linux-stable.git/drivers/net/wireless/rt2x00/rt2x00dev.c, branch linux-3.2.y

rt2x00: error in configurations with mesh support disabled

2013-04-10T02:20:08+00:00

commit 6ef9e2f6d12ce9e2120916804d2ddd46b954a70b upstream.

If CONFIG_MAC80211_MESH is not set, cfg80211 will now allow advertising
interface combinations with NL80211_IFTYPE_MESH_POINT present.
Add appropriate ifdefs to avoid running into errors.

Signed-off-by: Felix Fietkau 
Acked-by: Gertjan van Wingerde 
Signed-off-by: John W. Linville 
[lxiang: Backported for 3.4-stable. Removed code of simultaneous AP and mesh
 mode added in 4a5fc6d 3.9-rc1.]
Signed-off-by: Lingzhu Xiang 
Reviewed-by: CAI Qian 
Signed-off-by: Ben Hutchings

Revert: "rt2x00: Don't let mac80211 send a BAR when an AMPDU subframe fails"

2013-01-16T01:13:23+00:00

commit ab9d6e4ffe192427ce9e93d4f927b0faaa8a941e upstream.

This revert:

commit be03d4a45c09ee5100d3aaaedd087f19bc20d01f
Author: Andreas Hartmann 
Date:   Tue Apr 17 00:25:28 2012 +0200

    rt2x00: Don't let mac80211 send a BAR when an AMPDU subframe fails

To fix problem workaround by above commit use
IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL flag (see change log for
"mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL" patch).

Resolve: https://bugzilla.kernel.org/show_bug.cgi?id=42828
Bisected-by: Francisco Pina Martins 
Signed-off-by: Stanislaw Gruszka 
Signed-off-by: Johannes Berg 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

rt2x00: Don't let mac80211 send a BAR when an AMPDU subframe fails

2013-01-16T01:13:22+00:00

commit be03d4a45c09ee5100d3aaaedd087f19bc20d01f upstream.

There are connection stalls or very poor throughputs with rt2800
hardware using 802.11n in AP mode since patch "mac80211: retry sending
failed BAR frames later instead of tearing down aggr"[1][2].

Since rt2800 hardware is not able to correctly report the tx status of
BAR frames, this patch removes as workaround the existing error handling
on AP side, which lets mac80211 send a BAR when an AMPDU subframe fails.

As a result, most wifi clients (aside from Intel STAs on Windows)
instead will timeout now the reorder buffer and request the lost frame
again.

The correct solution would be, to tear down BA session on AP side.

This patch was born on the basis of "[RFT] rt2x00: Tear down BA
session on QoS frame failure"[3].

Thanks to Helmut Schaa for his support!

[1] http://thread.gmane.org/gmane.linux.kernel.wireless.general/83297/focus=83304
[2] http://git.kernel.org/?p=linux/kernel/git/linville/wireless-testing.git;a=commit;h=f0425beda4d404a6e751439b562100b902ba9c98
[3] http://thread.gmane.org/gmane.linux.drivers.rt2x00.user/569

Signed-off-by: Andreas Hartmann 
Acked-by: Helmut Schaa 
Signed-off-by: John W. Linville 
Signed-off-by: Ben Hutchings

rt2800usb: Added rx packet length validity check

2012-09-19T14:05:11+00:00

commit efd5d6b03bd9c9e0df646c56fb5f4f3e25e5c1ac upstream.

On our system (ARM Cortex-M3 SOC running linux-2.6.33)
frequent crashes were observed in the rt2800usb module
because of the invalid length of the received packet (3392,
46920...). This patch adds the sanity check on the packet
legth. Also, changed WARNING to ERROR in rt2x00lib_rxdone()
so that the bad packet condition would be noticed.

The fix was tested on the latest compat-wireless-3.5.1-1-snpc.

Signed-off-by: Sergei Poselenov 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville 
Signed-off-by: Ben Hutchings

rt2x00: fix random stalls

2012-03-19T16:02:19+00:00

commit 3780d038fdf4b5ef26ead10b0604ab1f46dd9510 upstream.

Is possible that we stop queue and then do not wake up it again,
especially when packets are transmitted fast. That can be easily
reproduced with modified tx queue entry_num to some small value e.g. 16.

If mac80211 already hold local->queue_stop_reason_lock, then we can wait
on that lock in both rt2x00queue_pause_queue() and
rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock
is possible that __ieee80211_wake_queue() will be performed before
__ieee80211_stop_queue(), hence we stop queue and newer wake up it
again.

Another race condition is possible when between rt2x00queue_threshold()
check and rt2x00queue_pause_queue() we will process all pending tx
buffers on different cpu. This might happen if for example interrupt
will be triggered on cpu performing rt2x00mac_tx().

To prevent race conditions serialize pause/unpause by queue->tx_lock.

Signed-off-by: Stanislaw Gruszka 
Acked-by: Gertjan van Wingerde 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rt2x00: Fix sleep-while-atomic bug in powersaving code.

2011-11-15T15:02:56+00:00

The generic powersaving code that determines after reception of a frame
whether the device should go back to sleep or whether is could stay
awake was calling rt2x00lib_config directly from RX tasklet context.
On a number of the devices this call can actually sleep, due to having
to confirm that the sleeping commands have been executed successfully.

Fix this by moving the call to rt2x00lib_config to a workqueue call.

This fixes bug https://bugzilla.redhat.com/show_bug.cgi?id=731672

Tested-by: Tomas Trnka 
Signed-off-by: Gertjan van Wingerde 
Cc: 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: Introduce sta_add/remove callbacks

2011-09-14T17:56:54+00:00

This implements a basic sta_add and sta_remove callback. Introduce a new
structure rt2x00_sta and ask mac80211 to allocate it as private part of
its ieee80211_sta. rt2x00_sta only contains the WCID for now.

The sta_add callback allows the driver to assign a WCID to a station
that is currently being added. The same wcid is also passed to the
sta_remove callback one mac80211 removes this STA.

Signed-off-by: Helmut Schaa 
Signed-off-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: Move bssidx calculation into its own function

2011-09-14T17:56:53+00:00

This will be used by a later patch. No functional changes.

Signed-off-by: Helmut Schaa 
Signed-off-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: Fix PCI interrupt processing race on SMP systems

2011-08-09T19:52:08+00:00

When toggle_irq is called for PCI devices to disable device interrupts
it used tasklet_disable to wait for a possibly running tasklet to finish.
However, on SMP systems the tasklet might still be scheduled on another CPU.
Instead, use tasklet_kill to ensure that all scheduled tasklets are finished
before returning from toggle_irq.

Furthermore, it was possible that a tasklet reenabled its interrupt even
though interrupts have been disabled already. Fix this by checking the
DEVICE_STATE_ENABLED_RADIO flag before reenabling single interrupts
during tasklet processing.

While at it also enable/kill the TBTT and PRETBTT tasklets in the
toggle_irq callback and only use tasklet_kill in stop_queue to wait
for a currently scheduled beacon update before returning.

Signed-off-by: Helmut Schaa 
Signed-off-by: Ivo van Doorn 
Signed-off-by: John W. Linville

rt2x00: fix possible memory corruption in case of invalid rxdesc.size

2011-06-22T20:09:44+00:00

Sometimes rxdesc descriptor provided by hardware contains invalid
(random) data. For example rxdesc.size can be bigger than actual
size of the buffer. When this happen rt2x00crypto_rx_insert_iv()
corrupt memory doing memmove outside of buffer boundaries.

Signed-off-by: Stanislaw Gruszka 
Acked-by: Ivo van Doorn 
Signed-off-by: John W. Linville