linux-toradex.git/drivers/net/wireless, branch v3.4.2 Linux kernel for Apalis and Colibri modules wl1251: fix oops on early interrupt 2012-06-09T15:36:19+00:00 Grazvydas Ignotas notasas@gmail.com 2012-05-18T00:04:08+00:00 ee9c8a04666ba15762f736f9030e6e8df02ca1a5 commit f380f2c4a12e913356bd49f8790ec1063c4fe9f8 upstream. This driver disables interrupt just after requesting it and enables it later, after interface is up. However currently there is a time window between request_irq() and disable_irq() where if interrupt arrives, the driver oopses because it's not yet ready to process it. This can be reproduced by inserting the module, associating and removing the module multiple times. Eliminate this race by setting IRQF_NOAUTOEN flag before request_irq(). Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit f380f2c4a12e913356bd49f8790ec1063c4fe9f8 upstream.

This driver disables interrupt just after requesting it and enables it
later, after interface is up. However currently there is a time window
between request_irq() and disable_irq() where if interrupt arrives, the
driver oopses because it's not yet ready to process it. This can be
reproduced by inserting the module, associating and removing the module
multiple times.

Eliminate this race by setting IRQF_NOAUTOEN flag before request_irq().

Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails 2012-06-09T15:36:08+00:00 Felix Fietkau nbd@openwrt.org 2012-05-24T12:32:20+00:00 c163f56463e26f771e3dc7e67921f268053ad8e6 commit 81357a281dcc454841532c46b30e6f2ba12b73ea upstream. ath_tx_setup_buffer() can fail if there is no ath_buf left, or if mapping DMA failed. In this case it frees the skb passed to it. If ath_tx_setup_buffer is called from ath_tx_form_aggr, the skb is still linked into the tid buffer list and must be dequeued before being released. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 81357a281dcc454841532c46b30e6f2ba12b73ea upstream.

ath_tx_setup_buffer() can fail if there is no ath_buf left, or if mapping DMA
failed. In this case it frees the skb passed to it.
If ath_tx_setup_buffer is called from ath_tx_form_aggr, the skb is still
linked into the tid buffer list and must be dequeued before being released.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
iwlwifi: do not use shadow registers by default 2012-06-09T15:36:07+00:00 Meenakshi Venkataraman meenakshi.venkataraman@intel.com 2012-05-16T20:35:59+00:00 784c9700444d2ebbace0a1d3a3ac48c3d5852164 commit 66a770729a5cdd24efed8afa5258f81232d8bba2 upstream. Shadow registers in the device are meant to allow the driver to update certain device registers without needing to wake up all components of the device. However, using this feature in the device causes communication between the driver and the device to become unreliable, resulting in host command timeouts. Disable this feature by default till a fix is available for the bug. Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 66a770729a5cdd24efed8afa5258f81232d8bba2 upstream.

Shadow registers in the device are meant to
allow the driver to update certain device
registers without needing to wake up all
components of the device. However, using
this feature in the device causes
communication between the driver and the
device to become unreliable, resulting in
host command timeouts.

Disable this feature by default till a fix is
available for the bug.

Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
iwlwifi: update BT traffic load states correctly 2012-06-09T15:36:07+00:00 Meenakshi Venkataraman meenakshi.venkataraman@intel.com 2012-05-16T20:35:57+00:00 75713d3f1b75e0054d47b258895225e152e638cb commit 882dde8eb0d49ce0f853f8f4084dde56a21fe55f upstream. When BT traffic load changes from its previous state, a new LQ command needs to be sent down to the firmware. This needs to be done only once per change. The state variable that keeps track of this change is last_bt_traffic_load. However, it was not being updated when the change had been handled. Not updating this variable was causing a flood of advanced BT config commands to be sent to the firmware. Fix this. Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 882dde8eb0d49ce0f853f8f4084dde56a21fe55f upstream.

When BT traffic load changes from its
previous state, a new LQ command needs to be
sent down to the firmware. This needs to
be done only once per change. The state
variable that keeps track of this change is
last_bt_traffic_load. However, it was not
being updated when the change had been
handled. Not updating this variable was
causing a flood of advanced BT config
commands to be sent to the firmware. Fix
this.

Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
b43legacy: Fix error due to MMIO access with SSB unpowered 2012-06-01T07:18:24+00:00 Larry Finger Larry.Finger@lwfinger.net 2012-05-06T21:01:05+00:00 46f736c6f722e9a71ab552178a6bf4edf85ba371 commit 8f4b20388fa77226a3605627a33a23f90d559e50 upstream. There is a dummy read of a PCI MMIO register that occurs before the SSB bus has been powered, which is an error. This bug has not been seen earlier, but was apparently exposed when udev was updated to version 182. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 8f4b20388fa77226a3605627a33a23f90d559e50 upstream.

There is a dummy read of a PCI MMIO register that occurs before the SSB bus
has been powered, which is an error. This bug has not been seen earlier,
but was apparently exposed when udev was updated to version 182.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
rtlwifi: fix for race condition when firmware is cached 2012-05-14T17:51:24+00:00 Larry Finger Larry.Finger@lwfinger.net 2012-05-04T13:27:43+00:00 574e02abaf816b582685805f0c1150ca9f1f18ee In commit b0302ab, the rtlwifi family of drivers was converted to use asynchronous firmware loading. Unfortumately, the implementation was racy, and the ieee80211 routines could be started before rtl_init_core() was called to setup the data. This patch fixes the bug noted in https://bugzilla.kernel.org/show_bug.cgi?id=43187. Reported-by: Joshua Roys <Joshua.Roys@gtri.gatech.edu> Tested-by: Neptune Ning <frostyplanet@gmail.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@vger.kernel.org> [3.3] Signed-off-by: John W. Linville <linville@tuxdriver.com> 
In commit b0302ab, the rtlwifi family of drivers was converted to use
asynchronous firmware loading. Unfortumately, the implementation was
racy, and the ieee80211 routines could be started before rtl_init_core()
was called to setup the data.

This patch fixes the bug noted in https://bugzilla.kernel.org/show_bug.cgi?id=43187.

Reported-by: Joshua Roys <Joshua.Roys@gtri.gatech.edu>
Tested-by: Neptune Ning <frostyplanet@gmail.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>    [3.3]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
iwlwifi: fix skb truesize underestimation 2012-05-03T14:52:30+00:00 Eric Dumazet eric.dumazet@gmail.com 2012-03-24T04:29:46+00:00 ed90542b0ce5415050c6fbfca324bccaafa69f2f By default, iwlwifi uses order-1 pages (8 KB) to store incoming frames, but doesnt say so in skb->truesize. This makes very possible to exhaust kernel memory since these skb evade normal socket memory accounting. As struct ieee80211_hdr is going to be pulled before calling IP stack, there is no need to use dev_alloc_skb() to reserve NET_SKB_PAD bytes. alloc_skb() is ok in this driver, allowing more tailroom. Pull beginning of frame in skb header, in the hope we can reuse order-1 pages in the driver immediately for small frames and reduce their truesize to the minimum (linear skbs) Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com> Cc: "John W. Linville" <linville@tuxdriver.com> Cc: Neal Cardwell <ncardwell@google.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
By default, iwlwifi uses order-1 pages (8 KB) to store incoming frames,
but doesnt say so in skb->truesize.

This makes very possible to exhaust kernel memory since these skb evade
normal socket memory accounting.

As struct ieee80211_hdr is going to be pulled before calling IP stack,
there is no need to use dev_alloc_skb() to reserve NET_SKB_PAD bytes.
alloc_skb() is ok in this driver, allowing more tailroom.

Pull beginning of frame in skb header, in the hope we can reuse order-1
pages in the driver immediately for small frames and reduce their
truesize to the minimum (linear skbs)

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: Neal Cardwell <ncardwell@google.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Revert "ath9k_hw: Fix incorrect spur_freq_sd for AR9003" 2012-05-02T18:02:03+00:00 Rajkumar Manoharan rmanohar@qca.qualcomm.com 2012-05-01T03:42:24+00:00 9d1ceac5c6f7e77ea914de376ec17ced3eb22e5f This reverts commit a844adfd7bee4edc66d337de6c33b348e83552a8. The commit a844adfd is degrading rx sensitivity of lower rate in HT40 mode and it is confirmed that reverting the change is improving rx sensitivity. spur_freq_sd (for self-corr in AGC) is defined with respect to the center of each 20MHz channel while spur_phase_delta (for self-corr in Rx and spur data filter) is defined with respect to the center of current RF channel. So in short, we need to subtract spur_freq_sd (for self-corr in AGC) by the offset between the center of primary20 and the center of RF channel in SW. This offset could be +/10 MHz for dynamic 40. Cc: Madhan Jaganathan <madhanj@qca.qualcomm.com> Signed-off-by: Kai Shi <kaishi@qca.qualcomm.com> Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
This reverts commit a844adfd7bee4edc66d337de6c33b348e83552a8.
The commit a844adfd is degrading rx sensitivity of lower rate in
HT40 mode and it is confirmed that reverting the change is
improving rx sensitivity.

spur_freq_sd (for self-corr in AGC) is defined with respect to the
center of each 20MHz channel while spur_phase_delta (for self-corr
in Rx and spur data filter) is defined with respect to the center
of current RF channel.

So in short, we need to subtract spur_freq_sd (for self-corr in AGC)
by the offset between the center of primary20 and the center of RF
channel in SW. This offset could be +/10 MHz for dynamic 40.

Cc: Madhan Jaganathan <madhanj@qca.qualcomm.com>
Signed-off-by: Kai Shi <kaishi@qca.qualcomm.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
brcmfmac: fix a double spin_unlock_irqrestore issue in dpc 2012-05-02T18:02:03+00:00 Franky Lin frankyl@broadcom.com 2012-04-30T18:43:07+00:00 cf04317227d0c53d931a0b963e7ac6f7f0125e8a dpc_tl_lock is not acquired in the error handle code for bus down. But it's unlocked using spin_unlock_irqrestore after finishing task list walk down. Grab the lock before breaking the loop to avoid a double unlock. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Franky Lin <frankyl@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
dpc_tl_lock is not acquired in the error handle code for bus down.
But it's unlocked using spin_unlock_irqrestore after finishing task
list walk down. Grab the lock before breaking the loop to avoid a
double unlock.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
wl1251: fix crash on remove due to leftover work item 2012-04-27T19:25:25+00:00 Grazvydas Ignotas notasas@gmail.com 2012-04-26T20:07:44+00:00 4c1bcdb5a3354b250b82a67549f57ac27a3bb85f This driver currently leaves elp_work behind when stopping, which occasionally results in data corruption because work function ends up accessing freed memory, typical symptoms of this are various worker_thread crashes. Fix it by cancelling elp_work. Cc: stable@vger.kernel.org # v2.6.37+ Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> 
This driver currently leaves elp_work behind when stopping, which
occasionally results in data corruption because work function ends
up accessing freed memory, typical symptoms of this are various
worker_thread crashes. Fix it by cancelling elp_work.

Cc: stable@vger.kernel.org # v2.6.37+
Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>