<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/net/wireless/rt2x00, branch tegra</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>rt2800usb: Move ID out of unknown</title>
<updated>2012-01-12T19:33:08+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2011-12-27T18:22:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=27f61685c1906c8114f7d20f1cbc4d87a5857ca9'/>
<id>27f61685c1906c8114f7d20f1cbc4d87a5857ca9</id>
<content type='text'>
commit 3f81f8f1524ccca24df1029b0cf825ecef5e5cdc upstream.

Testing on the openSUSE wireless forum has shown that a Linksys
WUSB54GC v3 with USB ID 1737:0077 works with rt2800usb when the ID is
written to /sys/.../new_id. This ID can therefore be moved out of UNKNOWN.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Acked-by: Gertjan van Wingerde &lt;gwingerde@gmail.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 3f81f8f1524ccca24df1029b0cf825ecef5e5cdc upstream.

Testing on the openSUSE wireless forum has shown that a Linksys
WUSB54GC v3 with USB ID 1737:0077 works with rt2800usb when the ID is
written to /sys/.../new_id. This ID can therefore be moved out of UNKNOWN.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Acked-by: Gertjan van Wingerde &lt;gwingerde@gmail.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>rt2x00: Fix efuse EEPROM reading on PPC32.</title>
<updated>2011-12-09T16:54:27+00:00</updated>
<author>
<name>Gertjan van Wingerde</name>
<email>gwingerde@gmail.com</email>
</author>
<published>2011-11-16T22:16:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7ca622f2e52f3161466ebe93e177fb64c6047dc9'/>
<id>7ca622f2e52f3161466ebe93e177fb64c6047dc9</id>
<content type='text'>
commit 68fa64ef606bcee688fce46d07aa68f175070156 upstream.

Fix __le32 to __le16 conversion of the first word of an 8-word block
of EEPROM read via the efuse method.

Reported-and-tested-by: Ingvar Hagelund &lt;ingvar@redpill-linpro.com&gt;
Signed-off-by: Gertjan van Wingerde &lt;gwingerde@gmail.com&gt;
Acked-by: Helmut Schaa &lt;helmut.schaa@googlemail.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 68fa64ef606bcee688fce46d07aa68f175070156 upstream.

Fix __le32 to __le16 conversion of the first word of an 8-word block
of EEPROM read via the efuse method.

Reported-and-tested-by: Ingvar Hagelund &lt;ingvar@redpill-linpro.com&gt;
Signed-off-by: Gertjan van Wingerde &lt;gwingerde@gmail.com&gt;
Acked-by: Helmut Schaa &lt;helmut.schaa@googlemail.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>rt2x00: Fix sleep-while-atomic bug in powersaving code.</title>
<updated>2011-11-26T17:08:34+00:00</updated>
<author>
<name>Gertjan van Wingerde</name>
<email>gwingerde@gmail.com</email>
</author>
<published>2011-11-12T18:10:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7aa8983f0b2c57c25de227909072fe4f8edaa9ad'/>
<id>7aa8983f0b2c57c25de227909072fe4f8edaa9ad</id>
<content type='text'>
commit ed66ba472a742cd8df37d7072804b2111cdb1014 upstream.

The generic powersaving code that determines after reception of a frame
whether the device should go back to sleep or whether is could stay
awake was calling rt2x00lib_config directly from RX tasklet context.
On a number of the devices this call can actually sleep, due to having
to confirm that the sleeping commands have been executed successfully.

Fix this by moving the call to rt2x00lib_config to a workqueue call.

This fixes bug https://bugzilla.redhat.com/show_bug.cgi?id=731672

Tested-by: Tomas Trnka &lt;tomastrnka@gmx.com&gt;
Signed-off-by: Gertjan van Wingerde &lt;gwingerde@gmail.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit ed66ba472a742cd8df37d7072804b2111cdb1014 upstream.

The generic powersaving code that determines after reception of a frame
whether the device should go back to sleep or whether is could stay
awake was calling rt2x00lib_config directly from RX tasklet context.
On a number of the devices this call can actually sleep, due to having
to confirm that the sleeping commands have been executed successfully.

Fix this by moving the call to rt2x00lib_config to a workqueue call.

This fixes bug https://bugzilla.redhat.com/show_bug.cgi?id=731672

Tested-by: Tomas Trnka &lt;tomastrnka@gmx.com&gt;
Signed-off-by: Gertjan van Wingerde &lt;gwingerde@gmail.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>rtl2800usb: Fix incorrect storage of MAC address on big-endian platforms</title>
<updated>2011-09-16T19:32:10+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2011-09-14T21:50:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=daabead1c32f331edcfb255fd973411c667977e8'/>
<id>daabead1c32f331edcfb255fd973411c667977e8</id>
<content type='text'>
The eeprom data is stored in little-endian order in the rt2x00 library.
As it was converted to cpu order in the read routines, the data need to
be converted to LE on a big-endian platform.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@kernel.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The eeprom data is stored in little-endian order in the rt2x00 library.
As it was converted to cpu order in the read routines, the data need to
be converted to LE on a big-endian platform.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: Stable &lt;stable@kernel.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rt2800pci: Fix compiler error on PowerPC</title>
<updated>2011-09-16T19:32:09+00:00</updated>
<author>
<name>Larry Finger</name>
<email>Larry.Finger@lwfinger.net</email>
</author>
<published>2011-09-14T21:50:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=d331eb51e4d4190b2178c30fcafea54a94a577e8'/>
<id>d331eb51e4d4190b2178c30fcafea54a94a577e8</id>
<content type='text'>
Using gcc 4.4.5 on a Powerbook G4 with a PPC cpu, a complicated
if statement results in incorrect flow, whereas the equivalent switch
statement works correctly.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: stable &lt;stable@kernel.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Using gcc 4.4.5 on a Powerbook G4 with a PPC cpu, a complicated
if statement results in incorrect flow, whereas the equivalent switch
statement works correctly.

Signed-off-by: Larry Finger &lt;Larry.Finger@lwfinger.net&gt;
Cc: stable &lt;stable@kernel.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rt2x00: do not drop usb dev reference counter on suspend</title>
<updated>2011-08-22T18:21:40+00:00</updated>
<author>
<name>Stanislaw Gruszka</name>
<email>sgruszka@redhat.com</email>
</author>
<published>2011-08-12T12:02:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=543cc38c8fe86deba4169977c61eb88491036837'/>
<id>543cc38c8fe86deba4169977c61eb88491036837</id>
<content type='text'>
When hibernating -&gt;resume may not be called by usb core, but disconnect
and probe instead, so we do not increase the counter after decreasing
it in -&gt;supend. As a result we free memory early, and get crash when
unplugging usb dongle.

BUG: unable to handle kernel paging request at 6b6b6b9f
IP: [&lt;c06909b0&gt;] driver_sysfs_remove+0x10/0x30
*pdpt = 0000000034f21001 *pde = 0000000000000000
Pid: 20, comm: khubd Not tainted 3.1.0-rc1-wl+ #20 LENOVO 6369CTO/6369CTO
EIP: 0060:[&lt;c06909b0&gt;] EFLAGS: 00010202 CPU: 1
EIP is at driver_sysfs_remove+0x10/0x30
EAX: 6b6b6b6b EBX: f52bba34 ECX: 00000000 EDX: 6b6b6b6b
ESI: 6b6b6b6b EDI: c0a0ea20 EBP: f61c9e68 ESP: f61c9e64
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process khubd (pid: 20, ti=f61c8000 task=f6138270 task.ti=f61c8000)
Call Trace:
 [&lt;c06909ef&gt;] __device_release_driver+0x1f/0xa0
 [&lt;c0690b20&gt;] device_release_driver+0x20/0x40
 [&lt;c068fd64&gt;] bus_remove_device+0x84/0xe0
 [&lt;c068e12a&gt;] ? device_remove_attrs+0x2a/0x80
 [&lt;c068e267&gt;] device_del+0xe7/0x170
 [&lt;c06d93d4&gt;] usb_disconnect+0xd4/0x180
 [&lt;c06d9d61&gt;] hub_thread+0x691/0x1600
 [&lt;c0473260&gt;] ? wake_up_bit+0x30/0x30
 [&lt;c0442a39&gt;] ? complete+0x49/0x60
 [&lt;c06d96d0&gt;] ? hub_disconnect+0xd0/0xd0
 [&lt;c06d96d0&gt;] ? hub_disconnect+0xd0/0xd0
 [&lt;c0472eb4&gt;] kthread+0x74/0x80
 [&lt;c0472e40&gt;] ? kthread_worker_fn+0x150/0x150
 [&lt;c0809b3e&gt;] kernel_thread_helper+0x6/0x10

Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When hibernating -&gt;resume may not be called by usb core, but disconnect
and probe instead, so we do not increase the counter after decreasing
it in -&gt;supend. As a result we free memory early, and get crash when
unplugging usb dongle.

BUG: unable to handle kernel paging request at 6b6b6b9f
IP: [&lt;c06909b0&gt;] driver_sysfs_remove+0x10/0x30
*pdpt = 0000000034f21001 *pde = 0000000000000000
Pid: 20, comm: khubd Not tainted 3.1.0-rc1-wl+ #20 LENOVO 6369CTO/6369CTO
EIP: 0060:[&lt;c06909b0&gt;] EFLAGS: 00010202 CPU: 1
EIP is at driver_sysfs_remove+0x10/0x30
EAX: 6b6b6b6b EBX: f52bba34 ECX: 00000000 EDX: 6b6b6b6b
ESI: 6b6b6b6b EDI: c0a0ea20 EBP: f61c9e68 ESP: f61c9e64
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process khubd (pid: 20, ti=f61c8000 task=f6138270 task.ti=f61c8000)
Call Trace:
 [&lt;c06909ef&gt;] __device_release_driver+0x1f/0xa0
 [&lt;c0690b20&gt;] device_release_driver+0x20/0x40
 [&lt;c068fd64&gt;] bus_remove_device+0x84/0xe0
 [&lt;c068e12a&gt;] ? device_remove_attrs+0x2a/0x80
 [&lt;c068e267&gt;] device_del+0xe7/0x170
 [&lt;c06d93d4&gt;] usb_disconnect+0xd4/0x180
 [&lt;c06d9d61&gt;] hub_thread+0x691/0x1600
 [&lt;c0473260&gt;] ? wake_up_bit+0x30/0x30
 [&lt;c0442a39&gt;] ? complete+0x49/0x60
 [&lt;c06d96d0&gt;] ? hub_disconnect+0xd0/0xd0
 [&lt;c06d96d0&gt;] ? hub_disconnect+0xd0/0xd0
 [&lt;c0472eb4&gt;] kthread+0x74/0x80
 [&lt;c0472e40&gt;] ? kthread_worker_fn+0x150/0x150
 [&lt;c0809b3e&gt;] kernel_thread_helper+0x6/0x10

Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rt2x00: fix crash in rt2800usb_get_txwi</title>
<updated>2011-08-11T18:34:37+00:00</updated>
<author>
<name>Stanislaw Gruszka</name>
<email>sgruszka@redhat.com</email>
</author>
<published>2011-08-10T13:32:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=674db1344443204b6ce3293f2df8fd1b7665deea'/>
<id>674db1344443204b6ce3293f2df8fd1b7665deea</id>
<content type='text'>
Patch should fix this oops:

BUG: unable to handle kernel NULL pointer dereference at 000000a0
IP: [&lt;f81b30c9&gt;] rt2800usb_get_txwi+0x19/0x70 [rt2800usb]
*pdpt = 0000000000000000 *pde = f000ff53f000ff53
Oops: 0000 [#1] SMP
Pid: 198, comm: kworker/u:3 Tainted: G        W   3.0.0-wl+ #9 LENOVO 6369CTO/6369CTO
EIP: 0060:[&lt;f81b30c9&gt;] EFLAGS: 00010283 CPU: 1
EIP is at rt2800usb_get_txwi+0x19/0x70 [rt2800usb]
EAX: 00000000 EBX: f465e140 ECX: f4494960 EDX: ef24c5f8
ESI: 810f21f5 EDI: f1da9960 EBP: f4581e80 ESP: f4581e70
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process kworker/u:3 (pid: 198, ti=f4580000 task=f4494960 task.ti=f4580000)
Call Trace:
 [&lt;f804790f&gt;] rt2800_txdone_entry+0x2f/0xf0 [rt2800lib]
 [&lt;c045110d&gt;] ? warn_slowpath_common+0x7d/0xa0
 [&lt;f81b3a38&gt;] ? rt2800usb_work_txdone+0x288/0x360 [rt2800usb]
 [&lt;f81b3a38&gt;] ? rt2800usb_work_txdone+0x288/0x360 [rt2800usb]
 [&lt;f81b3a13&gt;] rt2800usb_work_txdone+0x263/0x360 [rt2800usb]
 [&lt;c046a8d6&gt;] process_one_work+0x186/0x440
 [&lt;c046a85a&gt;] ? process_one_work+0x10a/0x440
 [&lt;f81b37b0&gt;] ? rt2800usb_probe_hw+0x120/0x120 [rt2800usb]
 [&lt;c046c283&gt;] worker_thread+0x133/0x310
 [&lt;c04885db&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;c046c150&gt;] ? manage_workers+0x1e0/0x1e0
 [&lt;c047054c&gt;] kthread+0x7c/0x90
 [&lt;c04704d0&gt;] ? __init_kthread_worker+0x60/0x60
 [&lt;c0826b42&gt;] kernel_thread_helper+0x6/0x1

Oops might happen because we check rt2x00queue_empty(queue) twice,
but this condition can change and we can process entry in
rt2800_txdone_entry(), which was already processed by
rt2800usb_txdone_entry_check() -&gt; rt2x00lib_txdone_noinfo() and
has nullify entry-&gt;skb .

Reported-by: Justin Piszcz &lt;jpiszcz@lucidpixels.com&gt;
Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Patch should fix this oops:

BUG: unable to handle kernel NULL pointer dereference at 000000a0
IP: [&lt;f81b30c9&gt;] rt2800usb_get_txwi+0x19/0x70 [rt2800usb]
*pdpt = 0000000000000000 *pde = f000ff53f000ff53
Oops: 0000 [#1] SMP
Pid: 198, comm: kworker/u:3 Tainted: G        W   3.0.0-wl+ #9 LENOVO 6369CTO/6369CTO
EIP: 0060:[&lt;f81b30c9&gt;] EFLAGS: 00010283 CPU: 1
EIP is at rt2800usb_get_txwi+0x19/0x70 [rt2800usb]
EAX: 00000000 EBX: f465e140 ECX: f4494960 EDX: ef24c5f8
ESI: 810f21f5 EDI: f1da9960 EBP: f4581e80 ESP: f4581e70
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process kworker/u:3 (pid: 198, ti=f4580000 task=f4494960 task.ti=f4580000)
Call Trace:
 [&lt;f804790f&gt;] rt2800_txdone_entry+0x2f/0xf0 [rt2800lib]
 [&lt;c045110d&gt;] ? warn_slowpath_common+0x7d/0xa0
 [&lt;f81b3a38&gt;] ? rt2800usb_work_txdone+0x288/0x360 [rt2800usb]
 [&lt;f81b3a38&gt;] ? rt2800usb_work_txdone+0x288/0x360 [rt2800usb]
 [&lt;f81b3a13&gt;] rt2800usb_work_txdone+0x263/0x360 [rt2800usb]
 [&lt;c046a8d6&gt;] process_one_work+0x186/0x440
 [&lt;c046a85a&gt;] ? process_one_work+0x10a/0x440
 [&lt;f81b37b0&gt;] ? rt2800usb_probe_hw+0x120/0x120 [rt2800usb]
 [&lt;c046c283&gt;] worker_thread+0x133/0x310
 [&lt;c04885db&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;c046c150&gt;] ? manage_workers+0x1e0/0x1e0
 [&lt;c047054c&gt;] kthread+0x7c/0x90
 [&lt;c04704d0&gt;] ? __init_kthread_worker+0x60/0x60
 [&lt;c0826b42&gt;] kernel_thread_helper+0x6/0x1

Oops might happen because we check rt2x00queue_empty(queue) twice,
but this condition can change and we can process entry in
rt2800_txdone_entry(), which was already processed by
rt2800usb_txdone_entry_check() -&gt; rt2x00lib_txdone_noinfo() and
has nullify entry-&gt;skb .

Reported-by: Justin Piszcz &lt;jpiszcz@lucidpixels.com&gt;
Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rt2x00: fix order of entry flags modification</title>
<updated>2011-08-11T18:34:36+00:00</updated>
<author>
<name>Stanislaw Gruszka</name>
<email>sgruszka@redhat.com</email>
</author>
<published>2011-08-10T13:32:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=df71c9cfceea801e7e26e2c74241758ef9c042e5'/>
<id>df71c9cfceea801e7e26e2c74241758ef9c042e5</id>
<content type='text'>
In rt2800usb_work_txdone we check flags in order:

- ENTRY_OWNER_DEVICE_DATA
- ENTRY_DATA_STATUS_PENDING
- ENTRY_DATA_IO_FAILED

Modify flags in separate order in rt2x00usb_interrupt_txdone, to avoid
processing entries in _txdone with wrong flags or skip processing
ready entries.

Reported-by: Justin Piszcz &lt;jpiszcz@lucidpixels.com&gt;
Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In rt2800usb_work_txdone we check flags in order:

- ENTRY_OWNER_DEVICE_DATA
- ENTRY_DATA_STATUS_PENDING
- ENTRY_DATA_IO_FAILED

Modify flags in separate order in rt2x00usb_interrupt_txdone, to avoid
processing entries in _txdone with wrong flags or skip processing
ready entries.

Reported-by: Justin Piszcz &lt;jpiszcz@lucidpixels.com&gt;
Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rt2x00: fix crash in rt2800usb_write_tx_desc</title>
<updated>2011-08-11T18:34:36+00:00</updated>
<author>
<name>Stanislaw Gruszka</name>
<email>sgruszka@redhat.com</email>
</author>
<published>2011-08-10T13:32:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=4b1bfb7d2d125af6653d6c2305356b2677f79dc6'/>
<id>4b1bfb7d2d125af6653d6c2305356b2677f79dc6</id>
<content type='text'>
Patch should fix this oops:

BUG: unable to handle kernel NULL pointer dereference at 000000a0
IP: [&lt;f8e06078&gt;] rt2800usb_write_tx_desc+0x18/0xc0 [rt2800usb]
*pdpt = 000000002408c001 *pde = 0000000024079067 *pte = 0000000000000000
Oops: 0000 [#1] SMP
EIP: 0060:[&lt;f8e06078&gt;] EFLAGS: 00010282 CPU: 0
EIP is at rt2800usb_write_tx_desc+0x18/0xc0 [rt2800usb]
EAX: 00000035 EBX: ef2bef10 ECX: 00000000 EDX: d40958a0
ESI: ef1865f8 EDI: ef1865f8 EBP: d4095878 ESP: d409585c
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Call Trace:
 [&lt;f8da5e85&gt;] rt2x00queue_write_tx_frame+0x155/0x300 [rt2x00lib]
 [&lt;f8da424c&gt;] rt2x00mac_tx+0x7c/0x370 [rt2x00lib]
 [&lt;c04882b2&gt;] ? mark_held_locks+0x62/0x90
 [&lt;c081f645&gt;] ? _raw_spin_unlock_irqrestore+0x35/0x60
 [&lt;c04884ba&gt;] ? trace_hardirqs_on_caller+0x5a/0x170
 [&lt;c04885db&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;f8d618ac&gt;] __ieee80211_tx+0x5c/0x1e0 [mac80211]
 [&lt;f8d631fc&gt;] ieee80211_tx+0xbc/0xe0 [mac80211]
 [&lt;f8d63163&gt;] ? ieee80211_tx+0x23/0xe0 [mac80211]
 [&lt;f8d632e1&gt;] ieee80211_xmit+0xc1/0x200 [mac80211]
 [&lt;f8d63220&gt;] ? ieee80211_tx+0xe0/0xe0 [mac80211]
 [&lt;c0487d45&gt;] ? lock_release_holdtime+0x35/0x1b0
 [&lt;f8d63986&gt;] ? ieee80211_subif_start_xmit+0x446/0x5f0 [mac80211]
 [&lt;f8d637dd&gt;] ieee80211_subif_start_xmit+0x29d/0x5f0 [mac80211]
 [&lt;f8d63924&gt;] ? ieee80211_subif_start_xmit+0x3e4/0x5f0 [mac80211]
 [&lt;c0760188&gt;] ? sock_setsockopt+0x6a8/0x6f0
 [&lt;c0760000&gt;] ? sock_setsockopt+0x520/0x6f0
 [&lt;c076daef&gt;] dev_hard_start_xmit+0x2ef/0x650

Oops might happen because we perform parallel putting new entries in a
queue (rt2x00queue_write_tx_frame()) and removing entries after
finishing transmitting (rt2800usb_work_txdone()). There are cases when
_txdone may process an entry that was not fully send and nullify
entry-&gt;skb .

To fix check in _txdone if entry has flags that indicate pending
transmission and wait until flags get cleared.

Reported-by: Justin Piszcz &lt;jpiszcz@lucidpixels.com&gt;
Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Patch should fix this oops:

BUG: unable to handle kernel NULL pointer dereference at 000000a0
IP: [&lt;f8e06078&gt;] rt2800usb_write_tx_desc+0x18/0xc0 [rt2800usb]
*pdpt = 000000002408c001 *pde = 0000000024079067 *pte = 0000000000000000
Oops: 0000 [#1] SMP
EIP: 0060:[&lt;f8e06078&gt;] EFLAGS: 00010282 CPU: 0
EIP is at rt2800usb_write_tx_desc+0x18/0xc0 [rt2800usb]
EAX: 00000035 EBX: ef2bef10 ECX: 00000000 EDX: d40958a0
ESI: ef1865f8 EDI: ef1865f8 EBP: d4095878 ESP: d409585c
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Call Trace:
 [&lt;f8da5e85&gt;] rt2x00queue_write_tx_frame+0x155/0x300 [rt2x00lib]
 [&lt;f8da424c&gt;] rt2x00mac_tx+0x7c/0x370 [rt2x00lib]
 [&lt;c04882b2&gt;] ? mark_held_locks+0x62/0x90
 [&lt;c081f645&gt;] ? _raw_spin_unlock_irqrestore+0x35/0x60
 [&lt;c04884ba&gt;] ? trace_hardirqs_on_caller+0x5a/0x170
 [&lt;c04885db&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;f8d618ac&gt;] __ieee80211_tx+0x5c/0x1e0 [mac80211]
 [&lt;f8d631fc&gt;] ieee80211_tx+0xbc/0xe0 [mac80211]
 [&lt;f8d63163&gt;] ? ieee80211_tx+0x23/0xe0 [mac80211]
 [&lt;f8d632e1&gt;] ieee80211_xmit+0xc1/0x200 [mac80211]
 [&lt;f8d63220&gt;] ? ieee80211_tx+0xe0/0xe0 [mac80211]
 [&lt;c0487d45&gt;] ? lock_release_holdtime+0x35/0x1b0
 [&lt;f8d63986&gt;] ? ieee80211_subif_start_xmit+0x446/0x5f0 [mac80211]
 [&lt;f8d637dd&gt;] ieee80211_subif_start_xmit+0x29d/0x5f0 [mac80211]
 [&lt;f8d63924&gt;] ? ieee80211_subif_start_xmit+0x3e4/0x5f0 [mac80211]
 [&lt;c0760188&gt;] ? sock_setsockopt+0x6a8/0x6f0
 [&lt;c0760000&gt;] ? sock_setsockopt+0x520/0x6f0
 [&lt;c076daef&gt;] dev_hard_start_xmit+0x2ef/0x650

Oops might happen because we perform parallel putting new entries in a
queue (rt2x00queue_write_tx_frame()) and removing entries after
finishing transmitting (rt2800usb_work_txdone()). There are cases when
_txdone may process an entry that was not fully send and nullify
entry-&gt;skb .

To fix check in _txdone if entry has flags that indicate pending
transmission and wait until flags get cleared.

Reported-by: Justin Piszcz &lt;jpiszcz@lucidpixels.com&gt;
Cc: stable@kernel.org
Signed-off-by: Stanislaw Gruszka &lt;sgruszka@redhat.com&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rt2x00: Add rt2870 device id for Dvico usb key</title>
<updated>2011-08-09T20:11:33+00:00</updated>
<author>
<name>Anthony Bourguignon</name>
<email>contact+kernel@toniob.net</email>
</author>
<published>2011-08-05T05:46:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=276b02e2a0ada2e0196852c312560ffdabcebddc'/>
<id>276b02e2a0ada2e0196852c312560ffdabcebddc</id>
<content type='text'>
This patch add a device id for the wifi usb keys shiped by DVICO with
some of their tvix hardware.

Signed-off-by: Anthony Bourguignon &lt;contact+kernel@toniob.net&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This patch add a device id for the wifi usb keys shiped by DVICO with
some of their tvix hardware.

Signed-off-by: Anthony Bourguignon &lt;contact+kernel@toniob.net&gt;
Acked-by: Ivo van Doorn &lt;IvDoorn@gmail.com&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
