linux-hardened/drivers/net/wireless/brcm80211
Arend van Spriel 0e33e48ddc brcmsmac: fix tx status processing
This issue was reported on the wireless list (see [1]) in which
brcmsmac ran into a fatal error:

[  588.284074] brcmsmac bcma0:0: frameid != txh->TxFrameID
[  588.284098] brcmsmac bcma0:0: MI_TFS: fatal
[  588.284103] brcmsmac bcma0:0: wl0: fatal error, reinitializing
[  588.286208] ieee80211 phy0: Hardware restart was requested

The tx status feedback is processed in a loop limiting the number of
frames processed in one run. The code terminate processing when the
limit is reached regardless the txstatus value read from the device
register. When that status is is flagged as being valid it must be
processed as the hardware will clear it after is has been read.

Bisecting was done by Seth Forshee and showed following commit as the
culprit:

commit 57fe504817
Author: Piotr Haber <phaber@broadcom.com>
Date:   Wed Nov 28 21:44:07 2012 +0100

    brcmsmac: fix bounds checking in tx/rx

[1] http://www.spinics.net/lists/linux-wireless/msg101293.html

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Seth Forshee <seth.forshee@canonical.com>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-01-28 14:48:52 -05:00
..
brcmfmac brcmfmac: fix parsing rsn ie for ap mode. 2013-01-02 14:38:38 -05:00
brcmsmac brcmsmac: fix tx status processing 2013-01-28 14:48:52 -05:00
brcmutil brcm80211: brcmu_pkt_buf_free_skb() should handle NULL 2012-06-05 15:23:20 -04:00
include brcmsmac: Add brcms_dbg_ht() debug macro 2012-11-20 14:07:25 -05:00
Kconfig brcm80211: Allow trace support to be enabled separately from debug 2012-11-20 14:05:22 -05:00
Makefile brcm80211: Use normal DEBUG define 2012-01-24 14:21:13 -05:00