summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless
AgeCommit message (Collapse)Author
2009-12-11Merge branch 'master' of /home/davem/src/GIT/linux-2.6/David S. Miller
Conflicts: include/net/tcp.h
2009-12-10b43: Remove reset after fatal DMA errorLarry Finger
As shown in Kernel Bugzilla #14761, doing a controller restart after a fatal DMA error does not accomplish anything other than consume the CPU on an affected system. Accordingly, substitute a meaningful message for the restart. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@vger.kernel.org> [2.6.32] Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-10rtl8187: add radio led and fix warnings on suspendHerton Ronaldo Krzesinski
Michael Buesch reports that his rtl8187 gives warnings on suspend ("queueing ieee80211 work while going to suspend" warnings), as rtl8187 can call ieee80211_queue_delayed_work after mac80211 is suspended. This change enhances rtl8187 led code so we can avoid queuing work after mac80211 is suspended: now we register a radio led and make additional checks to ensure led is off/on properly as mac80211 wants. Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br> Tested-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@vger.kernel.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-10ath5k: enable EEPROM checksum checkLuis R. Rodriguez
Without this we have no gaurantee of the integrity of the EEPROM and are likely to encounter a lot of bogus bug reports due to actual issues on the EEPROM. With the EEPROM checksum check in place we can easily rule those issues out. If you run patch during a revert *you* have a card with a busted EEPROM and only older kernel will support that concoction. This patch is a trade off between not accepitng bogus EEPROMs and avoiding bogus bug reports allowing developers to focus instead on real concrete issues. If stable keeps bogus bug reports because of a possibly busted EEPROM feel free to apply this there too. Tested on an AR5414 Cc: stable@kernel.org Cc: jirislaby@gmail.com Cc: akpm@linux-foundation.org Cc: rjw@sisk.pl Cc: me@bobcopeland.com Cc: david.quan@atheros.com Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-09Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (42 commits) tree-wide: fix misspelling of "definition" in comments reiserfs: fix misspelling of "journaled" doc: Fix a typo in slub.txt. inotify: remove superfluous return code check hdlc: spelling fix in find_pvc() comment doc: fix regulator docs cut-and-pasteism mtd: Fix comment in Kconfig doc: Fix IRQ chip docs tree-wide: fix assorted typos all over the place drivers/ata/libata-sff.c: comment spelling fixes fix typos/grammos in Documentation/edac.txt sysctl: add missing comments fs/debugfs/inode.c: fix comment typos sgivwfb: Make use of ARRAY_SIZE. sky2: fix sky2_link_down copy/paste comment error tree-wide: fix typos "couter" -> "counter" tree-wide: fix typos "offest" -> "offset" fix kerneldoc for set_irq_msi() spidev: fix double "of of" in comment comment typo fix: sybsystem -> subsystem ...
2009-12-07ath5k: add support for Dell Vostro A860 LEDShahar Or
Adds support for the WiFi activity LED on the Dell Vostro A860 laptop. Signed-off-by: Shahar Or <shahar@shahar-or.co.il> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07orinoco: remove spare KERN_DEBUGDavid Kilroy
A KERN_DEBUG didn't get removed when transitioning from printk to pr_debug Signed-off-by: David Kilroy <kilroyd@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07rtl8187: Fix wrong rfkill switch mask for some modelsLarry Finger
There are different bits used to convey the setting of the rfkill switch to the driver. The current driver only supports one of these possibilities. These changes were derived from the latest version of the vendor driver. This patch fixes the regression noted in kernel Bugzilla #14743. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Reported-and-tested-by: Antti Kaijanmäki <antti@kaijanmaki.net> Tested-by: Hin-Tak Leung <hintak.leung@gmail.com> Cc: Stable <stable@kernel.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07ath9k: fix tx status reportingFelix Fietkau
This patch fixes a bug in ath9k's tx status check, which caused mac80211 to consider regularly transmitted unicast frames as un-acked. When checking the ts_status field for errors, it needs to be masked with ATH9K_TXERR_FILT, because this field also contains other fields like ATH9K_TX_ACKED. Without this patch, AP mode is pretty much unusable, as hostapd checks the ACK status for the frames that it injects. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: don't complain about oversized beacons in FINALIZE_JOINLennert Buytenhek
The FINALIZE_JOIN firmware command only looks at the first couple of fields in the beacon, and therefore it's not necessary to complain if the beacon is longer than 128 bytes. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: don't overwrite mwl8k_vif::bssid until after disassociationLennert Buytenhek
When disassociating, mac80211 zeroes vif->bss_info.bssid before calling our ->bss_info_changed(), but we need the BSSID to remove the hardware station database entry for our AP, so we can't clear our local copy of the BSSID until after we've done that. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: struct ieee80211_rx_status::qual is deprecatedLennert Buytenhek
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: don't forget to call pci_disable_device()Lennert Buytenhek
Don't forget to call pci_disable_device() if pci_request_regions() fails during probe. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: increase firmware loading timeoutsLennert Buytenhek
The time between loading the helper image and starting to upload the main firmware image should be at least 5 ms or so. We were doing an msleep(1) before, and 1 ms appears to not be enough in almost all cases, but building with HZ=100 has always masked this so far. Bumping the msleep argument to 5 fixes firmware loading e.g. when HZ=1000. Some firmware images need more than 200ms to initialize. Bump the ready code timeout to 500ms to accommodate for this. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: allow more time for transmit rings to drainLennert Buytenhek
Before issuing any firmware commands, we wait for the transmit rings to drain, to prevent control versus data path synchronization issues. In some cases, this can end up taking longer than the current hardcoded limit of 5 seconds, for example if the transmit rings are filled with packets for a host that has dropped off the air and we end up retransmitting every pending packet at the lowest rate a couple of times. This patch changes mwl8k_tx_wait_empty() to only bail out on timeout expiry if there was no change in the number of packets pending in the transmit rings during the waiting period. If at least one transmit ring entry was reclaimed while we were waiting, we are apparently still making progress, and we'll allow waiting for another timeout period. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: allow more time for firmware commands to completeLennert Buytenhek
Some firmware commands can under some circumstances take more than 2 seconds to complete. This patch bumps the timeout up to 10 seconds, and prints a message whenever a command takes more than 2 seconds. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: properly report rate on received 40MHz packetsLennert Buytenhek
On 8366, bit 6 in the rx descriptor rate field indicates whether the packet was received on a 20MHz or 40MHz channel, and is not part of the MCS index. Handle this properly, which then prevents hitting the WARN_ON and being dropped in ieee80211_rx(). Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: fix addr4 zeroing and payload overwrite on DMA header creationLennert Buytenhek
When inserting a DMA header into a packet for transmission, mwl8k_add_dma_header() would blindly zero the addr4 field, which is not a good idea if the packet being transmitted is actually a 4-address packet. Also, if the transmitted packet was a 4-address with QoS packet, the memmove() to do the needed header reshuffling would inadvertently overwrite the first two bytes of the packet payload with the QoS field. This fixes both of these issues. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: prevent corruption of QoS field on receiveLennert Buytenhek
Packets exchanged between the mwl8k driver and the firmware always have a 4-address header without QoS field. For QoS packets, the QoS field is passed to/from the firmware via the tx/rx descriptors. We were handling this correctly on transmit, but not on receive -- if a QoS packet was received, we would leave garbage in the QoS field in the packet passed up to the stack, which is Bad(tm). Also, if the packet received on the air was a 4-address without QoS packet, we would forget to skb_pull the 2-byte DMA length prefix off. This patch adds an argument to the ->rxd_process() receive descriptor operation to retrieve the QoS field from the receive descriptor, and extends mwl8k_remove_dma_header() to insert this field back into the packet if the packet received is a QoS packet. It also fixes mwl8k_remove_dma_header() to strip off the length prefix in all cases. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: fix UPDATE_STADB command struct legacy_rates array lengthLennert Buytenhek
There exist 12 802.11b/g rates, but mwl8k supports two additional (non-standard) rates, and includes those rates in rate bitmasks and in its internal rate table that hardware rate indices index. Commit "mwl8k: report rate and other information for received frames" added one of the nonstandard rates to the mwl8k_rates table to make the OFDM rates in the table line up with the rate indices that are reported in the receive descriptor (so that we can just simply copy the receive descriptor rate index into ieee80211_rx_status::rate_idx) and bumped MWL8K_IEEE_LEGACY_DATA_RATES from 12 to 13, but this screwed up the UPDATE_STADB command struct layout, as it also uses that define, for its legacy_rates array. To avoid having to convert rate indices and legacy rate bitmaps (e.g. ieee80211_bss_conf::basic_rates) between the 12-rate mac80211 format and the 14-rate mwl8k format, we'll report all 14 rates in our wiphy's band, but filter out the nonstandard ones e.g. in the case of the UPDATE_STADB command which only accepts 12 rates. In the commands that accept 14 rates (SET_AID, SET_RATE), replace the use of the MWL8K_RATE_INDEX_MAX_ARRAY define in the command struct by the constant 14, to make it clearer that these commands accept 14 rates. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07mwl8k: fix MCS bitmap size in SET_RATE commandLennert Buytenhek
The MCS bitmaps in the SET_RATE command structure were of the wrong size, due to use of the wrong define for the array length. Just hardcode the lengths as 16, and do the same for the MCS bitmaps in other command structures. Signed-off-by: Lennert Buytenhek <buytenh@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07wl1251: don't build null data template in wl1251_op_config()Kalle Valo
The bssid can be zero when null data template is set in wl1251_op_config(). It's enough, and especially safe, to set it once after association. Signed-off-by: Kalle Valo <kalle.valo@nokia.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07wl1251: fix bssid handlingKalle Valo
bssid needs to be copied first in wl1251_op_bss_info_changed(), otherwise templates will have incorrect bssid and power save will not work correctly. Signed-off-by: Kalle Valo <kalle.valo@nokia.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07wl1251: remove false warning messagesKalle Valo
There was a warning from wl1251_op_bss_info_changed(): wl1251: WARNING Set ctsprotect failed 0 It was printed always, it's completely false and can be removed. Signed-off-by: Kalle Valo <kalle.valo@nokia.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07iwlwifi: fix warning from ieee80211_stop_tx_ba_cb_irqsafe argument changeJohn W. Linville
CC [M] drivers/net/wireless/iwlwifi/iwl-tx.o drivers/net/wireless/iwlwifi/iwl-tx.c: In function ‘iwl_tx_agg_stop’: drivers/net/wireless/iwlwifi/iwl-tx.c:1356: warning: passing argument 1 of ‘ieee80211_stop_tx_ba_cb_irqsafe’ from incompatible pointer type include/net/mac80211.h:2128: note: expected ‘struct ieee80211_vif *’ but argument is of type ‘struct ieee80211_hw *’ Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-07Merge branch 'for-next' into for-linusJiri Kosina
Conflicts: kernel/irq/chip.c
2009-12-05Merge branch 'master' of /home/davem/src/GIT/linux-2.6/David S. Miller
Conflicts: drivers/net/pcmcia/fmvj18x_cs.c drivers/net/pcmcia/nmclan_cs.c drivers/net/pcmcia/xirc2ps_cs.c drivers/net/wireless/ray_cs.c
2009-12-05Merge git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: (50 commits) pcmcia: rework the irq_req_t typedef pcmcia: remove deprecated handle_to_dev() macro pcmcia: pcmcia_request_window() doesn't need a pointer to a pointer pcmcia: remove unused "window_t" typedef pcmcia: move some window-related code to pcmcia_ioctl.c pcmcia: Change window_handle_t logic to unsigned long pcmcia: Pass struct pcmcia_socket to pcmcia_get_mem_page() pcmcia: Pass struct pcmcia_device to pcmcia_map_mem_page() pcmcia: Pass struct pcmcia_device to pcmcia_release_window() drivers/pcmcia: remove unnecessary kzalloc pcmcia: correct handling for Zoomed Video registers in topic.h pcmcia: fix printk formats pcmcia: autoload module pcmcia pcmcia/staging: update comedi drivers PCMCIA: stop duplicating pci_irq in soc_pcmcia_socket PCMCIA: ss: allow PCI IRQs > 255 PCMCIA: soc_common: remove 'dev' member from soc_pcmcia_socket PCMCIA: soc_common: constify soc_pcmcia_socket ops member PCMCIA: sa1111: remove duplicated initializers PCMCIA: sa1111: wrap soc_pcmcia_socket to contain sa1111 specific data ...
2009-12-04tree-wide: fix misspelling of "definition" in commentsAdam Buchbinder
"Definition" is misspelled "defintion" in several comments; this patch fixes them. No code changes. Signed-off-by: Adam Buchbinder <adam.buchbinder@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-12-04Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6
2009-12-04iwmc3200wifi: Enable wimax core through module parameterSamuel Ortiz
When debugging the wifi firmware, we need to disable the wimax core to gain some memory space. The default value will keep the wimax core enabled. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04iwmc3200wifi: Add wifi-wimax coexistence mode as a module parameterSamuel Ortiz
Wifi and wimax coexistence mode is set by wifi at boot time. There can be several modes, defined by priority tables. User space components can decide which one to select by writing to /sys/module/iwmc3200wifi/parameters/wiwi with this patch, before bringing the interface up. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04iwmc3200wifi: Coex table command does not expect a responseSamuel Ortiz
When sending the wiwi coexistence priority table, we should not tell the LMAC that we want a response. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04iwmc3200wifi: Update wiwi priority tableSamuel Ortiz
This update follows the firmware engineers recommendations. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04iwlwifi: driver version track kernel versionReinette Chatre
The driver version number is a remnant from when there was an out-of-tree iwlwifi driver. Now that the driver forms part of kernel source we do not need a separate driver version. Instead, we now use the kernel version as driver version. We maintain the previous tags used to indicate which components the driver has been compiled with. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Acked-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04iwlwifi: indicate uCode type when fail dump error/event logWey-Yi Guy
error_event_table_ptr is only set upon receipt of REPLY_ALIVE. Until then both event log and error log will fail. Add information to indicate which uCode encounter the failure case. Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04iwl3945: remove duplicated event logging codeWey-Yi Guy
In the process of improving uCode event logging capability, the new implementation was introduced without removing the existing implementation. The event log will be dumped to dmesg twice. Remove the old implementation to only log the event once upon sys assert or request by user. Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04b43: fix two warningsJohannes Berg
My gcc appears to be able to see past the function boundary and notices that the variable 'behaviour' could be used uninitialised: drivers/net/wireless/b43/leds.c: In function ‘b43_leds_register’: drivers/net/wireless/b43/leds.c:339: warning: ‘behaviour’ may be used uninitialized in this function drivers/net/wireless/b43/leds.c: In function ‘b43_leds_init’: drivers/net/wireless/b43/leds.c:262: warning: ‘behaviour’ may be used uninitialized in this function because b43_led_get_sprominfo() didn't initialise it in all cases. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04ipw2100: fix rebooting hang with driver loadedZhu Yi
Add PCI .shutdown method so that we can disable the device during shutdown or reboot. Without this, the reboot doesn't work well on some platforms. This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2124 Tested-by: pablo <pablolm2005@gmail.com> Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04iwmc3200wifi: fix NULL pointer dereference in pmkid updateZhu Yi
When handling IWM_CMD_PMKID_FLUSH command, the bssid and pmkid in pmksa are all NULL. Check it before memcpy. Signed-off-by: Zhu Yi <yi.zhu@intel.com> Acked-by: Samuel Ortiz <sameo@linux.intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04ath9k: enable 2GHz band only if the device supports itGabor Juhos
Currently, the 2GHz band is enabled unconditionally, even if the device does not support it. Changes-licensed-under: ISC Signed-off-by: Gabor Juhos <juhosg@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04airo: Fix integer overflow warningMichael Buesch
On BigEndian gcc complains: drivers/net/wireless/airo.c: In function ‘sniffing_mode’: drivers/net/wireless/airo.c:4809: warning: integer overflow in expression Fix this by doing the bitwise AND on the host-endian value. Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04rt2x00: Fix padding bug on L2PAD devices.Gertjan van Wingerde
While reviewing the l2pad function to align both the header and the payload on a DMA-capable boundary a bug was discovered where the payload would not be properly aligned. The header_align value was used where the payload_align value should have been used. Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04b43legacy: avoid PPC fault during resumeLarry Finger
For PPC architecture with PHY Revision < 3, a read of the register B43_MMIO_HWENABLED_LO will cause a CPU fault unless b43legacy_status() returns a value of 2 (B43legacy_STAT_STARTED); however, one finds that the driver is unable to associate after resuming from hibernation unless this routine returns 1. To satisfy both conditions, the routine is rewritten to return TRUE whenever b43legacy_status() returns a value < 2. This patch fixes the second problem listed in the postings for Red Hat Bugzilla #538523. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Stable <stable@vger.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04b43: avoid PPC fault during resumeLarry Finger
The routine b43_is_hw_radio_enabled() has long been a problem. For PPC architecture with PHY Revision < 3, a read of the register B43_MMIO_HWENABLED_LO will cause a CPU fault unless b43_status() returns a value of 2 (B43_STAT_STARTED) (BUG 14181). Fixing that results in Bug 14538 in which the driver is unable to reassociate after resuming from hibernation because b43_status() returns 0. The correct fix would be to determine why the status is 0; however, I have not yet found why that happens. The correct value is found for my device, which has PHY revision >= 3. Returning TRUE when the PHY revision < 3 and b43_status() returns 0 fixes the regression for 2.6.32. This patch fixes the problem in Red Hat Bugzilla #538523. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Tested-by: Christian Casteyde <casteyde.christian@free.fr> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-12-04tree-wide: fix assorted typos all over the placeAndré Goddard Rosa
That is "success", "unknown", "through", "performance", "[re|un]mapping" , "access", "default", "reasonable", "[con]currently", "temperature" , "channel", "[un]used", "application", "example","hierarchy", "therefore" , "[over|under]flow", "contiguous", "threshold", "enough" and others. Signed-off-by: André Goddard Rosa <andre.goddard@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-12-04tree-wide: fix typos "offest" -> "offset"Uwe Kleine-König
This patch was generated by git grep -E -i -l 'offest' | xargs -r perl -p -i -e 's/offest/offset/' Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-12-04tree-wide: fix some typos and punctuation in commentsThadeu Lima de Souza Cascardo
fix some typos and punctuation in comments Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2009-12-01Merge branch 'master' of ↵David S. Miller
master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 Conflicts: net/mac80211/ht.c
2009-11-30mac80211: fix spurious delBA handlingJohannes Berg
Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was commit d75636ef9c1af224f1097941879d5a8db7cd04e5 Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Feb 10 21:25:53 2009 +0100 mac80211: RX aggregation: clean up stop session and other parts were already present in the original commit d92684e66091c0f0101819619b315b4bb8b5bcc5 Author: Ron Rindjunsky <ron.rindjunsky@intel.com> Date: Mon Jan 28 14:07:22 2008 +0200 mac80211: A-MPDU Tx add delBA from recipient support The first problem is that I moved a BUG_ON before various checks -- thereby making it possible to hit. As the comment indicates, the BUG_ON can be removed since the ampdu_action callback must already exist when the state is != IDLE. The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARN_ON may happen with non-HT drivers, while the race opens only for HT drivers. For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock 2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already. Reported-by: Lennert Buytenhek <buytenh@marvell.com> Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>