6 files changed, 50 insertions, 20 deletions

diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8d690a0eb1a9..c4c0371c763b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1384,9 +1384,11 @@ void iwl_rx_handle(struct iwl_priv *priv)
 
                 rxq->queue[i] = NULL;
 
-                pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
-                                            priv->hw_params.rx_buf_size,
-                                            PCI_DMA_FROMDEVICE);
+                dma_sync_single_range_for_cpu(
+                                &priv->pci_dev->dev, rxb->real_dma_addr,
+                                rxb->aligned_dma_addr - rxb->real_dma_addr,
+                                priv->hw_params.rx_buf_size,
+                                PCI_DMA_FROMDEVICE);
                 pkt = (struct iwl_rx_packet *)rxb->skb->data;
 
                 /* Reclaim a command buffer only if this packet is a response
@@ -1436,8 +1438,8 @@ void iwl_rx_handle(struct iwl_priv *priv)
                         rxb->skb = NULL;
                 }
 
-                pci_unmap_single(priv->pci_dev, rxb->dma_addr,
-                                 priv->hw_params.rx_buf_size,
+                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
+                                 priv->hw_params.rx_buf_size + 256,
                                  PCI_DMA_FROMDEVICE);
                 spin_lock_irqsave(&rxq->lock, flags);
                 list_add_tail(&rxb->list, &priv->rxq.rx_used);
@@ -2341,7 +2343,6 @@ static void iwl_bg_alive_start(struct work_struct *data)
         mutex_lock(&priv->mutex);
         iwl_alive_start(priv);
         mutex_unlock(&priv->mutex);
-        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
 }
 
 static void iwl4965_bg_rf_kill(struct work_struct *work)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 4c312c55f90c..01a845851338 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -290,6 +290,9 @@ void iwl_clear_stations_table(struct iwl_priv *priv)
         priv->num_stations = 0;
         memset(priv->stations, 0, sizeof(priv->stations));
 
+        /* clean ucode key table bit map */
+        priv->ucode_key_table = 0;
+
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 EXPORT_SYMBOL(iwl_clear_stations_table);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index c018121085e9..9966d4e384ce 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -89,7 +89,8 @@ extern struct iwl_cfg iwl5100_abg_cfg;
 #define DEFAULT_LONG_RETRY_LIMIT  4U
 
 struct iwl_rx_mem_buffer {
-        dma_addr_t dma_addr;
+        dma_addr_t real_dma_addr;
+        dma_addr_t aligned_dma_addr;
         struct sk_buff *skb;
         struct list_head list;
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 7cde9d76ff5d..0509c16dbe75 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -204,7 +204,7 @@ int iwl_rx_queue_restock(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->dma_addr);
+                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->aligned_dma_addr);
                 rxq->queue[rxq->write] = rxb;
                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                 rxq->free_count--;
@@ -251,7 +251,7 @@ void iwl_rx_allocate(struct iwl_priv *priv)
                 rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
 
                 /* Alloc a new receive buffer */
-                rxb->skb = alloc_skb(priv->hw_params.rx_buf_size,
+                rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
                                 __GFP_NOWARN | GFP_ATOMIC);
                 if (!rxb->skb) {
                         if (net_ratelimit())
@@ -266,9 +266,17 @@ void iwl_rx_allocate(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Get physical address of RB/SKB */
-                rxb->dma_addr =
-                    pci_map_single(priv->pci_dev, rxb->skb->data,
-                           priv->hw_params.rx_buf_size, PCI_DMA_FROMDEVICE);
+                rxb->real_dma_addr = pci_map_single(
+                                        priv->pci_dev,
+                                        rxb->skb->data,
+                                        priv->hw_params.rx_buf_size + 256,
+                                        PCI_DMA_FROMDEVICE);
+                /* dma address must be no more than 36 bits */
+                BUG_ON(rxb->real_dma_addr & ~DMA_BIT_MASK(36));
+                /* and also 256 byte aligned! */
+                rxb->aligned_dma_addr = ALIGN(rxb->real_dma_addr, 256);
+                skb_reserve(rxb->skb, rxb->aligned_dma_addr - rxb->real_dma_addr);
+
                 list_add_tail(&rxb->list, &rxq->rx_free);
                 rxq->free_count++;
         }
@@ -300,8 +308,8 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
                 if (rxq->pool[i].skb != NULL) {
                         pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].dma_addr,
-                                         priv->hw_params.rx_buf_size,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size + 256,
                                          PCI_DMA_FROMDEVICE);
                         dev_kfree_skb(rxq->pool[i].skb);
                 }
@@ -354,8 +362,8 @@ void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                  * to an SKB, so we need to unmap and free potential storage */
                 if (rxq->pool[i].skb != NULL) {
                         pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].dma_addr,
-                                         priv->hw_params.rx_buf_size,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size + 256,
                                          PCI_DMA_FROMDEVICE);
                         priv->alloc_rxb_skb--;
                         dev_kfree_skb(rxq->pool[i].skb);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 61797f3f8d5c..26f7084d3011 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -475,7 +475,7 @@ static int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
                 if (!test_and_set_bit(i, &priv->ucode_key_table))
                         return i;
 
-        return -1;
+        return WEP_INVALID_OFFSET;
 }
 
 int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
@@ -620,6 +620,9 @@ static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
         /* else, we are overriding an existing key => no need to allocated room
          * in uCode. */
 
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
+
         priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
@@ -637,6 +640,7 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
 {
         unsigned long flags;
         __le16 key_flags = 0;
+        int ret;
 
         key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
         key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
@@ -664,14 +668,18 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         /* else, we are overriding an existing key => no need to allocated room
          * in uCode. */
 
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
+
         priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
+        ret = iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        IWL_DEBUG_INFO("hwcrypto: modify ucode station key info\n");
-        return iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+        return ret;
 }
 
 static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
@@ -696,6 +704,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
         /* else, we are overriding an existing key => no need to allocated room
          * in uCode. */
 
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
+
         /* This copy is acutally not needed: we get the key with each TX */
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
 
@@ -734,6 +745,13 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 return 0;
         }
 
+        if (priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+                IWL_WARNING("Removing wrong key %d 0x%x\n",
+                            keyconf->keyidx, key_flags);
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
+
         if (!test_and_clear_bit(priv->stations[sta_id].sta.key.key_offset,
                 &priv->ucode_key_table))
                 IWL_ERROR("index %d not used in uCode key table.\n",
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 285b53e7e261..45a6b0c35695 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -6012,7 +6012,6 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
         mutex_lock(&priv->mutex);
         iwl3945_alive_start(priv);
         mutex_unlock(&priv->mutex);
-        ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC);
 }
 
 static void iwl3945_bg_rf_kill(struct work_struct *work)