ath5k,ath9k: merge minor fixes from r27432, r27433
[openwrt-10.03/.git] / package / mac80211 / patches / 300-pending_work.patch
1 --- a/net/mac80211/agg-rx.c
2 +++ b/net/mac80211/agg-rx.c
3 @@ -176,6 +176,8 @@ static void ieee80211_send_addba_resp(st
4                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
5         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
6                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
7 +       else if (sdata->vif.type == NL80211_IFTYPE_WDS)
8 +               memcpy(mgmt->bssid, da, ETH_ALEN);
9  
10         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
11                                           IEEE80211_STYPE_ACTION);
12 @@ -262,7 +264,11 @@ void ieee80211_process_addba_request(str
13                                 "%pM on tid %u\n",
14                                 mgmt->sa, tid);
15  #endif /* CONFIG_MAC80211_HT_DEBUG */
16 -               goto end;
17 +
18 +               /* delete existing Rx BA session on the same tid */
19 +               ___ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT,
20 +                                               WLAN_STATUS_UNSPECIFIED_QOS,
21 +                                               false);
22         }
23  
24         /* prepare A-MPDU MLME for Rx aggregation */
25 --- a/net/mac80211/agg-tx.c
26 +++ b/net/mac80211/agg-tx.c
27 @@ -79,7 +79,8 @@ static void ieee80211_send_addba_request
28         memcpy(mgmt->da, da, ETH_ALEN);
29         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
30         if (sdata->vif.type == NL80211_IFTYPE_AP ||
31 -           sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
32 +           sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
33 +           sdata->vif.type == NL80211_IFTYPE_WDS)
34                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
35         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
36                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
37 @@ -398,7 +399,8 @@ int ieee80211_start_tx_ba_session(struct
38          */
39         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
40             sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
41 -           sdata->vif.type != NL80211_IFTYPE_AP)
42 +           sdata->vif.type != NL80211_IFTYPE_AP &&
43 +           sdata->vif.type != NL80211_IFTYPE_WDS)
44                 return -EINVAL;
45  
46         if (test_sta_flags(sta, WLAN_STA_BLOCK_BA)) {
47 --- a/net/mac80211/debugfs_sta.c
48 +++ b/net/mac80211/debugfs_sta.c
49 @@ -59,7 +59,7 @@ static ssize_t sta_flags_read(struct fil
50         char buf[100];
51         struct sta_info *sta = file->private_data;
52         u32 staflags = get_sta_flags(sta);
53 -       int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s%s%s",
54 +       int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s%s",
55                 staflags & WLAN_STA_AUTH ? "AUTH\n" : "",
56                 staflags & WLAN_STA_ASSOC ? "ASSOC\n" : "",
57                 staflags & WLAN_STA_PS_STA ? "PS (sta)\n" : "",
58 @@ -67,7 +67,6 @@ static ssize_t sta_flags_read(struct fil
59                 staflags & WLAN_STA_AUTHORIZED ? "AUTHORIZED\n" : "",
60                 staflags & WLAN_STA_SHORT_PREAMBLE ? "SHORT PREAMBLE\n" : "",
61                 staflags & WLAN_STA_WME ? "WME\n" : "",
62 -               staflags & WLAN_STA_WDS ? "WDS\n" : "",
63                 staflags & WLAN_STA_MFP ? "MFP\n" : "");
64         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
65  }
66 --- a/net/mac80211/iface.c
67 +++ b/net/mac80211/iface.c
68 @@ -178,7 +178,6 @@ static int ieee80211_do_open(struct net_
69  {
70         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
71         struct ieee80211_local *local = sdata->local;
72 -       struct sta_info *sta;
73         u32 changed = 0;
74         int res;
75         u32 hw_reconf_flags = 0;
76 @@ -290,27 +289,6 @@ static int ieee80211_do_open(struct net_
77  
78         set_bit(SDATA_STATE_RUNNING, &sdata->state);
79  
80 -       if (sdata->vif.type == NL80211_IFTYPE_WDS) {
81 -               /* Create STA entry for the WDS peer */
82 -               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
83 -                                    GFP_KERNEL);
84 -               if (!sta) {
85 -                       res = -ENOMEM;
86 -                       goto err_del_interface;
87 -               }
88 -
89 -               /* no locking required since STA is not live yet */
90 -               sta->flags |= WLAN_STA_AUTHORIZED;
91 -
92 -               res = sta_info_insert(sta);
93 -               if (res) {
94 -                       /* STA has been freed */
95 -                       goto err_del_interface;
96 -               }
97 -
98 -               rate_control_rate_init(sta);
99 -       }
100 -
101         /*
102          * set_multicast_list will be invoked by the networking core
103          * which will check whether any increments here were done in
104 @@ -344,8 +322,7 @@ static int ieee80211_do_open(struct net_
105         netif_tx_start_all_queues(dev);
106  
107         return 0;
108 - err_del_interface:
109 -       drv_remove_interface(local, &sdata->vif);
110 +
111   err_stop:
112         if (!local->open_count)
113                 drv_stop(local);
114 @@ -718,6 +695,70 @@ static void ieee80211_if_setup(struct ne
115         dev->destructor = free_netdev;
116  }
117  
118 +static void ieee80211_wds_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
119 +                                        struct sk_buff *skb)
120 +{
121 +       struct ieee80211_local *local = sdata->local;
122 +       struct ieee80211_rx_status *rx_status;
123 +       struct ieee802_11_elems elems;
124 +       struct ieee80211_mgmt *mgmt;
125 +       struct sta_info *sta;
126 +       size_t baselen;
127 +       u32 rates = 0;
128 +       u16 stype;
129 +       bool new = false;
130 +       enum ieee80211_band band = local->hw.conf.channel->band;
131 +       struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
132 +
133 +       rx_status = IEEE80211_SKB_RXCB(skb);
134 +       mgmt = (struct ieee80211_mgmt *) skb->data;
135 +       stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
136 +
137 +       if (stype != IEEE80211_STYPE_BEACON)
138 +               return;
139 +
140 +       baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
141 +       if (baselen > skb->len)
142 +               return;
143 +
144 +       ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
145 +                              skb->len - baselen, &elems);
146 +
147 +       rates = ieee80211_sta_get_rates(local, &elems, band);
148 +
149 +       rcu_read_lock();
150 +
151 +       sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
152 +
153 +       if (!sta) {
154 +               rcu_read_unlock();
155 +               sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
156 +                                    GFP_KERNEL);
157 +               if (!sta)
158 +                       return;
159 +
160 +               new = true;
161 +       }
162 +
163 +       sta->last_rx = jiffies;
164 +       sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
165 +
166 +       if (elems.ht_cap_elem)
167 +               ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
168 +                               elems.ht_cap_elem, &sta->sta.ht_cap);
169 +
170 +       if (elems.wmm_param)
171 +               set_sta_flags(sta, WLAN_STA_WME);
172 +
173 +       if (new) {
174 +               sta->flags = WLAN_STA_AUTHORIZED;
175 +               rate_control_rate_init(sta);
176 +               sta_info_insert_rcu(sta);
177 +       }
178 +
179 +       rcu_read_unlock();
180 +}
181 +
182  static void ieee80211_iface_work(struct work_struct *work)
183  {
184         struct ieee80211_sub_if_data *sdata =
185 @@ -822,6 +863,9 @@ static void ieee80211_iface_work(struct 
186                                 break;
187                         ieee80211_mesh_rx_queued_mgmt(sdata, skb);
188                         break;
189 +               case NL80211_IFTYPE_WDS:
190 +                       ieee80211_wds_rx_queued_mgmt(sdata, skb);
191 +                       break;
192                 default:
193                         WARN(1, "frame for unexpected interface type");
194                         break;
195 --- a/net/mac80211/rx.c
196 +++ b/net/mac80211/rx.c
197 @@ -2137,7 +2137,8 @@ ieee80211_rx_h_action(struct ieee80211_r
198                  */
199                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
200                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
201 -                   sdata->vif.type != NL80211_IFTYPE_AP)
202 +                   sdata->vif.type != NL80211_IFTYPE_AP &&
203 +                   sdata->vif.type != NL80211_IFTYPE_WDS)
204                         break;
205  
206                 /* verify action_code is present */
207 @@ -2335,13 +2336,14 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
208  
209         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
210             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
211 -           sdata->vif.type != NL80211_IFTYPE_STATION)
212 +           sdata->vif.type != NL80211_IFTYPE_STATION &&
213 +           sdata->vif.type != NL80211_IFTYPE_WDS)
214                 return RX_DROP_MONITOR;
215  
216         switch (stype) {
217         case cpu_to_le16(IEEE80211_STYPE_BEACON):
218         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
219 -               /* process for all: mesh, mlme, ibss */
220 +               /* process for all: mesh, mlme, ibss, wds */
221                 break;
222         case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
223         case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
224 @@ -2680,10 +2682,16 @@ static int prepare_for_handlers(struct i
225                 }
226                 break;
227         case NL80211_IFTYPE_WDS:
228 -               if (bssid || !ieee80211_is_data(hdr->frame_control))
229 -                       return 0;
230                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
231                         return 0;
232 +
233 +               if (ieee80211_is_data(hdr->frame_control) ||
234 +                   ieee80211_is_action(hdr->frame_control)) {
235 +                       if (compare_ether_addr(sdata->vif.addr, hdr->addr1))
236 +                               return 0;
237 +               } else if (!ieee80211_is_beacon(hdr->frame_control))
238 +                       return 0;
239 +
240                 break;
241         default:
242                 /* should never get here */
243 --- a/net/mac80211/sta_info.h
244 +++ b/net/mac80211/sta_info.h
245 @@ -31,7 +31,6 @@
246   *     frames.
247   * @WLAN_STA_ASSOC_AP: We're associated to that station, it is an AP.
248   * @WLAN_STA_WME: Station is a QoS-STA.
249 - * @WLAN_STA_WDS: Station is one of our WDS peers.
250   * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
251   *     IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
252   *     frame to this station is transmitted.
253 @@ -54,7 +53,6 @@ enum ieee80211_sta_info_flags {
254         WLAN_STA_SHORT_PREAMBLE = 1<<4,
255         WLAN_STA_ASSOC_AP       = 1<<5,
256         WLAN_STA_WME            = 1<<6,
257 -       WLAN_STA_WDS            = 1<<7,
258         WLAN_STA_CLEAR_PS_FILT  = 1<<9,
259         WLAN_STA_MFP            = 1<<10,
260         WLAN_STA_BLOCK_BA       = 1<<11,
261 --- a/drivers/net/wireless/ath/ath9k/beacon.c
262 +++ b/drivers/net/wireless/ath/ath9k/beacon.c
263 @@ -360,6 +360,7 @@ void ath_beacon_tasklet(unsigned long da
264         struct ath_common *common = ath9k_hw_common(ah);
265         struct ath_buf *bf = NULL;
266         struct ieee80211_vif *vif;
267 +       struct ath_tx_status ts;
268         int slot;
269         u32 bfaddr, bc = 0;
270  
271 @@ -384,7 +385,9 @@ void ath_beacon_tasklet(unsigned long da
272                         ath_dbg(common, ATH_DBG_BSTUCK,
273                                 "beacon is officially stuck\n");
274                         sc->sc_flags |= SC_OP_TSF_RESET;
275 +                       spin_lock(&sc->sc_pcu_lock);
276                         ath_reset(sc, true);
277 +                       spin_unlock(&sc->sc_pcu_lock);
278                 }
279  
280                 return;
281 @@ -464,6 +467,11 @@ void ath_beacon_tasklet(unsigned long da
282                 ath9k_hw_txstart(ah, sc->beacon.beaconq);
283  
284                 sc->beacon.ast_be_xmit += bc;     /* XXX per-vif? */
285 +               if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
286 +                       spin_lock_bh(&sc->sc_pcu_lock);
287 +                       ath9k_hw_txprocdesc(ah, bf->bf_desc, (void *)&ts);
288 +                       spin_unlock_bh(&sc->sc_pcu_lock);
289 +               }
290         }
291  }
292  
293 --- a/drivers/net/wireless/ath/ath9k/main.c
294 +++ b/drivers/net/wireless/ath/ath9k/main.c
295 @@ -617,8 +617,11 @@ void ath_hw_check(struct work_struct *wo
296         ath_dbg(common, ATH_DBG_RESET, "Possible baseband hang, "
297                 "busy=%d (try %d)\n", busy, sc->hw_busy_count + 1);
298         if (busy >= 99) {
299 -               if (++sc->hw_busy_count >= 3)
300 +               if (++sc->hw_busy_count >= 3) {
301 +                       spin_lock_bh(&sc->sc_pcu_lock);
302                         ath_reset(sc, true);
303 +                       spin_unlock_bh(&sc->sc_pcu_lock);
304 +               }
305         } else if (busy >= 0)
306                 sc->hw_busy_count = 0;
307  
308 @@ -637,7 +640,9 @@ static void ath_hw_pll_rx_hang_check(str
309                         /* Rx is hung for more than 500ms. Reset it */
310                         ath_dbg(common, ATH_DBG_RESET,
311                                 "Possible RX hang, resetting");
312 +                       spin_lock_bh(&sc->sc_pcu_lock);
313                         ath_reset(sc, true);
314 +                       spin_unlock_bh(&sc->sc_pcu_lock);
315                         count = 0;
316                 }
317         } else
318 @@ -674,7 +679,9 @@ void ath9k_tasklet(unsigned long data)
319  
320         if ((status & ATH9K_INT_FATAL) ||
321             (status & ATH9K_INT_BB_WATCHDOG)) {
322 +               spin_lock(&sc->sc_pcu_lock);
323                 ath_reset(sc, true);
324 +               spin_unlock(&sc->sc_pcu_lock);
325                 return;
326         }
327  
328 @@ -980,7 +987,6 @@ int ath_reset(struct ath_softc *sc, bool
329         del_timer_sync(&common->ani.timer);
330  
331         ath9k_ps_wakeup(sc);
332 -       spin_lock_bh(&sc->sc_pcu_lock);
333  
334         ieee80211_stop_queues(hw);
335  
336 @@ -1023,7 +1029,6 @@ int ath_reset(struct ath_softc *sc, bool
337         }
338  
339         ieee80211_wake_queues(hw);
340 -       spin_unlock_bh(&sc->sc_pcu_lock);
341  
342         /* Start ANI */
343         if (!common->disable_ani)
344 @@ -2326,9 +2331,9 @@ static void ath9k_flush(struct ieee80211
345         ath9k_ps_wakeup(sc);
346         spin_lock_bh(&sc->sc_pcu_lock);
347         drain_txq = ath_drain_all_txq(sc, false);
348 -       spin_unlock_bh(&sc->sc_pcu_lock);
349         if (!drain_txq)
350                 ath_reset(sc, false);
351 +       spin_unlock_bh(&sc->sc_pcu_lock);
352         ath9k_ps_restore(sc);
353         ieee80211_wake_queues(hw);
354  
355 --- a/drivers/net/wireless/ath/ath9k/xmit.c
356 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
357 @@ -565,11 +565,8 @@ static void ath_tx_complete_aggr(struct 
358  
359         rcu_read_unlock();
360  
361 -       if (needreset) {
362 -               spin_unlock_bh(&sc->sc_pcu_lock);
363 +       if (needreset)
364                 ath_reset(sc, false);
365 -               spin_lock_bh(&sc->sc_pcu_lock);
366 -       }
367  }
368  
369  static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
370 @@ -664,7 +661,8 @@ static int ath_compute_num_delims(struct
371          * TODO - this could be improved to be dependent on the rate.
372          *      The hardware can keep up at lower rates, but not higher rates
373          */
374 -       if (fi->keyix != ATH9K_TXKEYIX_INVALID)
375 +       if ((fi->keyix != ATH9K_TXKEYIX_INVALID) &&
376 +           !(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA))
377                 ndelim += ATH_AGGR_ENCRYPTDELIM;
378  
379         /*
380 @@ -2169,7 +2167,9 @@ static void ath_tx_complete_poll_work(st
381         if (needreset) {
382                 ath_dbg(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
383                         "tx hung, resetting the chip\n");
384 +               spin_lock_bh(&sc->sc_pcu_lock);
385                 ath_reset(sc, true);
386 +               spin_unlock_bh(&sc->sc_pcu_lock);
387         }
388  
389         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
390 --- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
391 +++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
392 @@ -236,7 +236,7 @@ static void ar9003_paprd_get_gain_table(
393         memset(entry, 0, sizeof(ah->paprd_gain_table_entries));
394         memset(index, 0, sizeof(ah->paprd_gain_table_index));
395  
396 -       for (i = 0; i < 32; i++) {
397 +       for (i = 0; i < PAPRD_GAIN_TABLE_ENTRIES; i++) {
398                 entry[i] = REG_READ(ah, reg);
399                 index[i] = (entry[i] >> 24) & 0xff;
400                 reg += 4;
401 @@ -246,13 +246,13 @@ static void ar9003_paprd_get_gain_table(
402  static unsigned int ar9003_get_desired_gain(struct ath_hw *ah, int chain,
403                                             int target_power)
404  {
405 -       int olpc_gain_delta = 0;
406 +       int olpc_gain_delta = 0, cl_gain_mod;
407         int alpha_therm, alpha_volt;
408         int therm_cal_value, volt_cal_value;
409         int therm_value, volt_value;
410         int thermal_gain_corr, voltage_gain_corr;
411         int desired_scale, desired_gain = 0;
412 -       u32 reg;
413 +       u32 reg_olpc  = 0, reg_cl_gain  = 0;
414  
415         REG_CLR_BIT(ah, AR_PHY_PAPRD_TRAINER_STAT1,
416                     AR_PHY_PAPRD_TRAINER_STAT1_PAPRD_TRAIN_DONE);
417 @@ -271,15 +271,29 @@ static unsigned int ar9003_get_desired_g
418         volt_value = REG_READ_FIELD(ah, AR_PHY_BB_THERM_ADC_4,
419                                     AR_PHY_BB_THERM_ADC_4_LATEST_VOLT_VALUE);
420  
421 -       if (chain == 0)
422 -               reg = AR_PHY_TPC_11_B0;
423 -       else if (chain == 1)
424 -               reg = AR_PHY_TPC_11_B1;
425 -       else
426 -               reg = AR_PHY_TPC_11_B2;
427 +       switch (chain) {
428 +       case 0:
429 +               reg_olpc = AR_PHY_TPC_11_B0;
430 +               reg_cl_gain = AR_PHY_CL_TAB_0;
431 +               break;
432 +       case 1:
433 +               reg_olpc = AR_PHY_TPC_11_B1;
434 +               reg_cl_gain = AR_PHY_CL_TAB_1;
435 +               break;
436 +       case 2:
437 +               reg_olpc = AR_PHY_TPC_11_B2;
438 +               reg_cl_gain = AR_PHY_CL_TAB_2;
439 +               break;
440 +       default:
441 +               ath_dbg(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
442 +               "Invalid chainmask: %d\n", chain);
443 +               break;
444 +       }
445  
446 -       olpc_gain_delta = REG_READ_FIELD(ah, reg,
447 +       olpc_gain_delta = REG_READ_FIELD(ah, reg_olpc,
448                                          AR_PHY_TPC_11_OLPC_GAIN_DELTA);
449 +       cl_gain_mod = REG_READ_FIELD(ah, reg_cl_gain,
450 +                                        AR_PHY_CL_TAB_CL_GAIN_MOD);
451  
452         if (olpc_gain_delta >= 128)
453                 olpc_gain_delta = olpc_gain_delta - 256;
454 @@ -289,7 +303,7 @@ static unsigned int ar9003_get_desired_g
455         voltage_gain_corr = (alpha_volt * (volt_value - volt_cal_value) +
456                              (128 / 2)) / 128;
457         desired_gain = target_power - olpc_gain_delta - thermal_gain_corr -
458 -           voltage_gain_corr + desired_scale;
459 +           voltage_gain_corr + desired_scale + cl_gain_mod;
460  
461         return desired_gain;
462  }
463 @@ -727,7 +741,7 @@ int ar9003_paprd_setup_gain_table(struct
464         desired_gain = ar9003_get_desired_gain(ah, chain, train_power);
465  
466         gain_index = 0;
467 -       for (i = 0; i < 32; i++) {
468 +       for (i = 0; i < PAPRD_GAIN_TABLE_ENTRIES; i++) {
469                 if (ah->paprd_gain_table_index[i] >= desired_gain)
470                         break;
471                 gain_index++;
472 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
473 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
474 @@ -1121,6 +1121,9 @@
475  #define AR_PHY_POWERTX_RATE8_POWERTXHT40_5     0x3F00
476  #define AR_PHY_POWERTX_RATE8_POWERTXHT40_5_S   8
477  
478 +#define AR_PHY_CL_TAB_CL_GAIN_MOD              0x1f
479 +#define AR_PHY_CL_TAB_CL_GAIN_MOD_S            0
480 +
481  void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
482  
483  #endif  /* AR9003_PHY_H */
484 --- a/drivers/net/wireless/ath/ath5k/eeprom.c
485 +++ b/drivers/net/wireless/ath/ath5k/eeprom.c
486 @@ -691,14 +691,12 @@ ath5k_eeprom_free_pcal_info(struct ath5k
487                 if (!chinfo[pier].pd_curves)
488                         continue;
489  
490 -               for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
491 +               for (pdg = 0; pdg < AR5K_EEPROM_N_PD_CURVES; pdg++) {
492                         struct ath5k_pdgain_info *pd =
493                                         &chinfo[pier].pd_curves[pdg];
494  
495 -                       if (pd != NULL) {
496 -                               kfree(pd->pd_step);
497 -                               kfree(pd->pd_pwr);
498 -                       }
499 +                       kfree(pd->pd_step);
500 +                       kfree(pd->pd_pwr);
501                 }
502  
503                 kfree(chinfo[pier].pd_curves);
504 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
505 +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
506 @@ -229,6 +229,7 @@ static void ar9003_hw_fill_txdesc(struct
507  static int ar9003_hw_proc_txdesc(struct ath_hw *ah, void *ds,
508                                  struct ath_tx_status *ts)
509  {
510 +       struct ar9003_txc *txc = (struct ar9003_txc *) ds;
511         struct ar9003_txs *ads;
512         u32 status;
513  
514 @@ -238,7 +239,11 @@ static int ar9003_hw_proc_txdesc(struct 
515         if ((status & AR_TxDone) == 0)
516                 return -EINPROGRESS;
517  
518 -       ah->ts_tail = (ah->ts_tail + 1) % ah->ts_size;
519 +       ts->qid = MS(ads->ds_info, AR_TxQcuNum);
520 +       if (!txc || (MS(txc->info, AR_TxQcuNum) == ts->qid))
521 +               ah->ts_tail = (ah->ts_tail + 1) % ah->ts_size;
522 +       else
523 +               return -ENOENT;
524  
525         if ((MS(ads->ds_info, AR_DescId) != ATHEROS_VENDOR_ID) ||
526             (MS(ads->ds_info, AR_TxRxDesc) != 1)) {
527 @@ -254,7 +259,6 @@ static int ar9003_hw_proc_txdesc(struct 
528         ts->ts_seqnum = MS(status, AR_SeqNum);
529         ts->tid = MS(status, AR_TxTid);
530  
531 -       ts->qid = MS(ads->ds_info, AR_TxQcuNum);
532         ts->desc_id = MS(ads->status1, AR_TxDescId);
533         ts->ts_tstamp = ads->status4;
534         ts->ts_status = 0;