linux-stable.git/drivers/net/wireless, branch v3.8.1

p54usb: corrected USB ID for T-Com Sinus 154 data II

2013-02-28T13:38:32+00:00

commit 008e33f733ca51acb2dd9d88ea878693b04d1d2a upstream.

Corrected USB ID for T-Com Sinus 154 data II. ISL3887-based. The
device was tested in managed mode with no security, WEP 128
bit and WPA-PSK (TKIP) with firmware 2.13.1.0.lm87.arm (md5sum:
7d676323ac60d6e1a3b6d61e8c528248). It works.

Signed-off-by: Tomasz Guszkowski 
Acked-By: Christian Lamparter 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: usb: allocate URB control message setup_packet and data buffer separately

2013-02-28T13:38:30+00:00

commit bc6b89237acb3dee6af6e64e51a18255fef89cc2 upstream.

rtlwifi allocates both setup_packet and data buffer of control message urb,
using shared kmalloc in _usbctrl_vendorreq_async_write. Structure used for
allocating is:
	struct {
		u8 data[254];
		struct usb_ctrlrequest dr;
	};

Because 'struct usb_ctrlrequest' is __packed, setup packet is unaligned and
DMA mapping of both 'data' and 'dr' confuses ARM/sunxi, leading to memory
corruptions and freezes.

Patch changes setup packet to be allocated separately.

[v2]:
 - Use WARN_ON_ONCE instead of WARN_ON

Signed-off-by: Jussi Kivilinna 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: rtl8192cu: Add new USB ID

2013-02-28T13:38:30+00:00

commit 8708aac79e4572ba673d7a21e94ddca9f3abb7fc upstream.

A new model of the RTL8188CUS has appeared.

Reported-and-tested-by: Thomas Rosenkrantz 
Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

rtlwifi: rtl8192cu: Fix NULL dereference BUG when using new_id

2013-02-28T13:38:30+00:00

commit 957f4aca5fa0db69635271bc4621cc0b65b2d590 upstream.

When the new_id entry in /sysfs is used for a foreign USB device, rtlwifi
BUGS with a NULL pointer dereference because the per-driver configuration
data is not available. The probe function has been restructured as
suggested by Ben Hutchings .

Signed-off-by: Larry Finger 
Signed-off-by: John W. Linville 
Signed-off-by: Greg Kroah-Hartman

b43: Increase number of RX DMA slots

2013-02-28T13:38:30+00:00

commit ccae0e50c16a7f7adb029c169147400d1ce9f703 upstream.

Bastian Bittorf reported that some of the silent freezes on a Linksys WRT54G
were due to overflow of the RX DMA ring buffer, which was created with 64
slots. That finding reminded me that I was seeing similar crashed on a netbook,
which also has a relatively slow processor. After increasing the number of
slots to 128, runs on the netbook that previously failed now worked; however,
I found that 109 slots had been used in one test. For that reason, the number
of slots is being increased to 256.

Signed-off-by: Larry Finger 
Cc: Bastian Bittorf 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

2013-02-12T15:41:46+00:00

mwl8k: fix band for supported channels

2013-02-11T19:31:36+00:00

The band field for the supported channels were left unpopulated, making
them default to 0 == IEEE80211_BAND_2GHZ, even for the 5GHz channels.

This resulted in null pointer accesses if anything tries to access
wiphy->bands[channel->band] of a 5GHz channel on 5GHz only cards, since
wiphy->bands[2GHZ] is NULL for them (e.g. cfg80211_chandef_usable does).

Example kernel OOPS:

[  665.669993] Unable to handle kernel NULL pointer dereference at virtual address 00000016
[  665.678194] pgd = c6d58000
[  665.680941] [00000016] *pgd=06f8a831, *pte=00000000, *ppte=00000000
[  665.687303] Internal error: Oops: 17 [#1]
(...)
[  666.116373] Backtrace:
[  666.118866] [] (cfg80211_chandef_usable+0x0/0x1bc [cfg80211]) from [] (nl80211_leave_mesh+0x244/0x264 [cfg80211])
[  666.130919]  r7:c6d12100 r6:0000143c r5:c0611c48 r4:c0611b98
[  666.136668] [] (nl80211_leave_mesh+0x164/0x264 [cfg80211]) from [] (nl80211_remain_on_channel+0x2a0/0x358 [cfg80211])
[  666.149074]  r7:c6d12000 r6:c6d12000 r5:c6f4f368 r4:00000003
[  666.154814] [] (nl80211_remain_on_channel+0x240/0x358 [cfg80211]) from [] (nl80211_set_wiphy+0x264/0x560 [cfg80211])
[  666.167150] [] (nl80211_set_wiphy+0x0/0x560 [cfg80211]) from [] (genl_rcv_msg+0x1b8/0x1f8)
[  666.177205] [] (genl_rcv_msg+0x0/0x1f8) from [] (netlink_rcv_skb+0x58/0xb4)
[  666.185949] [] (netlink_rcv_skb+0x0/0xb4) from [] (genl_rcv+0x20/0x2c)
[  666.194251]  r6:c6f70780 r5:0000002c r4:c6f70780 r3:00000001
[  666.199973] [] (genl_rcv+0x0/0x2c) from [] (netlink_unicast+0x154/0x1f4)
[  666.208449]  r4:c785ea00 r3:c01f92fc
[  666.212057] [] (netlink_unicast+0x0/0x1f4) from [] (netlink_sendmsg+0x230/0x2b0)
[  666.221240] [] (netlink_sendmsg+0x0/0x2b0) from [] (sock_sendmsg+0x90/0xa4)
[  666.229986] [] (sock_sendmsg+0x0/0xa4) from [] (__sys_sendmsg+0x290/0x298)
[  666.238637]  r9:00000000 r8:c0611ec8 r6:0000002c r5:c0610000 r4:c0611f64
[  666.245411] [] (__sys_sendmsg+0x0/0x298) from [] (sys_sendmsg+0x44/0x6c)
[  666.253897] [] (sys_sendmsg+0x0/0x6c) from [] (ret_fast_syscall+0x0/0x2c)
[  666.262460]  r6:00000000 r5:beeff96c r4:00000005

Signed-off-by: Jonas Gorski 
Signed-off-by: John W. Linville

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

2013-02-06T18:55:44+00:00

brcmsmac: rework of mac80211 .flush() callback operation

2013-02-04T21:46:28+00:00

This patch addresses a long standing issue of the driver with the
mac80211 .flush() callback. Since implementing the .flush() callback
a number of issues have been fixed, but a WARN_ON_ONCE() was still
triggered because the timeout on the flush could still occur.

This patch changes the awkward design using msleep() into one using
a waitqueue. The waiting flush() context will kick the transmit dma
when it is idle and the timeout used waiting for the event is set
to 500 ms. Worst case there can be 64 frames outstanding for transmit
in the driver. At a rate of 1Mbps that would take 1.5 seconds assuming
MTU is 1500 bytes and ignoring retries. The WARN_ON_ONCE() is also
removed as this was put in to indicate the flush timeout as a reason
for the driver to stall. That was not happening since fixing endless
AMPDU retries with following upstream commit:

commit 85091fc0a75653e239dc8379658515e577544927
Author: Arend van Spriel 
Date:   Thu Feb 23 18:38:22 2012 +0100

    brcm80211: smac: fix endless retry of A-MPDU transmissions

bugzilla: 42840 
bugzilla@redhat: 
bugzilla@redhat: 

Cc: Jonathan Nieder 
Cc: Stanislaw Gruszka 
Cc: Camaleón 
Cc: Milan Bouchet-Valat 
Cc: Seth Forshee 
Reviewed-by: Pieter-Paul Giesberts 
Reviewed-by: Hante Meuleman 
Reviewed-by: Piotr Haber 
Signed-off-by: Arend van Spriel 
Acked-by: Seth Forshee 
Signed-off-by: John W. Linville

rtlwifi: Fix scheduling while atomic bug

2013-02-04T21:41:56+00:00

Kernel commits 41affd5 and 6539306 changed the locking in rtl_lps_leave()
from a spinlock to a mutex by doing the calls indirectly from a work queue
to reduce the time that interrupts were disabled. This change was fine for
most systems; however a scheduling while atomic bug was reported in
https://bugzilla.redhat.com/show_bug.cgi?id=903881. The backtrace indicates
that routine rtl_is_special(), which calls rtl_lps_leave() in three places
was entered in atomic context. These direct calls are replaced by putting a
request on the appropriate work queue.

Signed-off-by: Larry Finger 
Reported-and-tested-by: Nathaniel Doherty 
Cc: Nathaniel Doherty 
Cc: Stanislaw Gruszka 
Cc: Stable 
Signed-off-by: John W. Linville