4 files changed, 32 insertions, 20 deletions

diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 1ec52356b5a1..130657db5c43 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3984,18 +3984,20 @@ static void ar9003_hw_quick_drop_apply(struct ath_hw *ah, u16 freq)
         int quick_drop;
         s32 t[3], f[3] = {5180, 5500, 5785};
 
-        if (!(pBase->miscConfiguration & BIT(1)))
+        if (!(pBase->miscConfiguration & BIT(4)))
                 return;
 
-        if (freq < 4000)
-                quick_drop = eep->modalHeader2G.quick_drop;
-        else {
-                t[0] = eep->base_ext1.quick_drop_low;
-                t[1] = eep->modalHeader5G.quick_drop;
-                t[2] = eep->base_ext1.quick_drop_high;
-                quick_drop = ar9003_hw_power_interpolate(freq, f, t, 3);
+        if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9340(ah)) {
+                if (freq < 4000) {
+                        quick_drop = eep->modalHeader2G.quick_drop;
+                } else {
+                        t[0] = eep->base_ext1.quick_drop_low;
+                        t[1] = eep->modalHeader5G.quick_drop;
+                        t[2] = eep->base_ext1.quick_drop_high;
+                        quick_drop = ar9003_hw_power_interpolate(freq, f, t, 3);
+                }
+                REG_RMW_FIELD(ah, AR_PHY_AGC, AR_PHY_AGC_QUICK_DROP, quick_drop);
         }
-        REG_RMW_FIELD(ah, AR_PHY_AGC, AR_PHY_AGC_QUICK_DROP, quick_drop);
 }
 
 static void ar9003_hw_txend_to_xpa_off_apply(struct ath_hw *ah, bool is2ghz)
@@ -4035,7 +4037,7 @@ static void ar9003_hw_xlna_bias_strength_apply(struct ath_hw *ah, bool is2ghz)
         struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
         u8 bias;
 
-        if (!(eep->baseEepHeader.featureEnable & 0x40))
+        if (!(eep->baseEepHeader.miscConfiguration & 0x40))
                 return;
 
         if (!AR_SREV_9300(ah))
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 54b04155e43b..8918035da3a3 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -146,10 +146,9 @@ static void ath9k_hw_set_clockrate(struct ath_hw *ah)
         else
                 clockrate = ATH9K_CLOCK_RATE_5GHZ_OFDM;
 
-        if (IS_CHAN_HT40(chan))
-                clockrate *= 2;
-
-        if (ah->curchan) {
+        if (chan) {
+                if (IS_CHAN_HT40(chan))
+                        clockrate *= 2;
                 if (IS_CHAN_HALF_RATE(chan))
                         clockrate /= 2;
                 if (IS_CHAN_QUARTER_RATE(chan))
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 09cdbcd09739..b5a19e098f2d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1276,6 +1276,10 @@ static void ath_tx_fill_desc(struct ath_softc *sc, struct ath_buf *bf,
                                 if (!rts_thresh || (len > rts_thresh))
                                         rts = true;
                         }
+
+                        if (!aggr)
+                                len = fi->framelen;
+
                         ath_buf_set_rate(sc, bf, &info, len, rts);
                 }
 
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index de9eb2cfbf4b..366339421d4f 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2041,13 +2041,20 @@ static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
         case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
                 mutex_lock(&wcn->hal_ind_mutex);
                 msg_ind = kmalloc(sizeof(*msg_ind), GFP_KERNEL);
-                msg_ind->msg_len = len;
-                msg_ind->msg = kmalloc(len, GFP_KERNEL);
-                memcpy(msg_ind->msg, buf, len);
-                list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
-                queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
-                wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                if (msg_ind) {
+                        msg_ind->msg_len = len;
+                        msg_ind->msg = kmalloc(len, GFP_KERNEL);
+                        memcpy(msg_ind->msg, buf, len);
+                        list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
+                        queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                }
                 mutex_unlock(&wcn->hal_ind_mutex);
+                if (msg_ind)
+                        break;
+                /* FIXME: Do something smarter then just printing an error. */
+                wcn36xx_err("Run out of memory while handling SMD_EVENT (%d)\n",
+                            msg_header->msg_type);
                 break;
         default:
                 wcn36xx_err("SMD_EVENT (%d) not supported\n",