 seq, 897 * int (*ndo_bridge_getlink)(struct sk_buff *skb, u32 pid, u32 seq,
898 * struct net_device *dev) 898 * struct net_device *dev, u32 filter_mask)
899 * 899 *
900 * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier); 900 * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier);
901 * Called to change device carrier. Soft-devices (like dummy, team, etc) 901 * Called to change device carrier. Soft-devices (like dummy, team, etc)
diff --git a/net/core/dev.c b/net/core/dev.c
index b13e5c766c11..13e6447f0398 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1624,7 +1624,6 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
1624 } 1624 }
1625 1625
1626 skb_orphan(skb); 1626 skb_orphan(skb);
1627 nf_reset(skb);
1628 1627
1629 if (unlikely(!is_skb_forwardable(dev, skb))) { 1628 if (unlikely(!is_skb_forwardable(dev, skb))) {
1630 atomic_long_inc(&dev->rx_dropped); 1629 atomic_long_inc(&dev->rx_dropped);
@@ -3314,6 +3313,7 @@ int netdev_rx_handler_register(struct net_device *dev,
3314 if (dev->rx_handler) 3313 if (dev->rx_handler)
3315 return -EBUSY; 3314 return -EBUSY;
3316 3315
3316 /* Note: rx_handler_data must be set before rx_handler */
3317 rcu_assign_pointer(dev->rx_handler_data, rx_handler_data); 3317 rcu_assign_pointer(dev->rx_handler_data, rx_handler_data);
3318 rcu_assign_pointer(dev->rx_handler, rx_handler); 3318 rcu_assign_pointer(dev->rx_handler, rx_handler);
3319 3319
@@ -3334,6 +3334,11 @@ void netdev_rx_handler_unregister(struct net_device *dev)
3334 3334
3335 ASSERT_RTNL(); 3335 ASSERT_RTNL();
3336 RCU_INIT_POINTER(dev->rx_handler, NULL); 3336 RCU_INIT_POINTER(dev->rx_handler, NULL);
3337 /* a reader seeing a non NULL rx_handler in a rcu_read_lock()
3338 * section has a guarantee to see a non NULL rx_handler_data
3339 * as well.
3340 */
3341 synchronize_net();
3337 RCU_INIT_POINTER(dev->rx_handler_data, NULL); 3342 RCU_INIT_POINTER(dev->rx_handler_data, NULL);
3338} 3343}
3339EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister); 3344EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
diff --git a/net/core/flow.c b/net/core/flow.c
index c56ea6f7f6c7..2bfd081c59f7 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -328,7 +328,7 @@ static void flow_cache_flush_per_cpu(void *data)
328 struct flow_flush_info *info = data; 328 struct flow_flush_info *info = data;
329 struct tasklet_struct *tasklet; 329 struct tasklet_struct *tasklet;
330 330
331 tasklet = this_cpu_ptr(&info->cache->percpu->flush_tasklet); 331 tasklet = &this_cpu_ptr(info->cache->percpu)->flush_tasklet;
332 tasklet->data = (unsigned long)info; 332 tasklet->data = (unsigned long)info;
333 tasklet_schedule(tasklet); 333 tasklet_schedule(tasklet);
334} 334}
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5fb8d7e47294..b65441da74ab 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -496,8 +496,10 @@ static int rtnl_link_fill(struct sk_buff *skb, const struct net_device *dev)
496 } 496 }
497 if (ops->fill_info) { 497 if (ops->fill_info) {
498 data = nla_nest_start(skb, IFLA_INFO_DATA); 498 data = nla_nest_start(skb, IFLA_INFO_DATA);
499 if (data == NULL) 499 if (data == NULL) {
500 err = -EMSGSIZE;
500 goto err_cancel_link; 501 goto err_cancel_link;
502 }
501 err = ops->fill_info(skb, dev); 503 err = ops->fill_info(skb, dev);
502 if (err < 0) 504 if (err < 0)
503 goto err_cancel_data; 505 goto err_cancel_data;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index e33fe0ab2568..2bab2aa59745 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -118,6 +118,18 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
118 ipv6_addr_loopback(&hdr->daddr)) 118 ipv6_addr_loopback(&hdr->daddr))
119 goto err; 119 goto err;
120 120
121 /* RFC4291 Errata ID: 3480
122 * Interface-Local scope spans only a single interface on a
123 * node and is useful only for loopback transmission of
124 * multicast. Packets with interface-local scope received
125 * from another node must be discarded.
126 */
127 if (!(skb->pkt_type == PACKET_LOOPBACK ||
128 dev->flags & IFF_LOOPBACK) &&
129 ipv6_addr_is_multicast(&hdr->daddr) &&
130 IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
131 goto err;
132
121 /* RFC4291 2.7 133 /* RFC4291 2.7
122 * Nodes must not originate a packet to a multicast address whose scope 134 * Nodes must not originate a packet to a multicast address whose scope
123 * field contains the reserved value 0; if such a packet is received, it 135 * field contains the reserved value 0; if such a packet is received, it
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8555f331ea60..5b1e5af25713 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2693,6 +2693,7 @@ static int key_notify_policy_flush(const struct km_event *c)
2693 hdr->sadb_msg_pid = c->portid; 2693 hdr->sadb_msg_pid = c->portid;
2694 hdr->sadb_msg_version = PF_KEY_V2; 2694 hdr->sadb_msg_version = PF_KEY_V2;
2695 hdr->sadb_msg_errno = (uint8_t) 0; 2695 hdr->sadb_msg_errno = (uint8_t) 0;
2696 hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
2696 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 2697 hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
2697 pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); 2698 pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
2698 return 0; 2699 return 0;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index baaa8608e52d..3bfe2612c8c2 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -349,21 +349,19 @@ static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
349static int ieee80211_add_virtual_monitor(struct ieee80211_local *local) 349static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
350{ 350{
351 struct ieee80211_sub_if_data *sdata; 351 struct ieee80211_sub_if_data *sdata;
352 int ret = 0; 352 int ret;
353 353
354 if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF)) 354 if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
355 return 0; 355 return 0;
356 356
357 mutex_lock(&local->iflist_mtx); 357 ASSERT_RTNL();
358 358
359 if (local->monitor_sdata) 359 if (local->monitor_sdata)
360 goto out_unlock; 360 return 0;
361 361
362 sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL); 362 sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
363 if (!sdata) { 363 if (!sdata)
364 ret = -ENOMEM; 364 return -ENOMEM;
365 goto out_unlock;
366 }
367 365
368 /* set up data */ 366 /* set up data */
369 sdata->local = local; 367 sdata->local = local;
@@ -377,13 +375,13 @@ static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
377 if (WARN_ON(ret)) { 375 if (WARN_ON(ret)) {
378 /* ok .. stupid driver, it asked for this! */ 376 /* ok .. stupid driver, it asked for this! */
379 kfree(sdata); 377 kfree(sdata);
380 goto out_unlock; 378 return ret;
381 } 379 }
382 380
383 ret = ieee80211_check_queues(sdata); 381 ret = ieee80211_check_queues(sdata);
384 if (ret) { 382 if (ret) {
385 kfree(sdata); 383 kfree(sdata);
386 goto out_unlock; 384 return ret;
387 } 385 }
388 386
389 ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef, 387 ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
@@ -391,13 +389,14 @@ static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
391 if (ret) { 389 if (ret) {
392 drv_remove_interface(local, sdata); 390 drv_remove_interface(local, sdata);
393 kfree(sdata); 391 kfree(sdata);
394 goto out_unlock; 392 return ret;
395 } 393 }
396 394
395 mutex_lock(&local->iflist_mtx);
397 rcu_assign_pointer(local->monitor_sdata, sdata); 396 rcu_assign_pointer(local->monitor_sdata, sdata);
398 out_unlock:
399 mutex_unlock(&local->iflist_mtx); 397 mutex_unlock(&local->iflist_mtx);
400 return ret; 398
399 return 0;
401} 400}
402 401
403static void ieee80211_del_virtual_monitor(struct ieee80211_local *local) 402static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
@@ -407,14 +406,20 @@ static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
407 if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF)) 406 if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
408 return; 407 return;
409 408
409 ASSERT_RTNL();
410
410 mutex_lock(&local->iflist_mtx); 411 mutex_lock(&local->iflist_mtx);
411 412
412 sdata = rcu_dereference_protected(local->monitor_sdata, 413 sdata = rcu_dereference_protected(local->monitor_sdata,
413 lockdep_is_held(&local->iflist_mtx)); 414 lockdep_is_held(&local->iflist_mtx));
414 if (!sdata) 415 if (!sdata) {
415 goto out_unlock; 416 mutex_unlock(&local->iflist_mtx);
417 return;
418 }
416 419
417 rcu_assign_pointer(local->monitor_sdata, NULL); 420 rcu_assign_pointer(local->monitor_sdata, NULL);
421 mutex_unlock(&local->iflist_mtx);
422
418 synchronize_net(); 423 synchronize_net();
419 424
420 ieee80211_vif_release_channel(sdata); 425 ieee80211_vif_release_channel(sdata);
@@ -422,8 +427,6 @@ static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
422 drv_remove_interface(local, sdata); 427 drv_remove_interface(local, sdata);
423 428
424 kfree(sdata); 429 kfree(sdata);
425 out_unlock:
426 mutex_unlock(&local->iflist_mtx);
427} 430}
428 431
429/* 432/*
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 29ce2aa87e7b..4749b3858695 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1060,7 +1060,8 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
1060 1060
1061 rcu_read_lock(); 1061 rcu_read_lock();
1062 list_for_each_entry_rcu(sdata, &local->interfaces, list) 1062 list_for_each_entry_rcu(sdata, &local->interfaces, list)
1063 if (ieee80211_vif_is_mesh(&sdata->vif)) 1063 if (ieee80211_vif_is_mesh(&sdata->vif) &&
1064 ieee80211_sdata_running(sdata))
1064 ieee80211_queue_work(&local->hw, &sdata->work); 1065 ieee80211_queue_work(&local->hw, &sdata->work);
1065 rcu_read_unlock(); 1066 rcu_read_unlock();
1066} 1067}
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 141577412d84..82cc30318a86 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3608,8 +3608,10 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
3608 3608
3609 /* Restart STA timers */ 3609 /* Restart STA timers */
3610 rcu_read_lock(); 3610 rcu_read_lock();
3611 list_for_each_entry_rcu(sdata, &local->interfaces, list) 3611 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3612 ieee80211_restart_sta_timer(sdata); 3612 if (ieee80211_sdata_running(sdata))
3613 ieee80211_restart_sta_timer(sdata);
3614 }
3613 rcu_read_unlock(); 3615 rcu_read_unlock();
3614} 3616}
3615 3617
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bb73ed2d20b9..c6844ad080be 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2675,7 +2675,19 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2675 2675
2676 memset(nskb->cb, 0, sizeof(nskb->cb)); 2676 memset(nskb->cb, 0, sizeof(nskb->cb));
2677 2677
2678 ieee80211_tx_skb(rx->sdata, nskb); 2678 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
2679 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
2680
2681 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
2682 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
2683 IEEE80211_TX_CTL_NO_CCK_RATE;
2684 if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
2685 info->hw_queue =
2686 local->hw.offchannel_tx_hw_queue;
2687 }
2688
2689 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
2690 status->band);
2679 } 2691 }
2680 dev_kfree_skb(rx->skb); 2692 dev_kfree_skb(rx->skb);
2681 return RX_QUEUED; 2693 return RX_QUEUED;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a79ce820cb50..238a0cca320e 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -766,6 +766,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
766 struct ieee80211_local *local; 766 struct ieee80211_local *local;
767 struct ieee80211_sub_if_data *sdata; 767 struct ieee80211_sub_if_data *sdata;
768 int ret, i; 768 int ret, i;
769 bool have_key = false;
769 770
770 might_sleep(); 771 might_sleep();
771 772
@@ -793,12 +794,19 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
793 list_del_rcu(&sta->list); 794 list_del_rcu(&sta->list);
794 795
795 mutex_lock(&local->key_mtx); 796 mutex_lock(&local->key_mtx);
796 for (i = 0; i < NUM_DEFAULT_KEYS; i++) 797 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
797 __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i])); 798 __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
798 if (sta->ptk) 799 have_key = true;
800 }
801 if (sta->ptk) {
799 __ieee80211_key_free(key_mtx_dereference(local, sta->ptk)); 802 __ieee80211_key_free(key_mtx_dereference(local, sta->ptk));
803 have_key = true;
804 }
800 mutex_unlock(&local->key_mtx); 805 mutex_unlock(&local->key_mtx);
801 806
807 if (!have_key)
808 synchronize_net();
809
802 sta->dead = true; 810 sta->dead = true;
803 811
804 local->num_sta--; 812 local->num_sta--;
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 4e606fcb2534..55786283a3df 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -195,7 +195,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
195 flow->deficit = q->quantum; 195 flow->deficit = q->quantum;
196 flow->dropped = 0; 196 flow->dropped = 0;
197 } 197 }
198 if (++sch->q.qlen < sch->limit) 198 if (++sch->q.qlen <= sch->limit)
199 return NET_XMIT_SUCCESS; 199 return NET_XMIT_SUCCESS;
200 200
201 q->drop_overlimit++; 201 q->drop_overlimit++;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index ffad48109a22..eac7e0ee23c1 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -904,7 +904,7 @@ void psched_ratecfg_precompute(struct psched_ratecfg *r, u32 rate)
904 u64 mult; 904 u64 mult;
905 int shift; 905 int shift;
906 906
907 r->rate_bps = rate << 3; 907 r->rate_bps = (u64)rate << 3;
908 r->shift = 0; 908 r->shift = 0;
909 r->mult = 1; 909 r->mult = 1;
910 /* 910 /*
diff --git a/net/wireless/core.c b/net/wireless/core.c
index ea4155fe9733..6ddf74f0ae1e 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -212,6 +212,39 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
212 rdev_rfkill_poll(rdev); 212 rdev_rfkill_poll(rdev);
213} 213}
214 214
215void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
216 struct wireless_dev *wdev)
217{
218 lockdep_assert_held(&rdev->devlist_mtx);
219 lockdep_assert_held(&rdev->sched_scan_mtx);
220
221 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_P2P_DEVICE))
222 return;
223
224 if (!wdev->p2p_started)
225 return;
226
227 rdev_stop_p2p_device(rdev, wdev);
228 wdev->p2p_started = false;
229
230 rdev->opencount--;
231
232 if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
233 bool busy = work_busy(&rdev->scan_done_wk);
234
235 /*
236 * If the work isn't pending or running (in which case it would
237 * be waiting for the lock we hold) the driver didn't properly
238 * cancel the scan when the interface was removed. In this case
239 * warn and leak the scan request object to not crash later.
240 */
241 WARN_ON(!busy);
242
243 rdev->scan_req->aborted = true;
244 ___cfg80211_scan_done(rdev, !busy);
245 }
246}
247
215static int cfg80211_rfkill_set_block(void *data, bool blocked) 248static int cfg80211_rfkill_set_block(void *data, bool blocked)
216{ 249{
217 struct cfg80211_registered_device *rdev = data; 250 struct cfg80211_registered_device *rdev = data;
@@ -221,7 +254,8 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
221 return 0; 254 return 0;
222 255
223 rtnl_lock(); 256 rtnl_lock();
224 mutex_lock(&rdev->devlist_mtx); 257
258 /* read-only iteration need not hold the devlist_mtx */
225 259
226 list_for_each_entry(wdev, &rdev->wdev_list, list) { 260 list_for_each_entry(wdev, &rdev->wdev_list, list) {
227 if (wdev->netdev) { 261 if (wdev->netdev) {
@@ -231,18 +265,18 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
231 /* otherwise, check iftype */ 265 /* otherwise, check iftype */
232 switch (wdev->iftype) { 266 switch (wdev->iftype) {
233 case NL80211_IFTYPE_P2P_DEVICE: 267 case NL80211_IFTYPE_P2P_DEVICE:
234 if (!wdev->p2p_started) 268 /* but this requires it */
235 break; 269 mutex_lock(&rdev->devlist_mtx);
236 rdev_stop_p2p_device(rdev, wdev); 270 mutex_lock(&rdev->sched_scan_mtx);
237 wdev->p2p_started = false; 271 cfg80211_stop_p2p_device(rdev, wdev);
238 rdev->opencount--; 272 mutex_unlock(&rdev->sched_scan_mtx);
273 mutex_unlock(&rdev->devlist_mtx);
239 break; 274 break;
240 default: 275 default:
241 break; 276 break;
242 } 277 }
243 } 278 }
244 279
245 mutex_unlock(&rdev->devlist_mtx);
246 rtnl_unlock(); 280 rtnl_unlock();
247 281
248 return 0; 282 return 0;
@@ -745,17 +779,13 @@ static void wdev_cleanup_work(struct work_struct *work)
745 wdev = container_of(work, struct wireless_dev, cleanup_work); 779 wdev = container_of(work, struct wireless_dev, cleanup_work);
746 rdev = wiphy_to_dev(wdev->wiphy); 780 rdev = wiphy_to_dev(wdev->wiphy);
747 781
748 cfg80211_lock_rdev(rdev); 782 mutex_lock(&rdev->sched_scan_mtx);
749 783
750 if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) { 784 if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
751 rdev->scan_req->aborted = true; 785 rdev->scan_req->aborted = true;
752 ___cfg80211_scan_done(rdev, true); 786 ___cfg80211_scan_done(rdev, true);
753 } 787 }
754 788
755 cfg80211_unlock_rdev(rdev);
756
757 mutex_lock(&rdev->sched_scan_mtx);
758
759 if (WARN_ON(rdev->sched_scan_req && 789 if (WARN_ON(rdev->sched_scan_req &&
760 rdev->sched_scan_req->dev == wdev->netdev)) { 790 rdev->sched_scan_req->dev == wdev->netdev)) {
761 __cfg80211_stop_sched_scan(rdev, false); 791 __cfg80211_stop_sched_scan(rdev, false);
@@ -781,21 +811,19 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
781 return; 811 return;
782 812
783 mutex_lock(&rdev->devlist_mtx); 813 mutex_lock(&rdev->devlist_mtx);
814 mutex_lock(&rdev->sched_scan_mtx);
784 list_del_rcu(&wdev->list); 815 list_del_rcu(&wdev->list);
785 rdev->devlist_generation++; 816 rdev->devlist_generation++;
786 817
787 switch (wdev->iftype) { 818 switch (wdev->iftype) {
788 case NL80211_IFTYPE_P2P_DEVICE: 819 case NL80211_IFTYPE_P2P_DEVICE:
789 if (!wdev->p2p_started) 820 cfg80211_stop_p2p_device(rdev, wdev);
790 break;
791 rdev_stop_p2p_device(rdev, wdev);
792 wdev->p2p_started = false;
793 rdev->opencount--;
794 break; 821 break;
795 default: 822 default:
796 WARN_ON_ONCE(1); 823 WARN_ON_ONCE(1);
797 break; 824 break;
798 } 825 }
826 mutex_unlock(&rdev->sched_scan_mtx);
799 mutex_unlock(&rdev->devlist_mtx); 827 mutex_unlock(&rdev->devlist_mtx);
800} 828}
801EXPORT_SYMBOL(cfg80211_unregister_wdev); 829EXPORT_SYMBOL(cfg80211_unregister_wdev);
@@ -936,6 +964,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
936 cfg80211_update_iface_num(rdev, wdev->iftype, 1); 964 cfg80211_update_iface_num(rdev, wdev->iftype, 1);
937 cfg80211_lock_rdev(rdev); 965 cfg80211_lock_rdev(rdev);
938 mutex_lock(&rdev->devlist_mtx); 966 mutex_lock(&rdev->devlist_mtx);
967 mutex_lock(&rdev->sched_scan_mtx);
939 wdev_lock(wdev); 968 wdev_lock(wdev);
940 switch (wdev->iftype) { 969 switch (wdev->iftype) {
941#ifdef CONFIG_CFG80211_WEXT 970#ifdef CONFIG_CFG80211_WEXT
@@ -967,6 +996,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
967 break; 996 break;
968 } 997 }
969 wdev_unlock(wdev); 998 wdev_unlock(wdev);
999 mutex_unlock(&rdev->sched_scan_mtx);
970 rdev->opencount++; 1000 rdev->opencount++;
971 mutex_unlock(&rdev->devlist_mtx); 1001 mutex_unlock(&rdev->devlist_mtx);
972 cfg80211_unlock_rdev(rdev); 1002 cfg80211_unlock_rdev(rdev);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 3aec0e429d8a..5845c2b37aa8 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -503,6 +503,9 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
503void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev, 503void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
504 enum nl80211_iftype iftype, int num); 504 enum nl80211_iftype iftype, int num);
505 505
506void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
507 struct wireless_dev *wdev);
508
506#define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10 509#define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
507 510
508#ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS 511#ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d44ab216c0ec..58e13a8c95f9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4702,14 +4702,19 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4702 if (!rdev->ops->scan) 4702 if (!rdev->ops->scan)
4703 return -EOPNOTSUPP; 4703 return -EOPNOTSUPP;
4704 4704
4705 if (rdev->scan_req) 4705 mutex_lock(&rdev->sched_scan_mtx);
4706 return -EBUSY; 4706 if (rdev->scan_req) {
4707 err = -EBUSY;
4708 goto unlock;
4709 }
4707 4710
4708 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 4711 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4709 n_channels = validate_scan_freqs( 4712 n_channels = validate_scan_freqs(
4710 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 4713 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4711 if (!n_channels) 4714 if (!n_channels) {
4712 return -EINVAL; 4715 err = -EINVAL;
4716 goto unlock;
4717 }
4713 } else { 4718 } else {
4714 enum ieee80211_band band; 4719 enum ieee80211_band band;
4715 n_channels = 0; 4720 n_channels = 0;
@@ -4723,23 +4728,29 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4723 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 4728 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4724 n_ssids++; 4729 n_ssids++;
4725 4730
4726 if (n_ssids > wiphy->max_scan_ssids) 4731 if (n_ssids > wiphy->max_scan_ssids) {
4727 return -EINVAL; 4732 err = -EINVAL;
4733 goto unlock;
4734 }
4728 4735
4729 if (info->attrs[NL80211_ATTR_IE]) 4736 if (info->attrs[NL80211_ATTR_IE])
4730 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 4737 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4731 else 4738 else
4732 ie_len = 0; 4739 ie_len = 0;
4733 4740
4734 if (ie_len > wiphy->max_scan_ie_len) 4741 if (ie_len > wiphy->max_scan_ie_len) {
4735 return -EINVAL; 4742 err = -EINVAL;
4743 goto unlock;
4744 }
4736 4745
4737 request = kzalloc(sizeof(*request) 4746 request = kzalloc(sizeof(*request)
4738 + sizeof(*request->ssids) * n_ssids 4747 + sizeof(*request->ssids) * n_ssids
4739 + sizeof(*request->channels) * n_channels 4748 + sizeof(*request->channels) * n_channels
4740 + ie_len, GFP_KERNEL); 4749 + ie_len, GFP_KERNEL);
4741 if (!request) 4750 if (!request) {
4742 return -ENOMEM; 4751 err = -ENOMEM;
4752 goto unlock;
4753 }
4743 4754
4744 if (n_ssids) 4755 if (n_ssids)
4745 request->ssids = (void *)&request->channels[n_channels]; 4756 request->ssids = (void *)&request->channels[n_channels];
@@ -4876,6 +4887,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4876 kfree(request); 4887 kfree(request);
4877 } 4888 }
4878 4889
4890 unlock:
4891 mutex_unlock(&rdev->sched_scan_mtx);
4879 return err; 4892 return err;
4880} 4893}
4881 4894
@@ -7749,20 +7762,9 @@ static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
7749 if (!rdev->ops->stop_p2p_device) 7762 if (!rdev->ops->stop_p2p_device)
7750 return -EOPNOTSUPP; 7763 return -EOPNOTSUPP;
7751 7764
7752 if (!wdev->p2p_started) 7765 mutex_lock(&rdev->sched_scan_mtx);
7753 return 0; 7766 cfg80211_stop_p2p_device(rdev, wdev);
7754 7767 mutex_unlock(&rdev->sched_scan_mtx);
7755 rdev_stop_p2p_device(rdev, wdev);
7756 wdev->p2p_started = false;
7757
7758 mutex_lock(&rdev->devlist_mtx);
7759 rdev->opencount--;
7760 mutex_unlock(&rdev->devlist_mtx);
7761
7762 if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
7763 rdev->scan_req->aborted = true;
7764 ___cfg80211_scan_done(rdev, true);
7765 }
7766 7768
7767 return 0; 7769 return 0;
7768} 7770}
@@ -8486,7 +8488,7 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
8486 struct nlattr *nest; 8488 struct nlattr *nest;
8487 int i; 8489 int i;
8488 8490
8489 ASSERT_RDEV_LOCK(rdev); 8491 lockdep_assert_held(&rdev->sched_scan_mtx);
8490 8492
8491 if (WARN_ON(!req)) 8493 if (WARN_ON(!req))
8492 return 0; 8494 return 0;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 674aadca0079..fd99ea495b7e 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -169,7 +169,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
169 union iwreq_data wrqu; 169 union iwreq_data wrqu;
170#endif 170#endif
171 171
172 ASSERT_RDEV_LOCK(rdev); 172 lockdep_assert_held(&rdev->sched_scan_mtx);
173 173
174 request = rdev->scan_req; 174 request = rdev->scan_req;
175 175
@@ -230,9 +230,9 @@ void __cfg80211_scan_done(struct work_struct *wk)
230 rdev = container_of(wk, struct cfg80211_registered_device, 230 rdev = container_of(wk, struct cfg80211_registered_device,
231 scan_done_wk); 231 scan_done_wk);
232 232
233 cfg80211_lock_rdev(rdev); 233 mutex_lock(&rdev->sched_scan_mtx);
234 ___cfg80211_scan_done(rdev, false); 234 ___cfg80211_scan_done(rdev, false);
235 cfg80211_unlock_rdev(rdev); 235 mutex_unlock(&rdev->sched_scan_mtx);
236} 236}
237 237
238void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted) 238void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
@@ -698,11 +698,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
698 found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR); 698 found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
699 699
700 if (found) { 700 if (found) {
701 found->pub.beacon_interval = tmp->pub.beacon_interval;
702 found->pub.signal = tmp->pub.signal;
703 found->pub.capability = tmp->pub.capability;
704 found->ts = tmp->ts;
705
706 /* Update IEs */ 701 /* Update IEs */
707 if (rcu_access_pointer(tmp->pub.proberesp_ies)) { 702 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
708 const struct cfg80211_bss_ies *old; 703 const struct cfg80211_bss_ies *old;
@@ -723,6 +718,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
723 718
724 if (found->pub.hidden_beacon_bss && 719 if (found->pub.hidden_beacon_bss &&
725 !list_empty(&found->hidden_list)) { 720 !list_empty(&found->hidden_list)) {
721 const struct cfg80211_bss_ies *f;
722
726 /* 723 /*
727 * The found BSS struct is one of the probe 724 * The found BSS struct is one of the probe
728 * response members of a group, but we're 725 * response members of a group, but we're
@@ -732,6 +729,10 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
732 * SSID to showing it, which is confusing so 729 * SSID to showing it, which is confusing so
733 * drop this information. 730 * drop this information.
734 */ 731 */
732
733 f = rcu_access_pointer(tmp->pub.beacon_ies);
734 kfree_rcu((struct cfg80211_bss_ies *)f,
735 rcu_head);
735 goto drop; 736 goto drop;
736 } 737 }
737 738
@@ -761,6 +762,11 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
761 kfree_rcu((struct cfg80211_bss_ies *)old, 762 kfree_rcu((struct cfg80211_bss_ies *)old,
762 rcu_head); 763 rcu_head);
763 } 764 }
765
766 found->pub.beacon_interval = tmp->pub.beacon_interval;
767 found->pub.signal = tmp->pub.signal;
768 found->pub.capability = tmp->pub.capability;
769 found->ts = tmp->ts;
764 } else { 770 } else {
765 struct cfg80211_internal_bss *new; 771 struct cfg80211_internal_bss *new;
766 struct cfg80211_internal_bss *hidden; 772 struct cfg80211_internal_bss *hidden;
@@ -1056,6 +1062,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
1056 if (IS_ERR(rdev)) 1062 if (IS_ERR(rdev))
1057 return PTR_ERR(rdev); 1063 return PTR_ERR(rdev);
1058 1064
1065 mutex_lock(&rdev->sched_scan_mtx);
1059 if (rdev->scan_req) { 1066 if (rdev->scan_req) {
1060 err = -EBUSY; 1067 err = -EBUSY;
1061 goto out; 1068 goto out;
@@ -1162,6 +1169,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
1162 dev_hold(dev); 1169 dev_hold(dev);
1163 } 1170 }
1164 out: 1171 out:
1172 mutex_unlock(&rdev->sched_scan_mtx);
1165 kfree(creq); 1173 kfree(creq);
1166 cfg80211_unlock_rdev(rdev); 1174 cfg80211_unlock_rdev(rdev);
1167 return err; 1175 return err;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f432bd3755b1..09d994d192ff 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -85,6 +85,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
85 ASSERT_RTNL(); 85 ASSERT_RTNL();
86 ASSERT_RDEV_LOCK(rdev); 86 ASSERT_RDEV_LOCK(rdev);
87 ASSERT_WDEV_LOCK(wdev); 87 ASSERT_WDEV_LOCK(wdev);
88 lockdep_assert_held(&rdev->sched_scan_mtx);
88 89
89 if (rdev->scan_req) 90 if (rdev->scan_req)
90 return -EBUSY; 91 return -EBUSY;
@@ -320,11 +321,9 @@ void cfg80211_sme_scan_done(struct net_device *dev)
320{ 321{
321 struct wireless_dev *wdev = dev->ieee80211_ptr; 322 struct wireless_dev *wdev = dev->ieee80211_ptr;
322 323
323 mutex_lock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
324 wdev_lock(wdev); 324 wdev_lock(wdev);
325 __cfg80211_sme_scan_done(dev); 325 __cfg80211_sme_scan_done(dev);
326 wdev_unlock(wdev); 326 wdev_unlock(wdev);
327 mutex_unlock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
328} 327}
329 328
330void cfg80211_sme_rx_auth(struct net_device *dev, 329void cfg80211_sme_rx_auth(struct net_device *dev,
@@ -924,9 +923,12 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
924 int err; 923 int err;
925 924
926 mutex_lock(&rdev->devlist_mtx); 925 mutex_lock(&rdev->devlist_mtx);
926 /* might request scan - scan_mtx -> wdev_mtx dependency */
927 mutex_lock(&rdev->sched_scan_mtx);
927 wdev_lock(dev->ieee80211_ptr); 928 wdev_lock(dev->ieee80211_ptr);
928 err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL); 929 err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
929 wdev_unlock(dev->ieee80211_ptr); 930 wdev_unlock(dev->ieee80211_ptr);
931 mutex_unlock(&rdev->sched_scan_mtx);
930 mutex_unlock(&rdev->devlist_mtx); 932 mutex_unlock(&rdev->devlist_mtx);
931 933
932 return err; 934 return err;
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index b7a531380e19..7586de77a2f8 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -27,7 +27,8 @@
27#define WIPHY_PR_ARG __entry->wiphy_name 27#define WIPHY_PR_ARG __entry->wiphy_name
28 28
29#define WDEV_ENTRY __field(u32, id) 29#define WDEV_ENTRY __field(u32, id)
30#define WDEV_ASSIGN (__entry->id) = (wdev ? wdev->identifier : 0) 30#define WDEV_ASSIGN (__entry->id) = (!IS_ERR_OR_NULL(wdev) \
31 ? wdev->identifier : 0)
31#define WDEV_PR_FMT "wdev(%u)" 32#define WDEV_PR_FMT "wdev(%u)"
32#define WDEV_PR_ARG (__entry->id) 33#define WDEV_PR_ARG (__entry->id)
33 34
@@ -1778,7 +1779,7 @@ TRACE_EVENT(rdev_set_mac_acl,
1778 ), 1779 ),
1779 TP_fast_assign( 1780 TP_fast_assign(
1780 WIPHY_ASSIGN; 1781 WIPHY_ASSIGN;
1781 WIPHY_ASSIGN; 1782 NETDEV_ASSIGN;
1782 __entry->acl_policy = params->acl_policy; 1783 __entry->acl_policy = params->acl_policy;
1783 ), 1784 ),
1784 TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", acl policy: %d", 1785 TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", acl policy: %d",
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index fb9622f6d99c..e79cb5c0655a 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -89,6 +89,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
89 89
90 cfg80211_lock_rdev(rdev); 90 cfg80211_lock_rdev(rdev);
91 mutex_lock(&rdev->devlist_mtx); 91 mutex_lock(&rdev->devlist_mtx);
92 mutex_lock(&rdev->sched_scan_mtx);
92 wdev_lock(wdev); 93 wdev_lock(wdev);
93 94
94 if (wdev->sme_state != CFG80211_SME_IDLE) { 95 if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -135,6 +136,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
135 err = cfg80211_mgd_wext_connect(rdev, wdev); 136 err = cfg80211_mgd_wext_connect(rdev, wdev);
136 out: 137 out:
137 wdev_unlock(wdev); 138 wdev_unlock(wdev);
139 mutex_unlock(&rdev->sched_scan_mtx);
138 mutex_unlock(&rdev->devlist_mtx); 140 mutex_unlock(&rdev->devlist_mtx);
139 cfg80211_unlock_rdev(rdev); 141 cfg80211_unlock_rdev(rdev);
140 return err; 142 return err;
@@ -190,6 +192,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
190 192
191 cfg80211_lock_rdev(rdev); 193 cfg80211_lock_rdev(rdev);
192 mutex_lock(&rdev->devlist_mtx); 194 mutex_lock(&rdev->devlist_mtx);
195 mutex_lock(&rdev->sched_scan_mtx);
193 wdev_lock(wdev); 196 wdev_lock(wdev);
194 197
195 err = 0; 198 err = 0;
@@ -223,6 +226,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
223 err = cfg80211_mgd_wext_connect(rdev, wdev); 226 err = cfg80211_mgd_wext_connect(rdev, wdev);
224 out: 227 out:
225 wdev_unlock(wdev); 228 wdev_unlock(wdev);
229 mutex_unlock(&rdev->sched_scan_mtx);
226 mutex_unlock(&rdev->devlist_mtx); 230 mutex_unlock(&rdev->devlist_mtx);
227 cfg80211_unlock_rdev(rdev); 231 cfg80211_unlock_rdev(rdev);
228 return err; 232 return err;
@@ -285,6 +289,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
285 289
286 cfg80211_lock_rdev(rdev); 290 cfg80211_lock_rdev(rdev);
287 mutex_lock(&rdev->devlist_mtx); 291 mutex_lock(&rdev->devlist_mtx);
292 mutex_lock(&rdev->sched_scan_mtx);
288 wdev_lock(wdev); 293 wdev_lock(wdev);
289 294
290 if (wdev->sme_state != CFG80211_SME_IDLE) { 295 if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -313,6 +318,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
313 err = cfg80211_mgd_wext_connect(rdev, wdev); 318 err = cfg80211_mgd_wext_connect(rdev, wdev);
314 out: 319 out:
315 wdev_unlock(wdev); 320 wdev_unlock(wdev);
321 mutex_unlock(&rdev->sched_scan_mtx);
316 mutex_unlock(&rdev->devlist_mtx); 322 mutex_unlock(&rdev->devlist_mtx);
317 cfg80211_unlock_rdev(rdev); 323 cfg80211_unlock_rdev(rdev);
318 return err; 324 return err;
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 35754cc8a9e5..8dafe6d3c6e4 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -334,6 +334,70 @@ static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
334 x->xflags &= ~XFRM_TIME_DEFER; 334 x->xflags &= ~XFRM_TIME_DEFER;
335} 335}
336 336
337static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
338{
339 u32 seq_diff, oseq_diff;
340 struct km_event c;
341 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
342 struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
343
344 /* we send notify messages in case
345 * 1. we updated on of the sequence numbers, and the seqno difference
346 * is at least x->replay_maxdiff, in this case we also update the
347 * timeout of our timer function
348 * 2. if x->replay_maxage has elapsed since last update,
349 * and there were changes
350 *
351 * The state structure must be locked!
352 */
353
354 switch (event) {
355 case XFRM_REPLAY_UPDATE:
356 if (!x->replay_maxdiff)
357 break;
358
359 if (replay_esn->seq_hi == preplay_esn->seq_hi)
360 seq_diff = replay_esn->seq - preplay_esn->seq;
361 else
362 seq_diff = ~preplay_esn->seq + replay_esn->seq + 1;
363
364 if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
365 oseq_diff = replay_esn->oseq - preplay_esn->oseq;
366 else
367 oseq_diff = ~preplay_esn->oseq + replay_esn->oseq + 1;
368
369 if (seq_diff < x->replay_maxdiff &&
370 oseq_diff < x->replay_maxdiff) {
371
372 if (x->xflags & XFRM_TIME_DEFER)
373 event = XFRM_REPLAY_TIMEOUT;
374 else
375 return;
376 }
377
378 break;
379
380 case XFRM_REPLAY_TIMEOUT:
381 if (memcmp(x->replay_esn, x->preplay_esn,
382 xfrm_replay_state_esn_len(replay_esn)) == 0) {
383 x->xflags |= XFRM_TIME_DEFER;
384 return;
385 }
386
387 break;
388 }
389
390 memcpy(x->preplay_esn, x->replay_esn,
391 xfrm_replay_state_esn_len(replay_esn));
392 c.event = XFRM_MSG_NEWAE;
393 c.data.aevent = event;
394 km_state_notify(x, &c);
395
396 if (x->replay_maxage &&
397 !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
398 x->xflags &= ~XFRM_TIME_DEFER;
399}
400
337static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb) 401static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb)
338{ 402{
339 int err = 0; 403 int err = 0;
@@ -510,7 +574,7 @@ static struct xfrm_replay xfrm_replay_esn = {
510 .advance = xfrm_replay_advance_esn, 574 .advance = xfrm_replay_advance_esn,
511 .check = xfrm_replay_check_esn, 575 .check = xfrm_replay_check_esn,
512 .recheck = xfrm_replay_recheck_esn, 576 .recheck = xfrm_replay_recheck_esn,
513 .notify = xfrm_replay_notify_bmp, 577 .notify = xfrm_replay_notify_esn,
514 .overflow = xfrm_replay_overflow_esn, 578 .overflow = xfrm_replay_overflow_esn,
515}; 579};
516 580
generated by cgit v1.2.2 (git 2.25.0) at 2025-01-17 08:59:53 -0500