debian-packaging
/
linux
8
0
Fork 0
Code Releases Activity

add p54 backport fixes 

all vanilla patches forwarded to stable, rest is from wireless-next.
seen in Fedora 13, important as we don't shipp prism54 monster.
hopefully will make users more happy with p54.

svn path=/dists/sid/linux-2.6/; revision=15550
This commit is contained in:
Maximilian Attems 2010-04-24 01:14:43 +00:00
parent 2422d961a8
commit 7bc0469416
12 changed files with 1069 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
debian/changelog vendored
View File

@ -45,6 +45,7 @@ linux-2.6 (2.6.32-12) UNRELEASED; urgency=low
* Add libata TRIM support.
* Backport radeon r800 modesetting support.
* drm/radeon/kms: further spread spectrum fixes.
* Backport p54 fixes.
[ dann frazier ]
* Add DRBD backport

31
debian/patches/bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch vendored Normal file
View File

@ -0,0 +1,31 @@
From 088ea189c4c75cdf211146faa4b341a0f7476be6 Mon Sep 17 00:00:00 2001
From: Darren Jenkins <darrenrjenkins@gmail.com>
Date: Wed, 17 Feb 2010 23:40:15 +1100
Subject: [PATCH] drivers/net/wireless/p54/txrx.c Fix off by one error
fix off by one error in the queue size check of p54_tx_qos_accounting_alloc()
Coverity CID: 13314
Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/txrx.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 0e8f694..6605799 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -186,7 +186,7 @@ static int p54_tx_qos_accounting_alloc(struct p54_common *priv,
struct p54_tx_queue_stats *queue;
unsigned long flags;
- if (WARN_ON(p54_queue > P54_QUEUE_NUM))
+ if (WARN_ON(p54_queue >= P54_QUEUE_NUM))
return -EINVAL;
queue = &priv->tx_stats[p54_queue];
--
1.6.5

108
debian/patches/bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch vendored Normal file
View File

@ -0,0 +1,108 @@
From 93a59d7527147e3656664aa3179f8d19de256081 Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@googlemail.com>
Date: Sat, 31 Oct 2009 22:59:27 +0100
Subject: [PATCH] p54: disable channels with incomplete calibration data sets
James Grossmann [1] reported that p54 spews out confusing
messages instead of preventing the mayhem from happening.
the reason is that "p54: generate channel list dynamically"
is not perfect. It didn't discard incomplete channel data
sets and therefore p54 advertised to support them as well.
[1]: http://marc.info/?l=linux-wireless&m=125699830215890
Cc: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: James Grossmann <cctsurf@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/eeprom.c | 31 +++++++++++++++++++------------
1 files changed, 19 insertions(+), 12 deletions(-)
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 0efe67d..8e3818f 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -126,7 +126,7 @@ static int p54_generate_band(struct ieee80211_hw *dev,
int ret = -ENOMEM;
if ((!list->entries) || (!list->band_channel_num[band]))
- return 0;
+ return -EINVAL;
tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
if (!tmp)
@@ -158,6 +158,7 @@ static int p54_generate_band(struct ieee80211_hw *dev,
(list->channels[i].data & CHAN_HAS_CURVE ? "" :
" [curve data]"),
list->channels[i].index, list->channels[i].freq);
+ continue;
}
tmp->channels[j].band = list->channels[i].band;
@@ -165,7 +166,16 @@ static int p54_generate_band(struct ieee80211_hw *dev,
j++;
}
- tmp->n_channels = list->band_channel_num[band];
+ if (j == 0) {
+ printk(KERN_ERR "%s: Disabling totally damaged %s band.\n",
+ wiphy_name(dev->wiphy), (band == IEEE80211_BAND_2GHZ) ?
+ "2 GHz" : "5 GHz");
+
+ ret = -ENODATA;
+ goto err_out;
+ }
+
+ tmp->n_channels = j;
old = priv->band_table[band];
priv->band_table[band] = tmp;
if (old) {
@@ -228,13 +238,13 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
struct p54_common *priv = dev->priv;
struct p54_channel_list *list;
unsigned int i, j, max_channel_num;
- int ret = -ENOMEM;
+ int ret = 0;
u16 freq;
if ((priv->iq_autocal_len != priv->curve_data->entries) ||
(priv->iq_autocal_len != priv->output_limit->entries))
- printk(KERN_ERR "%s: EEPROM is damaged... you may not be able"
- "to use all channels with this device.\n",
+ printk(KERN_ERR "%s: Unsupported or damaged EEPROM detected. "
+ "You may not be able to use all channels.\n",
wiphy_name(dev->wiphy));
max_channel_num = max_t(unsigned int, priv->output_limit->entries,
@@ -243,8 +253,10 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
priv->curve_data->entries);
list = kzalloc(sizeof(*list), GFP_KERNEL);
- if (!list)
+ if (!list) {
+ ret = -ENOMEM;
goto free;
+ }
list->max_entries = max_channel_num;
list->channels = kzalloc(sizeof(struct p54_channel_entry) *
@@ -282,13 +294,8 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
p54_compare_channels, NULL);
for (i = 0, j = 0; i < IEEE80211_NUM_BANDS; i++) {
- if (list->band_channel_num[i]) {
- ret = p54_generate_band(dev, list, i);
- if (ret)
- goto free;
-
+ if (p54_generate_band(dev, list, i) == 0)
j++;
- }
}
if (j == 0) {
/* no useable band available. */
--
1.6.5

106
debian/patches/bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch vendored Normal file
View File

@ -0,0 +1,106 @@
Return-Path: <linux-wireless-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
X-Spam-Level:
X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
X-Original-To: maks@dual
Delivered-To: maks@dual
Received: from dual (localhost.localdomain [127.0.0.1])
by dual (Postfix) with ESMTP id ED48524045
for <maks@dual>; Fri, 23 Apr 2010 04:14:59 +0200 (CEST)
X-Original-To: max@stro.at
Delivered-To: max@stro.at
Received: from baikonur.stro.at [213.239.196.228]
by dual with POP3 (fetchmail-6.3.16)
for <maks@dual> (single-drop); Fri, 23 Apr 2010 04:14:59 +0200 (CEST)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
by baikonur.stro.at (Postfix) with ESMTP id 407AB5C001
for <max@stro.at>; Thu, 22 Apr 2010 19:44:39 +0200 (CEST)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1755433Ab0DVRwc (ORCPT <rfc822;max@stro.at>);
Thu, 22 Apr 2010 13:52:32 -0400
Received: from mail-vw0-f46.google.com ([209.85.212.46]:52767 "EHLO
mail-vw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S1755072Ab0DVRwb (ORCPT
<rfc822;linux-wireless@vger.kernel.org>);
Thu, 22 Apr 2010 13:52:31 -0400
Received: by vws14 with SMTP id 14so38715vws.19
for <linux-wireless@vger.kernel.org>; Thu, 22 Apr 2010 10:52:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=gamma;
h=domainkey-signature:received:received:received:received:received
:from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
:content-type:content-transfer-encoding:message-id;
bh=rH+Y7riac85RIiXG6qbakuXBSY790hWoyH0ONriCSeg=;
b=Ykzs36TepjY445cGIr5IH3C+knJyI56PTTlTKWlRkO098l3gXlGleAI5fn2s5sivNa
F5+SpVSoGspL0FT7yHTYb+CnZ+6ZyzshVgudsBPAakjfrZNlBYpEub3PAgddsugf9A75
j1t9aq3UhlHL13NLQQg1mwfWsN5hUSbfjKwZQ=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=googlemail.com; s=gamma;
h=from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
:content-type:content-transfer-encoding:message-id;
b=ZixBFP6qSmufbPzN9DU5JjG83DMDIZFFEClBzUKD1bszfbpbEy3fsXLEFwgDchVGf2
VpqO7MVL6R70pPqT4CGb/k2XnaFpVM3lQZK695ehjHK+X/g0nPaprPYrZu/TbPii3Ieg
3Dj6OuAw0/tMNg5FUfKbIlLct8v3HfpJmNVwE=
Received: by 10.220.126.153 with SMTP id c25mr1130560vcs.140.1271958749500;
Thu, 22 Apr 2010 10:52:29 -0700 (PDT)
Received: from blech.mobile ([72.14.241.41])
by mx.google.com with ESMTPS id i29sm814619vcr.12.2010.04.22.10.52.27
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Thu, 22 Apr 2010 10:52:28 -0700 (PDT)
Received: from blech.mobile ([127.0.0.1])
by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id bUG7mXcCH9aE; Thu, 22 Apr 2010 19:52:17 +0200 (CEST)
Received: from blech.mobile (localhost [127.0.0.1])
by blech.mobile (Postfix) with ESMTP id ADBA2342417;
Thu, 22 Apr 2010 19:52:17 +0200 (CEST)
From: Christian Lamparter <chunkeey@googlemail.com>
To: linux-wireless@vger.kernel.org
Subject: [PATCH 1/2] p54pci: fix bugs in p54p_check_tx_ring
Date: Thu, 22 Apr 2010 19:52:16 +0200
User-Agent: KMail/1.12.4 (Linux/2.6.34-rc5-uber-wl; KDE/4.3.4; x86_64; ; )
Cc: linville@tuxdriver.com, hdegoede@redhat.com
MIME-Version: 1.0
X-Length: 2052
X-UID: 75
Content-Type: Text/Plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201004221952.16857.chunkeey@googlemail.com>
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org
Content-Length: 1159
From: Hans de Goede <hdegoede@redhat.com>
Hans de Goede identified a bug in p54p_check_tx_ring:
there are two ring indices. 1 => tx data and 3 => tx management.
But the old code had a constant "1" and this resulted in spurious
dma unmapping failures.
Cc: stable@kernel.org
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623
Bug-Identified-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 679da7e..cffe2f2 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
u32 idx, i;
i = (*index) % ring_limit;
- (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+ (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
idx %= ring_limit;
while (i != idx) {
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

164
debian/patches/bugfix/all/p54pci-fix-regression.patch vendored Normal file
View File

@ -0,0 +1,164 @@
Return-Path: <linux-wireless-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
X-Spam-Level:
X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
X-Original-To: maks@dual
Delivered-To: maks@dual
Received: from dual (localhost.localdomain [127.0.0.1])
by dual (Postfix) with ESMTP id 6945624045
for <maks@dual>; Fri, 23 Apr 2010 04:14:42 +0200 (CEST)
X-Original-To: max@stro.at
Delivered-To: max@stro.at
Received: from baikonur.stro.at [213.239.196.228]
by dual with POP3 (fetchmail-6.3.16)
for <maks@dual> (single-drop); Fri, 23 Apr 2010 04:14:42 +0200 (CEST)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
by baikonur.stro.at (Postfix) with ESMTP id 0650F5C00B
for <max@stro.at>; Thu, 22 Apr 2010 19:45:05 +0200 (CEST)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1755708Ab0DVRxA (ORCPT <rfc822;max@stro.at>);
Thu, 22 Apr 2010 13:53:00 -0400
Received: from mail-pz0-f194.google.com ([209.85.222.194]:37203 "EHLO
mail-pz0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S1755147Ab0DVRw7 (ORCPT
<rfc822;linux-wireless@vger.kernel.org>);
Thu, 22 Apr 2010 13:52:59 -0400
Received: by pzk32 with SMTP id 32so5663626pzk.21
for <linux-wireless@vger.kernel.org>; Thu, 22 Apr 2010 10:52:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=gamma;
h=domainkey-signature:received:received:received:received:received
:from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
:content-type:content-transfer-encoding:message-id;
bh=yJz+c5/JMqOxuMrxk75S5LvVDV5la+16zQVI/xQuosY=;
b=krjzx1PwXDglH9BKcI+e7WyvVPwy284xIAAxYojJMM3AkNsVpxCyuUXkzqkrDWaN8Z
VwzlJJFO5mYy9ZmQM+utsqENnmIEpQp2eszSxI2cfx36lKpoE71gDBkK1A+vDnClheMv
MyFHfI869i03WhBAASw6oe1xhdI1bb4F49zmE=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=googlemail.com; s=gamma;
h=from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
:content-type:content-transfer-encoding:message-id;
b=kLB1kLIJwVvNYqGmlY3Ql+PqUEXjk7KvsSUZSvES9+eYqzjAQYbiuEpl40DM10BSrl
Mtdenj+I5Ce2chMF6i1JrzzNFMFz0pUVtqUuAk9iQL9Iuo7eE7DZEOS2X3Vo4xCdRLC1
S3ygbtj1GOb1JfYn7ge9GL39GsyCNQBRlfVuA=
Received: by 10.141.188.24 with SMTP id q24mr1593520rvp.0.1271958778042;
Thu, 22 Apr 2010 10:52:58 -0700 (PDT)
Received: from blech.mobile ([72.14.240.9])
by mx.google.com with ESMTPS id 22sm156714pzk.13.2010.04.22.10.52.55
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Thu, 22 Apr 2010 10:52:57 -0700 (PDT)
Received: from blech.mobile ([127.0.0.1])
by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id vx9ld1JknfF5; Thu, 22 Apr 2010 19:52:44 +0200 (CEST)
Received: from blech.mobile (localhost [127.0.0.1])
by blech.mobile (Postfix) with ESMTP id 80D53342417;
Thu, 22 Apr 2010 19:52:44 +0200 (CEST)
From: Christian Lamparter <chunkeey@googlemail.com>
To: linux-wireless@vger.kernel.org
Subject: [PATCH 2/2] p54pci: fix regression from prevent stuck rx-ring on slow system
Date: Thu, 22 Apr 2010 19:52:43 +0200
User-Agent: KMail/1.12.4 (Linux/2.6.34-rc5-uber-wl; KDE/4.3.4; x86_64; ; )
Cc: linville@tuxdriver.com, hdegoede@redhat.com
MIME-Version: 1.0
X-Length: 4801
X-UID: 74
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201004221952.44071.chunkeey@googlemail.com>
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org
Content-Length: 4096
From: Hans de Goede <hdegoede@redhat.com>
This patch fixes a recently introduced use-after-free regression
from "p54pci: prevent stuck rx-ring on slow system".
Hans de Goede reported a use-after-free regression:
>BUG: unable to handle kernel paging request at 6b6b6b6b
>IP: [<e122284a>] p54p_check_tx_ring+0x84/0xb1 [p54pci]
>*pde = 00000000
>Oops: 0000 [#1] SMP
>EIP: 0060:[<e122284a>] EFLAGS: 00010286 CPU: 0
>EIP is at p54p_check_tx_ring+0x84/0xb1 [p54pci]
>EAX: 6b6b6b6b EBX: df10b170 ECX: 00000003 EDX: 00000001
>ESI: dc471500 EDI: d8acaeb0 EBP: c098be9c ESP: c098be84
> DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
>Process swapper (pid: 0, ti=c098a000 task=c09ccfe0 task.ti=c098a000)
>Call Trace:
> [<e1222b02>] ? p54p_tasklet+0xaa/0xb5 [p54pci]
> [<c0440568>] ? tasklet_action+0x78/0xcb
> [<c0440ed3>] ? __do_softirq+0xbc/0x173
Quote from comment #17:
"The problem is the innocent looking moving of the tx processing to
after the rx processing in the tasklet. Quoting from the changelog:
This patch does it the same way, except that it also prioritize
rx data processing, simply because tx routines *can* wait.
This is causing an issue with us referencing already freed memory,
because some skb's we transmit, we immediately receive back, such
as those for reading the eeprom (*) and getting stats.
What can happen because of the moving of the tx processing to after
the rx processing is that when the tasklet first runs after doing a
special skb tx (such as eeprom) we've already received the answer
to it.
Then the rx processing ends up calling p54_find_and_unlink_skb to
find the matching tx skb for the just received special rx skb and
frees the tx skb.
Then after the processing of the rx skb answer, and thus freeing
the tx skb, we go process the completed tx ring entires, and then
dereference the free-ed skb, to see if it should free free-ed by
p54p_check_tx_ring()."
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623
Bug-Identified-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index ca42ccb..07c4528 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -277,6 +277,14 @@ static void p54p_tasklet(unsigned long dev_id)
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
+ p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+ ARRAY_SIZE(ring_control->tx_mgmt),
+ priv->tx_buf_mgmt);
+
+ p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+ ARRAY_SIZE(ring_control->tx_data),
+ priv->tx_buf_data);
+
p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
@@ -285,14 +293,6 @@ static void p54p_tasklet(unsigned long dev_id)
wmb();
P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
-
- p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
- ARRAY_SIZE(ring_control->tx_mgmt),
- priv->tx_buf_mgmt);
-
- p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
- ARRAY_SIZE(ring_control->tx_data),
- priv->tx_buf_data);
}
static irqreturn_t p54p_interrupt(int irq, void *dev_id)
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

103
debian/patches/bugfix/all/p54pci-fix-serious-sparse-warning.patch vendored Normal file
View File

@ -0,0 +1,103 @@
Return-Path: <linux-wireless-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
X-Spam-Level:
X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
X-Original-To: maks@dual
Delivered-To: maks@dual
Received: from dual (localhost.localdomain [127.0.0.1])
by dual (Postfix) with ESMTP id 4027E2429D
for <maks@dual>; Thu, 15 Apr 2010 14:57:47 +0200 (CEST)
X-Original-To: max@stro.at
Delivered-To: max@stro.at
Received: from baikonur.stro.at [213.239.196.228]
by dual with POP3 (fetchmail-6.3.13)
for <maks@dual> (single-drop); Thu, 15 Apr 2010 14:57:47 +0200 (CEST)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
by baikonur.stro.at (Postfix) with ESMTP id 785425C00F
for <max@stro.at>; Thu, 15 Apr 2010 14:09:33 +0200 (CEST)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1752356Ab0DOMRR (ORCPT <rfc822;max@stro.at>);
Thu, 15 Apr 2010 08:17:17 -0400
Received: from mail-ew0-f220.google.com ([209.85.219.220]:35717 "EHLO
mail-ew0-f220.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S1752038Ab0DOMRQ (ORCPT
<rfc822;linux-wireless@vger.kernel.org>);
Thu, 15 Apr 2010 08:17:16 -0400
Received: by ewy20 with SMTP id 20so459287ewy.1
for <linux-wireless@vger.kernel.org>; Thu, 15 Apr 2010 05:17:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=gamma;
h=domainkey-signature:received:received:received:received:received
:from:to:subject:date:user-agent:cc:mime-version:content-type
:content-transfer-encoding:message-id;
bh=p4STqoMJiC6z/cKYzv2Exm9RYHj8L3PhiKgV8V/My+8=;
b=Df3+ZF5p9OAOZbcMmdGwwyRhe6KKgy9XnEhFVlpwzN2ifr78NiUNl9AwiYsHd2bCAb
DFIq9aj2Lw3AzsJziQaRZjAyi1BCwRHWYVT1z6DAUac3GKAPDbTwg8ci9O31eyKBcbQu
3d//ULPy6g8NH7caloyA+ZhU8cmIl93ddMv0I=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=googlemail.com; s=gamma;
h=from:to:subject:date:user-agent:cc:mime-version:content-type
:content-transfer-encoding:message-id;
b=n2N7kl6h8TV/cyVhTSMxV505sNe8/00nKdlLKyTn7h0M9MPZhLYgvJms0gr6wMtuoS
t78oiQsjdGsh2YMGVes/1eMoISXolb2pGF36Lp3UnoVJtJx5s6aBasGQ0oVUc2PIYozG
FyMOuuxhdfOyNOE8iJVAGWVBWLNxyIICBR4tU=
Received: by 10.213.2.81 with SMTP id 17mr25407ebi.76.1271333835129;
Thu, 15 Apr 2010 05:17:15 -0700 (PDT)
Received: from blech.mobile (nat-wh.rz.uni-karlsruhe.de [129.13.72.197])
by mx.google.com with ESMTPS id 15sm922586ewy.12.2010.04.15.05.17.14
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Thu, 15 Apr 2010 05:17:14 -0700 (PDT)
Received: from blech.mobile ([127.0.0.1])
by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id gSWm7mhNvXD9; Thu, 15 Apr 2010 14:17:08 +0200 (CEST)
Received: from blech.mobile (localhost [127.0.0.1])
by blech.mobile (Postfix) with ESMTP id 6D2D834077B;
Thu, 15 Apr 2010 14:17:08 +0200 (CEST)
From: Christian Lamparter <chunkeey@googlemail.com>
To: linux-wireless@vger.kernel.org
Subject: [PATCH] p54pci: fix serious sparse warning
Date: Thu, 15 Apr 2010 14:17:07 +0200
User-Agent: KMail/1.12.4 (Linux/2.6.34-rc3-uber-wl; KDE/4.3.4; x86_64; ; )
Cc: linville@tuxdriver.com
MIME-Version: 1.0
Content-Type: Text/Plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201004151417.07538.chunkeey@googlemail.com>
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org
X-Virus-Scanned: by Amavis (ClamAV) at stro.at
Content-Length: 1202
This patch fixes a bug which was just recently introduced by
("p54pci: prevent stuck rx-ring on slow system").
make M=drivers/net/wireless/p54 C=2 CF=-D__CHECK_ENDIAN__
CHECK drivers/net/wireless/p54/p54pci.c
drivers/net/wireless/p54/p54pci.c:143:11: warning: cast to restricted __le32
CC [M] drivers/net/wireless/p54/p54pci.o
Reported-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 86f3e9a..679da7e 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -140,7 +140,7 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
idx = le32_to_cpu(ring_control->host_idx[ring_index]);
limit = idx;
- limit -= le32_to_cpu(index);
+ limit -= index;
limit = ring_limit - limit;
i = idx % ring_limit;
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

180
debian/patches/bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch vendored Normal file
View File

@ -0,0 +1,180 @@
From d713804c6032b95cd3035014e16fadebb9655c6f Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@googlemail.com>
Date: Sun, 17 Jan 2010 23:19:25 +0100
Subject: [PATCH] p54pci: move tx cleanup into tasklet
This patch moves the tx cleanup routines out of the critical
interrupt context and into the (previously known as rx) tasklet.
The main goal of this operation is to remove the extensive
usage of spin_lock_irqsaves in the generic p54common library.
The next step would be to modify p54usb to do the
rx processing inside a tasklet (just like usbnet).
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/p54pci.c | 56 +++++++++++++++++++------------------
drivers/net/wireless/p54/p54pci.h | 6 ++--
2 files changed, 32 insertions(+), 30 deletions(-)
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 4bf4c21..48cae48 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -234,25 +234,26 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
}
-/* caller must hold priv->lock */
static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
int ring_index, struct p54p_desc *ring, u32 ring_limit,
- void **tx_buf)
+ struct sk_buff **tx_buf)
{
+ unsigned long flags;
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
struct p54p_desc *desc;
+ struct sk_buff *skb;
u32 idx, i;
i = (*index) % ring_limit;
(*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
idx %= ring_limit;
+ spin_lock_irqsave(&priv->lock, flags);
while (i != idx) {
desc = &ring[i];
- if (tx_buf[i])
- if (FREE_AFTER_TX((struct sk_buff *) tx_buf[i]))
- p54_free_skb(dev, tx_buf[i]);
+
+ skb = tx_buf[i];
tx_buf[i] = NULL;
pci_unmap_single(priv->pdev, le32_to_cpu(desc->host_addr),
@@ -263,17 +264,32 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
desc->len = 0;
desc->flags = 0;
+ if (skb && FREE_AFTER_TX(skb)) {
+ spin_unlock_irqrestore(&priv->lock, flags);
+ p54_free_skb(dev, skb);
+ spin_lock_irqsave(&priv->lock, flags);
+ }
+
i++;
i %= ring_limit;
}
+ spin_unlock_irqrestore(&priv->lock, flags);
}
-static void p54p_rx_tasklet(unsigned long dev_id)
+static void p54p_tasklet(unsigned long dev_id)
{
struct ieee80211_hw *dev = (struct ieee80211_hw *)dev_id;
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
+ p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+ ARRAY_SIZE(ring_control->tx_mgmt),
+ priv->tx_buf_mgmt);
+
+ p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+ ARRAY_SIZE(ring_control->tx_data),
+ priv->tx_buf_data);
+
p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
@@ -288,38 +304,24 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
{
struct ieee80211_hw *dev = dev_id;
struct p54p_priv *priv = dev->priv;
- struct p54p_ring_control *ring_control = priv->ring_control;
__le32 reg;
spin_lock(&priv->lock);
reg = P54P_READ(int_ident);
if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
- spin_unlock(&priv->lock);
- return IRQ_HANDLED;
+ goto out;
}
-
P54P_WRITE(int_ack, reg);
reg &= P54P_READ(int_enable);
- if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE)) {
- p54p_check_tx_ring(dev, &priv->tx_idx_mgmt,
- 3, ring_control->tx_mgmt,
- ARRAY_SIZE(ring_control->tx_mgmt),
- priv->tx_buf_mgmt);
-
- p54p_check_tx_ring(dev, &priv->tx_idx_data,
- 1, ring_control->tx_data,
- ARRAY_SIZE(ring_control->tx_data),
- priv->tx_buf_data);
-
- tasklet_schedule(&priv->rx_tasklet);
-
- } else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
+ if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE))
+ tasklet_schedule(&priv->tasklet);
+ else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
complete(&priv->boot_comp);
+out:
spin_unlock(&priv->lock);
-
return reg ? IRQ_HANDLED : IRQ_NONE;
}
@@ -368,7 +370,7 @@ static void p54p_stop(struct ieee80211_hw *dev)
unsigned int i;
struct p54p_desc *desc;
- tasklet_kill(&priv->rx_tasklet);
+ tasklet_kill(&priv->tasklet);
P54P_WRITE(int_enable, cpu_to_le32(0));
P54P_READ(int_enable);
@@ -559,7 +561,7 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
priv->common.tx = p54p_tx;
spin_lock_init(&priv->lock);
- tasklet_init(&priv->rx_tasklet, p54p_rx_tasklet, (unsigned long)dev);
+ tasklet_init(&priv->tasklet, p54p_tasklet, (unsigned long)dev);
err = request_firmware(&priv->firmware, "isl3886pci",
&priv->pdev->dev);
diff --git a/drivers/net/wireless/p54/p54pci.h b/drivers/net/wireless/p54/p54pci.h
index fbb6839..2feead6 100644
--- a/drivers/net/wireless/p54/p54pci.h
+++ b/drivers/net/wireless/p54/p54pci.h
@@ -92,7 +92,7 @@ struct p54p_priv {
struct p54_common common;
struct pci_dev *pdev;
struct p54p_csr __iomem *map;
- struct tasklet_struct rx_tasklet;
+ struct tasklet_struct tasklet;
const struct firmware *firmware;
spinlock_t lock;
struct p54p_ring_control *ring_control;
@@ -101,8 +101,8 @@ struct p54p_priv {
u32 rx_idx_mgmt, tx_idx_mgmt;
struct sk_buff *rx_buf_data[8];
struct sk_buff *rx_buf_mgmt[4];
- void *tx_buf_data[32];
- void *tx_buf_mgmt[4];
+ struct sk_buff *tx_buf_data[32];
+ struct sk_buff *tx_buf_mgmt[4];
struct completion boot_comp;
};
--
1.6.5

188
debian/patches/bugfix/all/p54pci-prevent-stuck-rx-ring.patch vendored Normal file
View File

@ -0,0 +1,188 @@
Return-Path: <linux-wireless-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
X-Spam-Level:
X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
X-Original-To: maks@dual
Delivered-To: maks@dual
Received: from dual (localhost.localdomain [127.0.0.1])
by dual (Postfix) with ESMTP id 9C5E5240B2
for <maks@dual>; Sat, 10 Apr 2010 05:40:32 +0200 (CEST)
X-Original-To: max@stro.at
Delivered-To: max@stro.at
Received: from baikonur.stro.at [213.239.196.228]
by dual with POP3 (fetchmail-6.3.13)
for <maks@dual> (single-drop); Sat, 10 Apr 2010 05:40:32 +0200 (CEST)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
by baikonur.stro.at (Postfix) with ESMTP id 57CCD5C001
for <max@stro.at>; Fri, 9 Apr 2010 21:30:10 +0200 (CEST)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1755774Ab0DIThv (ORCPT <rfc822;max@stro.at>);
Fri, 9 Apr 2010 15:37:51 -0400
Received: from mail-fx0-f223.google.com ([209.85.220.223]:53451 "EHLO
mail-fx0-f223.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S1755660Ab0DIThu (ORCPT
<rfc822;linux-wireless@vger.kernel.org>);
Fri, 9 Apr 2010 15:37:50 -0400
Received: by fxm23 with SMTP id 23so3059091fxm.21
for <linux-wireless@vger.kernel.org>; Fri, 09 Apr 2010 12:37:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=googlemail.com; s=gamma;
h=domainkey-signature:received:received:received:to:subject:cc:from
:date:mime-version:content-type:content-transfer-encoding:message-id;
bh=/1/MkPwABrV9B+UeF6gm0FPvrdPa07zITP+BiYkzzvw=;
b=auJ2WlRwYLTrqH7PVkjv2hQzjgsBbBZysz1x9gVsGRQoOOZ+wTxIkXHmADOz2Clurf
qKYgHxxCHnjDu6Xb3kQiYRHAmKFE9O/sRDNyWmVXKU9eLSt47cF16hKkyVPAOs/+g2P7
usGYv5VXGKFrTCJwhqjvUCrVeW/6sy2mne5qo=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=googlemail.com; s=gamma;
h=to:subject:cc:from:date:mime-version:content-type
:content-transfer-encoding:message-id;
b=jVz41M1Z71WIF8rYp/LErkkyGct/5qylglZrBSMErJB5AC3su/UaeNmI6c+tEXGrmE
RYWQDDFlrvqDy7qgL+QmxvU0RgOizjnueLLPZlD3X4dR1O7YN+CuIpK1JJ+6Roa+p2QF
e60ozvjRK1DjNk1aahW0hpaZxRDPGrFVxtxwM=
Received: by 10.223.6.153 with SMTP id 25mr453117faz.81.1270841868071;
Fri, 09 Apr 2010 12:37:48 -0700 (PDT)
Received: from debian64.daheim (p5B16D5D6.dip.t-dialin.net [91.22.213.214])
by mx.google.com with ESMTPS id e17sm3562248fke.27.2010.04.09.12.37.42
(version=TLSv1/SSLv3 cipher=RC4-MD5);
Fri, 09 Apr 2010 12:37:42 -0700 (PDT)
Received: from debian64.daheim
([192.168.0.4] helo=debian64.localnet ident=chuck)
by debian64.daheim with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
(Exim 4.71)
(envelope-from <chunkeey@googlemail.com>)
id 1O0K1N-0002Xr-Ua; Fri, 09 Apr 2010 21:37:41 +0200
To: linux-wireless@vger.kernel.org
Subject: [PATCH] p54pci: prevent stuck rx-ring on slow system
Cc: linville@tuxdriver.com
From: Christian Lamparter <chunkeey@googlemail.com>
Date: Fri, 9 Apr 2010 21:37:38 +0200
MIME-Version: 1.0
Content-Type: Text/Plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201004092137.39285.chunkeey@googlemail.com>
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org
X-Virus-Scanned: by Amavis (ClamAV) at stro.at
Content-Length: 4420
From: Quintin Pitts <geek4linux@gmail.com>
This patch fixes an old problem, which - under certain
circumstances - could cause the device to become
unresponsive.
most of p54pci's rx-ring management is implemented in just
two distinct standalone functions. p54p_check_rx_ring takes
care of processing incoming data, while p54p_refill_rx_ring
tries to replenish all depleted communication buffers.
This has always worked fine on my fast machine, but
now I know there is a hidden race...
The most likely candidate here is ring_control->device_idx.
Quintin Pitts had already analyzed the culprit and posted
a patch back in Oct 2009. But sadly, no one's picked up on this.
( https://patchwork.kernel.org/patch/53079/ [2 & 3] ).
This patch does the same way, except that it also prioritize
rx data processing, simply because tx routines *can* wait.
Reported-by: Sean Young <sean@mess.org>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=11386
Reported-by: Quintin Pitts <geek4linux@gmail.com>
Signed-off-by: Quintin Pitts <geek4linux@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
John,
It's been nearly a week and no complains or regressions
have been reported. Therefore I think it is now save to
finally merge this patch... Preferably into -next, so
bug #11386 can be closed for 2.6.34 release.
Regards,
Chr
---
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index ed4bdff..aa29663 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -131,7 +131,7 @@ static int p54p_upload_firmware(struct ieee80211_hw *dev)
static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
int ring_index, struct p54p_desc *ring, u32 ring_limit,
- struct sk_buff **rx_buf)
+ struct sk_buff **rx_buf, u32 index)
{
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
@@ -139,7 +139,7 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
idx = le32_to_cpu(ring_control->host_idx[ring_index]);
limit = idx;
- limit -= le32_to_cpu(ring_control->device_idx[ring_index]);
+ limit -= le32_to_cpu(index);
limit = ring_limit - limit;
i = idx % ring_limit;
@@ -231,7 +231,7 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
i %= ring_limit;
}
- p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
+ p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf, *index);
}
static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
@@ -276,14 +276,6 @@ static void p54p_tasklet(unsigned long dev_id)
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
- p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
- ARRAY_SIZE(ring_control->tx_mgmt),
- priv->tx_buf_mgmt);
-
- p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
- ARRAY_SIZE(ring_control->tx_data),
- priv->tx_buf_data);
-
p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
@@ -292,6 +284,14 @@ static void p54p_tasklet(unsigned long dev_id)
wmb();
P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
+
+ p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+ ARRAY_SIZE(ring_control->tx_mgmt),
+ priv->tx_buf_mgmt);
+
+ p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+ ARRAY_SIZE(ring_control->tx_data),
+ priv->tx_buf_data);
}
static irqreturn_t p54p_interrupt(int irq, void *dev_id)
@@ -444,10 +444,10 @@ static int p54p_open(struct ieee80211_hw *dev)
priv->rx_idx_mgmt = priv->tx_idx_mgmt = 0;
p54p_refill_rx_ring(dev, 0, priv->ring_control->rx_data,
- ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data);
+ ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data, 0);
p54p_refill_rx_ring(dev, 2, priv->ring_control->rx_mgmt,
- ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt);
+ ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt, 0);
P54P_WRITE(ring_control_base, cpu_to_le32(priv->ring_control_dma));
P54P_READ(ring_control_base);
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

100
debian/patches/bugfix/all/p54pci-revise-tx-locking.patch vendored Normal file
View File

@ -0,0 +1,100 @@
From b92f7d30830a319148df2943b7565989494e5ad1 Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@googlemail.com>
Date: Fri, 22 Jan 2010 08:01:11 +0100
Subject: [PATCH] p54pci: revise tx locking
This patch continues the effort which began with:
"[PATCH] p54pci: move tx cleanup into tasklet".
Thanks to these changes, p54pci's interrupt & tx
cleanup routines can be made lock-less.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/p54pci.c | 16 ++++------------
1 files changed, 4 insertions(+), 12 deletions(-)
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 48cae48..bda29c0 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -238,7 +238,6 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
int ring_index, struct p54p_desc *ring, u32 ring_limit,
struct sk_buff **tx_buf)
{
- unsigned long flags;
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
struct p54p_desc *desc;
@@ -249,7 +248,6 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
(*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
idx %= ring_limit;
- spin_lock_irqsave(&priv->lock, flags);
while (i != idx) {
desc = &ring[i];
@@ -264,16 +262,12 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
desc->len = 0;
desc->flags = 0;
- if (skb && FREE_AFTER_TX(skb)) {
- spin_unlock_irqrestore(&priv->lock, flags);
+ if (skb && FREE_AFTER_TX(skb))
p54_free_skb(dev, skb);
- spin_lock_irqsave(&priv->lock, flags);
- }
i++;
i %= ring_limit;
}
- spin_unlock_irqrestore(&priv->lock, flags);
}
static void p54p_tasklet(unsigned long dev_id)
@@ -306,7 +300,6 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
struct p54p_priv *priv = dev->priv;
__le32 reg;
- spin_lock(&priv->lock);
reg = P54P_READ(int_ident);
if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
goto out;
@@ -321,15 +314,14 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
complete(&priv->boot_comp);
out:
- spin_unlock(&priv->lock);
return reg ? IRQ_HANDLED : IRQ_NONE;
}
static void p54p_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
{
+ unsigned long flags;
struct p54p_priv *priv = dev->priv;
struct p54p_ring_control *ring_control = priv->ring_control;
- unsigned long flags;
struct p54p_desc *desc;
dma_addr_t mapping;
u32 device_idx, idx, i;
@@ -370,14 +362,14 @@ static void p54p_stop(struct ieee80211_hw *dev)
unsigned int i;
struct p54p_desc *desc;
- tasklet_kill(&priv->tasklet);
-
P54P_WRITE(int_enable, cpu_to_le32(0));
P54P_READ(int_enable);
udelay(10);
free_irq(priv->pdev->irq, dev);
+ tasklet_kill(&priv->tasklet);
+
P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
for (i = 0; i < ARRAY_SIZE(priv->rx_buf_data); i++) {
--
1.6.5

51
debian/patches/bugfix/all/p54pci-rx-frame-length-check.patch vendored Normal file
View File

@ -0,0 +1,51 @@
From f5300e04df78feae8107c1846dd3a9e27c071b2f Mon Sep 17 00:00:00 2001
From: Christian Lamparter <chunkeey@googlemail.com>
Date: Mon, 18 Jan 2010 00:07:38 +0100
Subject: [PATCH] p54pci: rx frame length check
A long time ago, a user reported several crashes due to
data corruptions which are likely the result of a
not-100%-supported, or faulty? PCI bridge.
( http://patchwork.kernel.org/patch/53004/ )
This patch fixes entry #1.
"1. p54p_check_rx_ring - skb_over_panic: Under a ping flood
or just left running for a bit would panic with a skb_over_panic."
As described in the mail: The invalid frame length causes
skb_put to bailout and trigger a crash.
Note:
Simply dropping the frame is problematic, because if its content
contains a tx feedback we would lose some portion of the device
memory space.... And the driver/mac80211 should handle all other
invalid data.
Reported-by: Quintin Pitts <geek4linux@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/p54pci.c | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index a15962a..a72f7c2 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -197,6 +197,14 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
i %= ring_limit;
continue;
}
+
+ if (unlikely(len > priv->common.rx_mtu)) {
+ if (net_ratelimit())
+ dev_err(&priv->pdev->dev, "rx'd frame size "
+ "exceeds length threshold.\n");
+
+ len = priv->common.rx_mtu;
+ }
skb_put(skb, len);
if (p54_rx(dev, skb)) {
--
1.6.5

27
debian/patches/bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch vendored Normal file
View File

@ -0,0 +1,27 @@
From 15a69a81731d337a3d9db51692ff8704c1114f43 Mon Sep 17 00:00:00 2001
From: Shimada Hirofumi <hirofumi@flycat.org>
Date: Sun, 14 Feb 2010 04:16:16 +0900
Subject: [PATCH] p54usb: Add usbid for Corega CG-WLUSB2GT.
Signed-off-by: Shimada Hirofumi <hirofumi@flycat.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
drivers/net/wireless/p54/p54usb.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 92af9b9..dcb484b 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -36,6 +36,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
/* Version 1 devices (pci chip + net2280) */
{USB_DEVICE(0x0506, 0x0a11)}, /* 3COM 3CRWE254G72 */
{USB_DEVICE(0x0707, 0xee06)}, /* SMC 2862W-G */
+ {USB_DEVICE(0x07aa, 0x001c)}, /* Corega CG-WLUSB2GT */
{USB_DEVICE(0x083a, 0x4501)}, /* Accton 802.11g WN4501 USB */
{USB_DEVICE(0x083a, 0x4502)}, /* Siemens Gigaset USB Adapter */
{USB_DEVICE(0x083a, 0x5501)}, /* Phillips CPWUA054 */
--
1.6.5

10
debian/patches/series/12 vendored
View File

@ -38,3 +38,13 @@
+ features/all/libata-Clarify-ata_set_lba_range_entries-function.patch
+ features/all/drm-radeon-evergreen.patch
+ bugfix/all/drm-radeon-kms-further-spread-spectrum-fixes.patch
+ bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch
+ bugfix/all/p54pci-rx-frame-length-check.patch
+ bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch
+ bugfix/all/p54pci-revise-tx-locking.patch
+ bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch
+ bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch
+ bugfix/all/p54pci-prevent-stuck-rx-ring.patch
+ bugfix/all/p54pci-fix-serious-sparse-warning.patch
+ bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch
+ bugfix/all/p54pci-fix-regression.patch