[kernel] r15550 - in dists/sid/linux-2.6/debian: . patches/bugfix/all patches/series

Maximilian Attems maks at alioth.debian.org
Sat Apr 24 01:14:47 UTC 2010


Author: maks
Date: Sat Apr 24 01:14:43 2010
New Revision: 15550

Log:
add p54 backport fixes

all vanilla patches forwarded to stable, rest is from wireless-next.
seen in Fedora 13, important as we don't shipp prism54 monster.
hopefully will make users more happy with p54.

Added:
   dists/sid/linux-2.6/debian/patches/bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch
   dists/sid/linux-2.6/debian/patches/bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch
   dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch
   dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-regression.patch
   dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-serious-sparse-warning.patch
   dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch
   dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-prevent-stuck-rx-ring.patch
   dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-revise-tx-locking.patch
   dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-rx-frame-length-check.patch
   dists/sid/linux-2.6/debian/patches/bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch
Modified:
   dists/sid/linux-2.6/debian/changelog
   dists/sid/linux-2.6/debian/patches/series/12

Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog	Sat Apr 24 00:38:45 2010	(r15549)
+++ dists/sid/linux-2.6/debian/changelog	Sat Apr 24 01:14:43 2010	(r15550)
@@ -45,6 +45,7 @@
   * Add libata TRIM support.
   * Backport radeon r800 modesetting support.
   * drm/radeon/kms: further spread spectrum fixes.
+  * Backport p54 fixes.
 
   [ dann frazier ]
   * Add DRBD backport

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,31 @@
+From 088ea189c4c75cdf211146faa4b341a0f7476be6 Mon Sep 17 00:00:00 2001
+From: Darren Jenkins <darrenrjenkins at gmail.com>
+Date: Wed, 17 Feb 2010 23:40:15 +1100
+Subject: [PATCH] drivers/net/wireless/p54/txrx.c Fix off by one error
+
+fix off by one error in the queue size check of p54_tx_qos_accounting_alloc()
+
+Coverity CID: 13314
+
+Signed-off-by: Darren Jenkins <darrenrjenkins at gmail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/txrx.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
+index 0e8f694..6605799 100644
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -186,7 +186,7 @@ static int p54_tx_qos_accounting_alloc(struct p54_common *priv,
+ 	struct p54_tx_queue_stats *queue;
+ 	unsigned long flags;
+ 
+-	if (WARN_ON(p54_queue > P54_QUEUE_NUM))
++	if (WARN_ON(p54_queue >= P54_QUEUE_NUM))
+ 		return -EINVAL;
+ 
+ 	queue = &priv->tx_stats[p54_queue];
+-- 
+1.6.5
+

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,108 @@
+From 93a59d7527147e3656664aa3179f8d19de256081 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date: Sat, 31 Oct 2009 22:59:27 +0100
+Subject: [PATCH] p54: disable channels with incomplete calibration data sets
+
+James Grossmann [1] reported that p54 spews out confusing
+messages instead of preventing the mayhem from happening.
+
+the reason is that "p54: generate channel list dynamically"
+is not perfect. It didn't discard incomplete channel data
+sets and therefore p54 advertised to support them as well.
+
+[1]: http://marc.info/?l=linux-wireless&m=125699830215890
+
+Cc: Larry Finger <Larry.Finger at lwfinger.net>
+Reported-by: James Grossmann <cctsurf at gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey at web.de>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/eeprom.c |   31 +++++++++++++++++++------------
+ 1 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
+index 0efe67d..8e3818f 100644
+--- a/drivers/net/wireless/p54/eeprom.c
++++ b/drivers/net/wireless/p54/eeprom.c
+@@ -126,7 +126,7 @@ static int p54_generate_band(struct ieee80211_hw *dev,
+ 	int ret = -ENOMEM;
+ 
+ 	if ((!list->entries) || (!list->band_channel_num[band]))
+-		return 0;
++		return -EINVAL;
+ 
+ 	tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
+ 	if (!tmp)
+@@ -158,6 +158,7 @@ static int p54_generate_band(struct ieee80211_hw *dev,
+ 			       (list->channels[i].data & CHAN_HAS_CURVE ? "" :
+ 				" [curve data]"),
+ 			       list->channels[i].index, list->channels[i].freq);
++			continue;
+ 		}
+ 
+ 		tmp->channels[j].band = list->channels[i].band;
+@@ -165,7 +166,16 @@ static int p54_generate_band(struct ieee80211_hw *dev,
+ 		j++;
+ 	}
+ 
+-	tmp->n_channels = list->band_channel_num[band];
++	if (j == 0) {
++		printk(KERN_ERR "%s: Disabling totally damaged %s band.\n",
++		       wiphy_name(dev->wiphy), (band == IEEE80211_BAND_2GHZ) ?
++		       "2 GHz" : "5 GHz");
++
++		ret = -ENODATA;
++		goto err_out;
++	}
++
++	tmp->n_channels = j;
+ 	old = priv->band_table[band];
+ 	priv->band_table[band] = tmp;
+ 	if (old) {
+@@ -228,13 +238,13 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
+ 	struct p54_common *priv = dev->priv;
+ 	struct p54_channel_list *list;
+ 	unsigned int i, j, max_channel_num;
+-	int ret = -ENOMEM;
++	int ret = 0;
+ 	u16 freq;
+ 
+ 	if ((priv->iq_autocal_len != priv->curve_data->entries) ||
+ 	    (priv->iq_autocal_len != priv->output_limit->entries))
+-		printk(KERN_ERR "%s: EEPROM is damaged... you may not be able"
+-				"to use all channels with this device.\n",
++		printk(KERN_ERR "%s: Unsupported or damaged EEPROM detected. "
++				"You may not be able to use all channels.\n",
+ 				wiphy_name(dev->wiphy));
+ 
+ 	max_channel_num = max_t(unsigned int, priv->output_limit->entries,
+@@ -243,8 +253,10 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
+ 				priv->curve_data->entries);
+ 
+ 	list = kzalloc(sizeof(*list), GFP_KERNEL);
+-	if (!list)
++	if (!list) {
++		ret = -ENOMEM;
+ 		goto free;
++	}
+ 
+ 	list->max_entries = max_channel_num;
+ 	list->channels = kzalloc(sizeof(struct p54_channel_entry) *
+@@ -282,13 +294,8 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
+ 	     p54_compare_channels, NULL);
+ 
+ 	for (i = 0, j = 0; i < IEEE80211_NUM_BANDS; i++) {
+-		if (list->band_channel_num[i]) {
+-			ret = p54_generate_band(dev, list, i);
+-			if (ret)
+-				goto free;
+-
++		if (p54_generate_band(dev, list, i) == 0)
+ 			j++;
+-		}
+ 	}
+ 	if (j == 0) {
+ 		/* no useable band available. */
+-- 
+1.6.5
+

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,106 @@
+Return-Path: <linux-wireless-owner at vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
+X-Spam-Level: 
+X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
+	KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
+X-Original-To: maks at dual
+Delivered-To: maks at dual
+Received: from dual (localhost.localdomain [127.0.0.1])
+	by dual (Postfix) with ESMTP id ED48524045
+	for <maks at dual>; Fri, 23 Apr 2010 04:14:59 +0200 (CEST)
+X-Original-To: max at stro.at
+Delivered-To: max at stro.at
+Received: from baikonur.stro.at [213.239.196.228]
+	by dual with POP3 (fetchmail-6.3.16)
+	for <maks at dual> (single-drop); Fri, 23 Apr 2010 04:14:59 +0200 (CEST)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+	by baikonur.stro.at (Postfix) with ESMTP id 407AB5C001
+	for <max at stro.at>; Thu, 22 Apr 2010 19:44:39 +0200 (CEST)
+Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+	id S1755433Ab0DVRwc (ORCPT <rfc822;max at stro.at>);
+	Thu, 22 Apr 2010 13:52:32 -0400
+Received: from mail-vw0-f46.google.com ([209.85.212.46]:52767 "EHLO
+	mail-vw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+	with ESMTP id S1755072Ab0DVRwb (ORCPT
+	<rfc822;linux-wireless at vger.kernel.org>);
+	Thu, 22 Apr 2010 13:52:31 -0400
+Received: by vws14 with SMTP id 14so38715vws.19
+        for <linux-wireless at vger.kernel.org>; Thu, 22 Apr 2010 10:52:29 -0700 (PDT)
+DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=googlemail.com; s=gamma;
+        h=domainkey-signature:received:received:received:received:received
+         :from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
+         :content-type:content-transfer-encoding:message-id;
+        bh=rH+Y7riac85RIiXG6qbakuXBSY790hWoyH0ONriCSeg=;
+        b=Ykzs36TepjY445cGIr5IH3C+knJyI56PTTlTKWlRkO098l3gXlGleAI5fn2s5sivNa
+         F5+SpVSoGspL0FT7yHTYb+CnZ+6ZyzshVgudsBPAakjfrZNlBYpEub3PAgddsugf9A75
+         j1t9aq3UhlHL13NLQQg1mwfWsN5hUSbfjKwZQ=
+DomainKey-Signature: a=rsa-sha1; c=nofws;
+        d=googlemail.com; s=gamma;
+        h=from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
+         :content-type:content-transfer-encoding:message-id;
+        b=ZixBFP6qSmufbPzN9DU5JjG83DMDIZFFEClBzUKD1bszfbpbEy3fsXLEFwgDchVGf2
+         VpqO7MVL6R70pPqT4CGb/k2XnaFpVM3lQZK695ehjHK+X/g0nPaprPYrZu/TbPii3Ieg
+         3Dj6OuAw0/tMNg5FUfKbIlLct8v3HfpJmNVwE=
+Received: by 10.220.126.153 with SMTP id c25mr1130560vcs.140.1271958749500;
+        Thu, 22 Apr 2010 10:52:29 -0700 (PDT)
+Received: from blech.mobile ([72.14.241.41])
+        by mx.google.com with ESMTPS id i29sm814619vcr.12.2010.04.22.10.52.27
+        (version=TLSv1/SSLv3 cipher=RC4-MD5);
+        Thu, 22 Apr 2010 10:52:28 -0700 (PDT)
+Received: from blech.mobile ([127.0.0.1])
+	by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
+	with ESMTP id bUG7mXcCH9aE; Thu, 22 Apr 2010 19:52:17 +0200 (CEST)
+Received: from blech.mobile (localhost [127.0.0.1])
+	by blech.mobile (Postfix) with ESMTP id ADBA2342417;
+	Thu, 22 Apr 2010 19:52:17 +0200 (CEST)
+From: Christian Lamparter <chunkeey at googlemail.com>
+To: linux-wireless at vger.kernel.org
+Subject: [PATCH 1/2] p54pci: fix bugs in p54p_check_tx_ring
+Date:	Thu, 22 Apr 2010 19:52:16 +0200
+User-Agent: KMail/1.12.4 (Linux/2.6.34-rc5-uber-wl; KDE/4.3.4; x86_64; ; )
+Cc: linville at tuxdriver.com, hdegoede at redhat.com
+MIME-Version: 1.0
+X-Length: 2052
+X-UID:	75
+Content-Type: Text/Plain;
+  charset="iso-8859-1"
+Content-Transfer-Encoding: 7bit
+Message-Id: <201004221952.16857.chunkeey at googlemail.com>
+Sender: linux-wireless-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List:	linux-wireless at vger.kernel.org
+Content-Length: 1159
+
+From: Hans de Goede <hdegoede at redhat.com>
+
+Hans de Goede identified a bug in p54p_check_tx_ring:
+
+there are two ring indices. 1 => tx data and 3 => tx management.
+But the old code had a constant "1" and this resulted in spurious
+dma unmapping failures. 
+
+Cc: stable at kernel.org
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623
+Bug-Identified-by: Hans de Goede <hdegoede at redhat.com>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+---
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 679da7e..cffe2f2 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ 	u32 idx, i;
+ 
+ 	i = (*index) % ring_limit;
+-	(*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
++	(*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
+ 	idx %= ring_limit;
+ 
+ 	while (i != idx) {
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
+

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-regression.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-regression.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,164 @@
+Return-Path: <linux-wireless-owner at vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
+X-Spam-Level: 
+X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
+	KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
+X-Original-To: maks at dual
+Delivered-To: maks at dual
+Received: from dual (localhost.localdomain [127.0.0.1])
+	by dual (Postfix) with ESMTP id 6945624045
+	for <maks at dual>; Fri, 23 Apr 2010 04:14:42 +0200 (CEST)
+X-Original-To: max at stro.at
+Delivered-To: max at stro.at
+Received: from baikonur.stro.at [213.239.196.228]
+	by dual with POP3 (fetchmail-6.3.16)
+	for <maks at dual> (single-drop); Fri, 23 Apr 2010 04:14:42 +0200 (CEST)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+	by baikonur.stro.at (Postfix) with ESMTP id 0650F5C00B
+	for <max at stro.at>; Thu, 22 Apr 2010 19:45:05 +0200 (CEST)
+Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+	id S1755708Ab0DVRxA (ORCPT <rfc822;max at stro.at>);
+	Thu, 22 Apr 2010 13:53:00 -0400
+Received: from mail-pz0-f194.google.com ([209.85.222.194]:37203 "EHLO
+	mail-pz0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+	with ESMTP id S1755147Ab0DVRw7 (ORCPT
+	<rfc822;linux-wireless at vger.kernel.org>);
+	Thu, 22 Apr 2010 13:52:59 -0400
+Received: by pzk32 with SMTP id 32so5663626pzk.21
+        for <linux-wireless at vger.kernel.org>; Thu, 22 Apr 2010 10:52:58 -0700 (PDT)
+DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=googlemail.com; s=gamma;
+        h=domainkey-signature:received:received:received:received:received
+         :from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
+         :content-type:content-transfer-encoding:message-id;
+        bh=yJz+c5/JMqOxuMrxk75S5LvVDV5la+16zQVI/xQuosY=;
+        b=krjzx1PwXDglH9BKcI+e7WyvVPwy284xIAAxYojJMM3AkNsVpxCyuUXkzqkrDWaN8Z
+         VwzlJJFO5mYy9ZmQM+utsqENnmIEpQp2eszSxI2cfx36lKpoE71gDBkK1A+vDnClheMv
+         MyFHfI869i03WhBAASw6oe1xhdI1bb4F49zmE=
+DomainKey-Signature: a=rsa-sha1; c=nofws;
+        d=googlemail.com; s=gamma;
+        h=from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
+         :content-type:content-transfer-encoding:message-id;
+        b=kLB1kLIJwVvNYqGmlY3Ql+PqUEXjk7KvsSUZSvES9+eYqzjAQYbiuEpl40DM10BSrl
+         Mtdenj+I5Ce2chMF6i1JrzzNFMFz0pUVtqUuAk9iQL9Iuo7eE7DZEOS2X3Vo4xCdRLC1
+         S3ygbtj1GOb1JfYn7ge9GL39GsyCNQBRlfVuA=
+Received: by 10.141.188.24 with SMTP id q24mr1593520rvp.0.1271958778042;
+        Thu, 22 Apr 2010 10:52:58 -0700 (PDT)
+Received: from blech.mobile ([72.14.240.9])
+        by mx.google.com with ESMTPS id 22sm156714pzk.13.2010.04.22.10.52.55
+        (version=TLSv1/SSLv3 cipher=RC4-MD5);
+        Thu, 22 Apr 2010 10:52:57 -0700 (PDT)
+Received: from blech.mobile ([127.0.0.1])
+	by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
+	with ESMTP id vx9ld1JknfF5; Thu, 22 Apr 2010 19:52:44 +0200 (CEST)
+Received: from blech.mobile (localhost [127.0.0.1])
+	by blech.mobile (Postfix) with ESMTP id 80D53342417;
+	Thu, 22 Apr 2010 19:52:44 +0200 (CEST)
+From: Christian Lamparter <chunkeey at googlemail.com>
+To: linux-wireless at vger.kernel.org
+Subject: [PATCH 2/2] p54pci: fix regression from prevent stuck rx-ring on slow system
+Date:	Thu, 22 Apr 2010 19:52:43 +0200
+User-Agent: KMail/1.12.4 (Linux/2.6.34-rc5-uber-wl; KDE/4.3.4; x86_64; ; )
+Cc: linville at tuxdriver.com, hdegoede at redhat.com
+MIME-Version: 1.0
+X-Length: 4801
+X-UID:	74
+Content-Type: text/plain;
+  charset="iso-8859-1"
+Content-Transfer-Encoding: 7bit
+Message-Id: <201004221952.44071.chunkeey at googlemail.com>
+Sender: linux-wireless-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List:	linux-wireless at vger.kernel.org
+Content-Length: 4096
+
+From: Hans de Goede <hdegoede at redhat.com>
+
+This patch fixes a recently introduced use-after-free regression
+from "p54pci: prevent stuck rx-ring on slow system".
+
+Hans de Goede reported a use-after-free regression:
+>BUG: unable to handle kernel paging request at 6b6b6b6b                         
+>IP: [<e122284a>] p54p_check_tx_ring+0x84/0xb1 [p54pci]                          
+>*pde = 00000000                                                                 
+>Oops: 0000 [#1] SMP                                                             
+>EIP: 0060:[<e122284a>] EFLAGS: 00010286 CPU: 0                                  
+>EIP is at p54p_check_tx_ring+0x84/0xb1 [p54pci]                                 
+>EAX: 6b6b6b6b EBX: df10b170 ECX: 00000003 EDX: 00000001                         
+>ESI: dc471500 EDI: d8acaeb0 EBP: c098be9c ESP: c098be84                         
+> DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068                                   
+>Process swapper (pid: 0, ti=c098a000 task=c09ccfe0 task.ti=c098a000)            
+>Call Trace:                                                                     
+> [<e1222b02>] ? p54p_tasklet+0xaa/0xb5 [p54pci]                                 
+> [<c0440568>] ? tasklet_action+0x78/0xcb                                        
+> [<c0440ed3>] ? __do_softirq+0xbc/0x173
+
+Quote from comment #17:
+"The problem is the innocent looking moving of the tx processing to
+ after the rx processing in the tasklet. Quoting from the changelog:
+  This patch does it the same way, except that it also prioritize
+  rx data processing, simply because tx routines *can* wait.
+
+ This is causing an issue with us referencing already freed memory,
+ because some skb's we transmit, we immediately receive back, such
+ as those for reading the eeprom (*) and getting stats.
+
+ What can happen because of the moving of the tx processing to after
+ the rx processing is that when the tasklet first runs after doing a
+ special skb tx (such as eeprom) we've already received the answer
+ to it.
+
+ Then the rx processing ends up calling p54_find_and_unlink_skb to
+ find the matching tx skb for the just received special rx skb and
+ frees the tx skb.
+
+ Then after the processing of the rx skb answer, and thus freeing
+ the tx skb, we go process the completed tx ring entires, and then
+ dereference the free-ed skb, to see if it should free free-ed by
+ p54p_check_tx_ring()."
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623
+Bug-Identified-by: Hans de Goede <hdegoede at redhat.com>
+Signed-off-by: Hans de Goede <hdegoede at redhat.com>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+---
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index ca42ccb..07c4528 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -277,6 +277,14 @@ static void p54p_tasklet(unsigned long dev_id)
+ 	struct p54p_priv *priv = dev->priv;
+ 	struct p54p_ring_control *ring_control = priv->ring_control;
+ 
++	p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
++			   ARRAY_SIZE(ring_control->tx_mgmt),
++			   priv->tx_buf_mgmt);
++
++	p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
++			   ARRAY_SIZE(ring_control->tx_data),
++			   priv->tx_buf_data);
++
+ 	p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
+ 		ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
+ 
+@@ -285,14 +293,6 @@ static void p54p_tasklet(unsigned long dev_id)
+ 
+ 	wmb();
+ 	P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
+-
+-	p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+-			   ARRAY_SIZE(ring_control->tx_mgmt),
+-			   priv->tx_buf_mgmt);
+-
+-	p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+-			   ARRAY_SIZE(ring_control->tx_data),
+-			   priv->tx_buf_data);
+ }
+ 
+ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
+

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-serious-sparse-warning.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-serious-sparse-warning.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,103 @@
+Return-Path: <linux-wireless-owner at vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
+X-Spam-Level: 
+X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
+	KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
+X-Original-To: maks at dual
+Delivered-To: maks at dual
+Received: from dual (localhost.localdomain [127.0.0.1])
+	by dual (Postfix) with ESMTP id 4027E2429D
+	for <maks at dual>; Thu, 15 Apr 2010 14:57:47 +0200 (CEST)
+X-Original-To: max at stro.at
+Delivered-To: max at stro.at
+Received: from baikonur.stro.at [213.239.196.228]
+	by dual with POP3 (fetchmail-6.3.13)
+	for <maks at dual> (single-drop); Thu, 15 Apr 2010 14:57:47 +0200 (CEST)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+	by baikonur.stro.at (Postfix) with ESMTP id 785425C00F
+	for <max at stro.at>; Thu, 15 Apr 2010 14:09:33 +0200 (CEST)
+Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+	id S1752356Ab0DOMRR (ORCPT <rfc822;max at stro.at>);
+	Thu, 15 Apr 2010 08:17:17 -0400
+Received: from mail-ew0-f220.google.com ([209.85.219.220]:35717 "EHLO
+	mail-ew0-f220.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+	with ESMTP id S1752038Ab0DOMRQ (ORCPT
+	<rfc822;linux-wireless at vger.kernel.org>);
+	Thu, 15 Apr 2010 08:17:16 -0400
+Received: by ewy20 with SMTP id 20so459287ewy.1
+        for <linux-wireless at vger.kernel.org>; Thu, 15 Apr 2010 05:17:15 -0700 (PDT)
+DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=googlemail.com; s=gamma;
+        h=domainkey-signature:received:received:received:received:received
+         :from:to:subject:date:user-agent:cc:mime-version:content-type
+         :content-transfer-encoding:message-id;
+        bh=p4STqoMJiC6z/cKYzv2Exm9RYHj8L3PhiKgV8V/My+8=;
+        b=Df3+ZF5p9OAOZbcMmdGwwyRhe6KKgy9XnEhFVlpwzN2ifr78NiUNl9AwiYsHd2bCAb
+         DFIq9aj2Lw3AzsJziQaRZjAyi1BCwRHWYVT1z6DAUac3GKAPDbTwg8ci9O31eyKBcbQu
+         3d//ULPy6g8NH7caloyA+ZhU8cmIl93ddMv0I=
+DomainKey-Signature: a=rsa-sha1; c=nofws;
+        d=googlemail.com; s=gamma;
+        h=from:to:subject:date:user-agent:cc:mime-version:content-type
+         :content-transfer-encoding:message-id;
+        b=n2N7kl6h8TV/cyVhTSMxV505sNe8/00nKdlLKyTn7h0M9MPZhLYgvJms0gr6wMtuoS
+         t78oiQsjdGsh2YMGVes/1eMoISXolb2pGF36Lp3UnoVJtJx5s6aBasGQ0oVUc2PIYozG
+         FyMOuuxhdfOyNOE8iJVAGWVBWLNxyIICBR4tU=
+Received: by 10.213.2.81 with SMTP id 17mr25407ebi.76.1271333835129;
+        Thu, 15 Apr 2010 05:17:15 -0700 (PDT)
+Received: from blech.mobile (nat-wh.rz.uni-karlsruhe.de [129.13.72.197])
+        by mx.google.com with ESMTPS id 15sm922586ewy.12.2010.04.15.05.17.14
+        (version=TLSv1/SSLv3 cipher=RC4-MD5);
+        Thu, 15 Apr 2010 05:17:14 -0700 (PDT)
+Received: from blech.mobile ([127.0.0.1])
+	by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
+	with ESMTP id gSWm7mhNvXD9; Thu, 15 Apr 2010 14:17:08 +0200 (CEST)
+Received: from blech.mobile (localhost [127.0.0.1])
+	by blech.mobile (Postfix) with ESMTP id 6D2D834077B;
+	Thu, 15 Apr 2010 14:17:08 +0200 (CEST)
+From: Christian Lamparter <chunkeey at googlemail.com>
+To: linux-wireless at vger.kernel.org
+Subject: [PATCH] p54pci: fix serious sparse warning
+Date:	Thu, 15 Apr 2010 14:17:07 +0200
+User-Agent: KMail/1.12.4 (Linux/2.6.34-rc3-uber-wl; KDE/4.3.4; x86_64; ; )
+Cc: linville at tuxdriver.com
+MIME-Version: 1.0
+Content-Type: Text/Plain;
+  charset="iso-8859-1"
+Content-Transfer-Encoding: 7bit
+Message-Id: <201004151417.07538.chunkeey at googlemail.com>
+Sender: linux-wireless-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List:	linux-wireless at vger.kernel.org
+X-Virus-Scanned: by Amavis (ClamAV) at stro.at
+Content-Length: 1202
+
+This patch fixes a bug which was just recently introduced by
+("p54pci: prevent stuck rx-ring on slow system").
+
+make M=drivers/net/wireless/p54 C=2 CF=-D__CHECK_ENDIAN__
+  CHECK   drivers/net/wireless/p54/p54pci.c                                                                 
+drivers/net/wireless/p54/p54pci.c:143:11: warning: cast to restricted __le32                                
+  CC [M]  drivers/net/wireless/p54/p54pci.o
+
+Reported-by: Johannes Berg <johannes at sipsolutions.net>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+---
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 86f3e9a..679da7e 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -140,7 +140,7 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
+ 
+ 	idx = le32_to_cpu(ring_control->host_idx[ring_index]);
+ 	limit = idx;
+-	limit -= le32_to_cpu(index);
++	limit -= index;
+ 	limit = ring_limit - limit;
+ 
+ 	i = idx % ring_limit;
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
+

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,180 @@
+From d713804c6032b95cd3035014e16fadebb9655c6f Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date: Sun, 17 Jan 2010 23:19:25 +0100
+Subject: [PATCH] p54pci: move tx cleanup into tasklet
+
+This patch moves the tx cleanup routines out of the critical
+interrupt context and into the (previously known as rx) tasklet.
+
+The main goal of this operation is to remove the extensive
+usage of spin_lock_irqsaves in the generic p54common library.
+
+The next step would be to modify p54usb to do the
+rx processing inside a tasklet (just like usbnet).
+
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/p54pci.c |   56 +++++++++++++++++++------------------
+ drivers/net/wireless/p54/p54pci.h |    6 ++--
+ 2 files changed, 32 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 4bf4c21..48cae48 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -234,25 +234,26 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
+ 	p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
+ }
+ 
+-/* caller must hold priv->lock */
+ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ 	int ring_index, struct p54p_desc *ring, u32 ring_limit,
+-	void **tx_buf)
++	struct sk_buff **tx_buf)
+ {
++	unsigned long flags;
+ 	struct p54p_priv *priv = dev->priv;
+ 	struct p54p_ring_control *ring_control = priv->ring_control;
+ 	struct p54p_desc *desc;
++	struct sk_buff *skb;
+ 	u32 idx, i;
+ 
+ 	i = (*index) % ring_limit;
+ 	(*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+ 	idx %= ring_limit;
+ 
++	spin_lock_irqsave(&priv->lock, flags);
+ 	while (i != idx) {
+ 		desc = &ring[i];
+-		if (tx_buf[i])
+-			if (FREE_AFTER_TX((struct sk_buff *) tx_buf[i]))
+-				p54_free_skb(dev, tx_buf[i]);
++
++		skb = tx_buf[i];
+ 		tx_buf[i] = NULL;
+ 
+ 		pci_unmap_single(priv->pdev, le32_to_cpu(desc->host_addr),
+@@ -263,17 +264,32 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ 		desc->len = 0;
+ 		desc->flags = 0;
+ 
++		if (skb && FREE_AFTER_TX(skb)) {
++			spin_unlock_irqrestore(&priv->lock, flags);
++			p54_free_skb(dev, skb);
++			spin_lock_irqsave(&priv->lock, flags);
++		}
++
+ 		i++;
+ 		i %= ring_limit;
+ 	}
++	spin_unlock_irqrestore(&priv->lock, flags);
+ }
+ 
+-static void p54p_rx_tasklet(unsigned long dev_id)
++static void p54p_tasklet(unsigned long dev_id)
+ {
+ 	struct ieee80211_hw *dev = (struct ieee80211_hw *)dev_id;
+ 	struct p54p_priv *priv = dev->priv;
+ 	struct p54p_ring_control *ring_control = priv->ring_control;
+ 
++	p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
++			   ARRAY_SIZE(ring_control->tx_mgmt),
++			   priv->tx_buf_mgmt);
++
++	p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
++			   ARRAY_SIZE(ring_control->tx_data),
++			   priv->tx_buf_data);
++
+ 	p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
+ 		ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
+ 
+@@ -288,38 +304,24 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+ {
+ 	struct ieee80211_hw *dev = dev_id;
+ 	struct p54p_priv *priv = dev->priv;
+-	struct p54p_ring_control *ring_control = priv->ring_control;
+ 	__le32 reg;
+ 
+ 	spin_lock(&priv->lock);
+ 	reg = P54P_READ(int_ident);
+ 	if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
+-		spin_unlock(&priv->lock);
+-		return IRQ_HANDLED;
++		goto out;
+ 	}
+-
+ 	P54P_WRITE(int_ack, reg);
+ 
+ 	reg &= P54P_READ(int_enable);
+ 
+-	if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE)) {
+-		p54p_check_tx_ring(dev, &priv->tx_idx_mgmt,
+-				   3, ring_control->tx_mgmt,
+-				   ARRAY_SIZE(ring_control->tx_mgmt),
+-				   priv->tx_buf_mgmt);
+-
+-		p54p_check_tx_ring(dev, &priv->tx_idx_data,
+-				   1, ring_control->tx_data,
+-				   ARRAY_SIZE(ring_control->tx_data),
+-				   priv->tx_buf_data);
+-
+-		tasklet_schedule(&priv->rx_tasklet);
+-
+-	} else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
++	if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE))
++		tasklet_schedule(&priv->tasklet);
++	else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
+ 		complete(&priv->boot_comp);
+ 
++out:
+ 	spin_unlock(&priv->lock);
+-
+ 	return reg ? IRQ_HANDLED : IRQ_NONE;
+ }
+ 
+@@ -368,7 +370,7 @@ static void p54p_stop(struct ieee80211_hw *dev)
+ 	unsigned int i;
+ 	struct p54p_desc *desc;
+ 
+-	tasklet_kill(&priv->rx_tasklet);
++	tasklet_kill(&priv->tasklet);
+ 
+ 	P54P_WRITE(int_enable, cpu_to_le32(0));
+ 	P54P_READ(int_enable);
+@@ -559,7 +561,7 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
+ 	priv->common.tx = p54p_tx;
+ 
+ 	spin_lock_init(&priv->lock);
+-	tasklet_init(&priv->rx_tasklet, p54p_rx_tasklet, (unsigned long)dev);
++	tasklet_init(&priv->tasklet, p54p_tasklet, (unsigned long)dev);
+ 
+ 	err = request_firmware(&priv->firmware, "isl3886pci",
+ 			       &priv->pdev->dev);
+diff --git a/drivers/net/wireless/p54/p54pci.h b/drivers/net/wireless/p54/p54pci.h
+index fbb6839..2feead6 100644
+--- a/drivers/net/wireless/p54/p54pci.h
++++ b/drivers/net/wireless/p54/p54pci.h
+@@ -92,7 +92,7 @@ struct p54p_priv {
+ 	struct p54_common common;
+ 	struct pci_dev *pdev;
+ 	struct p54p_csr __iomem *map;
+-	struct tasklet_struct rx_tasklet;
++	struct tasklet_struct tasklet;
+ 	const struct firmware *firmware;
+ 	spinlock_t lock;
+ 	struct p54p_ring_control *ring_control;
+@@ -101,8 +101,8 @@ struct p54p_priv {
+ 	u32 rx_idx_mgmt, tx_idx_mgmt;
+ 	struct sk_buff *rx_buf_data[8];
+ 	struct sk_buff *rx_buf_mgmt[4];
+-	void *tx_buf_data[32];
+-	void *tx_buf_mgmt[4];
++	struct sk_buff *tx_buf_data[32];
++	struct sk_buff *tx_buf_mgmt[4];
+ 	struct completion boot_comp;
+ };
+ 
+-- 
+1.6.5
+

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-prevent-stuck-rx-ring.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-prevent-stuck-rx-ring.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,188 @@
+Return-Path: <linux-wireless-owner at vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
+X-Spam-Level: 
+X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
+	KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
+X-Original-To: maks at dual
+Delivered-To: maks at dual
+Received: from dual (localhost.localdomain [127.0.0.1])
+	by dual (Postfix) with ESMTP id 9C5E5240B2
+	for <maks at dual>; Sat, 10 Apr 2010 05:40:32 +0200 (CEST)
+X-Original-To: max at stro.at
+Delivered-To: max at stro.at
+Received: from baikonur.stro.at [213.239.196.228]
+	by dual with POP3 (fetchmail-6.3.13)
+	for <maks at dual> (single-drop); Sat, 10 Apr 2010 05:40:32 +0200 (CEST)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+	by baikonur.stro.at (Postfix) with ESMTP id 57CCD5C001
+	for <max at stro.at>; Fri,  9 Apr 2010 21:30:10 +0200 (CEST)
+Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+	id S1755774Ab0DIThv (ORCPT <rfc822;max at stro.at>);
+	Fri, 9 Apr 2010 15:37:51 -0400
+Received: from mail-fx0-f223.google.com ([209.85.220.223]:53451 "EHLO
+	mail-fx0-f223.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+	with ESMTP id S1755660Ab0DIThu (ORCPT
+	<rfc822;linux-wireless at vger.kernel.org>);
+	Fri, 9 Apr 2010 15:37:50 -0400
+Received: by fxm23 with SMTP id 23so3059091fxm.21
+        for <linux-wireless at vger.kernel.org>; Fri, 09 Apr 2010 12:37:48 -0700 (PDT)
+DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=googlemail.com; s=gamma;
+        h=domainkey-signature:received:received:received:to:subject:cc:from
+         :date:mime-version:content-type:content-transfer-encoding:message-id;
+        bh=/1/MkPwABrV9B+UeF6gm0FPvrdPa07zITP+BiYkzzvw=;
+        b=auJ2WlRwYLTrqH7PVkjv2hQzjgsBbBZysz1x9gVsGRQoOOZ+wTxIkXHmADOz2Clurf
+         qKYgHxxCHnjDu6Xb3kQiYRHAmKFE9O/sRDNyWmVXKU9eLSt47cF16hKkyVPAOs/+g2P7
+         usGYv5VXGKFrTCJwhqjvUCrVeW/6sy2mne5qo=
+DomainKey-Signature: a=rsa-sha1; c=nofws;
+        d=googlemail.com; s=gamma;
+        h=to:subject:cc:from:date:mime-version:content-type
+         :content-transfer-encoding:message-id;
+        b=jVz41M1Z71WIF8rYp/LErkkyGct/5qylglZrBSMErJB5AC3su/UaeNmI6c+tEXGrmE
+         RYWQDDFlrvqDy7qgL+QmxvU0RgOizjnueLLPZlD3X4dR1O7YN+CuIpK1JJ+6Roa+p2QF
+         e60ozvjRK1DjNk1aahW0hpaZxRDPGrFVxtxwM=
+Received: by 10.223.6.153 with SMTP id 25mr453117faz.81.1270841868071;
+        Fri, 09 Apr 2010 12:37:48 -0700 (PDT)
+Received: from debian64.daheim (p5B16D5D6.dip.t-dialin.net [91.22.213.214])
+        by mx.google.com with ESMTPS id e17sm3562248fke.27.2010.04.09.12.37.42
+        (version=TLSv1/SSLv3 cipher=RC4-MD5);
+        Fri, 09 Apr 2010 12:37:42 -0700 (PDT)
+Received: from debian64.daheim
+	([192.168.0.4] helo=debian64.localnet ident=chuck)
+	by debian64.daheim with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
+	(Exim 4.71)
+	(envelope-from <chunkeey at googlemail.com>)
+	id 1O0K1N-0002Xr-Ua; Fri, 09 Apr 2010 21:37:41 +0200
+To: linux-wireless at vger.kernel.org
+Subject: [PATCH] p54pci: prevent stuck rx-ring on slow system
+Cc: linville at tuxdriver.com
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date:	Fri, 9 Apr 2010 21:37:38 +0200
+MIME-Version: 1.0
+Content-Type: Text/Plain;
+  charset="iso-8859-1"
+Content-Transfer-Encoding: 7bit
+Message-Id: <201004092137.39285.chunkeey at googlemail.com>
+Sender: linux-wireless-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List:	linux-wireless at vger.kernel.org
+X-Virus-Scanned: by Amavis (ClamAV) at stro.at
+Content-Length: 4420
+
+From: Quintin Pitts <geek4linux at gmail.com>
+
+This patch fixes an old problem, which - under certain
+circumstances - could cause the device to become
+unresponsive. 
+
+most of p54pci's rx-ring management is implemented in just
+two distinct standalone functions. p54p_check_rx_ring takes
+care of processing incoming data, while p54p_refill_rx_ring
+tries to replenish all depleted communication buffers.
+
+This has always worked fine on my fast machine, but
+now I know there is a hidden race...
+
+The most likely candidate here is ring_control->device_idx.
+Quintin Pitts had already analyzed the culprit and posted
+a patch back in Oct 2009. But sadly, no one's picked up on this.
+( https://patchwork.kernel.org/patch/53079/ [2 & 3] ).
+This patch does the same way, except that it also prioritize
+rx data processing, simply because tx routines *can* wait.
+
+Reported-by: Sean Young <sean at mess.org>
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=11386
+Reported-by: Quintin Pitts <geek4linux at gmail.com>
+Signed-off-by: Quintin Pitts <geek4linux at gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+---
+John,
+
+It's been nearly a week and no complains or regressions
+have been reported. Therefore I think it is now save to
+finally merge this patch... Preferably into -next, so
+bug #11386 can be closed for 2.6.34 release.
+
+Regards,
+	Chr
+---
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index ed4bdff..aa29663 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -131,7 +131,7 @@ static int p54p_upload_firmware(struct ieee80211_hw *dev)
+ 
+ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
+ 	int ring_index, struct p54p_desc *ring, u32 ring_limit,
+-	struct sk_buff **rx_buf)
++	struct sk_buff **rx_buf, u32 index)
+ {
+ 	struct p54p_priv *priv = dev->priv;
+ 	struct p54p_ring_control *ring_control = priv->ring_control;
+@@ -139,7 +139,7 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
+ 
+ 	idx = le32_to_cpu(ring_control->host_idx[ring_index]);
+ 	limit = idx;
+-	limit -= le32_to_cpu(ring_control->device_idx[ring_index]);
++	limit -= le32_to_cpu(index);
+ 	limit = ring_limit - limit;
+ 
+ 	i = idx % ring_limit;
+@@ -231,7 +231,7 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
+ 		i %= ring_limit;
+ 	}
+ 
+-	p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
++	p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf, *index);
+ }
+ 
+ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+@@ -276,14 +276,6 @@ static void p54p_tasklet(unsigned long dev_id)
+ 	struct p54p_priv *priv = dev->priv;
+ 	struct p54p_ring_control *ring_control = priv->ring_control;
+ 
+-	p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+-			   ARRAY_SIZE(ring_control->tx_mgmt),
+-			   priv->tx_buf_mgmt);
+-
+-	p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+-			   ARRAY_SIZE(ring_control->tx_data),
+-			   priv->tx_buf_data);
+-
+ 	p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
+ 		ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
+ 
+@@ -292,6 +284,14 @@ static void p54p_tasklet(unsigned long dev_id)
+ 
+ 	wmb();
+ 	P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
++
++	p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
++			   ARRAY_SIZE(ring_control->tx_mgmt),
++			   priv->tx_buf_mgmt);
++
++	p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
++			   ARRAY_SIZE(ring_control->tx_data),
++			   priv->tx_buf_data);
+ }
+ 
+ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+@@ -444,10 +444,10 @@ static int p54p_open(struct ieee80211_hw *dev)
+ 	priv->rx_idx_mgmt = priv->tx_idx_mgmt = 0;
+ 
+ 	p54p_refill_rx_ring(dev, 0, priv->ring_control->rx_data,
+-		ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data);
++		ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data, 0);
+ 
+ 	p54p_refill_rx_ring(dev, 2, priv->ring_control->rx_mgmt,
+-		ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt);
++		ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt, 0);
+ 
+ 	P54P_WRITE(ring_control_base, cpu_to_le32(priv->ring_control_dma));
+ 	P54P_READ(ring_control_base);
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
+

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-revise-tx-locking.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-revise-tx-locking.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,100 @@
+From b92f7d30830a319148df2943b7565989494e5ad1 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date: Fri, 22 Jan 2010 08:01:11 +0100
+Subject: [PATCH] p54pci: revise tx locking
+
+This patch continues the effort which began with:
+"[PATCH] p54pci: move tx cleanup into tasklet".
+
+Thanks to these changes, p54pci's interrupt & tx
+cleanup routines can be made lock-less.
+
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/p54pci.c |   16 ++++------------
+ 1 files changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 48cae48..bda29c0 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -238,7 +238,6 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ 	int ring_index, struct p54p_desc *ring, u32 ring_limit,
+ 	struct sk_buff **tx_buf)
+ {
+-	unsigned long flags;
+ 	struct p54p_priv *priv = dev->priv;
+ 	struct p54p_ring_control *ring_control = priv->ring_control;
+ 	struct p54p_desc *desc;
+@@ -249,7 +248,6 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ 	(*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+ 	idx %= ring_limit;
+ 
+-	spin_lock_irqsave(&priv->lock, flags);
+ 	while (i != idx) {
+ 		desc = &ring[i];
+ 
+@@ -264,16 +262,12 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ 		desc->len = 0;
+ 		desc->flags = 0;
+ 
+-		if (skb && FREE_AFTER_TX(skb)) {
+-			spin_unlock_irqrestore(&priv->lock, flags);
++		if (skb && FREE_AFTER_TX(skb))
+ 			p54_free_skb(dev, skb);
+-			spin_lock_irqsave(&priv->lock, flags);
+-		}
+ 
+ 		i++;
+ 		i %= ring_limit;
+ 	}
+-	spin_unlock_irqrestore(&priv->lock, flags);
+ }
+ 
+ static void p54p_tasklet(unsigned long dev_id)
+@@ -306,7 +300,6 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+ 	struct p54p_priv *priv = dev->priv;
+ 	__le32 reg;
+ 
+-	spin_lock(&priv->lock);
+ 	reg = P54P_READ(int_ident);
+ 	if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
+ 		goto out;
+@@ -321,15 +314,14 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+ 		complete(&priv->boot_comp);
+ 
+ out:
+-	spin_unlock(&priv->lock);
+ 	return reg ? IRQ_HANDLED : IRQ_NONE;
+ }
+ 
+ static void p54p_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
+ {
++	unsigned long flags;
+ 	struct p54p_priv *priv = dev->priv;
+ 	struct p54p_ring_control *ring_control = priv->ring_control;
+-	unsigned long flags;
+ 	struct p54p_desc *desc;
+ 	dma_addr_t mapping;
+ 	u32 device_idx, idx, i;
+@@ -370,14 +362,14 @@ static void p54p_stop(struct ieee80211_hw *dev)
+ 	unsigned int i;
+ 	struct p54p_desc *desc;
+ 
+-	tasklet_kill(&priv->tasklet);
+-
+ 	P54P_WRITE(int_enable, cpu_to_le32(0));
+ 	P54P_READ(int_enable);
+ 	udelay(10);
+ 
+ 	free_irq(priv->pdev->irq, dev);
+ 
++	tasklet_kill(&priv->tasklet);
++
+ 	P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
+ 
+ 	for (i = 0; i < ARRAY_SIZE(priv->rx_buf_data); i++) {
+-- 
+1.6.5
+

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-rx-frame-length-check.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-rx-frame-length-check.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,51 @@
+From f5300e04df78feae8107c1846dd3a9e27c071b2f Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date: Mon, 18 Jan 2010 00:07:38 +0100
+Subject: [PATCH] p54pci: rx frame length check
+
+A long time ago, a user reported several crashes due to
+data corruptions which are likely the result of a
+not-100%-supported, or faulty? PCI bridge.
+( http://patchwork.kernel.org/patch/53004/ )
+
+This patch fixes entry #1.
+"1.  p54p_check_rx_ring - skb_over_panic: Under a ping flood
+or just left running for a bit would panic with a skb_over_panic."
+As described in the mail: The invalid frame length causes
+skb_put to bailout and trigger a crash.
+
+Note:
+Simply dropping the frame is problematic, because if its content
+contains a tx feedback we would lose some portion of the device
+memory space.... And the driver/mac80211 should handle all other
+invalid data.
+
+Reported-by: Quintin Pitts <geek4linux at gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/p54pci.c |    8 ++++++++
+ 1 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index a15962a..a72f7c2 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -197,6 +197,14 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
+ 			i %= ring_limit;
+ 			continue;
+ 		}
++
++		if (unlikely(len > priv->common.rx_mtu)) {
++			if (net_ratelimit())
++				dev_err(&priv->pdev->dev, "rx'd frame size "
++					"exceeds length threshold.\n");
++
++			len = priv->common.rx_mtu;
++		}
+ 		skb_put(skb, len);
+ 
+ 		if (p54_rx(dev, skb)) {
+-- 
+1.6.5
+

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch	Sat Apr 24 01:14:43 2010	(r15550)
@@ -0,0 +1,27 @@
+From 15a69a81731d337a3d9db51692ff8704c1114f43 Mon Sep 17 00:00:00 2001
+From: Shimada Hirofumi <hirofumi at flycat.org>
+Date: Sun, 14 Feb 2010 04:16:16 +0900
+Subject: [PATCH] p54usb: Add usbid for Corega CG-WLUSB2GT.
+
+Signed-off-by: Shimada Hirofumi <hirofumi at flycat.org>
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji at linux-ipv6.org>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/p54usb.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
+index 92af9b9..dcb484b 100644
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -36,6 +36,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
+ 	/* Version 1 devices (pci chip + net2280) */
+ 	{USB_DEVICE(0x0506, 0x0a11)},	/* 3COM 3CRWE254G72 */
+ 	{USB_DEVICE(0x0707, 0xee06)},	/* SMC 2862W-G */
++	{USB_DEVICE(0x07aa, 0x001c)},	/* Corega CG-WLUSB2GT */
+ 	{USB_DEVICE(0x083a, 0x4501)},	/* Accton 802.11g WN4501 USB */
+ 	{USB_DEVICE(0x083a, 0x4502)},	/* Siemens Gigaset USB Adapter */
+ 	{USB_DEVICE(0x083a, 0x5501)},	/* Phillips CPWUA054 */
+-- 
+1.6.5
+

Modified: dists/sid/linux-2.6/debian/patches/series/12
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/12	Sat Apr 24 00:38:45 2010	(r15549)
+++ dists/sid/linux-2.6/debian/patches/series/12	Sat Apr 24 01:14:43 2010	(r15550)
@@ -38,3 +38,13 @@
 + features/all/libata-Clarify-ata_set_lba_range_entries-function.patch
 + features/all/drm-radeon-evergreen.patch
 + bugfix/all/drm-radeon-kms-further-spread-spectrum-fixes.patch
++ bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch
++ bugfix/all/p54pci-rx-frame-length-check.patch
++ bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch
++ bugfix/all/p54pci-revise-tx-locking.patch
++ bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch
++ bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch
++ bugfix/all/p54pci-prevent-stuck-rx-ring.patch
++ bugfix/all/p54pci-fix-serious-sparse-warning.patch
++ bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch
++ bugfix/all/p54pci-fix-regression.patch



More information about the Kernel-svn-changes mailing list