From 75e07fc3d87ba9b3255e1fcd735186a533ea0754 Mon Sep 17 00:00:00 2001 From: Andreas Petlund Date: Thu, 20 Nov 2008 20:42:25 -0800 Subject: [PATCH 01/24] pci: Added quirk to disable msi for MCP55 NIC on Asus P5N32-SLI Premium Signed-off-by: Andreas Petlund Signed-off-by: David S. Miller --- drivers/pci/quirks.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 5049a47030ac..5f4f85f56cb7 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -22,6 +22,7 @@ #include #include #include +#include #include "pci.h" int isa_dma_bridge_buggy; @@ -1828,6 +1829,22 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT1000_PXB, ht_enable_msi_mapping); +/* The P5N32-SLI Premium motherboard from Asus has a problem with msi + * for the MCP55 NIC. It is not yet determined whether the msi problem + * also affects other devices. As for now, turn off msi for this device. + */ +static void __devinit nvenet_msi_disable(struct pci_dev *dev) +{ + if (dmi_name_in_vendors("P5N32-SLI PREMIUM")) { + dev_info(&dev->dev, + "Disabling msi for MCP55 NIC on P5N32-SLI Premium\n"); + dev->no_msi = 1; + } +} +DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, + PCI_DEVICE_ID_NVIDIA_NVENET_15, + nvenet_msi_disable); + static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev) { struct pci_dev *host_bridge; From 6436cbcd735a11fc93bf3353c68914bc545e6d1e Mon Sep 17 00:00:00 2001 From: Giuseppe Cavallaro Date: Thu, 20 Nov 2008 20:43:18 -0800 Subject: [PATCH 02/24] phy: fix phy_id detection also for broken hardware. This patch fixes the case when the phy_ids is mostly Fs and in some case 0x0 due to broken hardware. Signed-off-by: Giuseppe Cavallaro Signed-off-by: David S. Miller --- drivers/net/phy/phy_device.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 55bc24b234e3..25acbbde4a60 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -227,8 +227,17 @@ struct phy_device * get_phy_device(struct mii_bus *bus, int addr) if (r) return ERR_PTR(r); - /* If the phy_id is all Fs or all 0s, there is no device there */ - if ((0xffff == phy_id) || (0x00 == phy_id)) + /* If the phy_id is mostly Fs, there is no device there */ + if ((phy_id & 0x1fffffff) == 0x1fffffff) + return NULL; + + /* + * Broken hardware is sometimes missing the pull down resistor on the + * MDIO line, which results in reads to non-existent devices returning + * 0 rather than 0xffff. Catch this here and treat 0 as a non-existent + * device as well. + */ + if (phy_id == 0) return NULL; dev = phy_device_create(bus, addr, phy_id); From 208fbec5bec1de4fce48aab41efde11ba25ab04c Mon Sep 17 00:00:00 2001 From: Cord Walter Date: Thu, 20 Nov 2008 13:46:57 +0000 Subject: [PATCH 03/24] axnet_cs / pcnet_cs: moving PCMCIA_DEVICE_PROD_ID for Netgear FA411 Hi, after noticing that my Netgear FA411 (PCMCIA-NIC) [1] stopped working with the release of the 2.6.25 kernel (sidux-version), I checked the respective driver sources and noticed that the pcnet_cs driver bailed out with "use axnet_cs instead" for the Netgear FA411, but axnet_cs doesn't claim this ID. I compiled a kernel with the PCMCIA-ID for the netgear card moved to axnet_cs from pcnet_cs which worked. I then contacted sidux-kernel maintainer Stefan Lippers-Hollmann who turned the info into this patch and integrated it into the kernel: This works for me and AFAIK there were no reports of any breakage for other devices on sidux-support. This looks like a trivial patch, but since I have very limited experience with kernel modifications I might be woefully wrong there. But if there are no side effects of this patch, is it possible to get it into the official kernel? I can provide more detailed information on the affected hardware if necessary. -cord [1] Socket 1 Device 0: [axnet_cs] (bus ID: 1.0) Configuration: state: on Product Name: NETGEAR FA411 Fast Ethernet Identification: manf_id: 0x0149 card_id: 0x0411 function: 6 (network) prod_id(1): "NETGEAR" (0x9aa79dc3) prod_id(2): "FA411" (0x40fad875) prod_id(3): "Fast Ethernet" (0xb4be14e3) prod_id(4): --- (---) From: Stefan Lippers-Hollmann Date: Sat, 1 Nov 2008 23:53:04 +0000 Subject: PCMCIA: move PCMCIA ID for Netgear FA411 from pcnet_cs to axnet_cs: Since kernel 2.6.25, commit 61da96be07ec860e260ca4af0199b9d48d000b80 (pcnet_cs: if AX88190-based card, printk "use axnet_cs instead" message.), pcnet_cs bails out with "use axnet_cs instead" for the Netgear FA411, but axnet_cs doesn't claim this ID. Socket 1 Device 0: [axnet_cs] (bus ID: 1.0) Configuration: state: on Product Name: NETGEAR FA411 Fast Ethernet Identification: manf_id: 0x0149 card_id: 0x0411 function: 6 (network) prod_id(1): "NETGEAR" (0x9aa79dc3) prod_id(2): "FA411" (0x40fad875) prod_id(3): "Fast Ethernet" (0xb4be14e3) prod_id(4): --- (---) Cc: stable [2.6.25, 2.6.26, 2.6.27] Signed-off-by: Stefan Lippers-Hollmann Signed-off-by: Cord Walter Signed-off-by: David S. Miller --- drivers/net/pcmcia/axnet_cs.c | 1 + drivers/net/pcmcia/pcnet_cs.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c index b37a498939ae..713091e2b896 100644 --- a/drivers/net/pcmcia/axnet_cs.c +++ b/drivers/net/pcmcia/axnet_cs.c @@ -779,6 +779,7 @@ static struct pcmcia_device_id axnet_ids[] = { PCMCIA_DEVICE_PROD_ID12("IO DATA", "ETXPCM", 0x547e66dc, 0x233adac2), PCMCIA_DEVICE_PROD_ID12("Linksys", "EtherFast 10/100 PC Card (PCMPC100 V3)", 0x0733cc81, 0x232019a8), PCMCIA_DEVICE_PROD_ID12("MELCO", "LPC3-TX", 0x481e0094, 0xf91af609), + PCMCIA_DEVICE_PROD_ID12("NETGEAR", "FA411", 0x9aa79dc3, 0x40fad875), PCMCIA_DEVICE_PROD_ID12("PCMCIA", "100BASE", 0x281f1c5d, 0x7c2add04), PCMCIA_DEVICE_PROD_ID12("PCMCIA", "FastEtherCard", 0x281f1c5d, 0x7ef26116), PCMCIA_DEVICE_PROD_ID12("PCMCIA", "FEP501", 0x281f1c5d, 0x2e272058), diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c index e40d6301aa7a..ce486f094492 100644 --- a/drivers/net/pcmcia/pcnet_cs.c +++ b/drivers/net/pcmcia/pcnet_cs.c @@ -1693,7 +1693,6 @@ static struct pcmcia_device_id pcnet_ids[] = { PCMCIA_DEVICE_PROD_ID12("National Semiconductor", "InfoMover NE4100", 0x36e1191f, 0xa6617ec8), PCMCIA_DEVICE_PROD_ID12("NEC", "PC-9801N-J12", 0x18df0ba0, 0xbc912d76), PCMCIA_DEVICE_PROD_ID12("NETGEAR", "FA410TX", 0x9aa79dc3, 0x60e5bc0e), - PCMCIA_DEVICE_PROD_ID12("NETGEAR", "FA411", 0x9aa79dc3, 0x40fad875), PCMCIA_DEVICE_PROD_ID12("Network Everywhere", "Fast Ethernet 10/100 PC Card", 0x820a67b6, 0x31ed1a5f), PCMCIA_DEVICE_PROD_ID12("NextCom K.K.", "Next Hawk", 0xaedaec74, 0xad050ef1), PCMCIA_DEVICE_PROD_ID12("PCMCIA", "10/100Mbps Ethernet Card", 0x281f1c5d, 0x6e41773b), From 38ae07e44bb2dc86770555a1acafcb937ec74478 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Fri, 21 Nov 2008 16:33:25 -0800 Subject: [PATCH 04/24] net/hp-plus: fix link errors Fix hp-plus driver link errors. Builds as loadable module and kernel image driver. All drivers that use 8390.o or 8390p.o that will build on i386 with MCA/PCI/EISA/ISA were built successfully both =m and =y. drivers/built-in.o: In function `hpp_open': hp-plus.c:(.text+0xac06c): undefined reference to `eip_interrupt' hp-plus.c:(.text+0xac0d7): undefined reference to `eip_open' drivers/built-in.o: In function `hpp_close': hp-plus.c:(.text+0xac1bb): undefined reference to `eip_close' drivers/built-in.o: In function `hpp_probe1': hp-plus.c:(.init.text+0xa98a): undefined reference to `NS8390p_init' drivers/built-in.o: In function `hp_plus_probe': (.init.text+0xa9fe): undefined reference to `__alloc_eip_netdev' Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller --- drivers/net/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/Makefile b/drivers/net/Makefile index f19acf8b9220..017383ad5ec6 100644 --- a/drivers/net/Makefile +++ b/drivers/net/Makefile @@ -114,7 +114,7 @@ obj-$(CONFIG_EL2) += 3c503.o 8390p.o obj-$(CONFIG_NE2000) += ne.o 8390p.o obj-$(CONFIG_NE2_MCA) += ne2.o 8390p.o obj-$(CONFIG_HPLAN) += hp.o 8390p.o -obj-$(CONFIG_HPLAN_PLUS) += hp-plus.o 8390.o +obj-$(CONFIG_HPLAN_PLUS) += hp-plus.o 8390p.o obj-$(CONFIG_ULTRA) += smc-ultra.o 8390.o obj-$(CONFIG_ULTRAMCA) += smc-mca.o 8390.o obj-$(CONFIG_ULTRA32) += smc-ultra32.o 8390.o From 33cf71cee14743185305c61625c4544885055733 Mon Sep 17 00:00:00 2001 From: Petr Tesarik Date: Fri, 21 Nov 2008 16:42:58 -0800 Subject: [PATCH 05/24] tcp: Do not use TSO/GSO when there is urgent data This patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=12014 Since most (if not all) implementations of TSO and even the in-kernel software GSO do not update the urgent pointer when splitting a large segment, it is necessary to turn off TSO/GSO for all outgoing traffic with the URG pointer set. Looking at tcp_current_mss (and the preceding comment) I even think this was the original intention. However, this approach is insufficient, because TSO/GSO is turned off only for newly created frames, not for frames which were already pending at the arrival of a message with MSG_OOB set. These frames were created when TSO/GSO was enabled, so they may be large, and they will have the urgent pointer set in tcp_transmit_skb(). With this patch, such large packets will be fragmented again before going to the transmit routine. As a side note, at least the following NICs are known to screw up the urgent pointer in the TCP header when doing TSO: Intel 82566MM (PCI ID 8086:1049) Intel 82566DC (PCI ID 8086:104b) Intel 82541GI (PCI ID 8086:1076) Broadcom NetXtreme II BCM5708 (PCI ID 14e4:164c) Signed-off-by: Petr Tesarik Signed-off-by: David S. Miller --- net/ipv4/tcp_output.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index ba85d8831893..85b07eba1879 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -722,7 +722,8 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb) static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int mss_now) { - if (skb->len <= mss_now || !sk_can_gso(sk)) { + if (skb->len <= mss_now || !sk_can_gso(sk) || + tcp_urg_mode(tcp_sk(sk))) { /* Avoid the costly divide in the normal * non-TSO case. */ @@ -1163,7 +1164,9 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb, { int tso_segs = tcp_skb_pcount(skb); - if (!tso_segs || (tso_segs > 1 && tcp_skb_mss(skb) != mss_now)) { + if (!tso_segs || + (tso_segs > 1 && (tcp_skb_mss(skb) != mss_now || + tcp_urg_mode(tcp_sk(sk))))) { tcp_set_skb_tso_segs(sk, skb, mss_now); tso_segs = tcp_skb_pcount(skb); } From 7e56b5d698707a9934833c47b24d78fb0bcaf764 Mon Sep 17 00:00:00 2001 From: Catalin Marinas Date: Fri, 21 Nov 2008 16:45:22 -0800 Subject: [PATCH 06/24] net: Fix memory leak in the proto_register function If the slub allocator is used, kmem_cache_create() may merge two or more kmem_cache's into one but the cache name pointer is not updated and kmem_cache_name() is no longer guaranteed to return the pointer passed to the former function. This patch stores the kmalloc'ed pointers in the corresponding request_sock_ops and timewait_sock_ops structures. Signed-off-by: Catalin Marinas Acked-by: Arnaldo Carvalho de Melo Reviewed-by: Christoph Lameter Signed-off-by: David S. Miller --- include/net/request_sock.h | 1 + include/net/timewait_sock.h | 1 + net/core/sock.c | 31 ++++++++++++------------------- 3 files changed, 14 insertions(+), 19 deletions(-) diff --git a/include/net/request_sock.h b/include/net/request_sock.h index cac811e51f6d..c7190846e128 100644 --- a/include/net/request_sock.h +++ b/include/net/request_sock.h @@ -31,6 +31,7 @@ struct request_sock_ops { int family; int obj_size; struct kmem_cache *slab; + char *slab_name; int (*rtx_syn_ack)(struct sock *sk, struct request_sock *req); void (*send_ack)(struct sock *sk, struct sk_buff *skb, diff --git a/include/net/timewait_sock.h b/include/net/timewait_sock.h index 1e1ee3253fd8..97c3b14da55d 100644 --- a/include/net/timewait_sock.h +++ b/include/net/timewait_sock.h @@ -16,6 +16,7 @@ struct timewait_sock_ops { struct kmem_cache *twsk_slab; + char *twsk_slab_name; unsigned int twsk_obj_size; int (*twsk_unique)(struct sock *sk, struct sock *sktw, void *twp); diff --git a/net/core/sock.c b/net/core/sock.c index 341e39456952..edf7220889a4 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -2035,9 +2035,6 @@ static inline void release_proto_idx(struct proto *prot) int proto_register(struct proto *prot, int alloc_slab) { - char *request_sock_slab_name = NULL; - char *timewait_sock_slab_name; - if (alloc_slab) { prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0, SLAB_HWCACHE_ALIGN, NULL); @@ -2051,12 +2048,12 @@ int proto_register(struct proto *prot, int alloc_slab) if (prot->rsk_prot != NULL) { static const char mask[] = "request_sock_%s"; - request_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL); - if (request_sock_slab_name == NULL) + prot->rsk_prot->slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL); + if (prot->rsk_prot->slab_name == NULL) goto out_free_sock_slab; - sprintf(request_sock_slab_name, mask, prot->name); - prot->rsk_prot->slab = kmem_cache_create(request_sock_slab_name, + sprintf(prot->rsk_prot->slab_name, mask, prot->name); + prot->rsk_prot->slab = kmem_cache_create(prot->rsk_prot->slab_name, prot->rsk_prot->obj_size, 0, SLAB_HWCACHE_ALIGN, NULL); @@ -2070,14 +2067,14 @@ int proto_register(struct proto *prot, int alloc_slab) if (prot->twsk_prot != NULL) { static const char mask[] = "tw_sock_%s"; - timewait_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL); + prot->twsk_prot->twsk_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL); - if (timewait_sock_slab_name == NULL) + if (prot->twsk_prot->twsk_slab_name == NULL) goto out_free_request_sock_slab; - sprintf(timewait_sock_slab_name, mask, prot->name); + sprintf(prot->twsk_prot->twsk_slab_name, mask, prot->name); prot->twsk_prot->twsk_slab = - kmem_cache_create(timewait_sock_slab_name, + kmem_cache_create(prot->twsk_prot->twsk_slab_name, prot->twsk_prot->twsk_obj_size, 0, SLAB_HWCACHE_ALIGN, NULL); @@ -2093,14 +2090,14 @@ int proto_register(struct proto *prot, int alloc_slab) return 0; out_free_timewait_sock_slab_name: - kfree(timewait_sock_slab_name); + kfree(prot->twsk_prot->twsk_slab_name); out_free_request_sock_slab: if (prot->rsk_prot && prot->rsk_prot->slab) { kmem_cache_destroy(prot->rsk_prot->slab); prot->rsk_prot->slab = NULL; } out_free_request_sock_slab_name: - kfree(request_sock_slab_name); + kfree(prot->rsk_prot->slab_name); out_free_sock_slab: kmem_cache_destroy(prot->slab); prot->slab = NULL; @@ -2123,18 +2120,14 @@ void proto_unregister(struct proto *prot) } if (prot->rsk_prot != NULL && prot->rsk_prot->slab != NULL) { - const char *name = kmem_cache_name(prot->rsk_prot->slab); - kmem_cache_destroy(prot->rsk_prot->slab); - kfree(name); + kfree(prot->rsk_prot->slab_name); prot->rsk_prot->slab = NULL; } if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) { - const char *name = kmem_cache_name(prot->twsk_prot->twsk_slab); - kmem_cache_destroy(prot->twsk_prot->twsk_slab); - kfree(name); + kfree(prot->twsk_prot->twsk_slab_name); prot->twsk_prot->twsk_slab = NULL; } } From ece4af18e07a5cea592ca095844783db4a349cb2 Mon Sep 17 00:00:00 2001 From: Qinghuang Feng Date: Sun, 23 Nov 2008 15:46:55 -0800 Subject: [PATCH 07/24] driver/net/*: remove redundant argument comments remove redundant argument comments in files of drivers/net/* Signed-off-by: Qinghuang Feng Signed-off-by: David S. Miller --- drivers/net/e1000e/netdev.c | 1 - drivers/net/igb/igb_main.c | 4 ---- drivers/net/ixgbe/ixgbe_main.c | 1 - drivers/net/pcmcia/axnet_cs.c | 1 - drivers/net/sis900.c | 1 - drivers/net/spider_net.c | 4 ---- 6 files changed, 12 deletions(-) diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c index 91795f78c3e4..122539a0e1fe 100644 --- a/drivers/net/e1000e/netdev.c +++ b/drivers/net/e1000e/netdev.c @@ -345,7 +345,6 @@ no_buffers: /** * e1000_alloc_jumbo_rx_buffers - Replace used jumbo receive buffers * @adapter: address of board private structure - * @rx_ring: pointer to receive ring structure * @cleaned_count: number of buffers to allocate this pass **/ diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c index 1cbae85b1426..20d27e622ec1 100644 --- a/drivers/net/igb/igb_main.c +++ b/drivers/net/igb/igb_main.c @@ -1980,7 +1980,6 @@ static void igb_configure_rx(struct igb_adapter *adapter) /** * igb_free_tx_resources - Free Tx Resources per Queue - * @adapter: board private structure * @tx_ring: Tx descriptor ring for a specific queue * * Free all transmit software resources @@ -2033,7 +2032,6 @@ static void igb_unmap_and_free_tx_resource(struct igb_adapter *adapter, /** * igb_clean_tx_ring - Free Tx Buffers - * @adapter: board private structure * @tx_ring: ring to be cleaned **/ static void igb_clean_tx_ring(struct igb_ring *tx_ring) @@ -2080,7 +2078,6 @@ static void igb_clean_all_tx_rings(struct igb_adapter *adapter) /** * igb_free_rx_resources - Free Rx Resources - * @adapter: board private structure * @rx_ring: ring to clean the resources from * * Free all receive software resources @@ -2120,7 +2117,6 @@ static void igb_free_all_rx_resources(struct igb_adapter *adapter) /** * igb_clean_rx_ring - Free Rx Buffers per Queue - * @adapter: board private structure * @rx_ring: ring to free buffers from **/ static void igb_clean_rx_ring(struct igb_ring *rx_ring) diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c index 36f2bb666bf7..b2a7ea887125 100644 --- a/drivers/net/ixgbe/ixgbe_main.c +++ b/drivers/net/ixgbe/ixgbe_main.c @@ -1320,7 +1320,6 @@ static inline void ixgbe_irq_enable(struct ixgbe_adapter *adapter) * ixgbe_intr - legacy mode Interrupt Handler * @irq: interrupt number * @data: pointer to a network interface device structure - * @pt_regs: CPU registers structure **/ static irqreturn_t ixgbe_intr(int irq, void *data) { diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c index 713091e2b896..0418045166c3 100644 --- a/drivers/net/pcmcia/axnet_cs.c +++ b/drivers/net/pcmcia/axnet_cs.c @@ -1175,7 +1175,6 @@ static int ei_start_xmit(struct sk_buff *skb, struct net_device *dev) * ax_interrupt - handle the interrupts from an 8390 * @irq: interrupt number * @dev_id: a pointer to the net_device - * @regs: unused * * Handle the ether interface interrupts. We pull packets from * the 8390 via the card specific functions and fire them at the networking diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c index fa3a460f8e2f..8e8337e8b072 100644 --- a/drivers/net/sis900.c +++ b/drivers/net/sis900.c @@ -1630,7 +1630,6 @@ sis900_start_xmit(struct sk_buff *skb, struct net_device *net_dev) * sis900_interrupt - sis900 interrupt handler * @irq: the irq number * @dev_instance: the client data object - * @regs: snapshot of processor context * * The interrupt handler does all of the Rx thread work, * and cleans up after the Tx thread diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c index b6435d0d71f9..07599b492359 100644 --- a/drivers/net/spider_net.c +++ b/drivers/net/spider_net.c @@ -672,7 +672,6 @@ write_hash: /** * spider_net_prepare_tx_descr - fill tx descriptor with skb data * @card: card structure - * @descr: descriptor structure to fill out * @skb: packet to use * * returns 0 on success, <0 on failure. @@ -867,7 +866,6 @@ spider_net_release_tx_chain(struct spider_net_card *card, int brutal) /** * spider_net_kick_tx_dma - enables TX DMA processing * @card: card structure - * @descr: descriptor address to enable TX processing at * * This routine will start the transmit DMA running if * it is not already running. This routine ned only be @@ -1637,7 +1635,6 @@ spider_net_handle_error_irq(struct spider_net_card *card, u32 status_reg, * spider_net_interrupt - interrupt handler for spider_net * @irq: interrupt number * @ptr: pointer to net_device - * @regs: PU registers * * returns IRQ_HANDLED, if interrupt was for driver, or IRQ_NONE, if no * interrupt found raised by card. @@ -2419,7 +2416,6 @@ spider_net_undo_pci_setup(struct spider_net_card *card) /** * spider_net_setup_pci_dev - sets up the device in terms of PCI operations - * @card: card structure * @pdev: PCI device * * Returns the card structure or NULL if any errors occur From 5147d14e995c097571d383fe1287fb33345a51ee Mon Sep 17 00:00:00 2001 From: Qinghuang Feng Date: Sun, 23 Nov 2008 15:47:24 -0800 Subject: [PATCH 08/24] drivers/net/chelsio/sge.c: remove redundant argument comments remove redundant argument comments Signed-off-by: Qinghuang Feng Signed-off-by: David S. Miller --- drivers/net/chelsio/sge.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c index d6c7d2aa761b..7092df50ff78 100644 --- a/drivers/net/chelsio/sge.c +++ b/drivers/net/chelsio/sge.c @@ -1035,10 +1035,6 @@ MODULE_PARM_DESC(copybreak, "Receive copy threshold"); * @pdev: the PCI device that received the packet * @fl: the SGE free list holding the packet * @len: the actual packet length, excluding any SGE padding - * @dma_pad: padding at beginning of buffer left by SGE DMA - * @skb_pad: padding to be used if the packet is copied - * @copy_thres: length threshold under which a packet should be copied - * @drop_thres: # of remaining buffers before we start dropping packets * * Get the next packet from a free list and complete setup of the * sk_buff. If the packet is small we make a copy and recycle the From b54ad409fd09a395b839fb81f300880d76861c0e Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Mon, 24 Nov 2008 15:56:17 -0800 Subject: [PATCH 09/24] netfilter: ctnetlink: fix conntrack creation race Conntrack creation through ctnetlink has two races: - the timer may expire and free the conntrack concurrently, causing an invalid memory access when attempting to put it in the hash tables - an identical conntrack entry may be created in the packet processing path in the time between the lookup and hash insertion Hold the conntrack lock between the lookup and insertion to avoid this. Reported-by: Zoltan Borbely Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- net/netfilter/nf_conntrack_core.c | 2 -- net/netfilter/nf_conntrack_netlink.c | 5 +++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 622d7c671cb7..233fdd2d7d21 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -305,9 +305,7 @@ void nf_conntrack_hash_insert(struct nf_conn *ct) hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple); - spin_lock_bh(&nf_conntrack_lock); __nf_conntrack_hash_insert(ct, hash, repl_hash); - spin_unlock_bh(&nf_conntrack_lock); } EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert); diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index a040d46f85d6..3b009a3e8549 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -1090,7 +1090,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[], struct nf_conn_help *help; struct nf_conntrack_helper *helper; - ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_KERNEL); + ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC); if (ct == NULL || IS_ERR(ct)) return -ENOMEM; @@ -1212,13 +1212,14 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, atomic_inc(&master_ct->ct_general.use); } - spin_unlock_bh(&nf_conntrack_lock); err = -ENOENT; if (nlh->nlmsg_flags & NLM_F_CREATE) err = ctnetlink_create_conntrack(cda, &otuple, &rtuple, master_ct); + spin_unlock_bh(&nf_conntrack_lock); + if (err < 0 && master_ct) nf_ct_put(master_ct); From f79fca55f9a6fe54635ad32ddc8a38f92a94ec30 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Mon, 24 Nov 2008 16:06:17 -0800 Subject: [PATCH 10/24] netfilter: xtables: add missing const qualifier to xt_tgchk_param When entryinfo was a standalone parameter to functions, it used to be "const void *". Put the const back in. Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- include/linux/netfilter/x_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h index be41b609c88f..e52ce475d19f 100644 --- a/include/linux/netfilter/x_tables.h +++ b/include/linux/netfilter/x_tables.h @@ -251,7 +251,7 @@ struct xt_target_param { */ struct xt_tgchk_param { const char *table; - void *entryinfo; + const void *entryinfo; const struct xt_target *target; void *targinfo; unsigned int hook_mask; From 631339f1e544a4d39a63cfe6708c5bddcd5a2c48 Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Mon, 24 Nov 2008 16:06:50 -0800 Subject: [PATCH 11/24] bridge: netfilter: fix update_pmtu crash with GRE As GRE tries to call the update_pmtu function on skb->dst and bridge supplies an skb->dst that has a NULL ops field, all is not well. This patch fixes this by giving the bridge device an ops field with an update_pmtu function. For the moment I've left all other fields blank but we can fill them in later should the need arise. Based on report and patch by Philip Craig. Signed-off-by: Herbert Xu Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- net/bridge/br_netfilter.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index fa5cda4e552a..45f61c348e36 100644 --- a/net/bridge/br_netfilter.c +++ b/net/bridge/br_netfilter.c @@ -101,6 +101,18 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb) pppoe_proto(skb) == htons(PPP_IPV6) && \ brnf_filter_pppoe_tagged) +static void fake_update_pmtu(struct dst_entry *dst, u32 mtu) +{ +} + +static struct dst_ops fake_dst_ops = { + .family = AF_INET, + .protocol = __constant_htons(ETH_P_IP), + .update_pmtu = fake_update_pmtu, + .entry_size = sizeof(struct rtable), + .entries = ATOMIC_INIT(0), +}; + /* * Initialize bogus route table used to keep netfilter happy. * Currently, we fill in the PMTU entry because netfilter @@ -117,6 +129,7 @@ void br_netfilter_rtable_init(struct net_bridge *br) rt->u.dst.path = &rt->u.dst; rt->u.dst.metrics[RTAX_MTU - 1] = 1500; rt->u.dst.flags = DST_NOXFRM; + rt->u.dst.ops = &fake_dst_ops; } static inline struct rtable *bridge_parent_rtable(const struct net_device *dev) From 244f46ae6e9e18f6fc0be7d1f49febde4762c34b Mon Sep 17 00:00:00 2001 From: Bernard Pidoux Date: Mon, 24 Nov 2008 11:49:40 +0000 Subject: [PATCH 12/24] rose: zero length frame filtering in af_rose.c Since changeset e79ad711a0108475c1b3a03815527e7237020b08 from mainline, >From David S. Miller, empty packet can be transmitted on connected socket for datagram protocols. However, this patch broke a high level application using ROSE network protocol with connected datagram. Bulletin Board Stations perform bulletins forwarding between BBS stations via ROSE network using a forward protocol. Now, if for some reason, a buffer in the application software happens to be empty at a specific moment, ROSE sends an empty packet via unfiltered packet socket. When received, this ROSE packet introduces perturbations of data exchange of BBS forwarding, for the application message forwarding protocol is waiting for something else. We agree that a more careful programming of the application protocol would avoid this situation and we are willing to debug it. But, as an empty frame is no use and does not have any meaning for ROSE protocol, we may consider filtering zero length data both when sending and receiving socket data. The proposed patch repaired BBS data exchange through ROSE network that were broken since 2.6.22.11 kernel. Signed-off-by: Bernard Pidoux Signed-off-by: David S. Miller --- net/rose/af_rose.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c index a7f1ce11bc22..0c1cc7612800 100644 --- a/net/rose/af_rose.c +++ b/net/rose/af_rose.c @@ -1072,6 +1072,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock, unsigned char *asmptr; int n, size, qbit = 0; + /* ROSE empty frame has no meaning : don't send */ + if (len == 0) + return 0; + if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT)) return -EINVAL; @@ -1265,6 +1269,12 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock, skb_reset_transport_header(skb); copied = skb->len; + /* ROSE empty frame has no meaning : ignore it */ + if (copied == 0) { + skb_free_datagram(sk, skb); + return copied; + } + if (copied > size) { copied = size; msg->msg_flags |= MSG_TRUNC; From 11c6dd2c723a9ff9bdd4ee11b2798a08abc94e98 Mon Sep 17 00:00:00 2001 From: Trent Piepho Date: Tue, 25 Nov 2008 01:00:47 -0800 Subject: [PATCH 13/24] phylib: Add Vitesse VSC8221 SGMII PHY PHY is mostly compatible with the existing VSC8244 PHY. The init sequence is different and the interrupt mask lacks some bits present in the VSC8244. Rather than making a copy of the existing VSC234x config_intr function and change one constant, I modify it to select the interrupt mask based on which driver is calling it. This lets it be used by both drivers. Signed-off-by: Trent Piepho Signed-off-by: David S. Miller --- drivers/net/phy/vitesse.c | 64 +++++++++++++++++++++++++++++++++------ 1 file changed, 55 insertions(+), 9 deletions(-) diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c index 8874497b6bbf..dd3b2447e85a 100644 --- a/drivers/net/phy/vitesse.c +++ b/drivers/net/phy/vitesse.c @@ -34,6 +34,8 @@ #define MII_VSC8244_IMASK_DUPLEX 0x1000 #define MII_VSC8244_IMASK_MASK 0xf000 +#define MII_VSC8221_IMASK_MASK 0xa000 + /* Vitesse Interrupt Status Register */ #define MII_VSC8244_ISTAT 0x1a #define MII_VSC8244_ISTAT_STATUS 0x8000 @@ -49,6 +51,12 @@ #define MII_VSC8244_AUXCONSTAT_GBIT 0x0010 #define MII_VSC8244_AUXCONSTAT_100 0x0008 +#define MII_VSC8221_AUXCONSTAT_INIT 0x0004 /* need to set this bit? */ +#define MII_VSC8221_AUXCONSTAT_RESERVED 0x0004 + +#define PHY_ID_VSC8244 0x000fc6c0 +#define PHY_ID_VSC8221 0x000fc550 + MODULE_DESCRIPTION("Vitesse PHY driver"); MODULE_AUTHOR("Kriston Carson"); MODULE_LICENSE("GPL"); @@ -95,13 +103,15 @@ static int vsc824x_ack_interrupt(struct phy_device *phydev) return (err < 0) ? err : 0; } -static int vsc824x_config_intr(struct phy_device *phydev) +static int vsc82xx_config_intr(struct phy_device *phydev) { int err; if (phydev->interrupts == PHY_INTERRUPT_ENABLED) err = phy_write(phydev, MII_VSC8244_IMASK, - MII_VSC8244_IMASK_MASK); + phydev->drv->phy_id == PHY_ID_VSC8244 ? + MII_VSC8244_IMASK_MASK : + MII_VSC8221_IMASK_MASK); else { /* * The Vitesse PHY cannot clear the interrupt @@ -120,7 +130,7 @@ static int vsc824x_config_intr(struct phy_device *phydev) /* Vitesse 824x */ static struct phy_driver vsc8244_driver = { - .phy_id = 0x000fc6c0, + .phy_id = PHY_ID_VSC8244, .name = "Vitesse VSC8244", .phy_id_mask = 0x000fffc0, .features = PHY_GBIT_FEATURES, @@ -129,19 +139,55 @@ static struct phy_driver vsc8244_driver = { .config_aneg = &genphy_config_aneg, .read_status = &genphy_read_status, .ack_interrupt = &vsc824x_ack_interrupt, - .config_intr = &vsc824x_config_intr, + .config_intr = &vsc82xx_config_intr, .driver = { .owner = THIS_MODULE,}, }; -static int __init vsc8244_init(void) +static int vsc8221_config_init(struct phy_device *phydev) { - return phy_driver_register(&vsc8244_driver); + int err; + + err = phy_write(phydev, MII_VSC8244_AUX_CONSTAT, + MII_VSC8221_AUXCONSTAT_INIT); + return err; + + /* Perhaps we should set EXT_CON1 based on the interface? + Options are 802.3Z SerDes or SGMII */ } -static void __exit vsc8244_exit(void) +/* Vitesse 8221 */ +static struct phy_driver vsc8221_driver = { + .phy_id = PHY_ID_VSC8221, + .phy_id_mask = 0x000ffff0, + .name = "Vitesse VSC8221", + .features = PHY_GBIT_FEATURES, + .flags = PHY_HAS_INTERRUPT, + .config_init = &vsc8221_config_init, + .config_aneg = &genphy_config_aneg, + .read_status = &genphy_read_status, + .ack_interrupt = &vsc824x_ack_interrupt, + .config_intr = &vsc82xx_config_intr, + .driver = { .owner = THIS_MODULE,}, +}; + +static int __init vsc82xx_init(void) +{ + int err; + + err = phy_driver_register(&vsc8244_driver); + if (err < 0) + return err; + err = phy_driver_register(&vsc8221_driver); + if (err < 0) + phy_driver_unregister(&vsc8244_driver); + return err; +} + +static void __exit vsc82xx_exit(void) { phy_driver_unregister(&vsc8244_driver); + phy_driver_unregister(&vsc8221_driver); } -module_init(vsc8244_init); -module_exit(vsc8244_exit); +module_init(vsc82xx_init); +module_exit(vsc82xx_exit); From e91af0af8677198346d5d29f09ab39bb3b0e3faf Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 19 Nov 2008 01:22:51 +0100 Subject: [PATCH 14/24] iwlagn: fix DMA sync For the RX DMA fix for iwlwifi ("iwlagn: fix RX skb alignment") Luis pointed out: > aligned_dma_addr can obviously be > real_dma_addr at this point, what > guarantees we can use it on our own whim? I asked around, and he's right, there may be platforms that do not allow passing such such an address to the DMA API functions. This patch changes it by using the proper dma_sync_single_range_for_cpu API invented for this purpose. Cc: Luis R. Rodriguez Signed-off-by: Johannes Berg Signed-off-by: John W. Linville --- drivers/net/wireless/iwlwifi/iwl-agn.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c index 444c5cc05f03..c4c0371c763b 100644 --- a/drivers/net/wireless/iwlwifi/iwl-agn.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn.c @@ -1384,9 +1384,11 @@ void iwl_rx_handle(struct iwl_priv *priv) rxq->queue[i] = NULL; - pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->aligned_dma_addr, - priv->hw_params.rx_buf_size, - PCI_DMA_FROMDEVICE); + dma_sync_single_range_for_cpu( + &priv->pci_dev->dev, rxb->real_dma_addr, + rxb->aligned_dma_addr - rxb->real_dma_addr, + priv->hw_params.rx_buf_size, + PCI_DMA_FROMDEVICE); pkt = (struct iwl_rx_packet *)rxb->skb->data; /* Reclaim a command buffer only if this packet is a response From 3dd3b79aeadc6f6abc5cc78724d7df3dfcc1bd0b Mon Sep 17 00:00:00 2001 From: Abhijeet Kolekar Date: Thu, 20 Nov 2008 10:20:31 -0800 Subject: [PATCH 15/24] mac80211 : Fix setting ad-hoc mode and non-ibss channel Patch fixes the kernel trace when user tries to set ad-hoc mode on non IBSS channel. e.g iwconfig wlan0 chan 36 mode ad-hoc Signed-off-by: Abhijeet Kolekar Signed-off-by: John W. Linville --- net/mac80211/wext.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c index 742f811ca416..ab4ddba874be 100644 --- a/net/mac80211/wext.c +++ b/net/mac80211/wext.c @@ -271,6 +271,7 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev, __u32 *mode, char *extra) { struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); + struct ieee80211_local *local = sdata->local; int type; if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) @@ -281,6 +282,13 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev, type = NL80211_IFTYPE_STATION; break; case IW_MODE_ADHOC: + /* Setting ad-hoc mode on non ibss channel is not + * supported. + */ + if (local->oper_channel && + (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS)) + return -EOPNOTSUPP; + type = NL80211_IFTYPE_ADHOC; break; case IW_MODE_REPEAT: From ca0c7e5101fd4f37fed8e851709f08580b92fbb3 Mon Sep 17 00:00:00 2001 From: "Luis R. Rodriguez" Date: Thu, 20 Nov 2008 17:15:12 -0800 Subject: [PATCH 16/24] ath9k: Fix SW-IOMMU bounce buffer starvation This should fix the SW-IOMMU bounce buffer starvation seen ok kernel.org bugzilla 11811: http://bugzilla.kernel.org/show_bug.cgi?id=11811 Users on MacBook Pro 3.1/MacBook v2 would see something like: DMA: Out of SW-IOMMU space for 4224 bytes at device 0000:0b:00.0 Unfortunately its only easy to trigger on MacBook Pro 3.1/MacBook v2 so far so its difficult to debug (even with swiotlb=force). We were pci_unmap_single()'ing less bytes than what we called for with pci_map_single() and as such we were starving the swiotlb from its 64MB amount of bounce buffers. We remain consistent and now always use sc->rxbufsize for RX. While at it we update the beacon DMA maps as well to only use the data portion of the skb, previous to this we were pci_map_single()'ing more data for beaconing than what we tell the hardware it can use, therefore pushing more iotlb abuse. Still not sure why this is so easily triggerable on MacBook Pro 3.1, it may be the hardware configuration tends to use more memory > 3GB mark for DMA. Signed-off-by: Maciej Zenczykowski Signed-off-by: Bennyam Malavazi Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville --- drivers/net/wireless/ath9k/beacon.c | 10 +++++----- drivers/net/wireless/ath9k/recv.c | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireless/ath9k/beacon.c b/drivers/net/wireless/ath9k/beacon.c index 9e15c30bbc06..4dd1c1bda0fb 100644 --- a/drivers/net/wireless/ath9k/beacon.c +++ b/drivers/net/wireless/ath9k/beacon.c @@ -170,7 +170,7 @@ static struct ath_buf *ath_beacon_generate(struct ath_softc *sc, int if_id) skb = (struct sk_buff *)bf->bf_mpdu; if (skb) { pci_unmap_single(sc->pdev, bf->bf_dmacontext, - skb_end_pointer(skb) - skb->head, + skb->len, PCI_DMA_TODEVICE); } @@ -193,7 +193,7 @@ static struct ath_buf *ath_beacon_generate(struct ath_softc *sc, int if_id) bf->bf_buf_addr = bf->bf_dmacontext = pci_map_single(sc->pdev, skb->data, - skb_end_pointer(skb) - skb->head, + skb->len, PCI_DMA_TODEVICE); skb = ieee80211_get_buffered_bc(sc->hw, avp->av_if_data); @@ -352,7 +352,7 @@ int ath_beacon_alloc(struct ath_softc *sc, int if_id) if (bf->bf_mpdu != NULL) { skb = (struct sk_buff *)bf->bf_mpdu; pci_unmap_single(sc->pdev, bf->bf_dmacontext, - skb_end_pointer(skb) - skb->head, + skb->len, PCI_DMA_TODEVICE); dev_kfree_skb_any(skb); bf->bf_mpdu = NULL; @@ -412,7 +412,7 @@ int ath_beacon_alloc(struct ath_softc *sc, int if_id) bf->bf_buf_addr = bf->bf_dmacontext = pci_map_single(sc->pdev, skb->data, - skb_end_pointer(skb) - skb->head, + skb->len, PCI_DMA_TODEVICE); bf->bf_mpdu = skb; @@ -439,7 +439,7 @@ void ath_beacon_return(struct ath_softc *sc, struct ath_vap *avp) if (bf->bf_mpdu != NULL) { struct sk_buff *skb = (struct sk_buff *)bf->bf_mpdu; pci_unmap_single(sc->pdev, bf->bf_dmacontext, - skb_end_pointer(skb) - skb->head, + skb->len, PCI_DMA_TODEVICE); dev_kfree_skb_any(skb); bf->bf_mpdu = NULL; diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c index 4983402af559..ad5f88879dc4 100644 --- a/drivers/net/wireless/ath9k/recv.c +++ b/drivers/net/wireless/ath9k/recv.c @@ -456,7 +456,7 @@ static int ath_rx_indicate(struct ath_softc *sc, if (nskb != NULL) { bf->bf_mpdu = nskb; bf->bf_buf_addr = pci_map_single(sc->pdev, nskb->data, - skb_end_pointer(nskb) - nskb->head, + sc->sc_rxbufsize, PCI_DMA_FROMDEVICE); bf->bf_dmacontext = bf->bf_buf_addr; ATH_RX_CONTEXT(nskb)->ctx_rxbuf = bf; @@ -542,7 +542,7 @@ int ath_rx_init(struct ath_softc *sc, int nbufs) bf->bf_mpdu = skb; bf->bf_buf_addr = pci_map_single(sc->pdev, skb->data, - skb_end_pointer(skb) - skb->head, + sc->sc_rxbufsize, PCI_DMA_FROMDEVICE); bf->bf_dmacontext = bf->bf_buf_addr; ATH_RX_CONTEXT(skb)->ctx_rxbuf = bf; @@ -1007,7 +1007,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush) pci_dma_sync_single_for_cpu(sc->pdev, bf->bf_buf_addr, - skb_tailroom(skb), + sc->sc_rxbufsize, PCI_DMA_FROMDEVICE); pci_unmap_single(sc->pdev, bf->bf_buf_addr, From b4b6cda2298b0c9a0af902312184b775b8867c65 Mon Sep 17 00:00:00 2001 From: "Luis R. Rodriguez" Date: Thu, 20 Nov 2008 17:15:13 -0800 Subject: [PATCH 17/24] ath9k: correct expected max RX buffer size We should only tell the hardware its capable of DMA'ing to us only what we asked dev_alloc_skb(). Prior to this it is possible a large RX'd frame could have corrupted DMA data but for us but we were saved only because we were previously also pci_map_single()'ing the same large value. The issue prior to this though was we were unmapping a smaller amount which the prior DMA patch fixed. Signed-off-by: Bennyam Malavazi Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville --- drivers/net/wireless/ath9k/recv.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c index ad5f88879dc4..504a0444d89f 100644 --- a/drivers/net/wireless/ath9k/recv.c +++ b/drivers/net/wireless/ath9k/recv.c @@ -49,10 +49,12 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf) ASSERT(skb != NULL); ds->ds_vdata = skb->data; - /* setup rx descriptors */ + /* setup rx descriptors. The sc_rxbufsize here tells the harware + * how much data it can DMA to us and that we are prepared + * to process */ ath9k_hw_setuprxdesc(ah, ds, - skb_tailroom(skb), /* buffer size */ + sc->sc_rxbufsize, 0); if (sc->sc_rxlink == NULL) @@ -398,6 +400,13 @@ static struct sk_buff *ath_rxbuf_alloc(struct ath_softc *sc, * in rx'd frames. */ + /* Note: the kernel can allocate a value greater than + * what we ask it to give us. We really only need 4 KB as that + * is this hardware supports and in fact we need at least 3849 + * as that is the MAX AMSDU size this hardware supports. + * Unfortunately this means we may get 8 KB here from the + * kernel... and that is actually what is observed on some + * systems :( */ skb = dev_alloc_skb(len + sc->sc_cachelsz - 1); if (skb != NULL) { off = ((unsigned long) skb->data) % sc->sc_cachelsz; From 33ab625f2a23e743161f7ccd8e774ce3d3891339 Mon Sep 17 00:00:00 2001 From: Cheng Renquan Date: Sat, 22 Nov 2008 11:22:49 +0800 Subject: [PATCH 18/24] ath5k: fix Security issue in DebugFS part of ath5k MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit http://bugzilla.kernel.org/show_bug.cgi?id=12076 Remove any write access to groups and others, only keep write permission to its owner, usually only root user. Reported-by: Jérôme Poulin Signed-off-by: Cheng Renquan Signed-off-by: John W. Linville --- drivers/net/wireless/ath5k/debug.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c index 19980cbd5d5f..ccaeb5c219d2 100644 --- a/drivers/net/wireless/ath5k/debug.c +++ b/drivers/net/wireless/ath5k/debug.c @@ -417,19 +417,19 @@ ath5k_debug_init_device(struct ath5k_softc *sc) sc->debug.debugfs_phydir = debugfs_create_dir(wiphy_name(sc->hw->wiphy), ath5k_global_debugfs); - sc->debug.debugfs_debug = debugfs_create_file("debug", 0666, + sc->debug.debugfs_debug = debugfs_create_file("debug", S_IWUSR | S_IRUGO, sc->debug.debugfs_phydir, sc, &fops_debug); - sc->debug.debugfs_registers = debugfs_create_file("registers", 0444, + sc->debug.debugfs_registers = debugfs_create_file("registers", S_IRUGO, sc->debug.debugfs_phydir, sc, &fops_registers); - sc->debug.debugfs_tsf = debugfs_create_file("tsf", 0666, + sc->debug.debugfs_tsf = debugfs_create_file("tsf", S_IWUSR | S_IRUGO, sc->debug.debugfs_phydir, sc, &fops_tsf); - sc->debug.debugfs_beacon = debugfs_create_file("beacon", 0666, + sc->debug.debugfs_beacon = debugfs_create_file("beacon", S_IWUSR | S_IRUGO, sc->debug.debugfs_phydir, sc, &fops_beacon); - sc->debug.debugfs_reset = debugfs_create_file("reset", 0222, + sc->debug.debugfs_reset = debugfs_create_file("reset", S_IWUSR, sc->debug.debugfs_phydir, sc, &fops_reset); } From 02969b38e6f7cef80e71d673d1e512e029a7009f Mon Sep 17 00:00:00 2001 From: Martin Xu Date: Mon, 24 Nov 2008 10:49:27 +0800 Subject: [PATCH 19/24] ath5k: disable beacon filter when station is not associated Ath5k driver has too many interrupts per second at idle http://bugzilla.kernel.org/show_bug.cgi?id=11749 Signed-off-by: Martin Xu Signed-off-by: John W. Linville --- drivers/net/wireless/ath5k/base.c | 35 ++++++++++++++++++++++++++++++- drivers/net/wireless/ath5k/base.h | 1 + 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c index cfd4d052d666..2d14255eb103 100644 --- a/drivers/net/wireless/ath5k/base.c +++ b/drivers/net/wireless/ath5k/base.c @@ -240,6 +240,10 @@ static u64 ath5k_get_tsf(struct ieee80211_hw *hw); static void ath5k_reset_tsf(struct ieee80211_hw *hw); static int ath5k_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb); +static void ath5k_bss_info_changed(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, + struct ieee80211_bss_conf *bss_conf, + u32 changes); static struct ieee80211_ops ath5k_hw_ops = { .tx = ath5k_tx, @@ -256,6 +260,7 @@ static struct ieee80211_ops ath5k_hw_ops = { .get_tx_stats = ath5k_get_tx_stats, .get_tsf = ath5k_get_tsf, .reset_tsf = ath5k_reset_tsf, + .bss_info_changed = ath5k_bss_info_changed, }; /* @@ -2942,7 +2947,7 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw, sc->opmode != NL80211_IFTYPE_MESH_POINT && test_bit(ATH_STAT_PROMISC, sc->status)) rfilt |= AR5K_RX_FILTER_PROM; - if (sc->opmode == NL80211_IFTYPE_STATION || + if ((sc->opmode == NL80211_IFTYPE_STATION && sc->assoc) || sc->opmode == NL80211_IFTYPE_ADHOC) { rfilt |= AR5K_RX_FILTER_BEACON; } @@ -3083,4 +3088,32 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb) end: return ret; } +static void +set_beacon_filter(struct ieee80211_hw *hw, bool enable) +{ + struct ath5k_softc *sc = hw->priv; + struct ath5k_hw *ah = sc->ah; + u32 rfilt; + rfilt = ath5k_hw_get_rx_filter(ah); + if (enable) + rfilt |= AR5K_RX_FILTER_BEACON; + else + rfilt &= ~AR5K_RX_FILTER_BEACON; + ath5k_hw_set_rx_filter(ah, rfilt); + sc->filter_flags = rfilt; +} +static void ath5k_bss_info_changed(struct ieee80211_hw *hw, + struct ieee80211_vif *vif, + struct ieee80211_bss_conf *bss_conf, + u32 changes) +{ + struct ath5k_softc *sc = hw->priv; + if (changes & BSS_CHANGED_ASSOC) { + mutex_lock(&sc->lock); + sc->assoc = bss_conf->assoc; + if (sc->opmode == NL80211_IFTYPE_STATION) + set_beacon_filter(hw, sc->assoc); + mutex_unlock(&sc->lock); + } +} diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h index 06d1054ca94b..facc60ddada2 100644 --- a/drivers/net/wireless/ath5k/base.h +++ b/drivers/net/wireless/ath5k/base.h @@ -179,6 +179,7 @@ struct ath5k_softc { struct timer_list calib_tim; /* calibration timer */ int power_level; /* Requested tx power in dbm */ + bool assoc; /* assocate state */ }; #define ath5k_hw_hasbssidmask(_ah) \ From 020cf6ba7a91ccc5db359f91e9abba175fd3a0aa Mon Sep 17 00:00:00 2001 From: Ingo Molnar Date: Sun, 23 Nov 2008 20:09:54 +0100 Subject: [PATCH 20/24] net/wireless/reg.c: fix bad WARN_ON in if statement fix: net/wireless/reg.c:348:29: error: macro "if" passed 2 arguments, but takes just 1 triggered by the branch-tracer. Signed-off-by: Ingo Molnar Signed-off-by: John W. Linville --- net/wireless/reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/wireless/reg.c b/net/wireless/reg.c index 626dbb688499..eb3b1a9f9b12 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -343,9 +343,9 @@ static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by, return 0; return -EALREADY; } - if (WARN_ON(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2)), + if (WARN(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2), "Invalid Country IE regulatory hint passed " - "to the wireless core\n") + "to the wireless core\n")) return -EINVAL; /* We ignore Country IE hints for now, as we haven't yet * added the dot11MultiDomainCapabilityEnabled flag From 1d71da164d7fb40fac72c0406a4a531265916fc8 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Tue, 25 Nov 2008 21:05:51 -0800 Subject: [PATCH 21/24] net: hp-plus uses eip_poll hp-plus uses 8390p.c, so it should use eip_poll(), not ei_poll(). drivers/built-in.o: In function `hpp_probe1': hp-plus.c:(.init.text+0x9cbd): undefined reference to `ei_poll' Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller --- drivers/net/hp-plus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/hp-plus.c b/drivers/net/hp-plus.c index fbbd3e660c27..c01e290d09d2 100644 --- a/drivers/net/hp-plus.c +++ b/drivers/net/hp-plus.c @@ -230,7 +230,7 @@ static int __init hpp_probe1(struct net_device *dev, int ioaddr) dev->open = &hpp_open; dev->stop = &hpp_close; #ifdef CONFIG_NET_POLL_CONTROLLER - dev->poll_controller = ei_poll; + dev->poll_controller = eip_poll; #endif ei_status.name = name; From 8f480c0e4e120911a673ed7385359bf76ae01963 Mon Sep 17 00:00:00 2001 From: Arjan van de Ven Date: Tue, 25 Nov 2008 21:08:13 -0800 Subject: [PATCH 22/24] net: make skb_truesize_bug() call WARN() The truesize message check is important enough to make it print "BUG" to the user console... lets also make it important enough to spit a backtrace/module list etc so that kerneloops.org can track them. Signed-off-by: Arjan van de Ven Signed-off-by: David S. Miller --- net/core/skbuff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index d49ef8301b5b..65f7757465bd 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -149,7 +149,7 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here) void skb_truesize_bug(struct sk_buff *skb) { - printk(KERN_ERR "SKB BUG: Invalid truesize (%u) " + WARN(net_ratelimit(), KERN_ERR "SKB BUG: Invalid truesize (%u) " "len=%u, sizeof(sk_buff)=%Zd\n", skb->truesize, skb->len, sizeof(struct sk_buff)); } From bd51126957eeac96d056c670545ff798c89f63f5 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Wed, 26 Nov 2008 01:17:01 -0800 Subject: [PATCH 23/24] sungem: Fix PCS_MIICTRL register write in gem_init_phy(). Use writel not writeb. Noticed by Hermann Lauer. Signed-off-by: David S. Miller --- drivers/net/sungem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c index 4291458955ef..1349e419673c 100644 --- a/drivers/net/sungem.c +++ b/drivers/net/sungem.c @@ -1714,7 +1714,7 @@ static void gem_init_phy(struct gem *gp) /* Reset PCS unit. */ val = readl(gp->regs + PCS_MIICTRL); val |= PCS_MIICTRL_RST; - writeb(val, gp->regs + PCS_MIICTRL); + writel(val, gp->regs + PCS_MIICTRL); limit = 32; while (readl(gp->regs + PCS_MIICTRL) & PCS_MIICTRL_RST) { From 3ec192559033ed457f0d7856838654c100fc659f Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Wed, 26 Nov 2008 03:57:44 -0800 Subject: [PATCH 24/24] netfilter: ctnetlink: fix GFP_KERNEL allocation under spinlock The previous fix for the conntrack creation race (netfilter: ctnetlink: fix conntrack creation race) missed a GFP_KERNEL allocation that is now performed while holding a spinlock. Switch to GFP_ATOMIC. Reported-and-tested-by: Zoltan Borbely Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- net/netfilter/nf_conntrack_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 3b009a3e8549..5f4a6516b3b6 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -1138,7 +1138,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[], } } - nf_ct_acct_ext_add(ct, GFP_KERNEL); + nf_ct_acct_ext_add(ct, GFP_ATOMIC); #if defined(CONFIG_NF_CONNTRACK_MARK) if (cda[CTA_MARK])