]> git.proxmox.com Git - mirror_ubuntu-kernels.git/log
mirror_ubuntu-kernels.git
14 years agofsl_pq_mdio: Fix iomem unmapping for non-eTSEC2.0 controllers
Anton Vorontsov [Wed, 30 Dec 2009 08:23:34 +0000 (08:23 +0000)]
fsl_pq_mdio: Fix iomem unmapping for non-eTSEC2.0 controllers

We use a rather complicated logic to support eTSEC and eTSEC2.0
registers maps in a single driver. Currently, the code tries to
unmap 'regs', but for non-eTSEC2.0 controllers 'regs' doesn't
point to a mapping start, and this might cause badness on probe
failure or module removal:

 Freescale PowerQUICC MII Bus: probed
 Trying to vfree() nonexistent vm area (e107f000)
 ------------[ cut here ]------------
 Badness at c00a7754 [verbose debug info unavailable]
 NIP: c00a7754 LR: c00a7754 CTR: c02231ec
 [...]
 NIP [c00a7754] __vunmap+0xec/0xf4
 LR [c00a7754] __vunmap+0xec/0xf4
 Call Trace:
 [df827e50] [c00a7754] __vunmap+0xec/0xf4 (unreliable)
 [df827e70] [c001519c] iounmap+0x44/0x54
 [df827e80] [c028b924] fsl_pq_mdio_probe+0x1cc/0x2fc
 [df827eb0] [c02fb9b4] of_platform_device_probe+0x5c/0x84
 [df827ed0] [c0229928] really_probe+0x78/0x1a8
 [df827ef0] [c0229b20] __driver_attach+0xa4/0xa8

Fix this by introducing a proper priv structure (finally!), which
now holds 'regs' and 'map' fields separately.

Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoucc_geth: Fix netdev watchdog triggering on suspend
Anton Vorontsov [Wed, 30 Dec 2009 08:23:32 +0000 (08:23 +0000)]
ucc_geth: Fix netdev watchdog triggering on suspend

Sometimes ucc_geth fails to suspend with the following trace:

 ucc_geth e0103000.ucc: suspend
 ucc_geth e0102000.ucc: suspend
 NETDEV WATCHDOG: eth0 (ucc_geth): transmit queue 0 timed out
 ------------[ cut here ]------------
 Badness at net/sched/sch_generic.c:255
 NIP: c021cb5c LR: c021cb5c CTR: c01ab4b4
 [...]
 NIP [c021cb5c] dev_watchdog+0x298/0x2a8
 LR [c021cb5c] dev_watchdog+0x298/0x2a8
 Call Trace:
 [c0389da0] [c021cb5c] dev_watchdog+0x298/0x2a8 (unreliable)
 [c0389e00] [c0031ed8] run_timer_softirq+0x16c/0x1dc
 [c0389e50] [c002c638] __do_softirq+0xa4/0x11c
 [...]

This patch fixes the issue by properly detaching the device on
suspend, and attaching it back on resume.

Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agophylib: Properly reinitialize PHYs after hibernation
Anton Vorontsov [Wed, 30 Dec 2009 08:23:30 +0000 (08:23 +0000)]
phylib: Properly reinitialize PHYs after hibernation

Since hibernation assumes power loss, we should fully reinitialize
PHYs (including platform fixups), as if PHYs were just attached.

This patch factors phy_init_hw() out of phy_attach_direct(), then
converts mdio_bus to dev_pm_ops and adds an appropriate restore()
callback.

Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agophylib: Fix deadlock on resume
Anton Vorontsov [Wed, 30 Dec 2009 08:23:28 +0000 (08:23 +0000)]
phylib: Fix deadlock on resume

Sometimes kernel hangs on resume with the following trace:

 ucc_geth e0102000.ucc: resume
 INFO: task bash:1764 blocked for more than 120 seconds.
 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 bash          D 0fecf43c     0  1764   1763 0x00000000
 Call Trace:
 [cf9a7c10] [c0012868] ret_from_except+0x0/0x14 (unreliable)
 --- Exception: cf9a7ce0 at __switch_to+0x4c/0x6c
     LR = 0xcf9a7cc0
 [cf9a7cd0] [c0008c14] __switch_to+0x4c/0x6c (unreliable)
 [cf9a7ce0] [c028bcfc] schedule+0x158/0x260
 [cf9a7d10] [c028c720] __mutex_lock_slowpath+0x80/0xd8
 [cf9a7d40] [c01cf388] phy_stop+0x20/0x70
 [cf9a7d50] [c01d514c] ugeth_resume+0x6c/0x13c
 [...]

Here is why.

On suspend:

- PM core starts suspending devices, ucc_geth_suspend gets called;

- ucc_geth calls phy_stop() on suspend. Note that phy_stop() is
  mostly asynchronous so it doesn't block ucc_geth's suspend routine,
  it just sets PHY_HALTED state and disables PHY's interrupts;

- Suddenly the state machine gets scheduled, it grabs the phydev->lock
  mutex and tries to process the PHY_HALTED state, so it calls
  phydev->adjust_link(phydev->attached_dev). In ucc_geth case
  adjust_link() calls msleep(), which reschedules the code flow back to
  PM core, which now finishes suspend and so we end up sleeping with
  phydev->lock mutex held.

On resume:

- PM core starts resuming devices (notice that nobody rescheduled
  the state machine yet, so the mutex is still held), the core calls
  ucc_geth's resume routine;

- ucc_geth_resume restarts the PHY with phy_stop()/phy_start()
  sequence, and the phy_*() calls are trying to grab the phydev->lock
  mutex. Here comes the deadlock.

This patch fixes the issue by stopping the state machine on suspend
and starting it again on resume.

Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoMerge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...
David S. Miller [Wed, 30 Dec 2009 03:44:25 +0000 (19:44 -0800)]
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

14 years agoRevert "b43: Enforce DMA descriptor memory constraints"
John W. Linville [Tue, 29 Dec 2009 19:07:42 +0000 (14:07 -0500)]
Revert "b43: Enforce DMA descriptor memory constraints"

This reverts commit 9bd568a50c446433038dec2a5186c5c57c3dbd23.

That commit is shown to cause allocation failures during initialization
on some machines.

http://bugzilla.kernel.org/show_bug.cgi?id=14844

Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwmc3200wifi: fix array out-of-boundary access
Zhu Yi [Mon, 28 Dec 2009 06:23:11 +0000 (14:23 +0800)]
iwmc3200wifi: fix array out-of-boundary access

Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().

Cc: stable@kernel.org
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agowl1251: timeout one too soon in wl1251_boot_run_firmware()
Roel Kluin [Sat, 26 Dec 2009 19:31:59 +0000 (20:31 +0100)]
wl1251: timeout one too soon in wl1251_boot_run_firmware()

`loop' reaches INIT_LOOP + 1 after the loop. so if ACX_INTR_INIT_COMPLETE
occurs in the last iteration the write occurs but also the error out as if a
timeout occurred. This is probably very unlikely to ever occur.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Kalle Valo <kalle.valo@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agomac80211: fix propagation of failed hardware reconfigurations
Luis R. Rodriguez [Thu, 24 Dec 2009 20:38:22 +0000 (15:38 -0500)]
mac80211: fix propagation of failed hardware reconfigurations

mac80211 does not propagate failed hardware reconfiguration
requests. For suspend and resume this is important due to all
the possible issues that can come out of the suspend <-> resume
cycle. Not propagating the error means cfg80211 will assume
the resume for the device went through fine and mac80211 will
continue on trying to poke at the hardware, enable timers,
queue work, and so on for a device which is completley
unfunctional.

The least we can do is to propagate device start issues and
warn when this occurs upon resume. A side effect of this patch
is we also now propagate the start errors upon harware
reconfigurations (non-suspend), but this should also be desirable
anyway, there is not point in continuing to reconfigure a
device if mac80211 was unable to start the device.

For further details refer to the thread:

http://marc.info/?t=126151038700001&r=1&w=2

Cc: stable@kernel.org
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agomac80211: fix race with suspend and dynamic_ps_disable_work
Luis R. Rodriguez [Thu, 24 Dec 2009 20:26:09 +0000 (15:26 -0500)]
mac80211: fix race with suspend and dynamic_ps_disable_work

When mac80211 suspends it calls a driver's suspend callback
as a last step and after that the driver assumes no calls will
be made to it until we resume and its start callback is kicked.
If such calls are made, however, suspend can end up throwing
hardware in an unexpected state and making the device unusable
upon resume.

Fix this by preventing mac80211 to schedule dynamic_ps_disable_work
by checking for when mac80211 starts to suspend and starts
quiescing. Frames should be allowed to go through though as
that is part of the quiescing steps and we do not flush the
mac80211 workqueue since it was already done towards the
beginning of suspend cycle.

The other mac80211 issue will be hanled in the next patch.

For further details see refer to the thread:

http://marc.info/?t=126144866100001&r=1&w=2

Cc: stable@kernel.org
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath9k: fix missed error codes in the tx status check
Felix Fietkau [Thu, 24 Dec 2009 13:04:32 +0000 (14:04 +0100)]
ath9k: fix missed error codes in the tx status check

My previous change added in:

 commit 815833e7ecf0b9a017315cae6aef4d7cd9517681
    ath9k: fix tx status reporting

was not checking all possible tx error conditions. This could possibly
lead to throughput issues due to slow rate control adaption or missed
retransmissions of failed A-MPDU frames.

This patch adds a mask for all possible error conditions and uses it
in the xmit ok check.

Cc: stable@kernel.org
Reported-by: Björn Smedman <bjorn.smedman@venatech.se>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath9k: wake hardware during AMPDU TX actions
Luis R. Rodriguez [Thu, 24 Dec 2009 01:03:29 +0000 (20:03 -0500)]
ath9k: wake hardware during AMPDU TX actions

AMDPDU actions poke hardware for TX operation, as such
we want to turn hardware on for these actions. AMDPU RX operations
do not require hardware on as nothing is done in hardware for
those actions. Without this we cannot guarantee hardware has
been programmed correctly for each AMPDU TX action.

Cc: stable@kernel.org
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath9k: wake hardware for interface IBSS/AP/Mesh removal
Luis R. Rodriguez [Thu, 24 Dec 2009 01:03:28 +0000 (20:03 -0500)]
ath9k: wake hardware for interface IBSS/AP/Mesh removal

When we remove a IBSS/AP/Mesh interface we stop DMA
but to do this we should ensure hardware is on. Awaken
the device prior to these calls. This should ensure
DMA is stopped upon suspend and plain device removal.

Cc: stable@kernel.org
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath9k: fix suspend by waking device prior to stop
Sujith [Thu, 24 Dec 2009 01:03:27 +0000 (20:03 -0500)]
ath9k: fix suspend by waking device prior to stop

Ensure the device is awake prior to trying to tell hardware
to stop it. Impact of not doing this is we can likely leave
the device in an undefined state likely causing issues with
suspend and resume. This patch ensures harware is where it
should be prior to suspend.

Cc: stable@kernel.org
Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agocfg80211: fix error path in cfg80211_wext_siwscan
Johannes Berg [Wed, 23 Dec 2009 14:33:35 +0000 (15:33 +0100)]
cfg80211: fix error path in cfg80211_wext_siwscan

If there's an invalid channel or SSID, the code leaks
the scan request. Always free the scan request, unless
it was successfully given to the driver.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Acked-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agowl1271_cmd.c: cleanup char => u8
Dan Carpenter [Wed, 23 Dec 2009 13:23:19 +0000 (15:23 +0200)]
wl1271_cmd.c: cleanup char => u8

This is just a clean up and doesn't make a functional difference.  It keeps the
lint checkers happy.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Kalle Valo <kalle.valo@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwlwifi: Storage class should be before const qualifier
Tobias Klauser [Wed, 23 Dec 2009 13:18:11 +0000 (14:18 +0100)]
iwlwifi: Storage class should be before const qualifier

The C99 specification states in section 6.11.5:

The placement of a storage-class specifier other than at the beginning
of the declaration specifiers in a declaration is an obsolescent
feature.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Acked-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath9k: Storage class should be before const qualifier
Tobias Klauser [Wed, 23 Dec 2009 13:04:43 +0000 (14:04 +0100)]
ath9k: Storage class should be before const qualifier

The C99 specification states in section 6.11.5:

The placement of a storage-class specifier other than at the beginning
of the declaration specifiers in a declaration is an obsolescent
feature.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agocfg80211: fix race between deauth and assoc response
Johannes Berg [Wed, 23 Dec 2009 12:12:05 +0000 (13:12 +0100)]
cfg80211: fix race between deauth and assoc response

Joseph Nahmias reported, in http://bugs.debian.org/562016,
that he was getting the following warning (with some log
around the issue):

  ath0: direct probe to AP 00:11:95:77:e0:b0 (try 1)
  ath0: direct probe responded
  ath0: authenticate with AP 00:11:95:77:e0:b0 (try 1)
  ath0: authenticated
  ath0: associate with AP 00:11:95:77:e0:b0 (try 1)
  ath0: deauthenticating from 00:11:95:77:e0:b0 by local choice (reason=3)
  ath0: direct probe to AP 00:11:95:77:e0:b0 (try 1)
  ath0: RX AssocResp from 00:11:95:77:e0:b0 (capab=0x421 status=0 aid=2)
  ath0: associated
  ------------[ cut here ]------------
  WARNING: at net/wireless/mlme.c:97 cfg80211_send_rx_assoc+0x14d/0x152 [cfg80211]()
  Hardware name: 7658CTO
  ...
  Pid: 761, comm: phy0 Not tainted 2.6.32-trunk-686 #1
  Call Trace:
   [<c1030a5d>] ? warn_slowpath_common+0x5e/0x8a
   [<c1030a93>] ? warn_slowpath_null+0xa/0xc
   [<f86cafc7>] ? cfg80211_send_rx_assoc+0x14d/0x152
  ...
  ath0: link becomes ready
  ath0: deauthenticating from 00:11:95:77:e0:b0 by local choice (reason=3)
  ath0: no IPv6 routers present
  ath0: link is not ready
  ath0: direct probe to AP 00:11:95:77:e0:b0 (try 1)
  ath0: direct probe responded
  ath0: authenticate with AP 00:11:95:77:e0:b0 (try 1)
  ath0: authenticated
  ath0: associate with AP 00:11:95:77:e0:b0 (try 1)
  ath0: RX ReassocResp from 00:11:95:77:e0:b0 (capab=0x421 status=0 aid=2)
  ath0: associated

It is not clear to me how the first "direct probe" here
happens, but this seems to be a race condition, if the
user requests to deauth after requesting assoc, but before
the assoc response is received. In that case, it may
happen that mac80211 tries to report the assoc success to
cfg80211, but gets blocked on the wdev lock that is held
because the user is requesting the deauth.

The result is that we run into a warning. This is mostly
harmless, but maybe cause an unexpected event to be sent
to userspace; we'd send an assoc success event although
userspace was no longer expecting that.

To fix this, remove the warning and check whether the
race happened and in that case abort processing.

Reported-by: Joseph Nahmias <joe@nahmias.net>
Cc: stable@kernel.org
Cc: 562016-quiet@bugs.debian.org
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agowireless: remove remaining qual code
Johannes Berg [Wed, 23 Dec 2009 12:12:04 +0000 (13:12 +0100)]
wireless: remove remaining qual code

This removes the remaining users of the rx status
'qual' field and the field itself.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agort2x00: Add USB ID for Linksys WUSB 600N rev 2.
Gertjan van Wingerde [Tue, 22 Dec 2009 23:03:21 +0000 (00:03 +0100)]
rt2x00: Add USB ID for Linksys WUSB 600N rev 2.

This is a rt2870 based device.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath5k: fix SWI calibration interrupt storm
Bob Copeland [Tue, 22 Dec 2009 03:26:48 +0000 (22:26 -0500)]
ath5k: fix SWI calibration interrupt storm

The calibration period is now invoked by triggering a software
interrupt from within the ISR by ath5k_hw_calibration_poll()
instead of via a timer.

However, the calibration interval isn't initialized before
interrupts are enabled, so we can have a situation where an
interrupt occurs before the interval is assigned, so the
interval is actually negative.  As a result, the ISR will
arm a software interrupt to schedule the tasklet, and then
rearm it when the SWI is processed, and so on, leading to a
softlockup at modprobe time.

Move the initialization order around so the calibration interval
is set before interrupts are active.  Another possible fix
is to schedule the tasklet directly from the poll routine,
but I think there are additional plans for the SWI.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Cc: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agomac80211: fix ibss join with fixed-bssid
Felix Fietkau [Sun, 20 Dec 2009 18:07:09 +0000 (19:07 +0100)]
mac80211: fix ibss join with fixed-bssid

When fixed bssid is requested when joining an ibss network, incoming
beacons that match the configured bssid cause mac80211 to create new
sta entries, even before the ibss interface is in joined state.
When that happens, it fails to bring up the interface entirely, because
it checks for existing sta entries before joining.
This patch fixes this bug by refusing to create sta info entries before
the interface is fully operational.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agolibertas: Remove carrier signaling from the scan code
Samuel Ortiz [Fri, 18 Dec 2009 10:36:49 +0000 (11:36 +0100)]
libertas: Remove carrier signaling from the scan code

There is no reason to signal a carrier off when doing a 802.11 scan.

Cc: Holger Schurig <holgerschurig@gmail.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoorinoco: fix GFP_KERNEL in orinoco_set_key with interrupts disabled
Andrey Borzenkov [Tue, 22 Dec 2009 18:38:44 +0000 (21:38 +0300)]
orinoco: fix GFP_KERNEL in orinoco_set_key with interrupts disabled

orinoco_set_key is called from two places both with interrupts disabled
(under orinoco_lock). Use GFP_ATOMIC instead of GFP_KERNEL. Fixes following
warning:

[   77.254109] WARNING: at /home/bor/src/linux-git/kernel/lockdep.c:2465 lockdep_trace_alloc+0x9a/0xa0()
[   77.254109] Hardware name: PORTEGE 4000
[   77.254109] Modules linked in: af_packet irnet ppp_generic slhc ircomm_tty ircomm binfmt_misc dm_mirror dm_region_hash dm_log dm_round_robin dm_multipath dm_mod loop nvram toshiba cryptomgr aead pcompress crypto_blkcipher michael_mic crypto_hash crypto_algapi orinoco_cs orinoco cfg80211 smsc_ircc2 pcmcia irda toshiba_acpi yenta_socket video i2c_ali1535 backlight rsrc_nonstatic ali_agp pcmcia_core psmouse output crc_ccitt i2c_core alim1535_wdt rfkill sg evdev ohci_hcd agpgart usbcore pata_ali libata reiserfs [last unloaded: scsi_wait_scan]
[   77.254109] Pid: 2296, comm: wpa_supplicant Not tainted 2.6.32-1avb #1
[   77.254109] Call Trace:
[   77.254109]  [<c011f0ad>] warn_slowpath_common+0x6d/0xa0
[   77.254109]  [<c014206a>] ? lockdep_trace_alloc+0x9a/0xa0
[   77.254109]  [<c014206a>] ? lockdep_trace_alloc+0x9a/0xa0
[   77.254109]  [<c011f0f5>] warn_slowpath_null+0x15/0x20
[   77.254109]  [<c014206a>] lockdep_trace_alloc+0x9a/0xa0
[   77.254109]  [<c018d296>] __kmalloc+0x36/0x130
[   77.254109]  [<dffcb6a8>] ? orinoco_set_key+0x48/0x1c0 [orinoco]
[   77.254109]  [<dffcb6a8>] orinoco_set_key+0x48/0x1c0 [orinoco]
[   77.254109]  [<dffcb9fc>] orinoco_ioctl_set_encodeext+0x1dc/0x2d0 [orinoco]
[   77.254109]  [<c035b117>] ioctl_standard_call+0x207/0x3b0
[   77.254109]  [<dffcb820>] ? orinoco_ioctl_set_encodeext+0x0/0x2d0 [orinoco]
[   77.254109]  [<c0307f1f>] ? rtnl_lock+0xf/0x20
[   77.254109]  [<c0307f1f>] ? rtnl_lock+0xf/0x20
[   77.254109]  [<c02fb115>] ? __dev_get_by_name+0x85/0xb0
[   77.254109]  [<c035b616>] wext_handle_ioctl+0x176/0x200
[   77.254109]  [<dffcb820>] ? orinoco_ioctl_set_encodeext+0x0/0x2d0 [orinoco]
[   77.254109]  [<c030020f>] dev_ioctl+0x6af/0x730
[   77.254109]  [<c02eec65>] ? move_addr_to_kernel+0x55/0x60
[   77.254109]  [<c02eed59>] ? sys_sendto+0xe9/0x130
[   77.254109]  [<c02ed77e>] sock_ioctl+0x7e/0x250
[   77.254109]  [<c02ed700>] ? sock_ioctl+0x0/0x250
[   77.254109]  [<c019cf4c>] vfs_ioctl+0x1c/0x70
[   77.254109]  [<c019d1fa>] do_vfs_ioctl+0x6a/0x590
[   77.254109]  [<c0178e50>] ? might_fault+0x90/0xa0
[   77.254109]  [<c0178e0a>] ? might_fault+0x4a/0xa0
[   77.254109]  [<c02ef90e>] ? sys_socketcall+0x17e/0x280
[   77.254109]  [<c019d759>] sys_ioctl+0x39/0x60
[   77.254109]  [<c0102e3b>] sysenter_do_call+0x12/0x32
[   77.254109] ---[ end trace 95ef563548d21efd ]---

Signed-off-by: Andrey Borzenkov <arvidjaar@mail.ru>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoNET: XFRM: Fix spelling of neighbour.
Ralf Baechle [Fri, 25 Dec 2009 23:30:02 +0000 (23:30 +0000)]
NET: XFRM: Fix spelling of neighbour.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
 net/xfrm/xfrm_policy.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agobond_3ad.c avoid possible null deref
Dan Carpenter [Wed, 23 Dec 2009 03:27:10 +0000 (03:27 +0000)]
bond_3ad.c avoid possible null deref

A few lines earlier we assume that best->slave could be either null or non-null so
we should check it here as well.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoFix MAC address access in 3c507, ibmlana, pcnet32 and libertas
Daniel Drake [Thu, 24 Dec 2009 08:11:24 +0000 (08:11 +0000)]
Fix MAC address access in 3c507, ibmlana, pcnet32 and libertas

Commit f001fde5eadd915f4858d22ed70d7040f48767cf changed
net_device.dev_addr from a 32-byte array to a pointer.

I found 4 ethernet drivers which rely on sizeof(dev_addr), which are now
only copying 4 bytes of the address information on 32bit systems.

Fix them to use ETH_ALEN.

Signed-off-by: Daniel Drake <dsd@laptop.org>
Reviewed-by: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agogianfar: Fix gianfar select_queue bogosity
Sandeep Gopalpet [Thu, 24 Dec 2009 03:13:06 +0000 (03:13 +0000)]
gianfar: Fix gianfar select_queue bogosity

The gfar_select_queue() function was used to set queue mapping
only for forwarding/bridging applications and the condition
for locally generated packets was completely ignored.

The solution is to remove the gfar_select_queue() function and
use skb_record_rx_queue to set queue mapping for
forwarding/bridging applications. This will ensure that in case of
forwarding/bridging applications txq = rxq will be selected and
skb_tx_hash will be used to pick up a txq for locally generated packets.

Signed-off-by: Sandeep Gopalpet <Sandeep.Kumar@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agotun: use tun_sk instead container_of
Vitaliy Gusev [Fri, 25 Dec 2009 07:17:43 +0000 (07:17 +0000)]
tun: use tun_sk instead container_of

Using macro tun_sk is more clear and shorter. However tun.c has tun_sk,
but doesn't use it.

Signed-off-by: Vitaliy Gusev <vgusev@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoucc_geth: Don't needlessly change MAC settings in adjust_link()
Anton Vorontsov [Thu, 24 Dec 2009 05:31:20 +0000 (05:31 +0000)]
ucc_geth: Don't needlessly change MAC settings in adjust_link()

If PHY doesn't have an IRQ, phylib would poll for link changes, and
would call adjust_link() every second. In that case we disable and
enable the controller every second.

Let's better check if there is actually anything changed, and, if so,
change the MAC settings.

Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoucc_geth: Fix netdev watchdog triggering on link changes
Anton Vorontsov [Thu, 24 Dec 2009 05:31:05 +0000 (05:31 +0000)]
ucc_geth: Fix netdev watchdog triggering on link changes

Since commit 864fdf884e82bacbe8ca5e93bd43393a61d2e2b4 ("ucc_geth:
Fix hangs after switching from full to half duplex") ucc_geth driver
disables the controller during MAC configuration changes. Though,
disabling the controller might take quite awhile, and so the netdev
watchdog might get upset:

 NETDEV WATCHDOG: eth2 (ucc_geth): transmit queue 0 timed out
 ------------[ cut here ]------------
 Badness at c02729a8 [verbose debug info unavailable]
 NIP: c02729a8 LR: c02729a8 CTR: c01b6088
 REGS: c0451c40 TRAP: 0700   Not tainted  (2.6.32-trunk-8360e)
 [...]
 NIP [c02729a8] dev_watchdog+0x280/0x290
 LR [c02729a8] dev_watchdog+0x280/0x290
 Call Trace:
 [c0451cf0] [c02729a8] dev_watchdog+0x280/0x290 (unreliable)
 [c0451d50] [c00377c4] run_timer_softirq+0x164/0x224
 [c0451da0] [c0032a38] __do_softirq+0xb8/0x13c
 [c0451df0] [c00065cc] do_softirq+0xa0/0xac
 [c0451e00] [c003280c] irq_exit+0x7c/0x9c
 [c0451e10] [c00640c4] __ipipe_sync_stage+0x248/0x24c
 [...]

This patch fixes the issue by detaching the netdev during the
time we change the configuration.

Reported-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Tested-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
Cc: Stable <stable@vger.kernel.org> [2.6.32]
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoucc_geth: Fix empty TX queue processing
Anton Vorontsov [Thu, 24 Dec 2009 05:31:03 +0000 (05:31 +0000)]
ucc_geth: Fix empty TX queue processing

Following oops was seen with the ucc_geth driver:

 Unable to handle kernel paging request for data at address 0x00000058
 Faulting instruction address: 0xc024f2fc
 Oops: Kernel access of bad area, sig: 11 [#1]
 [...]
 NIP [c024f2fc] skb_recycle_check+0x14/0x100
 LR [e30aa0a4] ucc_geth_poll+0xd8/0x4e0 [ucc_geth_driver]
 Call Trace:
 [df857d50] [c000b03c] __ipipe_grab_irq+0x3c/0xa4 (unreliable)
 [df857d60] [e30aa0a4] ucc_geth_poll+0xd8/0x4e0 [ucc_geth_driver]
 [df857dd0] [c0258cf8] net_rx_action+0xf8/0x1b8
 [df857e10] [c0032a38] __do_softirq+0xb8/0x13c
 [df857e60] [c00065cc] do_softirq+0xa0/0xac
 [...]

This is because ucc_geth_tx() tries to process an empty queue when
queues are logically stopped. Stopping the queues doesn't disable
polling, and since nowadays ucc_geth_tx() is actually called from
the polling routine, the oops above might pop up.

Fix this by removing 'netif_queue_stopped() == 0' check.

Reported-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Tested-by: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
Cc: Stable <stable@vger.kernel.org> [2.6.32]
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agovxge: use DMA_BIT_MASK instead of plain values.
Denis Kirjanov [Sat, 26 Dec 2009 02:48:33 +0000 (18:48 -0800)]
vxge: use DMA_BIT_MASK instead of plain values.

Use DMA_BIT_MASK instead of plain values.

Signed-off-by: Denis Kirjanov <kirjanov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agonet: restore ip source validation
Jamal Hadi Salim [Sat, 26 Dec 2009 01:30:22 +0000 (17:30 -0800)]
net: restore ip source validation

when using policy routing and the skb mark:
there are cases where a back path validation requires us
to use a different routing table for src ip validation than
the one used for mapping ingress dst ip.
One such a case is transparent proxying where we pretend to be
the destination system and therefore the local table
is used for incoming packets but possibly a main table would
be used on outbound.
Make the default behavior to allow the above and if users
need to turn on the symmetry via sysctl src_valid_mark

Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agobnx2x: Initialize cnic status block during chip reset
Michael Chan [Sat, 26 Dec 2009 01:13:07 +0000 (17:13 -0800)]
bnx2x: Initialize cnic status block during chip reset

When the device is reset during MTU change, ring size change, or self
test, etc, the cnic status block needs to be properly initialized if
cnic is registered.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agopktgen: ndo_start_xmit can return NET_XMIT_xxx values
John Fastabend [Thu, 24 Dec 2009 06:02:57 +0000 (22:02 -0800)]
pktgen: ndo_start_xmit can return NET_XMIT_xxx values

This updates pktgen so that it does not decrement skb->users
when it receives valid NET_XMIT_xxx values.  These are now
valid return values from ndo_start_xmit in net-next-2.6.
They also indicate the skb has been consumed.

This fixes pktgen to work correctly with vlan devices.

Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agonet/via-rhine: Fix scheduling while atomic bugs
Jarek Poplawski [Thu, 24 Dec 2009 05:54:29 +0000 (21:54 -0800)]
net/via-rhine: Fix scheduling while atomic bugs

There are BUGs "scheduling while atomic" triggered by the timer
rhine_tx_timeout(). They are caused by calling napi_disable() (with
msleep()). This patch fixes it by moving most of the timer content to
the workqueue function (similarly to other drivers, like tg3), with
spin_lock() changed to BH version.

Additionally, there is spin_lock_irq() moved in rhine_close() to
exclude napi_disable() etc., also tg3's way.

Reported-by: Andrey Rahmatullin <wrar@altlinux.org>
Tested-by: Andrey Rahmatullin <wrar@altlinux.org>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoixgbe: fix Need to call pci_save_state after pci_restore_state
Don Skidmore [Thu, 24 Dec 2009 05:19:19 +0000 (21:19 -0800)]
ixgbe: fix Need to call pci_save_state after pci_restore_state

This patch adds a pci_save_state() call in ixgbe_resume() after
pci_restore_state(). A similar change was made in ixgbe_io_slot_reset()
that accommodates pci_restore_state() new behavior. This change makes
pci_restore_state() clear the saved_state flag This is necessary due
to a resent kernel change to pci_restore_state() so that it now clears
the saved_state flag of the device right after the device.s standard
configuration registers have been poplulated with the previously saved
values.

Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com>
Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agobe2net: Bug fix to return correct values in ethtool get_settings.
Sarveshwar Bandi [Wed, 23 Dec 2009 04:42:51 +0000 (04:42 +0000)]
be2net: Bug fix to return correct values in ethtool get_settings.

Changes to return correct values for transceiver and supported in
ethtool get_settings function.

Signed-off-by: Sarveshwar Bandi <sarveshwarb@serverengines.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agobe2net: Bug fix to config NIC appropriately before loopback test
Sarveshwar Bandi [Wed, 23 Dec 2009 04:41:44 +0000 (04:41 +0000)]
be2net: Bug fix to config NIC appropriately before loopback test

NIC controller has to be set to an appropriate mode before doing a loopback
test. Test will fail otherwise.

Signed-off-by: Sarveshwar Bandi <sarveshwarb@serverengines.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agobe2net: Bug fix to avoid soft lockup in loopback test.
Sarveshwar Bandi [Wed, 23 Dec 2009 04:40:36 +0000 (04:40 +0000)]
be2net: Bug fix to avoid soft lockup in loopback test.

This change ensures that loopback test command gives up after 4 seconds when
the hardware is not responsive. This could happen if the ports are connected
properly in loopback mode.

Signed-off-by: Sarveshwar Bandi <sarveshwarb@serverengines.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoigbvf: Make igbvf error message more informative
Williams, Mitch A [Wed, 23 Dec 2009 13:22:43 +0000 (13:22 +0000)]
igbvf: Make igbvf error message more informative

Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoigb: check both function bits in status register in wol exception
Alexander Duyck [Wed, 23 Dec 2009 13:21:46 +0000 (13:21 +0000)]
igb: check both function bits in status register in wol exception

The ethtool code for enabling Wake on Lan was not correctly checking the
status register bits so as a result ports 0 and 2 were both being allowed
to set WOL to enabled even though it is only supported on the first port
for our adapters.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoigb: correctly offset 82575 flow control watermarks by 16 bytes
Alexander Duyck [Wed, 23 Dec 2009 13:21:27 +0000 (13:21 +0000)]
igb: correctly offset 82575 flow control watermarks by 16 bytes

The watermark values for the 82575 were not being set correctly.  As a
result the high and low watermark values were set to the same value which
can lead to excess xon/xoff packets being generated.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoigb: do not force retry count to 1 on 82580 phy
Alexander Duyck [Wed, 23 Dec 2009 13:21:07 +0000 (13:21 +0000)]
igb: do not force retry count to 1 on 82580 phy

This change resolves an issue seen in some configurations where the link
may drop to 100Mb/s even though the link itself supports 1000Mb/s.  The
issue was root caused to the fact that we were only trying the link once.
Now instead we will try up to 5 attempts on a faulty cable before
downshifting to 100Mb/s.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoigb: do not force pcs link when in KX mode
Alexander Duyck [Wed, 23 Dec 2009 13:20:47 +0000 (13:20 +0000)]
igb: do not force pcs link when in KX mode

We were forcing the PCS link up in error when we are in KX mode.  We should
only be disabling autoneg, not forcing the link up.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agosfc: Disable TX descriptor prefetch watchdog
Ben Hutchings [Wed, 23 Dec 2009 13:49:13 +0000 (13:49 +0000)]
sfc: Disable TX descriptor prefetch watchdog

This hardware watchdog can misfire, so it does more harm than good.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agosfc: QT2025C: Add error message for suspected bad SFP+ cables
Ben Hutchings [Wed, 23 Dec 2009 13:48:42 +0000 (13:48 +0000)]
sfc: QT2025C: Add error message for suspected bad SFP+ cables

Some cables have EEPROMs that conflict with the PHY's on-board EEPROM
so it cannot load firmware.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agosfc: QT2025C: Work around PHY firmware initialisation bug
Matthew Slattery [Wed, 23 Dec 2009 13:48:32 +0000 (13:48 +0000)]
sfc: QT2025C: Work around PHY firmware initialisation bug

The PHY's firmware very occasionally appears to lock up very early, but
with the heartbeat update still running.  Rebooting the microcontroller
core seems to be sufficient to recover.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agosfc: QT2025C: Switch into self-configure mode when not in loopback
Matthew Slattery [Wed, 23 Dec 2009 13:48:04 +0000 (13:48 +0000)]
sfc: QT2025C: Switch into self-configure mode when not in loopback

The PHY boots in a mode which is not necessarily optimal.  This change
switches it to self-configure mode (except when in loopback, which
won't work in that mode if an SFP+ module is not present) by rebooting
the PHY's microcontroller, and replicating the sequence of configuration
writes from the boot EEPROM with the appropriate changes.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agosfc: QT2025C: Work around PHY bug
Matthew Slattery [Wed, 23 Dec 2009 13:47:37 +0000 (13:47 +0000)]
sfc: QT2025C: Work around PHY bug

If we see the PHY remaining stuck in a link-down state due to PCS being
down while PMA/PMD is up, we briefly switch to PMA/PMD loopback and back,
which usually unsticks it.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agosfc: Fix DMA mapping cleanup in case of an error in TSO
Neil Turton [Wed, 23 Dec 2009 13:47:13 +0000 (13:47 +0000)]
sfc: Fix DMA mapping cleanup in case of an error in TSO

We need buffer->len to remain valid to work out the correct address to
be unmapped.  We therefore need to clear buffer->len after the unmap
operation.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agosfc: Include XGXS in XMAC link status check except in XGMII loopback
Ben Hutchings [Wed, 23 Dec 2009 13:46:47 +0000 (13:46 +0000)]
sfc: Include XGXS in XMAC link status check except in XGMII loopback

The XGXS block may not get a link immediately in XGXS or XAUI loopback
modes, so we still need to check it.  Split falcon_xaui_link_ok() into
falcon_xgxs_link_ok(), which checks only the Falcon XGXS block, and
falcon_xmac_link_ok(), which checks one or both sides of the link as
appropriate.  Also rename falcon_check_xaui_link() to
falcon_xmac_link_ok_retry().

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agosfc: Move PHY software state initialisation from init() into probe()
Steve Hodgson [Wed, 23 Dec 2009 13:46:36 +0000 (13:46 +0000)]
sfc: Move PHY software state initialisation from init() into probe()

This prevents efx->link_advertising from being blatted during
a reset.

The phy_short_reach sysfs node is now destroyed later in the
port shutdown process, so check for STATE_RUNNING after
acquiring the rtnl_lock (just like in set_phy_flash_cfg).

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoMerge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...
David S. Miller [Mon, 21 Dec 2009 19:54:49 +0000 (11:54 -0800)]
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

14 years agops3_gelic_wireless: Fix build failure due to missing WEXT_PRIV
Benjamin Herrenschmidt [Fri, 18 Dec 2009 19:19:32 +0000 (11:19 -0800)]
ps3_gelic_wireless: Fix build failure due to missing WEXT_PRIV

The option to support the old style PSK interface in the PS3
GELIC wireless drivers requires CONFIG_WEXT_PRIV to be set

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Geoff Levand <geoffrey.levand@am.sony.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agomac80211: fix WMM AP settings application
Johannes Berg [Thu, 17 Dec 2009 15:16:53 +0000 (16:16 +0100)]
mac80211: fix WMM AP settings application

My
  commit 77fdaa12cea26c204cc12c312fe40bc0f3dcdfd8
  Author: Johannes Berg <johannes@sipsolutions.net>
  Date:   Tue Jul 7 03:45:17 2009 +0200

      mac80211: rework MLME for multiple authentications

inadvertedly broke WMM because it removed, along with
a bunch of other now useless initialisations, the line
initialising sdata->u.mgd.wmm_last_param_set to -1
which would make it adopt any WMM parameter set. If,
as is usually the case, the AP uses WMM parameter set
sequence number zero, we'd never update it until the
AP changes the sequence number.

Add the missing initialisation back to get the WMM
settings from the AP applied locally.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Cc: stable@kernel.org [2.6.31+]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agomac80211: fix peer HT capabilities
Johannes Berg [Thu, 17 Dec 2009 12:55:48 +0000 (13:55 +0100)]
mac80211: fix peer HT capabilities

I noticed yesterday, because Jeff had noticed
a speed regression, cf. bug
http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2138
that the SM PS settings for peers were wrong.
Instead of overwriting the SM PS settings with
the local bits, we need to keep the remote bits.

The bug was part of the original HT code from
over two years ago, but unfortunately nobody
noticed that it makes no sense -- we shouldn't
be overwriting the peer's setting with our own
but rather keep it intact when masking the peer
capabilities with our own.

While fixing that, I noticed that the masking of
capabilities is completely useless for most of
the bits, so also fix those other bits.

Finally, I also noticed that PSMP_SUPPORT no
longer exists in the final 802.11n version, so
also remove that.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwmc3200wifi: Fix test of unsigned in iwm_ntf_stop_resume_tx()
Roel Kluin [Wed, 16 Dec 2009 16:01:38 +0000 (17:01 +0100)]
iwmc3200wifi: Fix test of unsigned in iwm_ntf_stop_resume_tx()

`queue' was unsigned so the test did not work.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Reviewed-by: Pavel Roskin <proski@gnu.org>
Acked-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoLibertas: fix buffer overflow in lbs_get_essid()
Daniel Mack [Wed, 16 Dec 2009 04:12:58 +0000 (05:12 +0100)]
Libertas: fix buffer overflow in lbs_get_essid()

The libertas driver copies the SSID buffer back to the wireless core and
appends a trailing NULL character for termination. This is

a) unnecessary because the buffer is allocated with kzalloc and is hence
   already NULLed when this function is called, and

b) for priv->curbssparams.ssid_len == 32, it writes back one byte too
   much which causes memory corruptions.

Fix this by removing the extra write.

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Cc: Stephen Hemminger <shemminger@vyatta.com>
Cc: Maithili Hinge <maithili@marvell.com>
Cc: Kiran Divekar <dkiran@marvell.com>
Cc: Michael Hirsch <m.hirsch@raumfeld.com>
Cc: netdev@vger.kernel.org
Cc: libertas-dev@lists.infradead.org
Cc: linux-wireless@lists.infradead.org
Cc: stable@kernel.org
Acked-by: Holger Schurig <holgerschurig@gmail.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agodrivers/net/wireless/iwlwifi/iwl-tx.c: fix gcc-3.4.5 warning
akpm@linux-foundation.org [Mon, 14 Dec 2009 23:56:54 +0000 (15:56 -0800)]
drivers/net/wireless/iwlwifi/iwl-tx.c: fix gcc-3.4.5 warning

drivers/net/wireless/iwlwifi/iwl-tx.c: In function `iwl_hw_txq_ctx_free':
drivers/net/wireless/iwlwifi/iwl-tx.c:410: warning: suggest explicit braces to avoid ambiguous `else'

Cc: Zhu Yi <yi.zhu@intel.com>
Cc: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath9k: Stop ANI when doing a reset
Sujith [Mon, 14 Dec 2009 11:04:56 +0000 (16:34 +0530)]
ath9k: Stop ANI when doing a reset

The MIB counters are disabled when doing a chip reset.
Since ANI depends on the MIB registers for its operation, relying
on the contents of said registers during HW reset results in sub-optimal
performance.

Cc: stable@kernel.org
Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath9k: Fix TX queue draining
Sujith [Mon, 14 Dec 2009 09:27:08 +0000 (14:57 +0530)]
ath9k: Fix TX queue draining

When TX DMA termination has failed, the HW has to be reset
completely. Doing a fast channel change in this case is insufficient.
Also, change the debug level of a couple of messages to FATAL.

Cc: stable@kernel.org
Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath9k: Fix bug in assigning sequence number
Sujith [Mon, 14 Dec 2009 09:26:56 +0000 (14:56 +0530)]
ath9k: Fix bug in assigning sequence number

The internal, driver-specific maintenance of sequence
numbers is applicable only for HT frames.

Also, remove comments that are not relevant anymore.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agort2x00: Fix calculation of rt2800 iveiv entry offset.
Gertjan van Wingerde [Mon, 14 Dec 2009 22:32:31 +0000 (23:32 +0100)]
rt2x00: Fix calculation of rt2800 iveiv entry offset.

Fix typo. The index should be multiplied by the entry size, not 'and'-ed.

Found via code-inspection.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwlwifi: fix 40MHz operation setting on cards that do not allow it
Reinette Chatre [Mon, 14 Dec 2009 22:12:13 +0000 (14:12 -0800)]
iwlwifi: fix 40MHz operation setting on cards that do not allow it

Some devices have 40MHz operation disabled entirely. Ensure that driver do
not enable 40MHz operation if a channel does not allow this.

This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2135

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
CC: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwl3945: fix panic in iwl3945 driver
Zhu Yi [Mon, 14 Dec 2009 22:12:12 +0000 (14:12 -0800)]
iwl3945: fix panic in iwl3945 driver

3945 updated write_ptr without regard to read_ptr on the Tx path.
This messes up our TFD on high load and result in the following:

<1>[ 7290.414172] IP: [<ffffffffa0dd53a1>] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
<4>[ 7290.414205] PGD 0
<1>[ 7290.414214] Thread overran stack, or stack corrupted
<0>[ 7290.414229] Oops: 0002 [#1] PREEMPT SMP
<0>[ 7290.414246] last sysfs file: /sys/devices/platform/coretemp.1/temp1_input
<4>[ 7290.414265] CPU 0
<4>[ 7290.414274] Modules linked in: af_packet nfsd usb_storage usb_libusual cpufreq_powersave exportfs cpufreq_conservative iwl3945 nfs cpufreq_userspace snd_hda_codec_realtek acpi_cpufreq uvcvideo lockd iwlcore snd_hda_intel joydev coretemp nfs_acl videodev snd_hda_codec mac80211 v4l1_compat snd_hwdep sbp2 v4l2_compat_ioctl32 uhci_hcd psmouse auth_rpcgss ohci1394 cfg80211 ehci_hcd video ieee1394 snd_pcm serio_raw battery ac nvidia(P) usbcore output sunrpc evdev lirc_ene0100 snd_page_alloc rfkill tg3 libphy fuse lzo lzo_decompress lzo_compress
<6>[ 7290.414486] Pid: 0, comm: swapper Tainted: P           2.6.32-rc8-wl #213 Aspire 5720
<6>[ 7290.414507] RIP: 0010:[<ffffffffa0dd53a1>]  [<ffffffffa0dd53a1>] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
<6>[ 7290.414541] RSP: 0018:ffff880002203d60  EFLAGS: 00010246
<6>[ 7290.414557] RAX: 000000000000004f RBX: ffff880064c11600 RCX: 0000000000000013
<6>[ 7290.414576] RDX: ffffffffa0ddcf20 RSI: ffff8800512b7008 RDI: 0000000000000038
<6>[ 7290.414596] RBP: ffff880002203dd0 R08: 0000000000000000 R09: 0000000000000100
<6>[ 7290.414616] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000000000a0
<6>[ 7290.414635] R13: 0000000000000002 R14: 0000000000000013 R15: 0000000000020201
<6>[ 7290.414655] FS:  0000000000000000(0000) GS:ffff880002200000(0000) knlGS:0000000000000000
<6>[ 7290.414677] CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
<6>[ 7290.414693] CR2: 0000000000000041 CR3: 0000000001001000 CR4: 00000000000006f0
<6>[ 7290.414712] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
<6>[ 7290.414732] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
<4>[ 7290.414752] Process swapper (pid: 0, threadinfo ffffffff81524000, task ffffffff81528b60)
<0>[ 7290.414772] Stack:
<4>[ 7290.414780]  ffff880002203da0 0000000000000046 0000000000000000 0000000000000046
<4>[ 7290.414804] <0> 0000000000000282 0000000000000282 0000000000000282 ffff880064c12010
<4>[ 7290.414830] <0> ffff880002203db0 ffff880064c11600 ffff880064c12e50 ffff8800512b7000
<0>[ 7290.414858] Call Trace:
<0>[ 7290.414867]  <IRQ>
<4>[ 7290.414884]  [<ffffffffa0dc8c47>] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945]
<4>[ 7290.414910]  [<ffffffff8138fc60>] ? _spin_unlock+0x30/0x60
<4>[ 7290.414931]  [<ffffffff81049a21>] tasklet_action+0x101/0x110
<4>[ 7290.414950]  [<ffffffff8104a3d0>] __do_softirq+0xc0/0x160
<4>[ 7290.414968]  [<ffffffff8100d01c>] call_softirq+0x1c/0x30
<4>[ 7290.414986]  [<ffffffff8100eff5>] do_softirq+0x75/0xb0
<4>[ 7290.415003]  [<ffffffff81049ee5>] irq_exit+0x95/0xa0
<4>[ 7290.415020]  [<ffffffff8100e547>] do_IRQ+0x77/0xf0
<4>[ 7290.415038]  [<ffffffff8100c7d3>] ret_from_intr+0x0/0xf
<0>[ 7290.415052]  <EOI>
<4>[ 7290.415067]  [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
<4>[ 7290.415087]  [<ffffffff81234f04>] ? acpi_idle_enter_bm+0x27a/0x2a5
<4>[ 7290.415107]  [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
<4>[ 7290.415130]  [<ffffffff812c11f3>] ? cpuidle_idle_call+0x93/0xf0
<4>[ 7290.415149]  [<ffffffff8100b0d7>] ? cpu_idle+0xa7/0x110
<4>[ 7290.415168]  [<ffffffff8137b3d5>] ? rest_init+0x75/0x80
<4>[ 7290.415187]  [<ffffffff8158cd0a>] ? start_kernel+0x3a7/0x3b3
<4>[ 7290.415206]  [<ffffffff8158c315>] ? x86_64_start_reservations+0x125/0x129
<4>[ 7290.415227]  [<ffffffff8158c3fd>] ? x86_64_start_kernel+0xe4/0xeb
<0>[ 7290.415243] Code: 00 41 39 ce 0f 8d e8 01 00 00 48 8b 47 40 48 63 d2 48 69 d2 98 00 00 00 4c 8b 04 02 48 c7 c2 20 cf dd a0 49 8d 78 38 49 8d 40 4f <c6> 47 09 00 c6 47 0c 00 c6 47 0f 00 c6 47 12 00 c6 47 15 00 49
<1>[ 7290.415382] RIP  [<ffffffffa0dd53a1>] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
<4>[ 7290.415410]  RSP <ffff880002203d60>
<0>[ 7290.415421] CR2: 0000000000000041
<4>[ 7290.415436] ---[ end trace ec46807277caa515 ]---
<0>[ 7290.415450] Kernel panic - not syncing: Fatal exception in interrupt
<4>[ 7290.415468] Pid: 0, comm: swapper Tainted: P      D    2.6.32-rc8-wl #213
<4>[ 7290.415486] Call Trace:
<4>[ 7290.415495]  <IRQ>  [<ffffffff8138c040>] panic+0x7d/0x13a
<4>[ 7290.415519]  [<ffffffff8101071a>] oops_end+0xda/0xe0
<4>[ 7290.415538]  [<ffffffff8102e1ea>] no_context+0xea/0x250
<4>[ 7290.415557]  [<ffffffff81038991>] ? select_task_rq_fair+0x511/0x780
<4>[ 7290.415578]  [<ffffffff8102e475>] __bad_area_nosemaphore+0x125/0x1e0
<4>[ 7290.415597]  [<ffffffff81038d0c>] ? __enqueue_entity+0x7c/0x80
<4>[ 7290.415616]  [<ffffffff81039201>] ? enqueue_task_fair+0x111/0x150
<4>[ 7290.415636]  [<ffffffff8102e53e>] bad_area_nosemaphore+0xe/0x10
<4>[ 7290.415656]  [<ffffffff8102e8fa>] do_page_fault+0x26a/0x320
<4>[ 7290.415674]  [<ffffffff813905df>] page_fault+0x1f/0x30
<4>[ 7290.415697]  [<ffffffffa0dd53a1>] ? iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945]
<4>[ 7290.415723]  [<ffffffffa0dc8c47>] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945]
<4>[ 7290.415746]  [<ffffffff8138fc60>] ? _spin_unlock+0x30/0x60
<4>[ 7290.415764]  [<ffffffff81049a21>] tasklet_action+0x101/0x110
<4>[ 7290.415783]  [<ffffffff8104a3d0>] __do_softirq+0xc0/0x160
<4>[ 7290.415801]  [<ffffffff8100d01c>] call_softirq+0x1c/0x30
<4>[ 7290.415818]  [<ffffffff8100eff5>] do_softirq+0x75/0xb0
<4>[ 7290.415835]  [<ffffffff81049ee5>] irq_exit+0x95/0xa0
<4>[ 7290.415852]  [<ffffffff8100e547>] do_IRQ+0x77/0xf0
<4>[ 7290.415869]  [<ffffffff8100c7d3>] ret_from_intr+0x0/0xf
<4>[ 7290.415883]  <EOI>  [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
<4>[ 7290.415911]  [<ffffffff81234f04>] ? acpi_idle_enter_bm+0x27a/0x2a5
<4>[ 7290.415931]  [<ffffffff81234efa>] ? acpi_idle_enter_bm+0x270/0x2a5
<4>[ 7290.415952]  [<ffffffff812c11f3>] ? cpuidle_idle_call+0x93/0xf0
<4>[ 7290.415971]  [<ffffffff8100b0d7>] ? cpu_idle+0xa7/0x110
<4>[ 7290.415989]  [<ffffffff8137b3d5>] ? rest_init+0x75/0x80
<4>[ 7290.416007]  [<ffffffff8158cd0a>] ? start_kernel+0x3a7/0x3b3
<4>[ 7290.416026]  [<ffffffff8158c315>] ? x86_64_start_reservations+0x125/0x129
<4>[ 7290.416047]  [<ffffffff8158c3fd>] ? x86_64_start_kernel+0xe4/0xeb

Reported-by: Maxim Levitsky <maximlevitsky@gmail.com>
Tested-by: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
CC: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwlwifi: initialize spinlock before use
Reinette Chatre [Mon, 14 Dec 2009 22:12:11 +0000 (14:12 -0800)]
iwlwifi: initialize spinlock before use

Recent powersaving work resulted in power management ops being called
during EEPROM initialization. The lock used by these functions is not
initialized at this time. Ensure lock is initialized before it is used.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwl3945: disable power save
Reinette Chatre [Mon, 14 Dec 2009 22:12:10 +0000 (14:12 -0800)]
iwl3945: disable power save

we see from http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2125
that power saving does not work well on 3945. Since then power saving has
also been connected with association problems where an AP deathenticates a
3945 after it is unable to transmit data to it - this happens when 3945
enters power savings mode.

Disable power save support until issues are resolved.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
CC: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwlwifi: fix more eeprom endian bugs
Johannes Berg [Mon, 14 Dec 2009 22:12:09 +0000 (14:12 -0800)]
iwlwifi: fix more eeprom endian bugs

I've also for a long time had a problem with the
temperature calculation code, which I had fixed
by byte-swapping the values, and now it turns out
that was the correct fix after all.

Also, any use of iwl_eeprom_query_addr() that is
for more than a u8 must be cast to little endian,
and some structs as well.

Fix all this. Again, no real impact on platforms
that already are little endian.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Cc: stable@kernel.org
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwlwifi: fix EEPROM/OTP reading endian annotations and a bug
Johannes Berg [Mon, 14 Dec 2009 22:12:08 +0000 (14:12 -0800)]
iwlwifi: fix EEPROM/OTP reading endian annotations and a bug

The construct "le16_to_cpu((__force __le16)(r >> 16))" has
always bothered me when looking through the iwlwifi code,
it shouldn't be necessary to __force anything, and before
this code, "r" was obtained with an ioread32, which swaps
each of the two u16 values in it properly when swapping the
entire u32 value. I've had arguments about this code with
people before, but always conceded they were right because
removing it only made things not work at all on big endian
platforms.

However, analysing a failure of the OTP reading code, I now
finally figured out what is going on, and why my intuition
about that code being wrong was right all along.

It turns out that the 'priv->eeprom' u8 array really wants
to have the data in it in little endian. So the force code
above and all really converts *to* little endian, not from
it. Cf., for instance, the function iwl_eeprom_query16() --
it reads two u8 values and combines them into a u16, in a
little-endian way. And considering it more, it makes sense
to have the eeprom array as on the device, after all not
all values really are 16-bit values, the MAC address for
instance is not.

Now, what this really means is that all the annotations are
completely wrong. The eeprom reading code should fill the
priv->eeprom array as a __le16 array, with __le16 values.

This also means that iwl_read_otp_word() should really have
a __le16 pointer as the data argument, since it should be
filling that in a format suitable for priv->eeprom.

Propagating these changes throughout, iwl_find_otp_image()
is found to be, now obviously visible, defective -- it uses
the data returned by iwl_read_otp_word() directly as if it
was CPU endianness. Fixing that, which is this hunk of the
patch:

-               next_link_addr = link_value * sizeof(u16);
+               next_link_addr = le16_to_cpu(link_value) * sizeof(u16);

is the only real change of this patch. Everything else is
just fixing the sparse annotations.

Also, the bug only shows up on big endian platforms with a
1000 series card. 5000 and previous series do not use OTP,
and 6000 series has shadow RAM support which means we don't
ever use the defective code on any cards but 1000.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Cc: stable@kernel.org
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agort2x00: Disable powersaving for rt61pci and rt2800pci.
Gertjan van Wingerde [Mon, 14 Dec 2009 19:33:55 +0000 (20:33 +0100)]
rt2x00: Disable powersaving for rt61pci and rt2800pci.

We've had many reports of rt61pci failures with powersaving enabled.
Therefore, as a stop-gap measure, disable powersaving of the rt61pci
until we have found a proper solution.
Also disable powersaving on rt2800pci as it most probably will show
the same problem.

Cc: stable@kernel.org
Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agodrivers/net/wireless: Correct code taking the size of a pointer
Julia Lawall [Sun, 13 Dec 2009 16:07:45 +0000 (17:07 +0100)]
drivers/net/wireless: Correct code taking the size of a pointer

sizeof(iv16) and sizeof(iv32) are the sizes of pointers.  Change them to
the size of the copied data.

Furthermore, iveiv_entry is a local structure that has just been
initialized and is not visible outside this function.  Thus, there would
seem to be no point to copy data into it.  The order of the arguments is
thus changed to copy the data into the parameters, which are provided as
pointers, suggesting in this case that they should be used to return values.

A simplified version of the semantic patch that finds the first problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression *x;
expression f;
type T;
@@

*f(...,(T)x,...)
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoath9k: Last fix for TX software padding.
Benoit Papillault [Fri, 11 Dec 2009 23:22:35 +0000 (00:22 +0100)]
ath9k: Last fix for TX software padding.

First, we copy/paste the padding stuff from ath9k_tx to ath_tx_cabq since it
needs to same kind of padding, but for internally generated beacons.
Next, software padding done on TX needs to be removed before calling
ieee80211_tx_status. The code was already there in ath_tx_complete but it
was wrong. Fix it by using ath9k_cmn_padpos. This later code has been
tested by sending packets to a monitor interface and reading packets from the
same interface.

Signed-off-by: Benoit PAPILLAULT <benoit.papillault@free.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwlwifi: fix syslog message for event log dump size
Wey-Yi Guy [Thu, 10 Dec 2009 22:37:23 +0000 (14:37 -0800)]
iwlwifi: fix syslog message for event log dump size

When trigger event log dumping from debugfs, the entire event log
should be dumped and the size should match the number of events being
dump.

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwlwifi: power up all devices for EEPROM read
Reinette Chatre [Thu, 10 Dec 2009 22:37:22 +0000 (14:37 -0800)]
iwlwifi: power up all devices for EEPROM read

Recent commits "iwlwifi: remove power-wasting calls to apm_ops.init()" and
"iwlagn: power up device before initializing EEPROM" had the goal of
reducing device power consumption from the time the module is loaded until
the interface is brought up and the device's power saving mechanisms kick
in. The idea is that once the module is loaded there is no need for the
device to consume power until the interface is brought up.

With the current solution the device is only powered up during EEPROM read,
and then so also only if the EEPROM type is OTP. We have found that on
certain platforms even non-OTP devices require power to be up during EEPROM
read. On these platforms the driver never loads and the system log contains
the following:

iwlagn 0000:03:00.0: MAC is in deep sleep!.  CSR_GP_CNTRL = 0x080403D8

We thus now power up all devices during EEPROM read.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agoiwlwifi: allocated rx page accounting cleanup
Zhu Yi [Thu, 10 Dec 2009 22:37:21 +0000 (14:37 -0800)]
iwlwifi: allocated rx page accounting cleanup

In iwlwifi, priv->alloc_rxb_page is used to keep track of the Rx
pages allocated by the driver. This cleans up the page free routines
by introducing __iwl_free_pages/iwl_free_pages so that the accounting
is more accurate and less error prone. This also fixes two instances where
the counter was not updated.

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
14 years agobnx2: Fix bnx2_netif_stop() merge error.
Michael Chan [Mon, 21 Dec 2009 02:40:18 +0000 (18:40 -0800)]
bnx2: Fix bnx2_netif_stop() merge error.

The error was introduced while merging:

commit 4529819c45161e4a119134f56ef504e69420bc98
bnx2: reset_task is crashing the kernel. Fixing it.

Signed-off-by: Michael Chan <mchan@broadcom.com>k
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agogianfar: Fix bit definitions of IMASK_GRSC and IMASK_GTSC
Sandeep Gopalpet [Wed, 16 Dec 2009 01:15:17 +0000 (01:15 +0000)]
gianfar: Fix bit definitions of IMASK_GRSC and IMASK_GTSC

Signed-off-by: Sandeep Gopalpet <Sandeep.Kumar@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agogianfar: Fix stats support
Sandeep Gopalpet [Wed, 16 Dec 2009 01:15:07 +0000 (01:15 +0000)]
gianfar: Fix stats support

This patch updates the per rx/tx queue stats.
To update the per rx queue stats a new structure has been
introduced rx_q_stats.
The per tx queue stats are updated via the netdev_queue
structure itself.

Note that we update only the tx_packtes, tx_bytes, rx_packets,
rx_bytes and rx_dropped stats on a per queue basis.

Signed-off-by: Sandeep Gopalpet <Sandeep.Kumar@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agogianfar: Fix a filer bug
Sandeep Gopalpet [Wed, 16 Dec 2009 01:14:58 +0000 (01:14 +0000)]
gianfar: Fix a filer bug

We need to enable filer whenever we need to use multiple RX
queues. Also, need to program RIR0 register with the required
distribution we require, if using RX filer hashing support for
packet distribution to multiple queues.

Signed-off-by: Sandeep Gopalpet <Sandeep.Kumar@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agobnx2: fixing a timout error due not refreshing TX timers correctly
Breno Leitao [Sat, 19 Dec 2009 04:35:34 +0000 (20:35 -0800)]
bnx2: fixing a timout error due not refreshing TX timers correctly

When running the following script on an active bnx2 interface:

while(true); do ifconfig ethX mtu 9000; ifconfig ethX mtu 1500; done

A timeout error appears and dumps the following stack:

NETDEV WATCHDOG: eth4 (bnx2): transmit queue 0 timed out
------------[ cut here ]------------
Badness at net/sched/sch_generic.c:261
<snip>

This patch just fixes the way that ->trans_start is refreshed.

Signed-off-by: Breno Leitao <leitao@linux.vnet.ibm.com>
Acked-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agocan/at91: don't check platform_get_irq's return value against zero
Uwe Kleine-König [Sat, 19 Dec 2009 04:31:56 +0000 (20:31 -0800)]
can/at91: don't check platform_get_irq's return value against zero

platform_get_irq returns -ENXIO on failure, so !irq was probably
always true.  Better use (int)irq <= 0.  Note that a return value of
zero is still handled as error even though this could mean irq0.

This is a followup to 305b3228f9ff4d59f49e6d34a7034d44ee8ce2f0 that
changed the return value of platform_get_irq from 0 to -ENXIO on error.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Wolfgang Grandegger <wg@grandegger.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agomISDN: use DECLARE_COMPLETION_ONSTACK for non-constant completion
Yong Zhang [Sat, 19 Dec 2009 04:30:11 +0000 (20:30 -0800)]
mISDN: use DECLARE_COMPLETION_ONSTACK for non-constant completion

The _ONSTACK variant should be used for on-stack completion,
otherwise it will break lockdep.

Signed-off-by: Yong Zhang <yong.zhang0@gmail.com>
Acked-by: Karsten Keil <keil@b1-systems.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agobnx2: reset_task is crashing the kernel. Fixing it.
Breno Leitao [Sat, 19 Dec 2009 04:29:04 +0000 (20:29 -0800)]
bnx2: reset_task is crashing the kernel. Fixing it.

If bnx2 schedules a reset via the reset_task, e.g., due to a TX
timeout, it's possible for the NIC to be disabled with packets
pending for transmit.  In this case, napi_disable will loop forever,
eventually crashing the kernel.  This patch moves the disable of
the device to after the napi_disable call.

Signed-off-by: Breno Leitao <leitao@linux.vnet.ibm.com>
Acked-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoipv6: fix an oops when force unload ipv6 module
Yang Hongyang [Sat, 19 Dec 2009 04:25:13 +0000 (20:25 -0800)]
ipv6: fix an oops when force unload ipv6 module

When I do an ipv6 module force unload,I got the following oops:
#rmmod -f ipv6
------------[ cut here ]------------
kernel BUG at mm/slub.c:2969!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:11.0/0000:02:03.0/net/eth2/ifindex
Modules linked in: ipv6(-) dm_multipath uinput ppdev tpm_tis tpm tpm_bios pcspkr pcnet32 mii parport_pc i2c_piix4 parport i2c_core floppy mptspi mptscsih mptbase scsi_transport_spi

Pid: 2530, comm: rmmod Tainted: G  R        2.6.32 #2 440BX Desktop Reference Platform/VMware Virtual Platform
EIP: 0060:[<c04b73f2>] EFLAGS: 00010246 CPU: 0
EIP is at kfree+0x6a/0xdd
EAX: 00000000 EBX: c09e86bc ECX: c043e4dd EDX: c14293e0
ESI: e141f1d8 EDI: e140fc31 EBP: dec58ef0 ESP: dec58ed0
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process rmmod (pid: 2530, ti=dec58000 task=decb1940 task.ti=dec58000)
Stack:
 c14293e0 00000282 df624240 c0897d08 c09e86bc c09e86bc e141f1d8 dec58f1c
<0> dec58f00 e140fc31 c09e84c4 e141f1bc dec58f14 c0689d21 dec58f1c e141f1bc
<0> 00000000 dec58f2c c0689eff c09e84d8 c09e84d8 e141f1bc bff33a90 dec58f38
Call Trace:
 [<e140fc31>] ? ipv6_frags_exit_net+0x22/0x32 [ipv6]
 [<c0689d21>] ? ops_exit_list+0x19/0x3d
 [<c0689eff>] ? unregister_pernet_operations+0x2a/0x51
 [<c0689f70>] ? unregister_pernet_subsys+0x17/0x24
 [<e140fbfe>] ? ipv6_frag_exit+0x21/0x32 [ipv6]
 [<e141a361>] ? inet6_exit+0x47/0x122 [ipv6]
 [<c045f5de>] ? sys_delete_module+0x198/0x1f6
 [<c04a8acf>] ? remove_vma+0x57/0x5d
 [<c070f63f>] ? do_page_fault+0x2e7/0x315
 [<c0403218>] ? sysenter_do_call+0x12/0x28
Code: 86 00 00 00 40 c1 e8 0c c1 e0 05 01 d0 89 45 e0 66 83 38 00 79 06 8b 40 0c 89 45 e0 8b 55 e0 8b 02 84 c0 78 14 66 a9 00 c0 75 04 <0f> 0b eb fe 8b 45 e0 e8 35 15 fe ff eb 5d 8b 45 04 8b 55 e0 89
EIP: [<c04b73f2>] kfree+0x6a/0xdd SS:ESP 0068:dec58ed0
---[ end trace 4475d1a5b0afa7e5 ]---

It's because in ip6_frags_ns_sysctl_register,
"table" only alloced when "net" is not equals
to "init_net".So when we free "table" in
ip6_frags_ns_sysctl_unregister,we should check
this first.

This patch fix the problem.

Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoTI DaVinci EMAC: Fix MDIO bus frequency configuration
Nageswari Srinivasan [Sat, 19 Dec 2009 04:21:21 +0000 (20:21 -0800)]
TI DaVinci EMAC: Fix MDIO bus frequency configuration

There was a typo in "if condition" checking for validity of MDIO
bus frequency passed as part of platform data. Bitwise AND was
being used instead of a Logical AND.

Tested on: DM6467 EVM

Signed-off-by: Nageswari Srinivasan <nageswari@ti.com>
Acked-by: Anant Gole <anantgole@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoe100: Fix broken cbs accounting due to missing memset.
Roger Oksanen [Sat, 19 Dec 2009 04:18:21 +0000 (20:18 -0800)]
e100: Fix broken cbs accounting due to missing memset.

Alan Stern noticed that e100 caused slab corruption.
commit 98468efddb101f8a29af974101c17ba513b07be1 changed
the allocation of cbs to use dma pools that don't return zeroed memory,
especially the cb->status field used to track which cb to clean, causing
(the visible) double freeing of skbs and a wrong free cbs count.

Now the cbs are explicitly zeroed at allocation time.

Reported-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agobroadcom: bcm54xx_shadow_read() errors ignored in bcm54xx_adjust_rxrefclk()
Roel Kluin [Sat, 19 Dec 2009 04:16:10 +0000 (20:16 -0800)]
broadcom: bcm54xx_shadow_read() errors ignored in bcm54xx_adjust_rxrefclk()

If not signed read errors are ignored.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoe1000e: LED settings in EEPROM ignored on 82571 and 82572
Bruce Allan [Sat, 19 Dec 2009 04:14:59 +0000 (20:14 -0800)]
e1000e: LED settings in EEPROM ignored on 82571 and 82572

Do not override the customizable LED configuration set in the EEPROM.

Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agonetxen: use module parameter correctly
Stephen Hemminger [Sat, 19 Dec 2009 04:13:35 +0000 (20:13 -0800)]
netxen: use module parameter correctly

Netxen driver is doing this bogus thing to create a control file.
This fails if device doesn't exist, and overall is a bad way to do
the module parameter. Rather than fix borked code, just rewrite.
Just using a writeable module parameter of 0/1 is the correct way

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agonetns: fix net.ipv6.route.gc_min_interval_ms in netns
Alexey Dobriyan [Sat, 19 Dec 2009 04:11:03 +0000 (20:11 -0800)]
netns: fix net.ipv6.route.gc_min_interval_ms in netns

sysctl table was copied, all right, but ->data for net.ipv6.route.gc_min_interval_ms
was not reinitialized for "!= &init_net" case.

In init_net everthing works by accident due to correct ->data initialization
in source table.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoBluetooth: Prevent ill-timed autosuspend in USB driver
Oliver Neukum [Wed, 16 Dec 2009 18:23:43 +0000 (19:23 +0100)]
Bluetooth: Prevent ill-timed autosuspend in USB driver

The device must be marked busy as it receives data.

Signed-off-by: Oliver Neukum <oliver@neukum.org>
Tested-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
14 years agoBluetooth: Fix L2CAP locking scheme regression
Andrei Emeltchenko [Tue, 15 Dec 2009 09:38:04 +0000 (11:38 +0200)]
Bluetooth: Fix L2CAP locking scheme regression

When locking was introduced the error path branch was not taken
into account. Error was found in sparse code checking. Kudos to
Jani Nikula.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
14 years agoBluetooth: Ack L2CAP I-frames before retransmit missing packet
Gustavo F. Padovan [Tue, 15 Dec 2009 22:13:27 +0000 (20:13 -0200)]
Bluetooth: Ack L2CAP I-frames before retransmit missing packet

Moving the Ack to before l2cap_retransmit_frame() we can avoid the
case where txWindow is full and the packet can't be retransmited.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
14 years agoBluetooth: Fix unset of RemoteBusy flag for L2CAP
Gustavo F. Padovan [Tue, 15 Dec 2009 17:56:34 +0000 (15:56 -0200)]
Bluetooth: Fix unset of RemoteBusy flag for L2CAP

RemoteBusy flag need to be unset before l2cap_ertm_send(), otherwise
l2cap_ertm_send() will return without sending packets because it checks
that flag before start sending.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
14 years agoBluetooth: Fix PTR_ERR return of wrong pointer in hidp_setup_hid()
Roel Kluin [Mon, 7 Dec 2009 13:23:21 +0000 (14:23 +0100)]
Bluetooth: Fix PTR_ERR return of wrong pointer in hidp_setup_hid()

Return the PTR_ERR of the correct pointer.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
14 years agonet: sh_eth alignment fix for sh7724 using NET_IP_ALIGN V2
Magnus Damm [Wed, 16 Dec 2009 05:16:55 +0000 (21:16 -0800)]
net: sh_eth alignment fix for sh7724 using NET_IP_ALIGN V2

Fix sh_eth for sh7724 by adding NET_IP_ALIGN support V2.
Without this patch the receive data is misaligned.

Signed-off-by: Magnus Damm <damm@opensource.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
14 years agoixgbe: allow tx of pre-formatted vlan tagged packets
Gurucharan Shetty [Tue, 15 Dec 2009 13:00:31 +0000 (13:00 +0000)]
ixgbe: allow tx of pre-formatted vlan tagged packets

When the 82598 is fed 802.1q packets, it chokes with
an error of the form:

ixgbe: eth0: ixgbe_tx_csum: partial checksum but proto=81!

As the logic there was not smart enough to look into
the vlan header to pick out the encapsulated protocol.

There are times when we'd like to send these packets
out without having to configure a vlan on the interface.
Here we check for the vlan tag and allow the packet to
go out with the correct hardware checksum.

This patch is a clone of a previously submitted patch by
Arthur Jones <ajones@riverbed.com> for igb (Commit -
fa4a7ef36ec834fee1719636b30d2f28f4cb0166).

Signed-off-by: Gurucharan Shetty <gshetty@riverbed.com>
Signed-off-by: Arthur Jones <ajones@riverbed.com>
Acked-by: Mallikarjuna R Chilakala <mallikarjuna.chilakala@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>