[kernel] r15550 - in dists/sid/linux-2.6/debian: . patches/bugfix/all patches/series
Maximilian Attems
maks at alioth.debian.org
Sat Apr 24 01:14:47 UTC 2010
Author: maks
Date: Sat Apr 24 01:14:43 2010
New Revision: 15550
Log:
add p54 backport fixes
all vanilla patches forwarded to stable, rest is from wireless-next.
seen in Fedora 13, important as we don't shipp prism54 monster.
hopefully will make users more happy with p54.
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-regression.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-serious-sparse-warning.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-prevent-stuck-rx-ring.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-revise-tx-locking.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-rx-frame-length-check.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/12
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Sat Apr 24 00:38:45 2010 (r15549)
+++ dists/sid/linux-2.6/debian/changelog Sat Apr 24 01:14:43 2010 (r15550)
@@ -45,6 +45,7 @@
* Add libata TRIM support.
* Backport radeon r800 modesetting support.
* drm/radeon/kms: further spread spectrum fixes.
+ * Backport p54 fixes.
[ dann frazier ]
* Add DRBD backport
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,31 @@
+From 088ea189c4c75cdf211146faa4b341a0f7476be6 Mon Sep 17 00:00:00 2001
+From: Darren Jenkins <darrenrjenkins at gmail.com>
+Date: Wed, 17 Feb 2010 23:40:15 +1100
+Subject: [PATCH] drivers/net/wireless/p54/txrx.c Fix off by one error
+
+fix off by one error in the queue size check of p54_tx_qos_accounting_alloc()
+
+Coverity CID: 13314
+
+Signed-off-by: Darren Jenkins <darrenrjenkins at gmail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/txrx.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
+index 0e8f694..6605799 100644
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -186,7 +186,7 @@ static int p54_tx_qos_accounting_alloc(struct p54_common *priv,
+ struct p54_tx_queue_stats *queue;
+ unsigned long flags;
+
+- if (WARN_ON(p54_queue > P54_QUEUE_NUM))
++ if (WARN_ON(p54_queue >= P54_QUEUE_NUM))
+ return -EINVAL;
+
+ queue = &priv->tx_stats[p54_queue];
+--
+1.6.5
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,108 @@
+From 93a59d7527147e3656664aa3179f8d19de256081 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date: Sat, 31 Oct 2009 22:59:27 +0100
+Subject: [PATCH] p54: disable channels with incomplete calibration data sets
+
+James Grossmann [1] reported that p54 spews out confusing
+messages instead of preventing the mayhem from happening.
+
+the reason is that "p54: generate channel list dynamically"
+is not perfect. It didn't discard incomplete channel data
+sets and therefore p54 advertised to support them as well.
+
+[1]: http://marc.info/?l=linux-wireless&m=125699830215890
+
+Cc: Larry Finger <Larry.Finger at lwfinger.net>
+Reported-by: James Grossmann <cctsurf at gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey at web.de>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/eeprom.c | 31 +++++++++++++++++++------------
+ 1 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
+index 0efe67d..8e3818f 100644
+--- a/drivers/net/wireless/p54/eeprom.c
++++ b/drivers/net/wireless/p54/eeprom.c
+@@ -126,7 +126,7 @@ static int p54_generate_band(struct ieee80211_hw *dev,
+ int ret = -ENOMEM;
+
+ if ((!list->entries) || (!list->band_channel_num[band]))
+- return 0;
++ return -EINVAL;
+
+ tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
+ if (!tmp)
+@@ -158,6 +158,7 @@ static int p54_generate_band(struct ieee80211_hw *dev,
+ (list->channels[i].data & CHAN_HAS_CURVE ? "" :
+ " [curve data]"),
+ list->channels[i].index, list->channels[i].freq);
++ continue;
+ }
+
+ tmp->channels[j].band = list->channels[i].band;
+@@ -165,7 +166,16 @@ static int p54_generate_band(struct ieee80211_hw *dev,
+ j++;
+ }
+
+- tmp->n_channels = list->band_channel_num[band];
++ if (j == 0) {
++ printk(KERN_ERR "%s: Disabling totally damaged %s band.\n",
++ wiphy_name(dev->wiphy), (band == IEEE80211_BAND_2GHZ) ?
++ "2 GHz" : "5 GHz");
++
++ ret = -ENODATA;
++ goto err_out;
++ }
++
++ tmp->n_channels = j;
+ old = priv->band_table[band];
+ priv->band_table[band] = tmp;
+ if (old) {
+@@ -228,13 +238,13 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
+ struct p54_common *priv = dev->priv;
+ struct p54_channel_list *list;
+ unsigned int i, j, max_channel_num;
+- int ret = -ENOMEM;
++ int ret = 0;
+ u16 freq;
+
+ if ((priv->iq_autocal_len != priv->curve_data->entries) ||
+ (priv->iq_autocal_len != priv->output_limit->entries))
+- printk(KERN_ERR "%s: EEPROM is damaged... you may not be able"
+- "to use all channels with this device.\n",
++ printk(KERN_ERR "%s: Unsupported or damaged EEPROM detected. "
++ "You may not be able to use all channels.\n",
+ wiphy_name(dev->wiphy));
+
+ max_channel_num = max_t(unsigned int, priv->output_limit->entries,
+@@ -243,8 +253,10 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
+ priv->curve_data->entries);
+
+ list = kzalloc(sizeof(*list), GFP_KERNEL);
+- if (!list)
++ if (!list) {
++ ret = -ENOMEM;
+ goto free;
++ }
+
+ list->max_entries = max_channel_num;
+ list->channels = kzalloc(sizeof(struct p54_channel_entry) *
+@@ -282,13 +294,8 @@ static int p54_generate_channel_lists(struct ieee80211_hw *dev)
+ p54_compare_channels, NULL);
+
+ for (i = 0, j = 0; i < IEEE80211_NUM_BANDS; i++) {
+- if (list->band_channel_num[i]) {
+- ret = p54_generate_band(dev, list, i);
+- if (ret)
+- goto free;
+-
++ if (p54_generate_band(dev, list, i) == 0)
+ j++;
+- }
+ }
+ if (j == 0) {
+ /* no useable band available. */
+--
+1.6.5
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,106 @@
+Return-Path: <linux-wireless-owner at vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
+X-Spam-Level:
+X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
+ KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
+X-Original-To: maks at dual
+Delivered-To: maks at dual
+Received: from dual (localhost.localdomain [127.0.0.1])
+ by dual (Postfix) with ESMTP id ED48524045
+ for <maks at dual>; Fri, 23 Apr 2010 04:14:59 +0200 (CEST)
+X-Original-To: max at stro.at
+Delivered-To: max at stro.at
+Received: from baikonur.stro.at [213.239.196.228]
+ by dual with POP3 (fetchmail-6.3.16)
+ for <maks at dual> (single-drop); Fri, 23 Apr 2010 04:14:59 +0200 (CEST)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+ by baikonur.stro.at (Postfix) with ESMTP id 407AB5C001
+ for <max at stro.at>; Thu, 22 Apr 2010 19:44:39 +0200 (CEST)
+Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+ id S1755433Ab0DVRwc (ORCPT <rfc822;max at stro.at>);
+ Thu, 22 Apr 2010 13:52:32 -0400
+Received: from mail-vw0-f46.google.com ([209.85.212.46]:52767 "EHLO
+ mail-vw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+ with ESMTP id S1755072Ab0DVRwb (ORCPT
+ <rfc822;linux-wireless at vger.kernel.org>);
+ Thu, 22 Apr 2010 13:52:31 -0400
+Received: by vws14 with SMTP id 14so38715vws.19
+ for <linux-wireless at vger.kernel.org>; Thu, 22 Apr 2010 10:52:29 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+ d=googlemail.com; s=gamma;
+ h=domainkey-signature:received:received:received:received:received
+ :from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
+ :content-type:content-transfer-encoding:message-id;
+ bh=rH+Y7riac85RIiXG6qbakuXBSY790hWoyH0ONriCSeg=;
+ b=Ykzs36TepjY445cGIr5IH3C+knJyI56PTTlTKWlRkO098l3gXlGleAI5fn2s5sivNa
+ F5+SpVSoGspL0FT7yHTYb+CnZ+6ZyzshVgudsBPAakjfrZNlBYpEub3PAgddsugf9A75
+ j1t9aq3UhlHL13NLQQg1mwfWsN5hUSbfjKwZQ=
+DomainKey-Signature: a=rsa-sha1; c=nofws;
+ d=googlemail.com; s=gamma;
+ h=from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
+ :content-type:content-transfer-encoding:message-id;
+ b=ZixBFP6qSmufbPzN9DU5JjG83DMDIZFFEClBzUKD1bszfbpbEy3fsXLEFwgDchVGf2
+ VpqO7MVL6R70pPqT4CGb/k2XnaFpVM3lQZK695ehjHK+X/g0nPaprPYrZu/TbPii3Ieg
+ 3Dj6OuAw0/tMNg5FUfKbIlLct8v3HfpJmNVwE=
+Received: by 10.220.126.153 with SMTP id c25mr1130560vcs.140.1271958749500;
+ Thu, 22 Apr 2010 10:52:29 -0700 (PDT)
+Received: from blech.mobile ([72.14.241.41])
+ by mx.google.com with ESMTPS id i29sm814619vcr.12.2010.04.22.10.52.27
+ (version=TLSv1/SSLv3 cipher=RC4-MD5);
+ Thu, 22 Apr 2010 10:52:28 -0700 (PDT)
+Received: from blech.mobile ([127.0.0.1])
+ by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
+ with ESMTP id bUG7mXcCH9aE; Thu, 22 Apr 2010 19:52:17 +0200 (CEST)
+Received: from blech.mobile (localhost [127.0.0.1])
+ by blech.mobile (Postfix) with ESMTP id ADBA2342417;
+ Thu, 22 Apr 2010 19:52:17 +0200 (CEST)
+From: Christian Lamparter <chunkeey at googlemail.com>
+To: linux-wireless at vger.kernel.org
+Subject: [PATCH 1/2] p54pci: fix bugs in p54p_check_tx_ring
+Date: Thu, 22 Apr 2010 19:52:16 +0200
+User-Agent: KMail/1.12.4 (Linux/2.6.34-rc5-uber-wl; KDE/4.3.4; x86_64; ; )
+Cc: linville at tuxdriver.com, hdegoede at redhat.com
+MIME-Version: 1.0
+X-Length: 2052
+X-UID: 75
+Content-Type: Text/Plain;
+ charset="iso-8859-1"
+Content-Transfer-Encoding: 7bit
+Message-Id: <201004221952.16857.chunkeey at googlemail.com>
+Sender: linux-wireless-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless at vger.kernel.org
+Content-Length: 1159
+
+From: Hans de Goede <hdegoede at redhat.com>
+
+Hans de Goede identified a bug in p54p_check_tx_ring:
+
+there are two ring indices. 1 => tx data and 3 => tx management.
+But the old code had a constant "1" and this resulted in spurious
+dma unmapping failures.
+
+Cc: stable at kernel.org
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623
+Bug-Identified-by: Hans de Goede <hdegoede at redhat.com>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+---
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 679da7e..cffe2f2 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ u32 idx, i;
+
+ i = (*index) % ring_limit;
+- (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
++ (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
+ idx %= ring_limit;
+
+ while (i != idx) {
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-regression.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-regression.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,164 @@
+Return-Path: <linux-wireless-owner at vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
+X-Spam-Level:
+X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
+ KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
+X-Original-To: maks at dual
+Delivered-To: maks at dual
+Received: from dual (localhost.localdomain [127.0.0.1])
+ by dual (Postfix) with ESMTP id 6945624045
+ for <maks at dual>; Fri, 23 Apr 2010 04:14:42 +0200 (CEST)
+X-Original-To: max at stro.at
+Delivered-To: max at stro.at
+Received: from baikonur.stro.at [213.239.196.228]
+ by dual with POP3 (fetchmail-6.3.16)
+ for <maks at dual> (single-drop); Fri, 23 Apr 2010 04:14:42 +0200 (CEST)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+ by baikonur.stro.at (Postfix) with ESMTP id 0650F5C00B
+ for <max at stro.at>; Thu, 22 Apr 2010 19:45:05 +0200 (CEST)
+Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+ id S1755708Ab0DVRxA (ORCPT <rfc822;max at stro.at>);
+ Thu, 22 Apr 2010 13:53:00 -0400
+Received: from mail-pz0-f194.google.com ([209.85.222.194]:37203 "EHLO
+ mail-pz0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+ with ESMTP id S1755147Ab0DVRw7 (ORCPT
+ <rfc822;linux-wireless at vger.kernel.org>);
+ Thu, 22 Apr 2010 13:52:59 -0400
+Received: by pzk32 with SMTP id 32so5663626pzk.21
+ for <linux-wireless at vger.kernel.org>; Thu, 22 Apr 2010 10:52:58 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+ d=googlemail.com; s=gamma;
+ h=domainkey-signature:received:received:received:received:received
+ :from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
+ :content-type:content-transfer-encoding:message-id;
+ bh=yJz+c5/JMqOxuMrxk75S5LvVDV5la+16zQVI/xQuosY=;
+ b=krjzx1PwXDglH9BKcI+e7WyvVPwy284xIAAxYojJMM3AkNsVpxCyuUXkzqkrDWaN8Z
+ VwzlJJFO5mYy9ZmQM+utsqENnmIEpQp2eszSxI2cfx36lKpoE71gDBkK1A+vDnClheMv
+ MyFHfI869i03WhBAASw6oe1xhdI1bb4F49zmE=
+DomainKey-Signature: a=rsa-sha1; c=nofws;
+ d=googlemail.com; s=gamma;
+ h=from:to:subject:date:user-agent:cc:mime-version:x-length:x-uid
+ :content-type:content-transfer-encoding:message-id;
+ b=kLB1kLIJwVvNYqGmlY3Ql+PqUEXjk7KvsSUZSvES9+eYqzjAQYbiuEpl40DM10BSrl
+ Mtdenj+I5Ce2chMF6i1JrzzNFMFz0pUVtqUuAk9iQL9Iuo7eE7DZEOS2X3Vo4xCdRLC1
+ S3ygbtj1GOb1JfYn7ge9GL39GsyCNQBRlfVuA=
+Received: by 10.141.188.24 with SMTP id q24mr1593520rvp.0.1271958778042;
+ Thu, 22 Apr 2010 10:52:58 -0700 (PDT)
+Received: from blech.mobile ([72.14.240.9])
+ by mx.google.com with ESMTPS id 22sm156714pzk.13.2010.04.22.10.52.55
+ (version=TLSv1/SSLv3 cipher=RC4-MD5);
+ Thu, 22 Apr 2010 10:52:57 -0700 (PDT)
+Received: from blech.mobile ([127.0.0.1])
+ by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
+ with ESMTP id vx9ld1JknfF5; Thu, 22 Apr 2010 19:52:44 +0200 (CEST)
+Received: from blech.mobile (localhost [127.0.0.1])
+ by blech.mobile (Postfix) with ESMTP id 80D53342417;
+ Thu, 22 Apr 2010 19:52:44 +0200 (CEST)
+From: Christian Lamparter <chunkeey at googlemail.com>
+To: linux-wireless at vger.kernel.org
+Subject: [PATCH 2/2] p54pci: fix regression from prevent stuck rx-ring on slow system
+Date: Thu, 22 Apr 2010 19:52:43 +0200
+User-Agent: KMail/1.12.4 (Linux/2.6.34-rc5-uber-wl; KDE/4.3.4; x86_64; ; )
+Cc: linville at tuxdriver.com, hdegoede at redhat.com
+MIME-Version: 1.0
+X-Length: 4801
+X-UID: 74
+Content-Type: text/plain;
+ charset="iso-8859-1"
+Content-Transfer-Encoding: 7bit
+Message-Id: <201004221952.44071.chunkeey at googlemail.com>
+Sender: linux-wireless-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless at vger.kernel.org
+Content-Length: 4096
+
+From: Hans de Goede <hdegoede at redhat.com>
+
+This patch fixes a recently introduced use-after-free regression
+from "p54pci: prevent stuck rx-ring on slow system".
+
+Hans de Goede reported a use-after-free regression:
+>BUG: unable to handle kernel paging request at 6b6b6b6b
+>IP: [<e122284a>] p54p_check_tx_ring+0x84/0xb1 [p54pci]
+>*pde = 00000000
+>Oops: 0000 [#1] SMP
+>EIP: 0060:[<e122284a>] EFLAGS: 00010286 CPU: 0
+>EIP is at p54p_check_tx_ring+0x84/0xb1 [p54pci]
+>EAX: 6b6b6b6b EBX: df10b170 ECX: 00000003 EDX: 00000001
+>ESI: dc471500 EDI: d8acaeb0 EBP: c098be9c ESP: c098be84
+> DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+>Process swapper (pid: 0, ti=c098a000 task=c09ccfe0 task.ti=c098a000)
+>Call Trace:
+> [<e1222b02>] ? p54p_tasklet+0xaa/0xb5 [p54pci]
+> [<c0440568>] ? tasklet_action+0x78/0xcb
+> [<c0440ed3>] ? __do_softirq+0xbc/0x173
+
+Quote from comment #17:
+"The problem is the innocent looking moving of the tx processing to
+ after the rx processing in the tasklet. Quoting from the changelog:
+ This patch does it the same way, except that it also prioritize
+ rx data processing, simply because tx routines *can* wait.
+
+ This is causing an issue with us referencing already freed memory,
+ because some skb's we transmit, we immediately receive back, such
+ as those for reading the eeprom (*) and getting stats.
+
+ What can happen because of the moving of the tx processing to after
+ the rx processing is that when the tasklet first runs after doing a
+ special skb tx (such as eeprom) we've already received the answer
+ to it.
+
+ Then the rx processing ends up calling p54_find_and_unlink_skb to
+ find the matching tx skb for the just received special rx skb and
+ frees the tx skb.
+
+ Then after the processing of the rx skb answer, and thus freeing
+ the tx skb, we go process the completed tx ring entires, and then
+ dereference the free-ed skb, to see if it should free free-ed by
+ p54p_check_tx_ring()."
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623
+Bug-Identified-by: Hans de Goede <hdegoede at redhat.com>
+Signed-off-by: Hans de Goede <hdegoede at redhat.com>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+---
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index ca42ccb..07c4528 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -277,6 +277,14 @@ static void p54p_tasklet(unsigned long dev_id)
+ struct p54p_priv *priv = dev->priv;
+ struct p54p_ring_control *ring_control = priv->ring_control;
+
++ p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
++ ARRAY_SIZE(ring_control->tx_mgmt),
++ priv->tx_buf_mgmt);
++
++ p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
++ ARRAY_SIZE(ring_control->tx_data),
++ priv->tx_buf_data);
++
+ p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
+ ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
+
+@@ -285,14 +293,6 @@ static void p54p_tasklet(unsigned long dev_id)
+
+ wmb();
+ P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
+-
+- p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+- ARRAY_SIZE(ring_control->tx_mgmt),
+- priv->tx_buf_mgmt);
+-
+- p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+- ARRAY_SIZE(ring_control->tx_data),
+- priv->tx_buf_data);
+ }
+
+ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-serious-sparse-warning.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-fix-serious-sparse-warning.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,103 @@
+Return-Path: <linux-wireless-owner at vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
+X-Spam-Level:
+X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
+ KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
+X-Original-To: maks at dual
+Delivered-To: maks at dual
+Received: from dual (localhost.localdomain [127.0.0.1])
+ by dual (Postfix) with ESMTP id 4027E2429D
+ for <maks at dual>; Thu, 15 Apr 2010 14:57:47 +0200 (CEST)
+X-Original-To: max at stro.at
+Delivered-To: max at stro.at
+Received: from baikonur.stro.at [213.239.196.228]
+ by dual with POP3 (fetchmail-6.3.13)
+ for <maks at dual> (single-drop); Thu, 15 Apr 2010 14:57:47 +0200 (CEST)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+ by baikonur.stro.at (Postfix) with ESMTP id 785425C00F
+ for <max at stro.at>; Thu, 15 Apr 2010 14:09:33 +0200 (CEST)
+Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+ id S1752356Ab0DOMRR (ORCPT <rfc822;max at stro.at>);
+ Thu, 15 Apr 2010 08:17:17 -0400
+Received: from mail-ew0-f220.google.com ([209.85.219.220]:35717 "EHLO
+ mail-ew0-f220.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+ with ESMTP id S1752038Ab0DOMRQ (ORCPT
+ <rfc822;linux-wireless at vger.kernel.org>);
+ Thu, 15 Apr 2010 08:17:16 -0400
+Received: by ewy20 with SMTP id 20so459287ewy.1
+ for <linux-wireless at vger.kernel.org>; Thu, 15 Apr 2010 05:17:15 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+ d=googlemail.com; s=gamma;
+ h=domainkey-signature:received:received:received:received:received
+ :from:to:subject:date:user-agent:cc:mime-version:content-type
+ :content-transfer-encoding:message-id;
+ bh=p4STqoMJiC6z/cKYzv2Exm9RYHj8L3PhiKgV8V/My+8=;
+ b=Df3+ZF5p9OAOZbcMmdGwwyRhe6KKgy9XnEhFVlpwzN2ifr78NiUNl9AwiYsHd2bCAb
+ DFIq9aj2Lw3AzsJziQaRZjAyi1BCwRHWYVT1z6DAUac3GKAPDbTwg8ci9O31eyKBcbQu
+ 3d//ULPy6g8NH7caloyA+ZhU8cmIl93ddMv0I=
+DomainKey-Signature: a=rsa-sha1; c=nofws;
+ d=googlemail.com; s=gamma;
+ h=from:to:subject:date:user-agent:cc:mime-version:content-type
+ :content-transfer-encoding:message-id;
+ b=n2N7kl6h8TV/cyVhTSMxV505sNe8/00nKdlLKyTn7h0M9MPZhLYgvJms0gr6wMtuoS
+ t78oiQsjdGsh2YMGVes/1eMoISXolb2pGF36Lp3UnoVJtJx5s6aBasGQ0oVUc2PIYozG
+ FyMOuuxhdfOyNOE8iJVAGWVBWLNxyIICBR4tU=
+Received: by 10.213.2.81 with SMTP id 17mr25407ebi.76.1271333835129;
+ Thu, 15 Apr 2010 05:17:15 -0700 (PDT)
+Received: from blech.mobile (nat-wh.rz.uni-karlsruhe.de [129.13.72.197])
+ by mx.google.com with ESMTPS id 15sm922586ewy.12.2010.04.15.05.17.14
+ (version=TLSv1/SSLv3 cipher=RC4-MD5);
+ Thu, 15 Apr 2010 05:17:14 -0700 (PDT)
+Received: from blech.mobile ([127.0.0.1])
+ by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024)
+ with ESMTP id gSWm7mhNvXD9; Thu, 15 Apr 2010 14:17:08 +0200 (CEST)
+Received: from blech.mobile (localhost [127.0.0.1])
+ by blech.mobile (Postfix) with ESMTP id 6D2D834077B;
+ Thu, 15 Apr 2010 14:17:08 +0200 (CEST)
+From: Christian Lamparter <chunkeey at googlemail.com>
+To: linux-wireless at vger.kernel.org
+Subject: [PATCH] p54pci: fix serious sparse warning
+Date: Thu, 15 Apr 2010 14:17:07 +0200
+User-Agent: KMail/1.12.4 (Linux/2.6.34-rc3-uber-wl; KDE/4.3.4; x86_64; ; )
+Cc: linville at tuxdriver.com
+MIME-Version: 1.0
+Content-Type: Text/Plain;
+ charset="iso-8859-1"
+Content-Transfer-Encoding: 7bit
+Message-Id: <201004151417.07538.chunkeey at googlemail.com>
+Sender: linux-wireless-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless at vger.kernel.org
+X-Virus-Scanned: by Amavis (ClamAV) at stro.at
+Content-Length: 1202
+
+This patch fixes a bug which was just recently introduced by
+("p54pci: prevent stuck rx-ring on slow system").
+
+make M=drivers/net/wireless/p54 C=2 CF=-D__CHECK_ENDIAN__
+ CHECK drivers/net/wireless/p54/p54pci.c
+drivers/net/wireless/p54/p54pci.c:143:11: warning: cast to restricted __le32
+ CC [M] drivers/net/wireless/p54/p54pci.o
+
+Reported-by: Johannes Berg <johannes at sipsolutions.net>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+---
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 86f3e9a..679da7e 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -140,7 +140,7 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
+
+ idx = le32_to_cpu(ring_control->host_idx[ring_index]);
+ limit = idx;
+- limit -= le32_to_cpu(index);
++ limit -= index;
+ limit = ring_limit - limit;
+
+ i = idx % ring_limit;
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,180 @@
+From d713804c6032b95cd3035014e16fadebb9655c6f Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date: Sun, 17 Jan 2010 23:19:25 +0100
+Subject: [PATCH] p54pci: move tx cleanup into tasklet
+
+This patch moves the tx cleanup routines out of the critical
+interrupt context and into the (previously known as rx) tasklet.
+
+The main goal of this operation is to remove the extensive
+usage of spin_lock_irqsaves in the generic p54common library.
+
+The next step would be to modify p54usb to do the
+rx processing inside a tasklet (just like usbnet).
+
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/p54pci.c | 56 +++++++++++++++++++------------------
+ drivers/net/wireless/p54/p54pci.h | 6 ++--
+ 2 files changed, 32 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 4bf4c21..48cae48 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -234,25 +234,26 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
+ p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
+ }
+
+-/* caller must hold priv->lock */
+ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ int ring_index, struct p54p_desc *ring, u32 ring_limit,
+- void **tx_buf)
++ struct sk_buff **tx_buf)
+ {
++ unsigned long flags;
+ struct p54p_priv *priv = dev->priv;
+ struct p54p_ring_control *ring_control = priv->ring_control;
+ struct p54p_desc *desc;
++ struct sk_buff *skb;
+ u32 idx, i;
+
+ i = (*index) % ring_limit;
+ (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+ idx %= ring_limit;
+
++ spin_lock_irqsave(&priv->lock, flags);
+ while (i != idx) {
+ desc = &ring[i];
+- if (tx_buf[i])
+- if (FREE_AFTER_TX((struct sk_buff *) tx_buf[i]))
+- p54_free_skb(dev, tx_buf[i]);
++
++ skb = tx_buf[i];
+ tx_buf[i] = NULL;
+
+ pci_unmap_single(priv->pdev, le32_to_cpu(desc->host_addr),
+@@ -263,17 +264,32 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ desc->len = 0;
+ desc->flags = 0;
+
++ if (skb && FREE_AFTER_TX(skb)) {
++ spin_unlock_irqrestore(&priv->lock, flags);
++ p54_free_skb(dev, skb);
++ spin_lock_irqsave(&priv->lock, flags);
++ }
++
+ i++;
+ i %= ring_limit;
+ }
++ spin_unlock_irqrestore(&priv->lock, flags);
+ }
+
+-static void p54p_rx_tasklet(unsigned long dev_id)
++static void p54p_tasklet(unsigned long dev_id)
+ {
+ struct ieee80211_hw *dev = (struct ieee80211_hw *)dev_id;
+ struct p54p_priv *priv = dev->priv;
+ struct p54p_ring_control *ring_control = priv->ring_control;
+
++ p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
++ ARRAY_SIZE(ring_control->tx_mgmt),
++ priv->tx_buf_mgmt);
++
++ p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
++ ARRAY_SIZE(ring_control->tx_data),
++ priv->tx_buf_data);
++
+ p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
+ ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
+
+@@ -288,38 +304,24 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+ {
+ struct ieee80211_hw *dev = dev_id;
+ struct p54p_priv *priv = dev->priv;
+- struct p54p_ring_control *ring_control = priv->ring_control;
+ __le32 reg;
+
+ spin_lock(&priv->lock);
+ reg = P54P_READ(int_ident);
+ if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
+- spin_unlock(&priv->lock);
+- return IRQ_HANDLED;
++ goto out;
+ }
+-
+ P54P_WRITE(int_ack, reg);
+
+ reg &= P54P_READ(int_enable);
+
+- if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE)) {
+- p54p_check_tx_ring(dev, &priv->tx_idx_mgmt,
+- 3, ring_control->tx_mgmt,
+- ARRAY_SIZE(ring_control->tx_mgmt),
+- priv->tx_buf_mgmt);
+-
+- p54p_check_tx_ring(dev, &priv->tx_idx_data,
+- 1, ring_control->tx_data,
+- ARRAY_SIZE(ring_control->tx_data),
+- priv->tx_buf_data);
+-
+- tasklet_schedule(&priv->rx_tasklet);
+-
+- } else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
++ if (reg & cpu_to_le32(ISL38XX_INT_IDENT_UPDATE))
++ tasklet_schedule(&priv->tasklet);
++ else if (reg & cpu_to_le32(ISL38XX_INT_IDENT_INIT))
+ complete(&priv->boot_comp);
+
++out:
+ spin_unlock(&priv->lock);
+-
+ return reg ? IRQ_HANDLED : IRQ_NONE;
+ }
+
+@@ -368,7 +370,7 @@ static void p54p_stop(struct ieee80211_hw *dev)
+ unsigned int i;
+ struct p54p_desc *desc;
+
+- tasklet_kill(&priv->rx_tasklet);
++ tasklet_kill(&priv->tasklet);
+
+ P54P_WRITE(int_enable, cpu_to_le32(0));
+ P54P_READ(int_enable);
+@@ -559,7 +561,7 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
+ priv->common.tx = p54p_tx;
+
+ spin_lock_init(&priv->lock);
+- tasklet_init(&priv->rx_tasklet, p54p_rx_tasklet, (unsigned long)dev);
++ tasklet_init(&priv->tasklet, p54p_tasklet, (unsigned long)dev);
+
+ err = request_firmware(&priv->firmware, "isl3886pci",
+ &priv->pdev->dev);
+diff --git a/drivers/net/wireless/p54/p54pci.h b/drivers/net/wireless/p54/p54pci.h
+index fbb6839..2feead6 100644
+--- a/drivers/net/wireless/p54/p54pci.h
++++ b/drivers/net/wireless/p54/p54pci.h
+@@ -92,7 +92,7 @@ struct p54p_priv {
+ struct p54_common common;
+ struct pci_dev *pdev;
+ struct p54p_csr __iomem *map;
+- struct tasklet_struct rx_tasklet;
++ struct tasklet_struct tasklet;
+ const struct firmware *firmware;
+ spinlock_t lock;
+ struct p54p_ring_control *ring_control;
+@@ -101,8 +101,8 @@ struct p54p_priv {
+ u32 rx_idx_mgmt, tx_idx_mgmt;
+ struct sk_buff *rx_buf_data[8];
+ struct sk_buff *rx_buf_mgmt[4];
+- void *tx_buf_data[32];
+- void *tx_buf_mgmt[4];
++ struct sk_buff *tx_buf_data[32];
++ struct sk_buff *tx_buf_mgmt[4];
+ struct completion boot_comp;
+ };
+
+--
+1.6.5
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-prevent-stuck-rx-ring.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-prevent-stuck-rx-ring.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,188 @@
+Return-Path: <linux-wireless-owner at vger.kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on dual
+X-Spam-Level:
+X-Spam-Status: No, score=0.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
+ KB_DATE_CONTAINS_TAB autolearn=no version=3.3.1
+X-Original-To: maks at dual
+Delivered-To: maks at dual
+Received: from dual (localhost.localdomain [127.0.0.1])
+ by dual (Postfix) with ESMTP id 9C5E5240B2
+ for <maks at dual>; Sat, 10 Apr 2010 05:40:32 +0200 (CEST)
+X-Original-To: max at stro.at
+Delivered-To: max at stro.at
+Received: from baikonur.stro.at [213.239.196.228]
+ by dual with POP3 (fetchmail-6.3.13)
+ for <maks at dual> (single-drop); Sat, 10 Apr 2010 05:40:32 +0200 (CEST)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+ by baikonur.stro.at (Postfix) with ESMTP id 57CCD5C001
+ for <max at stro.at>; Fri, 9 Apr 2010 21:30:10 +0200 (CEST)
+Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+ id S1755774Ab0DIThv (ORCPT <rfc822;max at stro.at>);
+ Fri, 9 Apr 2010 15:37:51 -0400
+Received: from mail-fx0-f223.google.com ([209.85.220.223]:53451 "EHLO
+ mail-fx0-f223.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+ with ESMTP id S1755660Ab0DIThu (ORCPT
+ <rfc822;linux-wireless at vger.kernel.org>);
+ Fri, 9 Apr 2010 15:37:50 -0400
+Received: by fxm23 with SMTP id 23so3059091fxm.21
+ for <linux-wireless at vger.kernel.org>; Fri, 09 Apr 2010 12:37:48 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+ d=googlemail.com; s=gamma;
+ h=domainkey-signature:received:received:received:to:subject:cc:from
+ :date:mime-version:content-type:content-transfer-encoding:message-id;
+ bh=/1/MkPwABrV9B+UeF6gm0FPvrdPa07zITP+BiYkzzvw=;
+ b=auJ2WlRwYLTrqH7PVkjv2hQzjgsBbBZysz1x9gVsGRQoOOZ+wTxIkXHmADOz2Clurf
+ qKYgHxxCHnjDu6Xb3kQiYRHAmKFE9O/sRDNyWmVXKU9eLSt47cF16hKkyVPAOs/+g2P7
+ usGYv5VXGKFrTCJwhqjvUCrVeW/6sy2mne5qo=
+DomainKey-Signature: a=rsa-sha1; c=nofws;
+ d=googlemail.com; s=gamma;
+ h=to:subject:cc:from:date:mime-version:content-type
+ :content-transfer-encoding:message-id;
+ b=jVz41M1Z71WIF8rYp/LErkkyGct/5qylglZrBSMErJB5AC3su/UaeNmI6c+tEXGrmE
+ RYWQDDFlrvqDy7qgL+QmxvU0RgOizjnueLLPZlD3X4dR1O7YN+CuIpK1JJ+6Roa+p2QF
+ e60ozvjRK1DjNk1aahW0hpaZxRDPGrFVxtxwM=
+Received: by 10.223.6.153 with SMTP id 25mr453117faz.81.1270841868071;
+ Fri, 09 Apr 2010 12:37:48 -0700 (PDT)
+Received: from debian64.daheim (p5B16D5D6.dip.t-dialin.net [91.22.213.214])
+ by mx.google.com with ESMTPS id e17sm3562248fke.27.2010.04.09.12.37.42
+ (version=TLSv1/SSLv3 cipher=RC4-MD5);
+ Fri, 09 Apr 2010 12:37:42 -0700 (PDT)
+Received: from debian64.daheim
+ ([192.168.0.4] helo=debian64.localnet ident=chuck)
+ by debian64.daheim with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
+ (Exim 4.71)
+ (envelope-from <chunkeey at googlemail.com>)
+ id 1O0K1N-0002Xr-Ua; Fri, 09 Apr 2010 21:37:41 +0200
+To: linux-wireless at vger.kernel.org
+Subject: [PATCH] p54pci: prevent stuck rx-ring on slow system
+Cc: linville at tuxdriver.com
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date: Fri, 9 Apr 2010 21:37:38 +0200
+MIME-Version: 1.0
+Content-Type: Text/Plain;
+ charset="iso-8859-1"
+Content-Transfer-Encoding: 7bit
+Message-Id: <201004092137.39285.chunkeey at googlemail.com>
+Sender: linux-wireless-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless at vger.kernel.org
+X-Virus-Scanned: by Amavis (ClamAV) at stro.at
+Content-Length: 4420
+
+From: Quintin Pitts <geek4linux at gmail.com>
+
+This patch fixes an old problem, which - under certain
+circumstances - could cause the device to become
+unresponsive.
+
+most of p54pci's rx-ring management is implemented in just
+two distinct standalone functions. p54p_check_rx_ring takes
+care of processing incoming data, while p54p_refill_rx_ring
+tries to replenish all depleted communication buffers.
+
+This has always worked fine on my fast machine, but
+now I know there is a hidden race...
+
+The most likely candidate here is ring_control->device_idx.
+Quintin Pitts had already analyzed the culprit and posted
+a patch back in Oct 2009. But sadly, no one's picked up on this.
+( https://patchwork.kernel.org/patch/53079/ [2 & 3] ).
+This patch does the same way, except that it also prioritize
+rx data processing, simply because tx routines *can* wait.
+
+Reported-by: Sean Young <sean at mess.org>
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=11386
+Reported-by: Quintin Pitts <geek4linux at gmail.com>
+Signed-off-by: Quintin Pitts <geek4linux at gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+---
+John,
+
+It's been nearly a week and no complains or regressions
+have been reported. Therefore I think it is now save to
+finally merge this patch... Preferably into -next, so
+bug #11386 can be closed for 2.6.34 release.
+
+Regards,
+ Chr
+---
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index ed4bdff..aa29663 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -131,7 +131,7 @@ static int p54p_upload_firmware(struct ieee80211_hw *dev)
+
+ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
+ int ring_index, struct p54p_desc *ring, u32 ring_limit,
+- struct sk_buff **rx_buf)
++ struct sk_buff **rx_buf, u32 index)
+ {
+ struct p54p_priv *priv = dev->priv;
+ struct p54p_ring_control *ring_control = priv->ring_control;
+@@ -139,7 +139,7 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
+
+ idx = le32_to_cpu(ring_control->host_idx[ring_index]);
+ limit = idx;
+- limit -= le32_to_cpu(ring_control->device_idx[ring_index]);
++ limit -= le32_to_cpu(index);
+ limit = ring_limit - limit;
+
+ i = idx % ring_limit;
+@@ -231,7 +231,7 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
+ i %= ring_limit;
+ }
+
+- p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf);
++ p54p_refill_rx_ring(dev, ring_index, ring, ring_limit, rx_buf, *index);
+ }
+
+ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+@@ -276,14 +276,6 @@ static void p54p_tasklet(unsigned long dev_id)
+ struct p54p_priv *priv = dev->priv;
+ struct p54p_ring_control *ring_control = priv->ring_control;
+
+- p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+- ARRAY_SIZE(ring_control->tx_mgmt),
+- priv->tx_buf_mgmt);
+-
+- p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+- ARRAY_SIZE(ring_control->tx_data),
+- priv->tx_buf_data);
+-
+ p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
+ ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
+
+@@ -292,6 +284,14 @@ static void p54p_tasklet(unsigned long dev_id)
+
+ wmb();
+ P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
++
++ p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
++ ARRAY_SIZE(ring_control->tx_mgmt),
++ priv->tx_buf_mgmt);
++
++ p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
++ ARRAY_SIZE(ring_control->tx_data),
++ priv->tx_buf_data);
+ }
+
+ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+@@ -444,10 +444,10 @@ static int p54p_open(struct ieee80211_hw *dev)
+ priv->rx_idx_mgmt = priv->tx_idx_mgmt = 0;
+
+ p54p_refill_rx_ring(dev, 0, priv->ring_control->rx_data,
+- ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data);
++ ARRAY_SIZE(priv->ring_control->rx_data), priv->rx_buf_data, 0);
+
+ p54p_refill_rx_ring(dev, 2, priv->ring_control->rx_mgmt,
+- ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt);
++ ARRAY_SIZE(priv->ring_control->rx_mgmt), priv->rx_buf_mgmt, 0);
+
+ P54P_WRITE(ring_control_base, cpu_to_le32(priv->ring_control_dma));
+ P54P_READ(ring_control_base);
+--
+To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-revise-tx-locking.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-revise-tx-locking.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,100 @@
+From b92f7d30830a319148df2943b7565989494e5ad1 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date: Fri, 22 Jan 2010 08:01:11 +0100
+Subject: [PATCH] p54pci: revise tx locking
+
+This patch continues the effort which began with:
+"[PATCH] p54pci: move tx cleanup into tasklet".
+
+Thanks to these changes, p54pci's interrupt & tx
+cleanup routines can be made lock-less.
+
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/p54pci.c | 16 ++++------------
+ 1 files changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index 48cae48..bda29c0 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -238,7 +238,6 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ int ring_index, struct p54p_desc *ring, u32 ring_limit,
+ struct sk_buff **tx_buf)
+ {
+- unsigned long flags;
+ struct p54p_priv *priv = dev->priv;
+ struct p54p_ring_control *ring_control = priv->ring_control;
+ struct p54p_desc *desc;
+@@ -249,7 +248,6 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+ idx %= ring_limit;
+
+- spin_lock_irqsave(&priv->lock, flags);
+ while (i != idx) {
+ desc = &ring[i];
+
+@@ -264,16 +262,12 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
+ desc->len = 0;
+ desc->flags = 0;
+
+- if (skb && FREE_AFTER_TX(skb)) {
+- spin_unlock_irqrestore(&priv->lock, flags);
++ if (skb && FREE_AFTER_TX(skb))
+ p54_free_skb(dev, skb);
+- spin_lock_irqsave(&priv->lock, flags);
+- }
+
+ i++;
+ i %= ring_limit;
+ }
+- spin_unlock_irqrestore(&priv->lock, flags);
+ }
+
+ static void p54p_tasklet(unsigned long dev_id)
+@@ -306,7 +300,6 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+ struct p54p_priv *priv = dev->priv;
+ __le32 reg;
+
+- spin_lock(&priv->lock);
+ reg = P54P_READ(int_ident);
+ if (unlikely(reg == cpu_to_le32(0xFFFFFFFF))) {
+ goto out;
+@@ -321,15 +314,14 @@ static irqreturn_t p54p_interrupt(int irq, void *dev_id)
+ complete(&priv->boot_comp);
+
+ out:
+- spin_unlock(&priv->lock);
+ return reg ? IRQ_HANDLED : IRQ_NONE;
+ }
+
+ static void p54p_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
+ {
++ unsigned long flags;
+ struct p54p_priv *priv = dev->priv;
+ struct p54p_ring_control *ring_control = priv->ring_control;
+- unsigned long flags;
+ struct p54p_desc *desc;
+ dma_addr_t mapping;
+ u32 device_idx, idx, i;
+@@ -370,14 +362,14 @@ static void p54p_stop(struct ieee80211_hw *dev)
+ unsigned int i;
+ struct p54p_desc *desc;
+
+- tasklet_kill(&priv->tasklet);
+-
+ P54P_WRITE(int_enable, cpu_to_le32(0));
+ P54P_READ(int_enable);
+ udelay(10);
+
+ free_irq(priv->pdev->irq, dev);
+
++ tasklet_kill(&priv->tasklet);
++
+ P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
+
+ for (i = 0; i < ARRAY_SIZE(priv->rx_buf_data); i++) {
+--
+1.6.5
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-rx-frame-length-check.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54pci-rx-frame-length-check.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,51 @@
+From f5300e04df78feae8107c1846dd3a9e27c071b2f Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey at googlemail.com>
+Date: Mon, 18 Jan 2010 00:07:38 +0100
+Subject: [PATCH] p54pci: rx frame length check
+
+A long time ago, a user reported several crashes due to
+data corruptions which are likely the result of a
+not-100%-supported, or faulty? PCI bridge.
+( http://patchwork.kernel.org/patch/53004/ )
+
+This patch fixes entry #1.
+"1. p54p_check_rx_ring - skb_over_panic: Under a ping flood
+or just left running for a bit would panic with a skb_over_panic."
+As described in the mail: The invalid frame length causes
+skb_put to bailout and trigger a crash.
+
+Note:
+Simply dropping the frame is problematic, because if its content
+contains a tx feedback we would lose some portion of the device
+memory space.... And the driver/mac80211 should handle all other
+invalid data.
+
+Reported-by: Quintin Pitts <geek4linux at gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey at googlemail.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/p54pci.c | 8 ++++++++
+ 1 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
+index a15962a..a72f7c2 100644
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -197,6 +197,14 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
+ i %= ring_limit;
+ continue;
+ }
++
++ if (unlikely(len > priv->common.rx_mtu)) {
++ if (net_ratelimit())
++ dev_err(&priv->pdev->dev, "rx'd frame size "
++ "exceeds length threshold.\n");
++
++ len = priv->common.rx_mtu;
++ }
+ skb_put(skb, len);
+
+ if (p54_rx(dev, skb)) {
+--
+1.6.5
+
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch Sat Apr 24 01:14:43 2010 (r15550)
@@ -0,0 +1,27 @@
+From 15a69a81731d337a3d9db51692ff8704c1114f43 Mon Sep 17 00:00:00 2001
+From: Shimada Hirofumi <hirofumi at flycat.org>
+Date: Sun, 14 Feb 2010 04:16:16 +0900
+Subject: [PATCH] p54usb: Add usbid for Corega CG-WLUSB2GT.
+
+Signed-off-by: Shimada Hirofumi <hirofumi at flycat.org>
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji at linux-ipv6.org>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+---
+ drivers/net/wireless/p54/p54usb.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
+index 92af9b9..dcb484b 100644
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -36,6 +36,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
+ /* Version 1 devices (pci chip + net2280) */
+ {USB_DEVICE(0x0506, 0x0a11)}, /* 3COM 3CRWE254G72 */
+ {USB_DEVICE(0x0707, 0xee06)}, /* SMC 2862W-G */
++ {USB_DEVICE(0x07aa, 0x001c)}, /* Corega CG-WLUSB2GT */
+ {USB_DEVICE(0x083a, 0x4501)}, /* Accton 802.11g WN4501 USB */
+ {USB_DEVICE(0x083a, 0x4502)}, /* Siemens Gigaset USB Adapter */
+ {USB_DEVICE(0x083a, 0x5501)}, /* Phillips CPWUA054 */
+--
+1.6.5
+
Modified: dists/sid/linux-2.6/debian/patches/series/12
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/12 Sat Apr 24 00:38:45 2010 (r15549)
+++ dists/sid/linux-2.6/debian/patches/series/12 Sat Apr 24 01:14:43 2010 (r15550)
@@ -38,3 +38,13 @@
+ features/all/libata-Clarify-ata_set_lba_range_entries-function.patch
+ features/all/drm-radeon-evergreen.patch
+ bugfix/all/drm-radeon-kms-further-spread-spectrum-fixes.patch
++ bugfix/all/p54-disable-channels-with-incomplete-calibration-dat.patch
++ bugfix/all/p54pci-rx-frame-length-check.patch
++ bugfix/all/p54pci-move-tx-cleanup-into-tasklet.patch
++ bugfix/all/p54pci-revise-tx-locking.patch
++ bugfix/all/p54usb-Add-usbid-for-Corega-CG-WLUSB2GT.patch
++ bugfix/all/drivers-net-wireless-p54-txrx.c-Fix-off-by-one-error.patch
++ bugfix/all/p54pci-prevent-stuck-rx-ring.patch
++ bugfix/all/p54pci-fix-serious-sparse-warning.patch
++ bugfix/all/p54pci-fix-bugs-in-p54p_check_tx_ring.patch
++ bugfix/all/p54pci-fix-regression.patch
More information about the Kernel-svn-changes
mailing list