]>
Commit | Line | Data |
---|---|---|
c06f7f46 GKH |
1 | From 8ab2cd09fecc8819bbaee2d0fd8f3a092d866ce3 Mon Sep 17 00:00:00 2001 |
2 | From: Luis R. Rodriguez <lrodriguez@atheros.com> | |
3 | Date: Thu, 16 Sep 2010 15:12:26 -0400 | |
4 | Subject: ath9k: fix power save race conditions | |
5 | ||
6 | From: Luis R. Rodriguez <lrodriguez@atheros.com> | |
7 | ||
8 | commit 8ab2cd09fecc8819bbaee2d0fd8f3a092d866ce3 upstream. | |
9 | ||
10 | ath9k has a race on putting the chip into network sleep and | |
11 | having registers read from hardware. The race occurs because | |
12 | although ath9k_ps_restore() locks its own callers it makes use | |
13 | of some variables which get altered in the driver at different | |
14 | code paths. The variables are the ps_enabled and ps_flags. | |
15 | ||
16 | This is easily reprodicible in large network environments when | |
17 | roaming with the wpa_supplicant simple bgscan. You'd get some | |
18 | 0xdeadbeef read out on certain registers such as: | |
19 | ||
20 | ath: timeout (100000 us) on reg 0x806c: 0xdeadbeef & 0x01f00000 != 0x00000000 | |
21 | ath: RX failed to go idle in 10 ms RXSM=0xdeadbeef | |
22 | ||
23 | ath: timeout (100000 us) on reg 0x7000: 0xdeadbeef & 0x00000003 != 0x00000000 | |
24 | ath: Chip reset failed | |
25 | ||
26 | The fix is to protect the ath9k_config(hw, IEEE80211_CONF_CHANGE_PS) | |
27 | calls with a spin_lock_irqsave() which will disable contendors for | |
28 | these variables from interrupt context, timers, re-entry from mac80211 | |
29 | on the same callback, and most importantly from ath9k_ps_restore() | |
30 | which is the only call which will put the device into network sleep. | |
31 | ||
32 | There are quite a few threads and bug reports on these a few of them are: | |
33 | ||
34 | https://bugs.launchpad.net/ubuntu/karmic/+source/linux/+bug/407040 | |
35 | http://code.google.com/p/chromium-os/issues/detail?id=5709 | |
36 | http://code.google.com/p/chromium-os/issues/detail?id=5943 | |
37 | ||
38 | Stable fixes apply to [2.6.32+] | |
39 | ||
40 | Cc: Paul Stewart <pstew@google.com> | |
41 | Cc: Amod Bodas <amod.bodas@atheros.com> | |
42 | Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> | |
43 | Signed-off-by: John W. Linville <linville@tuxdriver.com> | |
44 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
45 | ||
46 | --- | |
47 | drivers/net/wireless/ath/ath9k/main.c | 5 ++++- | |
48 | drivers/net/wireless/ath/ath9k/recv.c | 3 +++ | |
49 | 2 files changed, 7 insertions(+), 1 deletion(-) | |
50 | ||
51 | --- a/drivers/net/wireless/ath/ath9k/main.c | |
52 | +++ b/drivers/net/wireless/ath/ath9k/main.c | |
53 | @@ -1558,6 +1558,8 @@ static int ath9k_config(struct ieee80211 | |
54 | * IEEE80211_CONF_CHANGE_PS is only passed by mac80211 for STA mode. | |
55 | */ | |
56 | if (changed & IEEE80211_CONF_CHANGE_PS) { | |
57 | + unsigned long flags; | |
58 | + spin_lock_irqsave(&sc->sc_pm_lock, flags); | |
59 | if (conf->flags & IEEE80211_CONF_PS) { | |
60 | sc->ps_flags |= PS_ENABLED; | |
61 | /* | |
62 | @@ -1572,7 +1574,7 @@ static int ath9k_config(struct ieee80211 | |
63 | sc->ps_enabled = false; | |
64 | sc->ps_flags &= ~(PS_ENABLED | | |
65 | PS_NULLFUNC_COMPLETED); | |
66 | - ath9k_setpower(sc, ATH9K_PM_AWAKE); | |
67 | + ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE); | |
68 | if (!(ah->caps.hw_caps & | |
69 | ATH9K_HW_CAP_AUTOSLEEP)) { | |
70 | ath9k_hw_setrxabort(sc->sc_ah, 0); | |
71 | @@ -1587,6 +1589,7 @@ static int ath9k_config(struct ieee80211 | |
72 | } | |
73 | } | |
74 | } | |
75 | + spin_unlock_irqrestore(&sc->sc_pm_lock, flags); | |
76 | } | |
77 | ||
78 | if (changed & IEEE80211_CONF_CHANGE_MONITOR) { | |
79 | --- a/drivers/net/wireless/ath/ath9k/recv.c | |
80 | +++ b/drivers/net/wireless/ath/ath9k/recv.c | |
81 | @@ -1096,6 +1096,7 @@ int ath_rx_tasklet(struct ath_softc *sc, | |
82 | u8 rx_status_len = ah->caps.rx_status_len; | |
83 | u64 tsf = 0; | |
84 | u32 tsf_lower = 0; | |
85 | + unsigned long flags; | |
86 | ||
87 | if (edma) | |
88 | dma_type = DMA_BIDIRECTIONAL; | |
89 | @@ -1204,11 +1205,13 @@ int ath_rx_tasklet(struct ath_softc *sc, | |
90 | sc->rx.rxotherant = 0; | |
91 | } | |
92 | ||
93 | + spin_lock_irqsave(&sc->sc_pm_lock, flags); | |
94 | if (unlikely(ath9k_check_auto_sleep(sc) || | |
95 | (sc->ps_flags & (PS_WAIT_FOR_BEACON | | |
96 | PS_WAIT_FOR_CAB | | |
97 | PS_WAIT_FOR_PSPOLL_DATA)))) | |
98 | ath_rx_ps(sc, skb); | |
99 | + spin_unlock_irqrestore(&sc->sc_pm_lock, flags); | |
100 | ||
101 | ath_rx_send_to_mac80211(hw, sc, skb, rxs); | |
102 |