Merge branch 'master' of git://git.infradead.org/users/linville/wireless-next into...

diff --combined drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index cb8bcc4e609148e76b79df8a5eae1efba4a1540b,cb4c32eaef61249e061a2c2c5b1f4970d3c9161d..5f3ac251b486d97c2d4f5792ff496b0bd0617521
--- 1/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
--- 2/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@@ -307,7 -307,7 +307,7 @@@ static const struct ar9300_eeprom ar930
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
  
 -               { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
 +               { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
  
@@@ -884,7 -884,7 +884,7 @@@ static const struct ar9300_eeprom ar930
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
  
 -               { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
 +               { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
  
@@@ -2040,7 -2040,7 +2040,7 @@@ static const struct ar9300_eeprom ar930
                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
  
 -              { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
 +              { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0) } },
                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
  
@@@ -3318,7 -3318,7 +3318,7 @@@ static int ar9300_eeprom_restore_intern
  
        word = kzalloc(2048, GFP_KERNEL);
        if (!word)
-               return -1;
+               return -ENOMEM;
  
        memcpy(mptr, &ar9300_default, mdata_size);
  
@@@ -3861,7 -3861,7 +3861,7 @@@ static void ar9003_hw_internal_regulato
                                }
                        } else {
                                reg_pmu_set = (5 << 1) | (7 << 4) |
 -                                            (1 << 8) | (2 << 14) |
 +                                            (2 << 8) | (2 << 14) |
                                              (6 << 17) | (1 << 20) |
                                              (3 << 24) | (1 << 28);
                        }

diff --combined drivers/net/wireless/b43/dma.c
index c5d890e74a1e426e80bc8379afa3b49a4617cb8c,975d960405488b6ea2cf3db429688098247103da..5e45604f0f5d2c95b86b364ab354769fd126d24f
--- 1/drivers/net/wireless/b43/dma.c
--- 2/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@@ -419,33 -419,34 +419,34 @@@ static int alloc_ringmemory(struct b43_
        gfp_t flags = GFP_KERNEL;
  
        /* The specs call for 4K buffers for 30- and 32-bit DMA with 4K
-        * alignment and 8K buffers for 64-bit DMA with 8K alignment. Testing
-        * has shown that 4K is sufficient for the latter as long as the buffer
-        * does not cross an 8K boundary.
-        *
-        * For unknown reasons - possibly a hardware error - the BCM4311 rev
-        * 02, which uses 64-bit DMA, needs the ring buffer in very low memory,
-        * which accounts for the GFP_DMA flag below.
-        *
-        * The flags here must match the flags in free_ringmemory below!
+        * alignment and 8K buffers for 64-bit DMA with 8K alignment.
+        * In practice we could use smaller buffers for the latter, but the
+        * alignment is really important because of the hardware bug. If bit
+        * 0x00001000 is used in DMA address, some hardware (like BCM4331)
+        * copies that bit into B43_DMA64_RXSTATUS and we get false values from
+        * B43_DMA64_RXSTATDPTR. Let's just use 8K buffers even if we don't use
+        * more than 256 slots for ring.
         */
-       if (ring->type == B43_DMA_64BIT)
-               flags |= GFP_DMA;
+       u16 ring_mem_size = (ring->type == B43_DMA_64BIT) ?
+                               B43_DMA64_RINGMEMSIZE : B43_DMA32_RINGMEMSIZE;
+ 
        ring->descbase = dma_alloc_coherent(ring->dev->dev->dma_dev,
-                                           B43_DMA_RINGMEMSIZE,
-                                           &(ring->dmabase), flags);
+                                           ring_mem_size, &(ring->dmabase),
+                                           flags);
        if (!ring->descbase) {
                b43err(ring->dev->wl, "DMA ringmemory allocation failed\n");
                return -ENOMEM;
        }
-       memset(ring->descbase, 0, B43_DMA_RINGMEMSIZE);
+       memset(ring->descbase, 0, ring_mem_size);
  
        return 0;
  }
  
  static void free_ringmemory(struct b43_dmaring *ring)
  {
-       dma_free_coherent(ring->dev->dev->dma_dev, B43_DMA_RINGMEMSIZE,
+       u16 ring_mem_size = (ring->type == B43_DMA_64BIT) ?
+                               B43_DMA64_RINGMEMSIZE : B43_DMA32_RINGMEMSIZE;
+       dma_free_coherent(ring->dev->dev->dma_dev, ring_mem_size,
                          ring->descbase, ring->dmabase);
  }
  
@@@ -816,23 -817,9 +817,23 @@@ static u64 supported_dma_mask(struct b4
        u32 tmp;
        u16 mmio_base;
  
 -      tmp = b43_read32(dev, SSB_TMSHIGH);
 -      if (tmp & SSB_TMSHIGH_DMA64)
 -              return DMA_BIT_MASK(64);
 +      switch (dev->dev->bus_type) {
 +#ifdef CONFIG_B43_BCMA
 +      case B43_BUS_BCMA:
 +              tmp = bcma_aread32(dev->dev->bdev, BCMA_IOST);
 +              if (tmp & BCMA_IOST_DMA64)
 +                      return DMA_BIT_MASK(64);
 +              break;
 +#endif
 +#ifdef CONFIG_B43_SSB
 +      case B43_BUS_SSB:
 +              tmp = ssb_read32(dev->dev->sdev, SSB_TMSHIGH);
 +              if (tmp & SSB_TMSHIGH_DMA64)
 +                      return DMA_BIT_MASK(64);
 +              break;
 +#endif
 +      }
 +
        mmio_base = b43_dmacontroller_base(0, 0);
        b43_write32(dev, mmio_base + B43_DMA32_TXCTL, B43_DMA32_TXADDREXT_MASK);
        tmp = b43_read32(dev, mmio_base + B43_DMA32_TXCTL);

diff --combined net/mac80211/mesh_pathtbl.c
index 7fde32159fdcd1bc077bb9a071575b3920626a9c,ede4f5242e0b7e1be9fc36cbda954a8ed9d7e5c0..f97d17cb073c0f0388e390cf6f8d4ffcbed06a5b
--- 1/net/mac80211/mesh_pathtbl.c
--- 2/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@@ -307,14 -307,14 +307,14 @@@ static void mesh_path_move_to_queue(str
  
        while (num_skbs--) {
                skb = __skb_dequeue(&failq);
-               if (copy)
+               if (copy) {
                        cp_skb = skb_copy(skb, GFP_ATOMIC);
+                       if (cp_skb)
+                               __skb_queue_tail(&failq, cp_skb);
+               }
  
                prepare_for_gate(skb, gate_mpath->dst, gate_mpath);
                __skb_queue_tail(&gateq, skb);
- 
-               if (copy && cp_skb)
-                       __skb_queue_tail(&failq, cp_skb);
        }
  
        spin_lock_irqsave(&gate_mpath->frame_queue.lock, flags);
@@@ -1132,6 -1132,6 +1132,6 @@@ void mesh_path_expire(struct ieee80211_
  void mesh_pathtbl_unregister(void)
  {
        /* no need for locking during exit path */
 -      mesh_table_free(rcu_dereference_raw(mesh_paths), true);
 -      mesh_table_free(rcu_dereference_raw(mpp_paths), true);
 +      mesh_table_free(rcu_dereference_protected(mesh_paths, 1), true);
 +      mesh_table_free(rcu_dereference_protected(mpp_paths, 1), true);
  }